npm - @crossauth/backend - Versions diffs - 1.1.2 → 1.1.3 - Mend

@crossauth/backend 1.1.2 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/dist/auth.d.ts +1 -0
package/dist/auth.d.ts.map +1 -1
package/dist/index.cjs +2 -2
package/dist/index.d.ts +2 -0
package/dist/index.d.ts.map +1 -1
package/dist/index.js +1072 -769
package/dist/oauth/authserver.d.ts +28 -4
package/dist/oauth/authserver.d.ts.map +1 -1
package/dist/oauth/client.d.ts.map +1 -1
package/package.json +2 -2

package/dist/index.js CHANGED Viewed

@@ -1,25 +1,25 @@
-var Oe = Object.defineProperty;
-var Ke = (S, a, e) => a in S ? Oe(S, a, { enumerable: !0, configurable: !0, writable: !0, value: e }) : S[a] = e;
-var u = (S, a, e) => Ke(S, typeof a != "symbol" ? a + "" : a, e);
-import { CrossauthError as o, ErrorCode as l, CrossauthLogger as h, j as m, UserState as k, OAuthFlows as U, KeyPrefix as b, OAuthTokenConsumerBase as Fe, OAuthClientBase as Ne } from "@crossauth/common";
-import * as De from "node:path";
-import { fileURLToPath as xe } from "node:url";
-import * as G from "@prisma/client/runtime/client";
-import { PrismaBetterSqlite3 as de } from "@prisma/adapter-better-sqlite3";
-import Se from "@mbakereth/ldapjs";
-import { timingSafeEqual as me, randomBytes as fe, randomUUID as Re, createHash as Be, pbkdf2 as ze, createHmac as se, createCipheriv as Le, createDecipheriv as je, randomInt as re } from "node:crypto";
-import { promisify as He } from "node:util";
-import W from "nunjucks";
-import Ae from "nodemailer";
-import Ve from "twilio";
-import Me from "qrcode";
-import { authenticator as ge } from "otplib";
-import te from "jsonwebtoken";
-import ie from "node:fs";
-import { createPublicKey as $e } from "crypto";
-import * as qe from "jose";
+var ze = Object.defineProperty;
+var Le = (S, a, e) => a in S ? ze(S, a, { enumerable: !0, configurable: !0, writable: !0, value: e }) : S[a] = e;
+var u = (S, a, e) => Le(S, typeof a != "symbol" ? a + "" : a, e);
+import { CrossauthError as o, ErrorCode as l, CrossauthLogger as h, j as m, UserState as E, OAuthFlows as I, KeyPrefix as U, OAuthTokenConsumerBase as je, OAuthClientBase as He } from "@crossauth/common";
+import * as Ve from "node:path";
+import { fileURLToPath as Me } from "node:url";
+import * as re from "@prisma/client/runtime/client";
+import { PrismaBetterSqlite3 as ye } from "@prisma/adapter-better-sqlite3";
+import Ue from "@mbakereth/ldapjs";
+import { timingSafeEqual as Se, randomBytes as Te, randomUUID as $e, createHash as qe, pbkdf2 as We, createHmac as he, createCipheriv as Je, createDecipheriv as Ye, randomInt as ce } from "node:crypto";
+import { promisify as Ge } from "node:util";
+import Z from "nunjucks";
+import xe from "nodemailer";
+import Ze from "twilio";
+import Xe from "qrcode";
+import { authenticator as _e } from "otplib";
+import ae from "jsonwebtoken";
+import ue from "node:fs";
+import { createPublicKey as Qe } from "crypto";
+import * as et from "jose";
 var g = /* @__PURE__ */ ((S) => (S[S.String = 0] = "String", S[S.Number = 1] = "Number", S[S.Boolean = 2] = "Boolean", S[S.Json = 3] = "Json", S[S.JsonArray = 4] = "JsonArray", S))(g || {});
-function We(S, a) {
+function tt(S, a) {
   let e = S.split("."), t = a;
   for (let r in e) {
     const i = e[r];
@@ -28,7 +28,7 @@ function We(S, a) {
   }
   return t;
 }
-function Te(S, a) {
+function Ae(S, a) {
   let e = S.split("."), t = a;
   for (let r in e) {
     const i = e[r];
@@ -37,11 +37,11 @@ function Te(S, a) {
   }
   return !0;
 }
-function Je(S, a, e) {
-  const t = We(a, e);
+function rt(S, a, e) {
+  const t = tt(a, e);
   S[a.replace(".", "_")] = t;
 }
-function Ye(S, a, e, t) {
+function it(S, a, e, t) {
   var i;
   const r = a.replace(".", "_");
   switch (e) {
@@ -64,11 +64,11 @@ function Ye(S, a, e, t) {
 }
 function w(S, a, e, t, r, i = !1) {
   const s = "CROSSAUTH_" + r;
-  if (i && !Te(S, t) && !(s && s in process.env))
+  if (i && !Ae(S, t) && !(s && s in process.env))
     throw new o(l.Configuration, S + " is required");
-  Te(S, t) ? Je(e, S, t) : r && s in process.env && process.env[s] != null && Ye(e, S, a, s);
+  Ae(S, t) ? rt(e, S, t) : r && s in process.env && process.env[s] != null && it(e, S, a, s);
 }
-class L {
+class q {
   /**
    * Constructor
    * @param options See {@link UserStorageOptions}
@@ -101,7 +101,7 @@ class L {
     return a.normalize("NFD").replace(new RegExp("\\p{Diacritic}", "gu"), "").toLowerCase();
   }
 }
-class z {
+class V {
   /**
    * Returns an object decoded from the data field as a JSON string
    * @param data the JSON string to decode
@@ -153,7 +153,7 @@ class z {
       return e in a ? (delete a[e], !0) : !1;
   }
 }
-class ye {
+class ve {
   /**
    * Constructor
    * @param _options see {@link OAuthClientStorageOptions}
@@ -161,7 +161,7 @@ class ye {
   constructor(a = {}) {
   }
 }
-class pe {
+class Ee {
   /**
    * Constructor
    * @param _options see {@link OAuthAuthorizationStorageOptions}
@@ -169,7 +169,7 @@ class pe {
   constructor(a = {}) {
   }
 }
-const Ce = {
+const be = {
   previewFeatures: [],
   clientVersion: "7.2.0",
   engineVersion: "0c8ef2ce45c83248ab3df073180d5eda9e8be7a3",
@@ -306,31 +306,31 @@ model OAuthAuthorization {
     types: {}
   }
 };
-Ce.runtimeDataModel = JSON.parse('{"models":{"User":{"fields":[{"name":"id","kind":"scalar","type":"Int"},{"name":"username","kind":"scalar","type":"String"},{"name":"username_normalized","kind":"scalar","type":"String"},{"name":"email","kind":"scalar","type":"String"},{"name":"email_normalized","kind":"scalar","type":"String"},{"name":"phone","kind":"scalar","type":"String"},{"name":"state","kind":"scalar","type":"String"},{"name":"factor1","kind":"scalar","type":"String"},{"name":"factor2","kind":"scalar","type":"String"},{"name":"dummyfield","kind":"scalar","type":"String"},{"name":"session","kind":"object","type":"Key","relationName":"KeyToUser"},{"name":"apiKey","kind":"object","type":"ApiKey","relationName":"ApiKeyToUser"},{"name":"secrets","kind":"object","type":"UserSecrets","relationName":"UserToUserSecrets"},{"name":"authorization","kind":"object","type":"OAuthAuthorization","relationName":"OAuthAuthorizationToUser"},{"name":"oauthClients","kind":"object","type":"OAuthClient","relationName":"OAuthClientToUser"}],"dbName":null},"UserSecrets":{"fields":[{"name":"userid","kind":"scalar","type":"Int"},{"name":"password","kind":"scalar","type":"String"},{"name":"totpsecret","kind":"scalar","type":"String"},{"name":"user","kind":"object","type":"User","relationName":"UserToUserSecrets"}],"dbName":null},"Key":{"fields":[{"name":"id","kind":"scalar","type":"Int"},{"name":"value","kind":"scalar","type":"String"},{"name":"userid","kind":"scalar","type":"Int"},{"name":"created","kind":"scalar","type":"DateTime"},{"name":"expires","kind":"scalar","type":"DateTime"},{"name":"lastactive","kind":"scalar","type":"DateTime"},{"name":"data","kind":"scalar","type":"String"},{"name":"user","kind":"object","type":"User","relationName":"KeyToUser"}],"dbName":null},"ApiKey":{"fields":[{"name":"id","kind":"scalar","type":"Int"},{"name":"name","kind":"scalar","type":"String"},{"name":"value","kind":"scalar","type":"String"},{"name":"userid","kind":"scalar","type":"Int"},{"name":"created","kind":"scalar","type":"DateTime"},{"name":"expires","kind":"scalar","type":"DateTime"},{"name":"data","kind":"scalar","type":"String"},{"name":"user","kind":"object","type":"User","relationName":"ApiKeyToUser"}],"dbName":null},"OAuthClient":{"fields":[{"name":"client_id","kind":"scalar","type":"String"},{"name":"confidential","kind":"scalar","type":"Boolean"},{"name":"client_name","kind":"scalar","type":"String"},{"name":"client_secret","kind":"scalar","type":"String"},{"name":"userid","kind":"scalar","type":"Int"},{"name":"redirect_uri","kind":"object","type":"OAuthClientRedirectUri","relationName":"OAuthClientToOAuthClientRedirectUri"},{"name":"authorization","kind":"object","type":"OAuthAuthorization","relationName":"OAuthAuthorizationToOAuthClient"},{"name":"valid_flow","kind":"object","type":"OAuthClientValidFlow","relationName":"OAuthClientToOAuthClientValidFlow"},{"name":"user","kind":"object","type":"User","relationName":"OAuthClientToUser"}],"dbName":null},"OAuthClientRedirectUri":{"fields":[{"name":"id","kind":"scalar","type":"Int"},{"name":"client_id","kind":"scalar","type":"String"},{"name":"uri","kind":"scalar","type":"String"},{"name":"client","kind":"object","type":"OAuthClient","relationName":"OAuthClientToOAuthClientRedirectUri"}],"dbName":null},"OAuthClientValidFlow":{"fields":[{"name":"id","kind":"scalar","type":"Int"},{"name":"client_id","kind":"scalar","type":"String"},{"name":"flow","kind":"scalar","type":"String"},{"name":"client","kind":"object","type":"OAuthClient","relationName":"OAuthClientToOAuthClientValidFlow"}],"dbName":null},"OAuthAuthorization":{"fields":[{"name":"id","kind":"scalar","type":"Int"},{"name":"client_id","kind":"scalar","type":"String"},{"name":"userid","kind":"scalar","type":"Int"},{"name":"user","kind":"object","type":"User","relationName":"OAuthAuthorizationToUser"},{"name":"scope","kind":"scalar","type":"String"},{"name":"Client","kind":"object","type":"OAuthClient","relationName":"OAuthAuthorizationToOAuthClient"}],"dbName":null}},"enums":{},"types":{}}');
-async function Ge(S) {
+be.runtimeDataModel = JSON.parse('{"models":{"User":{"fields":[{"name":"id","kind":"scalar","type":"Int"},{"name":"username","kind":"scalar","type":"String"},{"name":"username_normalized","kind":"scalar","type":"String"},{"name":"email","kind":"scalar","type":"String"},{"name":"email_normalized","kind":"scalar","type":"String"},{"name":"phone","kind":"scalar","type":"String"},{"name":"state","kind":"scalar","type":"String"},{"name":"factor1","kind":"scalar","type":"String"},{"name":"factor2","kind":"scalar","type":"String"},{"name":"dummyfield","kind":"scalar","type":"String"},{"name":"session","kind":"object","type":"Key","relationName":"KeyToUser"},{"name":"apiKey","kind":"object","type":"ApiKey","relationName":"ApiKeyToUser"},{"name":"secrets","kind":"object","type":"UserSecrets","relationName":"UserToUserSecrets"},{"name":"authorization","kind":"object","type":"OAuthAuthorization","relationName":"OAuthAuthorizationToUser"},{"name":"oauthClients","kind":"object","type":"OAuthClient","relationName":"OAuthClientToUser"}],"dbName":null},"UserSecrets":{"fields":[{"name":"userid","kind":"scalar","type":"Int"},{"name":"password","kind":"scalar","type":"String"},{"name":"totpsecret","kind":"scalar","type":"String"},{"name":"user","kind":"object","type":"User","relationName":"UserToUserSecrets"}],"dbName":null},"Key":{"fields":[{"name":"id","kind":"scalar","type":"Int"},{"name":"value","kind":"scalar","type":"String"},{"name":"userid","kind":"scalar","type":"Int"},{"name":"created","kind":"scalar","type":"DateTime"},{"name":"expires","kind":"scalar","type":"DateTime"},{"name":"lastactive","kind":"scalar","type":"DateTime"},{"name":"data","kind":"scalar","type":"String"},{"name":"user","kind":"object","type":"User","relationName":"KeyToUser"}],"dbName":null},"ApiKey":{"fields":[{"name":"id","kind":"scalar","type":"Int"},{"name":"name","kind":"scalar","type":"String"},{"name":"value","kind":"scalar","type":"String"},{"name":"userid","kind":"scalar","type":"Int"},{"name":"created","kind":"scalar","type":"DateTime"},{"name":"expires","kind":"scalar","type":"DateTime"},{"name":"data","kind":"scalar","type":"String"},{"name":"user","kind":"object","type":"User","relationName":"ApiKeyToUser"}],"dbName":null},"OAuthClient":{"fields":[{"name":"client_id","kind":"scalar","type":"String"},{"name":"confidential","kind":"scalar","type":"Boolean"},{"name":"client_name","kind":"scalar","type":"String"},{"name":"client_secret","kind":"scalar","type":"String"},{"name":"userid","kind":"scalar","type":"Int"},{"name":"redirect_uri","kind":"object","type":"OAuthClientRedirectUri","relationName":"OAuthClientToOAuthClientRedirectUri"},{"name":"authorization","kind":"object","type":"OAuthAuthorization","relationName":"OAuthAuthorizationToOAuthClient"},{"name":"valid_flow","kind":"object","type":"OAuthClientValidFlow","relationName":"OAuthClientToOAuthClientValidFlow"},{"name":"user","kind":"object","type":"User","relationName":"OAuthClientToUser"}],"dbName":null},"OAuthClientRedirectUri":{"fields":[{"name":"id","kind":"scalar","type":"Int"},{"name":"client_id","kind":"scalar","type":"String"},{"name":"uri","kind":"scalar","type":"String"},{"name":"client","kind":"object","type":"OAuthClient","relationName":"OAuthClientToOAuthClientRedirectUri"}],"dbName":null},"OAuthClientValidFlow":{"fields":[{"name":"id","kind":"scalar","type":"Int"},{"name":"client_id","kind":"scalar","type":"String"},{"name":"flow","kind":"scalar","type":"String"},{"name":"client","kind":"object","type":"OAuthClient","relationName":"OAuthClientToOAuthClientValidFlow"}],"dbName":null},"OAuthAuthorization":{"fields":[{"name":"id","kind":"scalar","type":"Int"},{"name":"client_id","kind":"scalar","type":"String"},{"name":"userid","kind":"scalar","type":"Int"},{"name":"user","kind":"object","type":"User","relationName":"OAuthAuthorizationToUser"},{"name":"scope","kind":"scalar","type":"String"},{"name":"Client","kind":"object","type":"OAuthClient","relationName":"OAuthAuthorizationToOAuthClient"}],"dbName":null}},"enums":{},"types":{}}');
+async function at(S) {
   const { Buffer: a } = await import("node:buffer"), e = a.from(S, "base64");
   return new WebAssembly.Module(e);
 }
-Ce.compilerWasm = {
+be.compilerWasm = {
   getRuntime: async () => await import("@prisma/client/runtime/query_compiler_bg.sqlite.mjs"),
   getQueryCompilerWasmModule: async () => {
     const { wasm: S } = await import("@prisma/client/runtime/query_compiler_bg.sqlite.wasm-base64.mjs");
-    return await Ge(S);
+    return await at(S);
   }
 };
-function Ze() {
-  return G.getPrismaClient(Ce);
+function st() {
+  return re.getPrismaClient(be);
 }
-const Q = G.PrismaClientKnownRequestError;
-G.Extensions.getExtensionContext;
-G.NullTypes.DbNull, G.NullTypes.JsonNull, G.NullTypes.AnyNull;
-G.makeStrictEnum({
+const oe = re.PrismaClientKnownRequestError;
+re.Extensions.getExtensionContext;
+re.NullTypes.DbNull, re.NullTypes.JsonNull, re.NullTypes.AnyNull;
+re.makeStrictEnum({
   Serializable: "Serializable"
 });
-G.Extensions.defineExtension;
-globalThis.__dirname = De.dirname(xe(import.meta.url));
-const ue = Ze();
-class Z extends L {
+re.Extensions.defineExtension;
+globalThis.__dirname = Ve.dirname(Me(import.meta.url));
+const pe = st();
+class se extends q {
   /**
    * Creates a PrismaUserStorage object, optionally overriding defaults.
    * @param options see {@link PrismaUserStorageOptions}
@@ -350,8 +350,8 @@ class Z extends L {
     }), e && e.prismaClient)
       this.prismaClient = e.prismaClient;
     else {
-      const t = `${process.env.DATABASE_URL}`, r = new de({ url: t });
-      this.prismaClient = new ue({ adapter: r });
+      const t = `${process.env.DATABASE_URL}`, r = new ye({ url: t });
+      this.prismaClient = new pe({ adapter: r });
     }
   }
   async getUser(e, t, r) {
@@ -368,17 +368,17 @@ class Z extends L {
       typeof c == "object" && (c == null ? void 0 : c.constructor.name) == "PrismaClientInitializationError" ? (h.logger.debug(m({ err: c })), h.logger.error(m({ cerr: c })), i = new o(l.Connection, "Couldn't connect to database server")) : typeof c == "object" && (c == null ? void 0 : c.constructor.name) == "PrismaClientInitializationError" ? (h.logger.debug(m({ err: c })), h.logger.error(m({ cerr: c })), i = new o(l.Connection, "Received error from database")) : i = new o(l.UserNotExist);
     }
     if (i) throw i;
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == k.awaitingTwoFactorSetup)
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.awaitingTwoFactorSetup)
       throw h.logger.debug(m({ msg: "2FA setup is not complete" })), new o(l.TwoFactorIncomplete);
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == k.disabled)
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.disabled)
       throw h.logger.debug(m({ msg: "User is deactivated" })), new o(l.UserNotActive);
-    if ((r == null ? void 0 : r.skipEmailVerifiedCheck) != !0 && s.state == k.awaitingEmailVerification)
+    if ((r == null ? void 0 : r.skipEmailVerifiedCheck) != !0 && s.state == E.awaitingEmailVerification)
       throw h.logger.debug(m({ msg: "User has not verified email" })), new o(l.EmailNotVerified);
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == k.passwordChangeNeeded)
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.passwordChangeNeeded)
       throw h.logger.debug(m({ msg: "User must change password" })), new o(l.PasswordChangeNeeded);
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && (s.state == k.passwordResetNeeded || s.state == k.passwordAndFactor2ResetNeeded))
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && (s.state == E.passwordResetNeeded || s.state == E.passwordAndFactor2ResetNeeded))
       throw h.logger.debug(m({ msg: "User must reset password" })), new o(l.PasswordResetNeeded);
-    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == k.factor2ResetNeeded)
+    if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.factor2ResetNeeded)
       throw h.logger.debug(m({ msg: "2FA reset required" })), new o(l.Factor2ResetNeeded);
     const n = s.secrets || {};
     return s.secrets && (delete n[this.useridForeignKeyColumn], delete s.secrets), { user: { ...s, id: s[this.idColumn] }, secrets: { userid: s[this.idColumn], ...n } };
@@ -391,7 +391,7 @@ class Z extends L {
    */
   async getUserByUsername(e, t) {
     if (this.normalizeUsername) {
-      const r = Z.normalize(e);
+      const r = se.normalize(e);
       return this.getUser("username_normalized", r, t);
     } else {
       const r = e;
@@ -420,7 +420,7 @@ class Z extends L {
    */
   async getUserByEmail(e, t) {
     if (this.normalizeEmail) {
-      const r = Z.normalize(e);
+      const r = se.normalize(e);
       return this.getUser("email_normalized", r, t);
     } else {
       const r = e;
@@ -458,7 +458,7 @@ class Z extends L {
     t && !t.userid && (t = { ...t, userid: e[this.idColumn] });
     try {
       let { id: r, ...i } = e, { userid: s, ...n } = t ?? {};
-      "email" in i && i.email && this.normalizeEmail && (i = { email_normalized: Z.normalize(i.email), ...i }), "username" in i && i.username && this.normalizeUsername && (i = { username_normalized: Z.normalize(i.username), ...i }), t ? await this.prismaClient.$transaction(async (c) => {
+      "email" in i && i.email && this.normalizeEmail && (i = { email_normalized: se.normalize(i.email), ...i }), "username" in i && i.username && this.normalizeUsername && (i = { username_normalized: se.normalize(i.username), ...i }), t ? await this.prismaClient.$transaction(async (c) => {
         let d = {};
         try {
           d = await c[this.userSecretsTable].findUniqueOrThrow({
@@ -510,7 +510,7 @@ class Z extends L {
     if (t && !t.password) throw new o(l.PasswordFormat, "Password required when creating user");
     let i, s = "", n = "";
     try {
-      "email" in e && e.email && this.normalizeEmail && (n = Z.normalize(e.email)), "username" in e && e.username && this.normalizeUsername && (s = Z.normalize(e.username));
+      "email" in e && e.email && this.normalizeEmail && (n = se.normalize(e.email)), "username" in e && e.username && this.normalizeUsername && (s = se.normalize(e.username));
       let c = {
         ...e
       };
@@ -532,7 +532,7 @@ class Z extends L {
         data: c
       });
     } catch (c) {
-      h.logger.debug(m({ err: c })), r = new o(l.Connection, "Error creating user"), (c instanceof Q || c instanceof Object && "code" in c) && c.code === "P2002" && (r = new o(l.UserExists));
+      h.logger.debug(m({ err: c })), r = new o(l.Connection, "Error creating user"), (c instanceof oe || c instanceof Object && "code" in c) && c.code === "P2002" && (r = new o(l.UserExists));
     }
     if (r)
       throw r;
@@ -598,7 +598,7 @@ class Z extends L {
     }
   }
 }
-class Ft extends z {
+class Lt extends V {
   /**
    * Constructor with user storage object to use plus optional parameters.
    *
@@ -611,8 +611,8 @@ class Ft extends z {
     u(this, "transactionTimeout", 5e3);
     u(this, "useridForeignKeyColumn", "userid");
     if (w("transactionTimeout", g.Number, this, e, "TRANSACTION_TIMEOUT"), w("useridForeignKeyColumn", g.Number, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), e.keyTable && (this.keyTable = e.keyTable), e.prismaClient == null) {
-      const t = `${process.env.DATABASE_URL}`, r = new de({ url: t });
-      this.prismaClient = new ue({ adapter: r });
+      const t = `${process.env.DATABASE_URL}`, r = new ye({ url: t });
+      this.prismaClient = new pe({ adapter: r });
     } else
       this.prismaClient = e.prismaClient;
   }
@@ -669,7 +669,7 @@ class Ft extends z {
         data: d
       });
     } catch (d) {
-      d instanceof Q || d instanceof Object && "code" in d ? d.code == "P2002" ? (h.logger.warn(m({ msg: "Attempt to create key that already exists. Stack trace follows" })), h.logger.debug(m({ err: d })), c = new o(l.KeyExists)) : (h.logger.debug(m({ err: d })), c = new o(l.Connection, "Error saving key")) : (h.logger.debug(m({ err: d })), c = new o(l.Connection, "Error saving key"));
+      d instanceof oe || d instanceof Object && "code" in d ? d.code == "P2002" ? (h.logger.warn(m({ msg: "Attempt to create key that already exists. Stack trace follows" })), h.logger.debug(m({ err: d })), c = new o(l.KeyExists)) : (h.logger.debug(m({ err: d })), c = new o(l.Connection, "Error saving key")) : (h.logger.debug(m({ err: d })), c = new o(l.Connection, "Error saving key"));
     }
     if (c)
       throw c;
@@ -872,7 +872,7 @@ class Ft extends z {
     }
   }
 }
-class Nt extends ye {
+class jt extends ve {
   /**
    * Constructor with user storage object to use plus optional parameters.
    *
@@ -889,8 +889,8 @@ class Nt extends ye {
     u(this, "updateMode", "DeleteAndInsert");
     u(this, "useridForeignKeyColumn", "userid");
     if (w("clientTable", g.String, this, e, "OAUTH_CLIENT_TABLE"), w("redirectUriTable", g.String, this, e, "OAUTH_REDIRECTURI_TABLE"), w("validFlowTable", g.String, this, e, "OAUTH_VALID_FLOW_TABLE"), w("transactionTimeout", g.Number, this, e, "TRANSACTION_TIMEOUT"), w("updateMode", g.String, this, e, "OAUTHCLIENT_UPDATE_MODE"), w("useridForeignKeyColumn", g.String, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), e.prismaClient == null) {
-      const t = `${process.env.DATABASE_URL}`, r = new de({ url: t });
-      this.prismaClient = new ue({ adapter: r });
+      const t = `${process.env.DATABASE_URL}`, r = new ye({ url: t });
+      this.prismaClient = new pe({ adapter: r });
     } else
       this.prismaClient = e.prismaClient;
   }
@@ -916,8 +916,8 @@ class Nt extends ye {
           ...d,
           userid: C,
           client_secret: d.client_secret ?? void 0,
-          redirect_uri: f.map((v) => v.uri),
-          valid_flow: y.map((v) => v.flow)
+          redirect_uri: f.map((_) => _.uri),
+          valid_flow: y.map((_) => _.flow)
         }];
       } else {
         const d = await r[this.clientTable].findMany({
@@ -929,8 +929,8 @@ class Nt extends ye {
         });
         for (let f of d) {
           const y = f.redirect_uri, C = f.valid_flow;
-          let v = f[this.useridForeignKeyColumn];
-          v == null && (v = void 0), f.userid = v, this.useridForeignKeyColumn != "userid" && delete f[this.useridForeignKeyColumn], f.client_secret = f.client_secret ?? void 0, f.redirect_uri = y.map((p) => p.uri), f.valid_flow = C.map((p) => p.flow);
+          let _ = f[this.useridForeignKeyColumn];
+          _ == null && (_ = void 0), f.userid = _, this.useridForeignKeyColumn != "userid" && delete f[this.useridForeignKeyColumn], f.client_secret = f.client_secret ?? void 0, f.redirect_uri = y.map((p) => p.uri), f.valid_flow = C.map((p) => p.flow);
         }
         return d;
       }
@@ -973,14 +973,14 @@ class Nt extends ye {
       }
     if (i) {
       for (let d = 0; d < i.length; ++d)
-        if (!U.isValidFlow(i[d])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[d]);
+        if (!I.isValidFlow(i[d])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[d]);
     }
     try {
       c = await t[this.clientTable].create({
         data: n
       });
     } catch (d) {
-      throw d instanceof Q || d instanceof Object && "code" in d ? d.code == "P2002" ? (h.logger.debug(m({ err: d })), new o(l.ClientExists, "Attempt to create an OAuth client with a client_id that already exists. Maximum attempts failed")) : (h.logger.debug(m({ err: d })), new o(l.Connection, "Error saving OAuth client")) : (h.logger.debug(m({ err: d })), new o(l.Connection, "Error saving OAuth client"));
+      throw d instanceof oe || d instanceof Object && "code" in d ? d.code == "P2002" ? (h.logger.debug(m({ err: d })), new o(l.ClientExists, "Attempt to create an OAuth client with a client_id that already exists. Maximum attempts failed")) : (h.logger.debug(m({ err: d })), new o(l.Connection, "Error saving OAuth client")) : (h.logger.debug(m({ err: d })), new o(l.Connection, "Error saving OAuth client"));
     }
     if (!c)
       throw h.logger.error(m({ msg: "Attempt to create key that already exists. Stack trace follows" })), new o(l.KeyExists);
@@ -994,7 +994,7 @@ class Nt extends ye {
             }
           });
       } catch (d) {
-        throw d instanceof Q || d instanceof Object && "code" in d ? d.code == "P2002" ? (h.logger.debug(m({ err: d })), new o(l.InvalidRedirectUri, "Attempt to create an OAuth client with a redirect uri that already belongs to another client")) : (h.logger.debug(m({ err: d })), new o(l.Connection, "Error saving OAuth client")) : (h.logger.debug(m({ err: d })), new o(l.Connection, "Error saving OAuth client"));
+        throw d instanceof oe || d instanceof Object && "code" in d ? d.code == "P2002" ? (h.logger.debug(m({ err: d })), new o(l.InvalidRedirectUri, "Attempt to create an OAuth client with a redirect uri that already belongs to another client")) : (h.logger.debug(m({ err: d })), new o(l.Connection, "Error saving OAuth client")) : (h.logger.debug(m({ err: d })), new o(l.Connection, "Error saving OAuth client"));
       }
     if (i)
       try {
@@ -1006,7 +1006,7 @@ class Nt extends ye {
             }
           });
       } catch (d) {
-        throw d instanceof Q || d instanceof Object && "code" in d ? (h.logger.debug(m({ err: d })), new o(l.Connection, "Error saving OAuth client")) : (h.logger.debug(m({ err: d })), new o(l.Connection, "Error saving OAuth client"));
+        throw d instanceof oe || d instanceof Object && "code" in d ? (h.logger.debug(m({ err: d })), new o(l.Connection, "Error saving OAuth client")) : (h.logger.debug(m({ err: d })), new o(l.Connection, "Error saving OAuth client"));
       }
     return { ...c, redirect_uri: r, valid_flow: i };
   }
@@ -1060,7 +1060,7 @@ class Nt extends ye {
       }
     if (i) {
       for (let s = 0; s < i.length; ++s)
-        if (!U.isValidFlow(i[s])) throw new o(l.InvalidOAuthFlow, "Redirect Uri's may not contain page fragments");
+        if (!I.isValidFlow(i[s])) throw new o(l.InvalidOAuthFlow, "Redirect Uri's may not contain page fragments");
     }
     try {
       let s = { ...e };
@@ -1088,7 +1088,7 @@ class Nt extends ye {
             }
           });
       } catch (s) {
-        throw s instanceof Q || s instanceof Object && "code" in s ? s.code == "P2002" ? (h.logger.debug(m({ err: s })), new o(l.KeyExists, "Attempt to update an OAuth client with a redirect Uri that already belongs to another client")) : (h.logger.debug(m({ err: s })), new o(l.Connection, "Error updating client")) : (h.logger.debug(m({ err: s })), new o(l.Connection, "Error updating client"));
+        throw s instanceof oe || s instanceof Object && "code" in s ? s.code == "P2002" ? (h.logger.debug(m({ err: s })), new o(l.KeyExists, "Attempt to update an OAuth client with a redirect Uri that already belongs to another client")) : (h.logger.debug(m({ err: s })), new o(l.Connection, "Error updating client")) : (h.logger.debug(m({ err: s })), new o(l.Connection, "Error updating client"));
       }
     if (i != null)
       try {
@@ -1105,7 +1105,7 @@ class Nt extends ye {
             }
           });
       } catch (s) {
-        throw s instanceof Q || s instanceof Object && "code" in s ? (h.logger.debug(m({ err: s })), new o(l.Connection, "Error updating client")) : (h.logger.debug(m({ err: s })), new o(l.Connection, "Error updating client"));
+        throw s instanceof oe || s instanceof Object && "code" in s ? (h.logger.debug(m({ err: s })), new o(l.Connection, "Error updating client")) : (h.logger.debug(m({ err: s })), new o(l.Connection, "Error updating client"));
       }
   }
   async updateClientWithTransaction_deleteAndInsert(e, t) {
@@ -1141,7 +1141,7 @@ class Nt extends ye {
     }
   }
 }
-class Dt extends pe {
+class Ht extends Ee {
   /**
    * Constructor with user storage object to use plus optional parameters.
    *
@@ -1155,8 +1155,8 @@ class Dt extends pe {
     u(this, "transactionTimeout", 5e3);
     u(this, "useridForeignKeyColumn", "userid");
     if (w("authorizationTable", g.String, this, e, "OAUTH_AUTHORIZATION_TABLE"), w("transactionTimeout", g.Number, this, e, "TRANSACTION_TIMEOUT"), w("useridForeignKeyColumn", g.String, this, e, "USER_ID_FOREIGN_KEY_COLUMN"), e.prismaClient == null) {
-      const t = `${process.env.DATABASE_URL}`, r = new de({ url: t });
-      this.prismaClient = new ue({ adapter: r });
+      const t = `${process.env.DATABASE_URL}`, r = new ye({ url: t });
+      this.prismaClient = new pe({ adapter: r });
     } else
       this.prismaClient = e.prismaClient;
   }
@@ -1210,7 +1210,7 @@ class Dt extends pe {
     }
   }
 }
-class xt extends L {
+class Vt extends q {
   /**
    * Creates a InMemoryUserStorage object, optionally overriding defaults.
    * @param options see {@link InMemoryUserStorageOptions}
@@ -1229,9 +1229,9 @@ class xt extends L {
    */
   async createUser(e, t) {
     let r = "username", i = "email";
-    if (this.normalizeUsername && (r = "username_normalized", e.username_normalized = L.normalize(e.username), e.username_normalized in this.usersByUsername))
+    if (this.normalizeUsername && (r = "username_normalized", e.username_normalized = q.normalize(e.username), e.username_normalized in this.usersByUsername))
       throw new o(l.UserExists);
-    if ("email" in e && e.email && this.normalizeEmail && (i = "email_normalized", e.email_normalized = L.normalize(e.email), e.email_normalized in this.getUserByEmail))
+    if ("email" in e && e.email && this.normalizeEmail && (i = "email_normalized", e.email_normalized = q.normalize(e.email), e.email_normalized in this.getUserByEmail))
       throw new o(l.UserExists);
     const s = { id: e.username, ...e };
     return this.usersByUsername[e[r]] = s, this.secretsByUsername[e[r]] = t ?? {}, "email" in e && e.email && (this.usersByEmail[e[i]] = s), "email" in e && e.email && (this.secretsByEmail[e[i]] = t ?? {}), { id: e.username, ...e };
@@ -1244,21 +1244,21 @@ class xt extends L {
    * @throws {@link @crossauth/common!CrossauthError } with {@link @crossauth/common!ErrorCode } set to either `UserNotExist`.
    */
   async getUserByUsername(e, t) {
-    const r = this.normalizeUsername ? L.normalize(e) : e;
+    const r = this.normalizeUsername ? q.normalize(e) : e;
     if (r in this.usersByUsername) {
       const i = this.usersByUsername[r];
       if (!i) throw new o(l.UserNotExist);
-      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == k.passwordChangeNeeded)
+      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == E.passwordChangeNeeded)
         throw h.logger.debug(m({ msg: "Password change required" })), new o(l.PasswordChangeNeeded);
-      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && (i.state == k.passwordResetNeeded || i.state == k.passwordAndFactor2ResetNeeded))
+      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && (i.state == E.passwordResetNeeded || i.state == E.passwordAndFactor2ResetNeeded))
         throw h.logger.debug(m({ msg: "Password reset required" })), new o(l.PasswordResetNeeded);
-      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == k.factor2ResetNeeded)
+      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == E.factor2ResetNeeded)
         throw h.logger.debug(m({ msg: "2FA reset required" })), new o(l.Factor2ResetNeeded);
-      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == k.awaitingTwoFactorSetup)
+      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == E.awaitingTwoFactorSetup)
         throw h.logger.debug(m({ msg: "2FA setup is not complete" })), new o(l.TwoFactorIncomplete);
-      if ((t == null ? void 0 : t.skipEmailVerifiedCheck) != !0 && i.state == k.awaitingEmailVerification)
+      if ((t == null ? void 0 : t.skipEmailVerifiedCheck) != !0 && i.state == E.awaitingEmailVerification)
         throw h.logger.debug(m({ msg: "User email not verified" })), new o(l.EmailNotVerified);
-      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == k.disabled)
+      if ((t == null ? void 0 : t.skipActiveCheck) != !0 && i.state == E.disabled)
         throw h.logger.debug(m({ msg: "User is deactivated" })), new o(l.UserNotActive);
       const s = this.secretsByUsername[r];
       return { user: { ...i }, secrets: { userid: i.id, ...s } };
@@ -1273,7 +1273,7 @@ class xt extends L {
    * @throws {@link @crossauth/common!CrossauthError } with {@link @crossauth/common!ErrorCode } set to either `UserNotExist`.
    */
   async getUserByEmail(e, t) {
-    const r = this.normalizeEmail ? L.normalize(e) : e;
+    const r = this.normalizeEmail ? q.normalize(e) : e;
     if (r in this.usersByEmail) {
       const i = this.usersByEmail[r];
       if (!i) throw new o(l.UserNotExist);
@@ -1317,7 +1317,7 @@ class xt extends L {
    */
   async updateUser(e, t) {
     let r = { ...e }, i = "username";
-    if ("username" in r && r.username && this.normalizeUsername ? (r.username_normalized = L.normalize(r.username), i = "username_normalized") : "id" in r && r.id && this.normalizeUsername && (r.username_normalized = L.normalize(String(r.id)), i = "username_normalized"), "email" in r && r.email && this.normalizeEmail && (r.email_normalized = L.normalize(r.email)), r[i] && r[i] in this.usersByUsername) {
+    if ("username" in r && r.username && this.normalizeUsername ? (r.username_normalized = q.normalize(r.username), i = "username_normalized") : "id" in r && r.id && this.normalizeUsername && (r.username_normalized = q.normalize(String(r.id)), i = "username_normalized"), "email" in r && r.email && this.normalizeEmail && (r.email_normalized = q.normalize(r.email)), r[i] && r[i] in this.usersByUsername) {
       for (let s in r)
         this.usersByUsername[r[i]][s] = r[s];
       t && (this.secretsByUsername[r[i]] = {
@@ -1331,11 +1331,11 @@ class xt extends L {
    * @param username username of user to delete
    */
   async deleteUserByUsername(e) {
-    const t = this.normalizeUsername ? L.normalize(String(e)) : e;
+    const t = this.normalizeUsername ? q.normalize(String(e)) : e;
     if (t in this.usersByUsername) {
       const r = this.usersByUsername[t];
       delete this.usersByUsername[t], delete this.secretsByUsername[t];
-      const i = this.normalizeEmail ? L.normalize(String(r.email)) : r.email;
+      const i = this.normalizeEmail ? q.normalize(String(r.email)) : r.email;
       i && i in this.usersByEmail && (delete this.usersByEmail[i], delete this.secretsByEmail[i]);
     }
   }
@@ -1357,7 +1357,7 @@ class xt extends L {
     return i;
   }
 }
-class Rt extends z {
+class Mt extends V {
   /**
    * Constructor
    */
@@ -1510,7 +1510,7 @@ class Rt extends z {
     this.deleteDataInternal(i, t) && (r.data = JSON.stringify(i));
   }
 }
-class Bt extends ye {
+class $t extends ve {
   /**
    * Constructor
    */
@@ -1601,7 +1601,7 @@ class Bt extends ye {
     return s;
   }
 }
-class zt extends pe {
+class qt extends Ee {
   /**
    * Constructor
    */
@@ -1636,10 +1636,10 @@ class zt extends pe {
       this.byClient[e] = [...r];
   }
 }
-function Xe(S, a) {
+function nt(S, a) {
   return { username: Array.isArray(a.uid) ? a.uid[0] : a.uid, state: "active", ...S };
 }
-class le extends L {
+class ge extends q {
   /**
    * Constructor.
    * @param localStorage the underlying storage where users are kept (without passwords)
@@ -1651,7 +1651,7 @@ class le extends L {
     u(this, "ldapUrls", []);
     u(this, "ldapUserSearchBase", "");
     u(this, "ldapUsernameAttribute", "cn");
-    u(this, "createUserFn", Xe);
+    u(this, "createUserFn", nt);
     this.localStorage = e, w("ldapUrls", g.JsonArray, this, t, "LDAP_URL", !0), w("ldapUserSearchBase", g.String, this, t, "LDAP_USER_SEARCH_BASE"), w("ldapUsernameAttribute", g.String, this, t, "LDAP_USENAME_ATTRIBUTE"), t.createUserFn && (this.createUserFn = t.createUserFn);
   }
   /**
@@ -1746,20 +1746,20 @@ class le extends L {
   async getLdapUser(e, t) {
     let r;
     try {
-      const i = le.sanitizeLdapDnForSearch(e), s = [this.ldapUsernameAttribute + "=" + i, this.ldapUserSearchBase].join(",");
+      const i = ge.sanitizeLdapDnForSearch(e), s = [this.ldapUsernameAttribute + "=" + i, this.ldapUserSearchBase].join(",");
       if (!t) throw new o(l.PasswordInvalid);
       return h.logger.debug(m({ msg: "LDAP search " + s })), r = await this.ldapBind(s, t), await this.searchUser(r, s);
     } catch (i) {
       h.logger.debug(m({ err: i }));
       const s = o.asCrossauthError(i);
-      throw i instanceof Se.InvalidCredentialsError ? new o(l.UsernameOrPasswordInvalid) : s.code != l.UnknownError ? s : new o(l.Connection, "LDAP error getting user");
+      throw i instanceof Ue.InvalidCredentialsError ? new o(l.UsernameOrPasswordInvalid) : s.code != l.UnknownError ? s : new o(l.Connection, "LDAP error getting user");
     }
   }
   // bind and return the ldap client
   // from https://github.com/shaozi/ldap-authentication/blob/master/index.js
   ldapBind(e, t) {
     return new Promise((r, i) => {
-      let s = Se.createClient({ url: this.ldapUrls });
+      let s = Ue.createClient({ url: this.ldapUrls });
       s.on("connect", function() {
         s.bind(e, t, function(n) {
           if (n) {
@@ -1797,7 +1797,7 @@ class le extends L {
             return;
           }
           d.on("searchEntry", function(y) {
-            f = le.searchResultToUser(y.pojo);
+            f = ge.searchResultToUser(y.pojo);
           }), d.on("error", function(y) {
             s(y), e.unbind();
           }), d.on("end", function(y) {
@@ -1827,10 +1827,10 @@ class le extends L {
    * @returns a sanitized dn
    */
   static sanitizeLdapDnForSearch(e) {
-    return le.sanitizeLdapDn(e).replace("*", "*").replace("(", "(").replace(")", ")");
+    return ge.sanitizeLdapDn(e).replace("*", "*").replace("(", "(").replace(")", ")");
   }
 }
-class Y extends L {
+class te extends q {
   /**
    * Creates a DbUserStorage object, optionally overriding defaults.
    * @param dbPool the instance of the Posrgres client.
@@ -1865,7 +1865,7 @@ class Y extends L {
    * @throws CrossauthException with ErrorCode either `UserNotExist` or whatever pg throws
    */
   async getUserByUsername(e, t) {
-    const r = this.normalizeUsername ? Y.normalize(e) : e;
+    const r = this.normalizeUsername ? te.normalize(e) : e;
     return await this.getUser("username_normalized", r, t);
   }
   /**
@@ -1878,7 +1878,7 @@ class Y extends L {
    * @throws {@link @crossauth/common!CrossauthError } with {@link @crossauth/common!ErrorCode } set to either `UserNotExist` or whatever pg throwsa.
    */
   async getUserByEmail(e, t) {
-    const r = this.normalizeEmail ? Y.normalize(e) : e;
+    const r = this.normalizeEmail ? te.normalize(e) : e;
     return this.getUser("email_normalized", r, t);
   }
   /**
@@ -1899,33 +1899,33 @@ class Y extends L {
       let d = `select * from ${this.userTable} where ${e} = ` + c.nextParameter(), f = await i.execute(d, [t]);
       if (f.length == 0)
         throw new o(l.UserNotExist);
-      let y, C, v;
+      let y, C, _;
       if (this.idColumn in f[0]) y = f[0][this.idColumn];
       else throw new o(l.Configuration, "ID column " + this.idColumn + " not present in user table");
       if ("username" in f[0]) C = f[0].username;
       else throw new o(l.Configuration, "username column " + this.idColumn + " not present in user table");
-      if ("state" in f[0]) v = f[0].state;
+      if ("state" in f[0]) _ = f[0].state;
       else throw new o(l.Configuration, "state column " + this.idColumn + " not present in user table");
       if (s = {
         ...f[0],
         id: y,
         username: C,
-        state: v
+        state: _
       }, !s) throw new o(l.UserNotExist);
       if (c = this.dbPool.parameters(), d = `select * from ${this.userSecretsTable} where ${this.useridForeignKeyColumn} = ` + c.nextParameter(), f = await i.execute(d, [s.id]), f.length == 0)
         throw new o(l.UserNotExist);
       if (f.length > 0 ? n = { userid: s.id, ...f[0] } : n = { userid: s.id }, !n) throw new o(l.UserNotExist);
-      if (this.useridForeignKeyColumn != "userid" && this.useridForeignKeyColumn in n && delete n[this.useridForeignKeyColumn], await i.commit(), (r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == k.awaitingTwoFactorSetup)
+      if (this.useridForeignKeyColumn != "userid" && this.useridForeignKeyColumn in n && delete n[this.useridForeignKeyColumn], await i.commit(), (r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.awaitingTwoFactorSetup)
         throw h.logger.debug(m({ msg: "2FA setup is not complete" })), new o(l.TwoFactorIncomplete);
-      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == k.disabled)
+      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.disabled)
         throw h.logger.debug(m({ msg: "User is deactivated" })), new o(l.UserNotActive);
-      if ((r == null ? void 0 : r.skipEmailVerifiedCheck) != !0 && s.state == k.awaitingEmailVerification)
+      if ((r == null ? void 0 : r.skipEmailVerifiedCheck) != !0 && s.state == E.awaitingEmailVerification)
         throw h.logger.debug(m({ msg: "User has not verified email" })), new o(l.EmailNotVerified);
-      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == k.passwordChangeNeeded)
+      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.passwordChangeNeeded)
         throw h.logger.debug(m({ msg: "User must change password" })), new o(l.PasswordChangeNeeded);
-      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && (s.state == k.passwordResetNeeded || s.state == k.passwordAndFactor2ResetNeeded))
+      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && (s.state == E.passwordResetNeeded || s.state == E.passwordAndFactor2ResetNeeded))
         throw h.logger.debug(m({ msg: "User must reset password" })), new o(l.PasswordResetNeeded);
-      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == k.factor2ResetNeeded)
+      if ((r == null ? void 0 : r.skipActiveCheck) != !0 && s.state == E.factor2ResetNeeded)
         throw h.logger.debug(m({ msg: "2FA reset required" })), new o(l.Factor2ResetNeeded);
       return { user: s, secrets: n };
     } catch (d) {
@@ -1949,20 +1949,20 @@ class Y extends L {
       if (y.length == 0)
         throw new o(l.UserNotExist);
       for (let C of y) {
-        let v, p, T;
-        if (this.idColumn in C) v = C[this.idColumn];
+        let _, p, T;
+        if (this.idColumn in C) _ = C[this.idColumn];
         else throw new o(l.Configuration, "ID column " + this.idColumn + " not present in user table");
         if ("username" in C) p = C.username;
         else throw new o(l.Configuration, "username column " + this.idColumn + " not present in user table");
         if ("state" in C) T = C.state;
         else throw new o(l.Configuration, "state column " + this.idColumn + " not present in user table");
-        let E = {
+        let v = {
           ...C,
-          id: v,
+          id: _,
           username: p,
           state: T
         };
-        i.push(E);
+        i.push(v);
       }
       return i;
     } catch (f) {
@@ -1990,15 +1990,15 @@ class Y extends L {
       if ((await r.execute(s, [e.id])).length == 0)
         throw new o(l.UserNotExist);
       let c = { ...e }, d = t ? { ...t } : void 0;
-      "email" in c && c.email && (c = { email_normalized: this.normalizeEmail ? Y.normalize(c.email) : c.email, ...c }), "username" in c && c.username && (c = { username_normalized: this.normalizeUsername ? Y.normalize(c.username) : c.username, ...c }), i = this.dbPool.parameters();
+      "email" in c && c.email && (c = { email_normalized: this.normalizeEmail ? te.normalize(c.email) : c.email, ...c }), "username" in c && c.username && (c = { username_normalized: this.normalizeUsername ? te.normalize(c.username) : c.username, ...c }), i = this.dbPool.parameters();
       let f = [], y = [];
       for (let C in c)
         c[C] != null && C != "id" && (f.push(C + "= " + i.nextParameter()), y.push(c[C]));
       if (f.length > 0) {
         let C = f.join(", ");
         y.push(e.id);
-        let v = `update ${this.userTable} set ${C} where ${this.idColumn} = ` + i.nextParameter();
-        await r.execute(v, y);
+        let _ = `update ${this.userTable} set ${C} where ${this.idColumn} = ` + i.nextParameter();
+        await r.execute(_, y);
       }
       if (t) {
         f = [], y = [], i = this.dbPool.parameters();
@@ -2007,8 +2007,8 @@ class Y extends L {
         if (f.length > 0) {
           let C = f.join(", ");
           y.push(e.id);
-          let v = `update ${this.userSecretsTable} set ${C} where userid = ` + i.nextParameter();
-          await r.execute(v, y);
+          let _ = `update ${this.userSecretsTable} set ${C} where userid = ` + i.nextParameter();
+          await r.execute(_, y);
         }
       }
       await r.commit();
@@ -2035,28 +2035,28 @@ class Y extends L {
     try {
       await r.startTransaction();
       let s = { ...e }, n = t ? { ...t } : void 0;
-      "email" in s && s.email && (s = { email_normalized: this.normalizeEmail ? Y.normalize(s.email) : s.email, ...s }), "username" in s && s.username && (s = { username_normalized: this.normalizeUsername ? Y.normalize(s.username) : s.username, ...s });
+      "email" in s && s.email && (s = { email_normalized: this.normalizeEmail ? te.normalize(s.email) : s.email, ...s }), "username" in s && s.username && (s = { username_normalized: this.normalizeUsername ? te.normalize(s.username) : s.username, ...s });
       let c = [], d = [], f = [];
       const y = this.dbPool.parameters();
-      for (let v in s)
-        s[v] != null && v != "id" && (c.push(v), d.push(y.nextParameter()), f.push(s[v]));
+      for (let _ in s)
+        s[_] != null && _ != "id" && (c.push(_), d.push(y.nextParameter()), f.push(s[_]));
       if (c.length > 0) {
-        let v = c.join(", "), p = d.join(", ");
-        const T = `insert into ${this.userTable} (${v}) values (${p}) returning ${this.idColumn}`, E = await r.execute(T, f);
-        if (E.length == 0 || !E[0][this.idColumn]) throw new o(l.Connection, "Couldn't create user");
-        i = E[0][this.idColumn];
+        let _ = c.join(", "), p = d.join(", ");
+        const T = `insert into ${this.userTable} (${_}) values (${p}) returning ${this.idColumn}`, v = await r.execute(T, f);
+        if (v.length == 0 || !v[0][this.idColumn]) throw new o(l.Connection, "Couldn't create user");
+        i = v[0][this.idColumn];
       }
       if (!i) throw new o(l.Connection, "Couldn't create user");
       if (t) {
         c = [], d = [], f = [];
-        const v = this.dbPool.parameters();
-        c.push("userid"), d.push(v.nextParameter()), f.push(i);
+        const _ = this.dbPool.parameters();
+        c.push("userid"), d.push(_.nextParameter()), f.push(i);
         for (let p in n)
-          n[p] != null && p != "userid" && (c.push(p), d.push(v.nextParameter()), f.push(n[p]));
+          n[p] != null && p != "userid" && (c.push(p), d.push(_.nextParameter()), f.push(n[p]));
         if (c.length > 0) {
           let p = c.join(", "), T = d.join(", ");
-          const E = `insert into ${this.userSecretsTable} (${p}) values (${T})`;
-          h.logger.debug(m({ msg: "Executing query", query: E })), await r.execute(E, f);
+          const v = `insert into ${this.userSecretsTable} (${p}) values (${T})`;
+          h.logger.debug(m({ msg: "Executing query", query: v })), await r.execute(v, f);
         }
       }
       return await r.commit(), (await this.getUserById(i)).user;
@@ -2103,7 +2103,7 @@ class Y extends L {
     }
   }
 }
-class Qe extends z {
+class ot extends V {
   /**
    * Constructor with user storage object to use plus optional parameters.
    *
@@ -2163,18 +2163,18 @@ class Qe extends z {
    */
   async saveKey(e, t, r, i, s, n = {}) {
     let c, d = [this.useridForeignKeyColumn, "value", "created", "expires", "data"], f = this.dbPool.parameters(), y = [];
-    for (let E = 0; E < 5; ++E)
+    for (let v = 0; v < 5; ++v)
       y.push(f.nextParameter());
     let C = [e ?? null, t, r, i ?? null, s ?? ""];
-    for (let E in n)
-      d.push(E), y.push(f.nextParameter()), C.push(n[E]);
-    let v = d.join(", "), p = y.join(", ");
+    for (let v in n)
+      d.push(v), y.push(f.nextParameter()), C.push(n[v]);
+    let _ = d.join(", "), p = y.join(", ");
     const T = await this.dbPool.connect();
     try {
-      const E = `insert into ${this.keyTable} (${v}) values (${p})`;
-      await T.execute(E, C);
-    } catch (E) {
-      o.asCrossauthError(E).code == l.ConstraintViolation ? (h.logger.warn(m({ msg: "Attempt to create key that already exists. Stack trace follows" })), h.logger.debug(m({ err: E })), c = new o(l.KeyExists)) : (h.logger.debug(m({ err: E })), c = new o(l.Connection, "Error saving key"));
+      const v = `insert into ${this.keyTable} (${_}) values (${p})`;
+      await T.execute(v, C);
+    } catch (v) {
+      o.asCrossauthError(v).code == l.ConstraintViolation ? (h.logger.warn(m({ msg: "Attempt to create key that already exists. Stack trace follows" })), h.logger.debug(m({ err: v })), c = new o(l.KeyExists)) : (h.logger.debug(m({ err: v })), c = new o(l.Connection, "Error saving key"));
     } finally {
       T.release();
     }
@@ -2354,7 +2354,7 @@ class Qe extends z {
     }
   }
 }
-class et extends ye {
+class lt extends ve {
   /**
    * Constructor with user storage object to use plus optional parameters.
    *
@@ -2412,14 +2412,14 @@ class et extends ye {
   async getClientWithTransaction(e, t, r, i, s, n) {
     let c = [], d = this.dbPool.parameters(), f = [], y = `select c.*, r.uri as uri, null as flow from ${this.clientTable} as c left join ${this.redirectUriTable} r on c.client_id = r.client_id `, C = "";
     t && r && (C = `where c.${t} = ` + d.nextParameter(), f.push(r)), i !== null && i == null || (C == "" ? C = "where " : C += " and ", i == null ? C += "userid is null" : (C += `${this.useridForeignKeyColumn} = ` + d.nextParameter(), f.push(i)));
-    let v = `select c.*, null as uri, f.flow as flow from ${this.clientTable} as c left join ${this.validFlowTable} f on c.client_id = f.client_id `, p = "";
-    t && r && (p = `where c.${t} = ` + d.nextParameter(), f.push(r)), i !== null && i == null || (p == "" ? p = "where " : p += " and ", i == null ? p += "userid is null" : (p += `${this.useridForeignKeyColumn} = ` + d.nextParameter(), f.push(i))), n && (s || (s = 0), s = Number(s), n = Number(n), C == "" ? C = "where " : C += " and ", C += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${s})`, p == "" ? p = "where " : p += " and ", p += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${s})`), y += C, v += p;
-    let T = y + " union " + v + " order by client_id";
-    const E = await e.execute(T, f);
-    let A;
-    for (let j of E)
-      (!A || j.client_id != A.client_id) && (A && c.push(A), A = this.makeClient(j), A.valid_flow = [], A.redirect_uri = []), j.uri && A.redirect_uri.push(j.uri), j.flow && A.valid_flow.push(j.flow);
-    return A && c.push(A), c;
+    let _ = `select c.*, null as uri, f.flow as flow from ${this.clientTable} as c left join ${this.validFlowTable} f on c.client_id = f.client_id `, p = "";
+    t && r && (p = `where c.${t} = ` + d.nextParameter(), f.push(r)), i !== null && i == null || (p == "" ? p = "where " : p += " and ", i == null ? p += "userid is null" : (p += `${this.useridForeignKeyColumn} = ` + d.nextParameter(), f.push(i))), n && (s || (s = 0), s = Number(s), n = Number(n), C == "" ? C = "where " : C += " and ", C += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${s})`, p == "" ? p = "where " : p += " and ", p += ` c.client_id in (select client_id from ${this.clientTable} limit ${n} offset ${s})`), y += C, _ += p;
+    let T = y + " union " + _ + " order by client_id";
+    const v = await e.execute(T, f);
+    let b;
+    for (let M of v)
+      (!b || M.client_id != b.client_id) && (b && c.push(b), b = this.makeClient(M), b.valid_flow = [], b.redirect_uri = []), M.uri && b.redirect_uri.push(M.uri), M.flow && b.valid_flow.push(M.flow);
+    return b && c.push(b), c;
   }
   /**
    * Saves a key in the session table.
@@ -2453,7 +2453,7 @@ class et extends ye {
       }
     if (i) {
       for (let p = 0; p < i.length; ++p)
-        if (!U.isValidFlow(i[p])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[p]);
+        if (!I.isValidFlow(i[p])) throw new o(l.InvalidOAuthFlow, "Invalid flow " + i[p]);
     }
     let c = [], d = [], f = [], y = this.dbPool.parameters();
     try {
@@ -2461,8 +2461,8 @@ class et extends ye {
         c.push(p), d.push(y.nextParameter()), f.push(n[p]);
       if (c.length > 0) {
         let p = c.join(", "), T = d.join(", ");
-        const E = `insert into ${this.clientTable} (${p}) values (${T})`;
-        await e.execute(E, f);
+        const v = `insert into ${this.clientTable} (${p}) values (${T})`;
+        await e.execute(v, f);
       }
     } catch (p) {
       throw typeof p == "object" && p != null && "code" in p && typeof p.code == "string" && (p.code.startsWith("22") || p.code.startsWith("23")) ? (h.logger.debug(m({ err: p })), new o(l.InvalidClientId, "Attempt to create an OAuth client with a client_id that already exists. Maximum attempts failed")) : (h.logger.debug(m({ err: p })), new o(l.Connection, "Error saving OAuth client"));
@@ -2470,20 +2470,20 @@ class et extends ye {
     let C = await this.getClientWithTransaction(e, "client_id", t.client_id, t.userid);
     if (C.length == 0)
       throw h.logger.error(m({ msg: "Attempt to create key that already exists. Stack trace follows" })), new o(l.KeyExists);
-    let v = C[0];
+    let _ = C[0];
     if (r)
       for (let p = 0; p < r.length; ++p) {
         f = [], y = this.dbPool.parameters();
         let T = `insert into ${this.redirectUriTable} (client_id, uri) values (` + y.nextParameter() + ", " + y.nextParameter() + ")";
-        f.push(v.client_id), f.push(r[p]), await e.execute(T, f);
+        f.push(_.client_id), f.push(r[p]), await e.execute(T, f);
       }
     if (i)
       for (let p = 0; p < i.length; ++p) {
         f = [], y = this.dbPool.parameters();
         let T = `insert into ${this.validFlowTable} (client_id, flow) values (` + y.nextParameter() + ", " + y.nextParameter() + ")";
-        f.push(v.client_id), f.push(i[p]), await e.execute(T, f);
+        f.push(_.client_id), f.push(i[p]), await e.execute(T, f);
       }
-    return { ...v, redirect_uri: r, valid_flow: i };
+    return { ..._, redirect_uri: r, valid_flow: i };
   }
   /**
    *
@@ -2538,32 +2538,32 @@ class et extends ye {
       }
     if (i) {
       for (let T = 0; T < i.length; ++T)
-        if (!U.isValidFlow(i[T])) throw new o(l.InvalidOAuthFlow, "Redirect Uri's may not contain page fragments");
+        if (!I.isValidFlow(i[T])) throw new o(l.InvalidOAuthFlow, "Redirect Uri's may not contain page fragments");
     }
     if (!t.client_id) throw new o(l.InvalidClientId, "No client ig given");
     let { client_id: s, redirect_uri: n, valid_flow: c, ...d } = t;
     n || (n = []), c || (c = []);
     let f = this.dbPool.parameters(), y = `delete from ${this.redirectUriTable} where client_id = ` + f.nextParameter();
     await e.execute(y, [t.client_id]), f = this.dbPool.parameters(), y = `delete from ${this.validFlowTable} where client_id = ` + f.nextParameter(), await e.execute(y, [t.client_id]);
-    let C = [], v = [], p = [];
+    let C = [], _ = [], p = [];
     f = this.dbPool.parameters(), y = `delete from ${this.validFlowTable} where client_id = ` + f.nextParameter();
     for (let T in d)
-      C.push(T), v.push(f.nextParameter()), p.push(d[T]);
+      C.push(T), _.push(f.nextParameter()), p.push(d[T]);
     if (C.length > 0) {
-      let T = C.join(", "), E = v.join(", ");
-      y = `update ${this.clientTable} set (${T}) values (${E})`, await e.execute(y, p);
+      let T = C.join(", "), v = _.join(", ");
+      y = `update ${this.clientTable} set (${T}) values (${v})`, await e.execute(y, p);
     }
     if (n)
       for (let T = 0; T < n.length; ++T) {
         p = [], f = this.dbPool.parameters();
-        let E = `insert into ${this.redirectUriTable} (client_id, uri) values (` + f.nextParameter() + ", " + f.nextParameter() + ")";
-        p.push(t.client_id), p.push(n[T]), await e.execute(E, p);
+        let v = `insert into ${this.redirectUriTable} (client_id, uri) values (` + f.nextParameter() + ", " + f.nextParameter() + ")";
+        p.push(t.client_id), p.push(n[T]), await e.execute(v, p);
       }
     if (c)
       for (let T = 0; T < c.length; ++T) {
         p = [], f = this.dbPool.parameters();
-        let E = `insert into ${this.validFlowTable} (client_id, flow) values (` + f.nextParameter() + ", " + f.nextParameter() + ")";
-        p.push(t.client_id), p.push(c[T]), await e.execute(E, p);
+        let v = `insert into ${this.validFlowTable} (client_id, flow) values (` + f.nextParameter() + ", " + f.nextParameter() + ")";
+        p.push(t.client_id), p.push(c[T]), await e.execute(v, p);
       }
   }
   async getClients(e, t, r) {
@@ -2579,7 +2579,7 @@ class et extends ye {
     }
   }
 }
-class tt extends pe {
+class ct extends Ee {
   /**
    * Constructor with user storage object to use plus optional parameters.
    *
@@ -2620,17 +2620,17 @@ class tt extends pe {
     }
   }
 }
-class rt {
+class dt {
   constructor() {
   }
 }
-class it {
+class ut {
   constructor() {
   }
 }
-class at {
+class ht {
 }
-class he extends rt {
+class Ce extends dt {
   constructor(e) {
     super();
     u(this, "pgPool");
@@ -2638,13 +2638,13 @@ class he extends rt {
   }
   async connect() {
     const e = await this.pgPool.connect();
-    return h.logger.debug(m({ msg: "DB connect" })), new st(e);
+    return h.logger.debug(m({ msg: "DB connect" })), new mt(e);
   }
   parameters() {
-    return new nt();
+    return new ft();
   }
 }
-class st extends at {
+class mt extends ht {
   constructor(e) {
     super();
     u(this, "pgClient");
@@ -2679,7 +2679,7 @@ class st extends at {
     h.logger.debug(m({ msg: "DB rollback" })), await this.pgClient.query("ROLLBACK");
   }
 }
-class nt extends it {
+class ft extends ut {
   constructor() {
     super();
     u(this, "nextParam", 1);
@@ -2688,47 +2688,47 @@ class nt extends it {
     return "$" + this.nextParam++;
   }
 }
-class Lt extends Y {
+class Wt extends te {
   /**
    * Creates a PostgresUserStorage object, optionally overriding defaults.
    * @param pgPool the instance of the Posrgres client.
    * @param options see {@link PostgresUserStorageOptions}.
    */
   constructor(a, e = {}) {
-    super(new he(a), e);
+    super(new Ce(a), e);
   }
 }
-class jt extends Qe {
+class Jt extends ot {
   /**
    * Creates a PostgresKeyStorage object, optionally overriding defaults.
    * @param pgPool the instance of the Posrgres client.
    * @param options see {@link PostgresKeyStorageOptions}.
    */
   constructor(a, e = {}) {
-    super(new he(a), e);
+    super(new Ce(a), e);
   }
 }
-class Ht extends et {
+class Yt extends lt {
   /**
    * Creates a PostgresOAuthClientStorage object, optionally overriding defaults.
    * @param pgPool the instance of the Posrgres client.
    * @param options see {@link PostgresOAuthClientStorageOptions}.
    */
   constructor(a, e = {}) {
-    super(new he(a), e);
+    super(new Ce(a), e);
   }
 }
-class Vt extends tt {
+class Gt extends ct {
   /**
    * Creates a PostgresOAuthClientStorage object, optionally overriding defaults.
    * @param pgPool the instance of the Posrgres client.
    * @param options see {@link PostgresOAuthAuthorizationStorageOptions}.
    */
   constructor(a, e = {}) {
-    super(new he(a), e);
+    super(new Ce(a), e);
   }
 }
-class ae {
+class de {
   // overridden when registered to backend
   /**
    * Constructor.
@@ -2755,7 +2755,7 @@ class ae {
     return !0;
   }
 }
-class Ie extends ae {
+class Re extends de {
   /** @returns `password` */
   secretNames() {
     return ["password"];
@@ -2773,7 +2773,7 @@ class Ie extends ae {
     return "none";
   }
 }
-const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2_ITERATIONS || 6e5), ke = Number(process.env.PBKDF2_KEYLENGTH || 32), ot = Number(process.env.PBKDF2_KEYLENGTH || 16), ne = "sha256", q = class q {
+const Ie = process.env.PBKDF2_DIGEST || "sha256", Pe = Number(process.env.PBKDF2_ITERATIONS || 6e5), Oe = Number(process.env.PBKDF2_KEYLENGTH || 32), gt = Number(process.env.PBKDF2_KEYLENGTH || 16), me = "sha256", G = class G {
   /**
    * Returns true if the plaintext password, when hashed, equals the one in the hash, using
    * it's hasher settings
@@ -2783,7 +2783,7 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
    * @returns true if they are equal, false otherwise
    */
   static async passwordsEqual(a, e, t) {
-    let r = q.decodePasswordHash(e), i = await q.passwordHash(a, {
+    let r = G.decodePasswordHash(e), i = await G.passwordHash(a, {
       salt: r.salt,
       encode: !1,
       secret: r.useSecret ? t : void 0,
@@ -2793,7 +2793,7 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
     });
     if (i.length != r.hashedPassword.length)
       throw new o(l.PasswordInvalid);
-    return me(Buffer.from(i), Buffer.from(r.hashedPassword));
+    return Se(Buffer.from(i), Buffer.from(r.hashedPassword));
   }
   /**
    * Decodes a string from base64 to UTF-89
@@ -2861,7 +2861,7 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
    * @returns random salt as a base64 encoded string
    */
   static randomSalt() {
-    return q.randomValue(ot);
+    return G.randomValue(gt);
   }
   /**
    * Creates a random string encoded as in base64url
@@ -2869,7 +2869,7 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
    * @returns the random value as a string.  Number of bytes will be greater as it is base64 encoded.
    */
   static randomValue(a) {
-    return fe(a).toString("base64url");
+    return Te(a).toString("base64url");
   }
   // not real base32 - omits 1,i,0,o
   /**
@@ -2879,14 +2879,14 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
    */
   static randomBase32(a, e) {
     var i;
-    const r = [...fe(a)].map((s) => q.Base32[s % 32]).join("");
+    const r = [...Te(a)].map((s) => G.Base32[s % 32]).join("");
     return e ? ((i = r.match(/(.{1,4})/g)) == null ? void 0 : i.join("-")) ?? r : r;
   }
   /**
    * Creates a UUID
    */
   static uuid() {
-    return Re();
+    return $e();
   }
   /**
    * Standard hash using SHA256 (not PBKDF2 or HMAC)
@@ -2904,7 +2904,7 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
    * @returns the string containing the hash
    */
   static sha256(a) {
-    return Be("sha256").update(a).digest("base64url");
+    return qe("sha256").update(a).digest("base64url");
   }
   /**
    * Hashes a password and returns it as a base64 or base64url encoded string
@@ -2917,23 +2917,23 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
    */
   static async passwordHash(a, e = {}) {
     let { salt: t, secret: r, encode: i } = { ...e };
-    t || (t = q.randomSalt());
+    t || (t = G.randomSalt());
     let s = r != null, n = s ? t + "!" + r : t;
     i == null && (i = !1);
-    let f = (await He(ze)(
+    let f = (await Ge(We)(
       a,
       n,
-      e.iterations ?? _e,
-      e.keyLen ?? ke,
-      e.digest ?? ve
+      e.iterations ?? Pe,
+      e.keyLen ?? Oe,
+      e.digest ?? Ie
     )).toString("base64url");
     return i && (f = this.encodePasswordHash(
       f,
       t,
       s,
-      e.iterations ?? _e,
-      e.keyLen ?? ke,
-      e.digest ?? ve
+      e.iterations ?? Pe,
+      e.keyLen ?? Oe,
+      e.digest ?? Ie
     )), f;
   }
   /**
@@ -2946,7 +2946,7 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
    * @returns a Base64-URL-encoded string that can be hashed.
    */
   static signableToken(a, e, t) {
-    return e == null && (e = q.randomSalt()), t || (t = (/* @__PURE__ */ new Date()).getTime()), Buffer.from(JSON.stringify({ ...a, t, s: e })).toString("base64url");
+    return e == null && (e = G.randomSalt()), t || (t = (/* @__PURE__ */ new Date()).getTime()), Buffer.from(JSON.stringify({ ...a, t, s: e })).toString("base64url");
   }
   /**
    * Signs a JSON payload by creating a hash, using a secret and
@@ -2959,7 +2959,7 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
    * @returns Base64-url encoded hash
    */
   static sign(a, e, t, r) {
-    const i = q.signableToken(a, t, r), s = se(ne, e);
+    const i = G.signableToken(a, t, r), s = he(me, e);
     return i + "." + s.update(i).digest("base64url");
   }
   /**
@@ -2972,7 +2972,7 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
    * @returns Base64-url encoded hash
    */
   static signSecureToken(a, e) {
-    const t = se(ne, e);
+    const t = he(me, e);
     return a + "." + t.update(a).digest("base64url");
   }
   /**
@@ -2991,10 +2991,10 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
     const i = r[0], s = r[1], n = JSON.parse(Buffer.from(i, "base64url").toString());
     if (t && n.t + t * 1e3 > (/* @__PURE__ */ new Date()).getTime())
       throw new o(l.Expired);
-    const d = se(ne, e).update(i).digest("base64url");
+    const d = he(me, e).update(i).digest("base64url");
     if (d.length != s.length)
       throw new o(l.InvalidKey, "Signature does not match payload");
-    if (!me(Buffer.from(d), Buffer.from(s)))
+    if (!Se(Buffer.from(d), Buffer.from(s)))
       throw new o(l.InvalidKey, "Signature does not match payload");
     return n;
   }
@@ -3011,10 +3011,10 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
   static unsignSecureToken(a, e) {
     const t = a.split(".");
     if (t.length != 2) throw new o(l.InvalidKey);
-    const r = t[0], i = t[1], s = r, c = se(ne, e).update(r).digest("base64url");
+    const r = t[0], i = t[1], s = r, c = he(me, e).update(r).digest("base64url");
     if (c.length != i.length)
       throw new o(l.InvalidKey, "Signature does not match payload");
-    if (!me(Buffer.from(c), Buffer.from(i)))
+    if (!Se(Buffer.from(c), Buffer.from(i)))
       throw new o(l.InvalidKey, "Signature does not match payload");
     return s;
   }
@@ -3036,9 +3036,9 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
    * @returns Encrypted text Base64-url encoded.
    */
   static symmetricEncrypt(a, e, t = void 0) {
-    t || (t = fe(16));
+    t || (t = Te(16));
     let r = Buffer.from(e, "base64url");
-    var i = Le("aes-256-cbc", r, t);
+    var i = Je("aes-256-cbc", r, t);
     let s = i.update(a);
     return s = Buffer.concat([s, i.final()]), t.toString("base64url") + "." + s.toString("base64url");
   }
@@ -3054,14 +3054,14 @@ const ve = process.env.PBKDF2_DIGEST || "sha256", _e = Number(process.env.PBKDF2
     const r = a.split(".");
     if (r.length != 2) throw new o(l.InvalidHash, "Not AES-256-CBC ciphertext");
     let i = Buffer.from(r[0], "base64url"), s = Buffer.from(r[1], "base64url");
-    var n = je("aes-256-cbc", t, i);
+    var n = Ye("aes-256-cbc", t, i);
     let c = n.update(s);
     return c = Buffer.concat([c, n.final()]), c.toString();
   }
 };
-u(q, "Base32", "ABCDEFGHJKLMNPQRSTUVWXYZ23456789".split(""));
-let _ = q;
-function lt(S) {
+u(G, "Base32", "ABCDEFGHJKLMNPQRSTUVWXYZ23456789".split(""));
+let k = G;
+function wt(S) {
   let a = [];
   if (!S.password) a.push("Password not provided");
   else {
@@ -3070,7 +3070,7 @@ function lt(S) {
   }
   return a;
 }
-const ce = class ce extends Ie {
+const we = class we extends Re {
   /**
    * Create a new authenticator.
    *
@@ -3093,7 +3093,7 @@ const ce = class ce extends Ie {
     /** See {@link LocalPasswordAuthenticatorOptions.pbkdf2KeyLength}  */
     u(this, "pbkdf2KeyLength", 32);
     /** See {@link LocalPasswordAuthenticatorOptions.validatePasswordFn}  */
-    u(this, "validatePasswordFn", lt);
+    u(this, "validatePasswordFn", wt);
     w("secret", g.String, this, t, "HASHER_SECRET"), w("enableSecretForPasswordHash", g.Boolean, this, t, "ENABLE_SECRET_FOR_PASSWORDS"), w("pbkdf2Digest", g.String, this, t, "PASSWORD_PBKDF2_DIGEST"), w("pbkdf2Iterations", g.String, this, t, "PASSWORD_PBKDF2_ITERATIONS"), w("pbkdf2SaltLength", g.String, this, t, "PASSWORD_PBKDF2_SALTLENGTH"), w("pbkdf2KeyLength", g.String, this, t, "PASSWORD_PBKDF2_KEYLENGTH"), t.validatePasswordFn && (this.validatePasswordFn = t.validatePasswordFn);
   }
   /**
@@ -3114,11 +3114,11 @@ const ce = class ce extends Ie {
   async authenticateUser(e, t, r) {
     if (!r.password) throw new o(l.PasswordInvalid, "Password not provided");
     if (!t.password) throw new o(l.PasswordInvalid);
-    if (!await _.passwordsEqual(r.password, t.password, this.secret))
+    if (!await k.passwordsEqual(r.password, t.password, this.secret))
       throw h.logger.debug(m({ msg: "Invalid password hash", user: e.username })), new o(l.PasswordInvalid);
-    if (e.state == k.awaitingTwoFactorSetup) throw new o(l.TwoFactorIncomplete);
-    if (e.state == k.awaitingEmailVerification) throw new o(l.EmailNotVerified);
-    if (e.state == k.disabled) throw new o(l.UserNotActive);
+    if (e.state == E.awaitingTwoFactorSetup) throw new o(l.TwoFactorIncomplete);
+    if (e.state == E.awaitingEmailVerification) throw new o(l.EmailNotVerified);
+    if (e.state == E.disabled) throw new o(l.UserNotActive);
   }
   /**
    * Calls the implementor-provided `validatePasswordFn`
@@ -3144,7 +3144,7 @@ const ce = class ce extends Ie {
    * @returns the encoded hash string.
    */
   async createPasswordHash(e, t, r = !0) {
-    return await _.passwordHash(e, {
+    return await k.passwordHash(e, {
       salt: t,
       encode: r,
       secret: this.enableSecretForPasswords ? this.secret : void 0,
@@ -3169,7 +3169,7 @@ const ce = class ce extends Ie {
    * @returns true if match, false otherwise
    */
   async passwordMatchesHash(e, t, r) {
-    return t == ce.NoPassword ? !1 : await _.passwordsEqual(e, t, r);
+    return t == we.NoPassword ? !1 : await k.passwordsEqual(e, t, r);
   }
   /**
    * This will return p hash of the passed password.
@@ -3226,9 +3226,9 @@ const ce = class ce extends Ie {
   async reprepareConfiguration(e, t) {
   }
 };
-u(ce, "NoPassword", "********");
-let Ee = ce;
-class X extends ae {
+u(we, "NoPassword", "********");
+let Ke = we;
+class ne extends de {
   /**
    * Constructor
    *
@@ -3248,7 +3248,7 @@ class X extends ae {
     u(this, "smtpPassword");
     u(this, "emailAuthenticatorTokenExpires", 60 * 5);
     u(this, "render");
-    w("views", g.String, this, e, "VIEWS"), w("emailAuthenticatorTextBody", g.String, this, e, "EMAIL_AUTHENTICATOR_TEXT_BODY"), w("emailAuthenticatorHtmlBody", g.String, this, e, "EMAIL_AUTHENTICATOR_HTML_BODY"), w("emailAuthenticatorSubject", g.String, this, e, "EMAIL_AUTHENTICATOR_SUBJECT"), w("emailFrom", g.String, this, e, "EMAIL_FROM", !0), w("smtpHost", g.String, this, e, "SMTP_HOST", !0), w("smtpPort", g.Number, this, e, "SMTP_PORT"), w("smtpUsername", g.String, this, e, "SMTP_USERNAME"), w("smtpPassword", g.String, this, e, "SMTP_PASSWORD"), w("smtpUseTls", g.Boolean, this, e, "SMTP_USE_TLS"), w("emailAuthenticatorTokenExpires", g.Number, this, e, "EMAIL_AUTHENTICATOR_TOKEN_EXPIRES"), e.render ? this.render = e.render : W.configure(this.views, { autoescape: !0 });
+    w("views", g.String, this, e, "VIEWS"), w("emailAuthenticatorTextBody", g.String, this, e, "EMAIL_AUTHENTICATOR_TEXT_BODY"), w("emailAuthenticatorHtmlBody", g.String, this, e, "EMAIL_AUTHENTICATOR_HTML_BODY"), w("emailAuthenticatorSubject", g.String, this, e, "EMAIL_AUTHENTICATOR_SUBJECT"), w("emailFrom", g.String, this, e, "EMAIL_FROM", !0), w("smtpHost", g.String, this, e, "SMTP_HOST", !0), w("smtpPort", g.Number, this, e, "SMTP_PORT"), w("smtpUsername", g.String, this, e, "SMTP_USERNAME"), w("smtpPassword", g.String, this, e, "SMTP_PASSWORD"), w("smtpUseTls", g.Boolean, this, e, "SMTP_USE_TLS"), w("emailAuthenticatorTokenExpires", g.Number, this, e, "EMAIL_AUTHENTICATOR_TOKEN_EXPIRES"), e.render ? this.render = e.render : Z.configure(this.views, { autoescape: !0 });
   }
   /**
    * Used by the OAuth password_mfa grant type.
@@ -3264,7 +3264,7 @@ class X extends ae {
   }
   createEmailer() {
     let e = {};
-    return this.smtpUsername && (e.user = this.smtpUsername), this.smtpPassword && (e.pass = this.smtpPassword), Ae.createTransport({
+    return this.smtpUsername && (e.user = this.smtpUsername), this.smtpPassword && (e.pass = this.smtpPassword), xe.createTransport({
       host: this.smtpHost,
       port: this.smtpPort,
       secure: this.smtpUseTls,
@@ -3272,13 +3272,13 @@ class X extends ae {
     });
   }
   async sendToken(e, t) {
-    X.validateEmail(e), this.smtpUsername && this.smtpUsername, this.smtpPassword && this.smtpPassword;
+    ne.validateEmail(e), this.smtpUsername && this.smtpUsername, this.smtpPassword && this.smtpPassword;
     let r = {
       from: this.emailFrom,
       to: e,
       subject: this.emailAuthenticatorSubject
     }, i = { otp: t };
-    return this.emailAuthenticatorTextBody && (r.text = this.render ? this.render(this.emailAuthenticatorTextBody, i) : W.render(this.emailAuthenticatorTextBody, i)), this.emailAuthenticatorHtmlBody && (r.html = this.render ? this.render(this.emailAuthenticatorHtmlBody, i) : W.render(this.emailAuthenticatorHtmlBody, i)), (await this.createEmailer().sendMail(r)).messageId;
+    return this.emailAuthenticatorTextBody && (r.text = this.render ? this.render(this.emailAuthenticatorTextBody, i) : Z.render(this.emailAuthenticatorTextBody, i)), this.emailAuthenticatorHtmlBody && (r.html = this.render ? this.render(this.emailAuthenticatorHtmlBody, i) : Z.render(this.emailAuthenticatorHtmlBody, i)), (await this.createEmailer().sendMail(r)).messageId;
   }
   /**
    * Creates and emails the one-time code
@@ -3294,8 +3294,8 @@ class X extends ae {
       l.Configuration,
       "Please set factorName on EmailAuthenticator before using"
     );
-    const t = X.zeroPad(re(999999), 6), r = e.email ? e.email : e.username;
-    X.validateEmail(r);
+    const t = ne.zeroPad(ce(999999), 6), r = e.email ? e.email : e.username;
+    ne.validateEmail(r);
     const i = /* @__PURE__ */ new Date(), s = new Date(i.getTime() + 1e3 * this.emailAuthenticatorTokenExpires).getTime(), n = {
       username: e.username,
       email: r,
@@ -3320,7 +3320,7 @@ class X extends ae {
    * @returns
    */
   async reprepareConfiguration(e, t) {
-    const r = z.decodeData(t.data)["2fa"], i = X.zeroPad(re(999999), 6), s = /* @__PURE__ */ new Date(), n = new Date(s.getTime() + 1e3 * this.emailAuthenticatorTokenExpires).getTime(), c = this.sendToken(r.email, i);
+    const r = V.decodeData(t.data)["2fa"], i = ne.zeroPad(ce(999999), 6), s = /* @__PURE__ */ new Date(), n = new Date(s.getTime() + 1e3 * this.emailAuthenticatorTokenExpires).getTime(), c = this.sendToken(r.email, i);
     return h.logger.info(m({
       msg: "Sent factor otp email",
       emailMessageId: c,
@@ -3365,7 +3365,7 @@ class X extends ae {
    * @returns `otp` and `expiry` as a Unix time (number).
    */
   async createOneTimeSecrets(e) {
-    const t = X.zeroPad(re(999999), 6), r = /* @__PURE__ */ new Date(), i = new Date(r.getTime() + 1e3 * this.emailAuthenticatorTokenExpires).getTime(), s = e.email || e.username, n = this.sendToken(s, t);
+    const t = ne.zeroPad(ce(999999), 6), r = /* @__PURE__ */ new Date(), i = new Date(r.getTime() + 1e3 * this.emailAuthenticatorTokenExpires).getTime(), s = e.email || e.username, n = this.sendToken(s, t);
     return h.logger.info(m({
       msg: "Sent factor otp email",
       emailMessageId: n,
@@ -3431,7 +3431,7 @@ class X extends ae {
    * @throws {@link @crossauth/common!CrossauthError} with {@link @crossauth/common!ErrorCode} `InvalidEmail`.
    */
   static validateEmail(e) {
-    if (e == null || !X.isEmailValid(e))
+    if (e == null || !ne.isEmailValid(e))
       throw new o(l.InvalidEmail);
   }
   /**
@@ -3445,7 +3445,7 @@ class X extends ae {
     return Array(+(r > 0 && r)).join("0") + e;
   }
 }
-class ee extends ae {
+class le extends de {
   /**
    * Constructor
    * @param options see {@link SmsAuthenticatorOptions}
@@ -3457,7 +3457,7 @@ class ee extends ae {
     u(this, "smsAuthenticatorFrom", "");
     u(this, "smsAuthenticatorTokenExpires", 60 * 5);
     u(this, "render");
-    w("views", g.String, this, e, "VIEWS"), w("smsAuthenticatorBody", g.String, this, e, "SMS_AUTHENTICATOR_BODY"), w("smsAuthenticatorFrom", g.String, this, e, "SMS_AUTHENTICATOR_FROM", !0), w("smsAuthenticatorTokenExpires", g.Number, this, e, "SMS_AUTHENTICATOR_TOKEN_EXPIRES"), e.render ? this.render = e.render : W.configure(this.views, { autoescape: !0 });
+    w("views", g.String, this, e, "VIEWS"), w("smsAuthenticatorBody", g.String, this, e, "SMS_AUTHENTICATOR_BODY"), w("smsAuthenticatorFrom", g.String, this, e, "SMS_AUTHENTICATOR_FROM", !0), w("smsAuthenticatorTokenExpires", g.Number, this, e, "SMS_AUTHENTICATOR_TOKEN_EXPIRES"), e.render ? this.render = e.render : Z.configure(this.views, { autoescape: !0 });
   }
   /**
    * Used by the OAuth password_mfa grant type.
@@ -3484,8 +3484,8 @@ class ee extends ae {
       l.Configuration,
       "Please set factorName on SmsAuthenticator before using"
     );
-    const t = ee.zeroPad(re(999999), 6), r = e.phone;
-    ee.validatePhone(r);
+    const t = le.zeroPad(ce(999999), 6), r = e.phone;
+    le.validatePhone(r);
     const i = /* @__PURE__ */ new Date(), s = new Date(i.getTime() + 1e3 * this.smsAuthenticatorTokenExpires).getTime(), n = {
       username: e.username,
       phone: r,
@@ -3498,7 +3498,7 @@ class ee extends ae {
       otp: t
     };
     let d = { otp: t };
-    const f = this.render ? this.render(this.smsAuthenticatorBody, d) : W.render(this.smsAuthenticatorBody, d), y = this.sendSms(r, f);
+    const f = this.render ? this.render(this.smsAuthenticatorBody, d) : Z.render(this.smsAuthenticatorBody, d), y = this.sendSms(r, f);
     return h.logger.info(m({
       msg: "Sent factor otp sms",
       smsMessageId: y,
@@ -3512,7 +3512,7 @@ class ee extends ae {
    * @returns
    */
   async reprepareConfiguration(e, t) {
-    const r = z.decodeData(t.data)["2fa"], i = ee.zeroPad(re(999999), 6), s = /* @__PURE__ */ new Date(), n = new Date(s.getTime() + 1e3 * this.smsAuthenticatorTokenExpires).getTime(), c = this.sendSms(r.phone, i);
+    const r = V.decodeData(t.data)["2fa"], i = le.zeroPad(ce(999999), 6), s = /* @__PURE__ */ new Date(), n = new Date(s.getTime() + 1e3 * this.smsAuthenticatorTokenExpires).getTime(), c = this.sendSms(r.phone, i);
     return h.logger.info(m({
       msg: "Sent factor otp sms",
       smsMessageId: c,
@@ -3556,7 +3556,7 @@ class ee extends ae {
    * @returns `otp` and `expiry` as a Unix time (number).
    */
   async createOneTimeSecrets(e) {
-    const t = ee.zeroPad(re(999999), 6), r = /* @__PURE__ */ new Date(), i = new Date(r.getTime() + 1e3 * this.smsAuthenticatorTokenExpires).getTime(), s = e.phone, n = this.sendSms(s, t);
+    const t = le.zeroPad(ce(999999), 6), r = /* @__PURE__ */ new Date(), i = new Date(r.getTime() + 1e3 * this.smsAuthenticatorTokenExpires).getTime(), s = e.phone, n = this.sendSms(s, t);
     return h.logger.info(m({
       msg: "Sent factor otp sms",
       smsMessageId: n,
@@ -3624,7 +3624,7 @@ class ee extends ae {
    * {@link @crossauth/common!ErrorCode} `InvalidPhoneNumber`.
    */
   static validatePhone(e) {
-    if (e == null || !ee.isPhoneValid(e))
+    if (e == null || !le.isPhoneValid(e))
       throw new o(l.InvalidPhoneNumber);
   }
   /**
@@ -3638,7 +3638,7 @@ class ee extends ae {
     return Array(+(r > 0 && r)).join("0") + e;
   }
 }
-class Pe extends ee {
+class Be extends le {
   /**
    * Constructor
    *
@@ -3667,16 +3667,16 @@ class Pe extends ee {
    * @returns the send message ID
    */
   async sendSms(e, t) {
-    Pe.validatePhone(e);
+    Be.validatePhone(e);
     let r = {
       from: this.smsAuthenticatorFrom,
       to: e,
       body: t
     };
-    return (await Ve(this.accountSid, this.authToken).messages.create(r)).sid;
+    return (await Ze(this.accountSid, this.authToken).messages.create(r)).sid;
   }
 }
-class Mt extends ae {
+class Zt extends de {
   /**
    * Constructor
    *
@@ -3731,7 +3731,7 @@ class Mt extends ae {
    * @returns
    */
   async reprepareConfiguration(e, t) {
-    const r = z.decodeData(t.data)["2fa"], i = this.code, s = /* @__PURE__ */ new Date(), n = new Date(s.getTime() + 1e3 * 60).getTime();
+    const r = V.decodeData(t.data)["2fa"], i = this.code, s = /* @__PURE__ */ new Date(), n = new Date(s.getTime() + 1e3 * 60).getTime();
     return {
       userData: { factor2: r.factor2, otp: i },
       secrets: {},
@@ -3837,7 +3837,7 @@ class Mt extends ae {
     return Array(+(r > 0 && r)).join("0") + e;
   }
 }
-class $t extends Ie {
+class Xt extends Re {
   /**
    * Create a new authenticator.
    *
@@ -3873,9 +3873,9 @@ class $t extends Ie {
         }
       else
         i = (await this.ldapStorage.getUserByUsername(e.username)).user;
-      if (i.state == k.awaitingTwoFactorSetup) throw new o(l.TwoFactorIncomplete);
-      if (i.state == k.awaitingEmailVerification) throw new o(l.EmailNotVerified);
-      if (i.state == k.disabled) throw new o(l.UserNotActive);
+      if (i.state == E.awaitingTwoFactorSetup) throw new o(l.TwoFactorIncomplete);
+      if (i.state == E.awaitingEmailVerification) throw new o(l.EmailNotVerified);
+      if (i.state == E.disabled) throw new o(l.UserNotActive);
     } catch (s) {
       throw h.logger.debug(m({ err: s })), s;
     }
@@ -3938,7 +3938,7 @@ class $t extends Ie {
   async reprepareConfiguration(e, t) {
   }
 }
-class qt extends ae {
+class Qt extends de {
   /**
    * Constructor
    * @param appName this forms part of the QR code that users scan into
@@ -3963,9 +3963,9 @@ class qt extends ae {
     return "none";
   }
   async createSecret(e, t) {
-    t || (t = ge.generateSecret());
+    t || (t = _e.generateSecret());
     let r = "";
-    return await Me.toDataURL(ge.keyuri(e, this.appName, t)).then((i) => {
+    return await Xe.toDataURL(_e.keyuri(e, this.appName, t)).then((i) => {
       r = i;
     }).catch((i) => {
       throw h.logger.debug(m({ err: i })), new o(
@@ -3975,7 +3975,7 @@ class qt extends ae {
     }), { qrUrl: r, secret: t };
   }
   async getSecretFromSession(e, t) {
-    let r = z.decodeData(t.data);
+    let r = V.decodeData(t.data);
     if (r && r["2fa"] && (r = r["2fa"]), !("totpsecret" in r))
       throw new o(
         l.Unauthorized,
@@ -4048,7 +4048,7 @@ class qt extends ae {
         "TOTP secret or code not given"
       );
     const i = r.otp, s = t.totpsecret;
-    if (!ge.check(i, s))
+    if (!_e.check(i, s))
       throw new o(
         l.InvalidToken,
         "Invalid TOTP code"
@@ -4118,8 +4118,112 @@ class qt extends ae {
     return !1;
   }
 }
-const oe = 16;
-class D {
+class er extends de {
+  /** @returns empty array */
+  secretNames() {
+    return [];
+  }
+  /** @returns an empty array */
+  transientSecretNames() {
+    return [];
+  }
+  /** @returns `none` */
+  mfaType() {
+    return "none";
+  }
+  /** @returns `none` */
+  mfaChannel() {
+    return "none";
+  }
+  /**
+   * Create a new authenticator.
+   *
+   * See crypto.pbkdf2 for more information on the optional parameters.
+   *
+   * @param _userStorage ignored
+   * @param options see {@link LocalPasswordAuthenticatorOptions}
+   */
+  constructor(a, e = {}) {
+    super({ friendlyName: "OIDC", ...e });
+  }
+  /**
+   * Authenticates the user, returning a the user as a {@link User} object.
+   *
+   * If you set `extraFields` when constructing the {@link UserStorage} instance passed to the constructor,
+   * these will be included in the returned User object.  `hashedPassword`, if present in the User object,
+   * will be removed.
+   *
+   * @param user the `username` field should contain the username
+   * @param secrets from the `UserSecrets` table.  `password` is expected to be present
+   * @param params the user input.  `password` is expected to be present
+   * @throws {@link @crossauth/common!CrossauthError} with
+   *         {@link @crossauth/common!ErrorCode} of `Connection`,
+   *         `UserNotExist`or `PasswordInvalid`, `TwoFactorIncomplete`,
+   *         `EmailNotVerified` or `UserNotActive`.
+   */
+  async authenticateUser(a, e, t) {
+    throw new o(l.PasswordInvalid, "Please use OpenID Connect to log in");
+  }
+  /**
+   * This will return p hash of the passed password.
+   * @param _username ignored
+   * @param params expected to contain `password`
+   * @param repeatParams if defined, this is expected to also contain
+   *        `password` and is checked to match the one in `params`
+   * @returns the newly created password in the `password` field.
+   */
+  async createPersistentSecrets(a, e, t) {
+    return {};
+  }
+  /**
+   * Does nothing for this class.
+   */
+  async createOneTimeSecrets(a) {
+    return {};
+  }
+  /**
+   * @returns true - this class can create users
+   */
+  canCreateUser() {
+    return !0;
+  }
+  /**
+   * @returns true - this class can update users
+   */
+  canUpdateUser() {
+    return !0;
+  }
+  /**
+   * @returns true - users can update secrets
+   */
+  canUpdateSecrets() {
+    return !0;
+  }
+  /**
+   * @returns false, if email verification is enabled, it should be for this authenticator too
+   */
+  skipEmailVerificationOnSignup() {
+    return !1;
+  }
+  /**
+   * Does nothing for this class.
+   */
+  async prepareConfiguration(a) {
+  }
+  /**
+   * Does nothing for this class.
+   */
+  async reprepareConfiguration(a, e) {
+  }
+  /**
+   * Does nothing for this class
+   */
+  validateSecrets(a) {
+    return [];
+  }
+}
+const fe = 16;
+class L {
   /**
    * Construct a new EmailVerifier.
    *
@@ -4150,11 +4254,11 @@ class D {
     u(this, "verifyEmailExpires", 60 * 60 * 24);
     u(this, "passwordResetExpires", 60 * 60 * 24);
     u(this, "render");
-    this.userStorage = a, this.keyStorage = e, w("siteUrl", g.String, this, t, "SITE_URL", !0), w("prefix", g.String, this, t, "PREFIX"), w("views", g.String, this, t, "VIEWS"), w("emailVerificationTextBody", g.String, this, t, "EMAIL_VERIFICATION_TEXT_BODY"), w("emailVerificationHtmlBody", g.String, this, t, "EMAIL_VERIFICATION_HTML_BODY"), w("emailVerificationSubject", g.String, this, t, "EMAIL_VERIFICATION_SUBJECT"), w("passwordResetTextBody", g.String, this, t, "PASSWORD_RESET_TEXT_BODY"), w("passwordResetHtmlBody", g.String, this, t, "PASSWORD_RESET_HTML_BODY"), w("passwordResetSubject", g.String, this, t, "PASSWORD_RESET_SUBJECT"), w("emailFrom", g.String, this, t, "EMAIL_FROM", !0), w("smtpHost", g.String, this, t, "SMTP_HOST", !0), w("smtpPort", g.Number, this, t, "SMTP_PORT"), w("smtpUsername", g.String, this, t, "SMTP_USERNAME"), w("smtpPassword", g.String, this, t, "SMTP_PASSWORD"), w("smtpUseTls", g.Boolean, this, t, "SMTP_USE_TLS"), w("verifyEmailExpires", g.Boolean, this, t, "VERIFY_EMAIL_EXPIRES"), w("passwordResetExpires", g.String, this, t, "PASSWORD_RESET_EXPIRES"), t.render ? this.render = t.render : W.configure(this.views, { autoescape: !0 });
+    this.userStorage = a, this.keyStorage = e, w("siteUrl", g.String, this, t, "SITE_URL", !0), w("prefix", g.String, this, t, "PREFIX"), w("views", g.String, this, t, "VIEWS"), w("emailVerificationTextBody", g.String, this, t, "EMAIL_VERIFICATION_TEXT_BODY"), w("emailVerificationHtmlBody", g.String, this, t, "EMAIL_VERIFICATION_HTML_BODY"), w("emailVerificationSubject", g.String, this, t, "EMAIL_VERIFICATION_SUBJECT"), w("passwordResetTextBody", g.String, this, t, "PASSWORD_RESET_TEXT_BODY"), w("passwordResetHtmlBody", g.String, this, t, "PASSWORD_RESET_HTML_BODY"), w("passwordResetSubject", g.String, this, t, "PASSWORD_RESET_SUBJECT"), w("emailFrom", g.String, this, t, "EMAIL_FROM", !0), w("smtpHost", g.String, this, t, "SMTP_HOST", !0), w("smtpPort", g.Number, this, t, "SMTP_PORT"), w("smtpUsername", g.String, this, t, "SMTP_USERNAME"), w("smtpPassword", g.String, this, t, "SMTP_PASSWORD"), w("smtpUseTls", g.Boolean, this, t, "SMTP_USE_TLS"), w("verifyEmailExpires", g.Boolean, this, t, "VERIFY_EMAIL_EXPIRES"), w("passwordResetExpires", g.String, this, t, "PASSWORD_RESET_EXPIRES"), t.render ? this.render = t.render : Z.configure(this.views, { autoescape: !0 });
   }
   createEmailer() {
     let a = {};
-    return this.smtpUsername && (a.user = this.smtpUsername), this.smtpPassword && (a.pass = this.smtpPassword), Ae.createTransport({
+    return this.smtpUsername && (a.user = this.smtpUsername), this.smtpPassword && (a.pass = this.smtpPassword), xe.createTransport({
       host: this.smtpHost,
       port: this.smtpPort,
       secure: this.smtpUseTls,
@@ -4166,24 +4270,24 @@ class D {
    * correct prefix for inserting into storage.
    */
   static hashEmailVerificationToken(a) {
-    return b.emailVerificationToken + _.hash(a);
+    return U.emailVerificationToken + k.hash(a);
   }
   /**
    * Produces a hash of the given password reset token with the
    * correct prefix for inserting into storage.
    */
   static hashPasswordResetToken(a) {
-    return b.passwordResetToken + _.hash(a);
+    return U.passwordResetToken + k.hash(a);
   }
   async createAndSaveEmailVerificationToken(a, e = "") {
     let r = 0;
     const i = /* @__PURE__ */ new Date(), s = new Date(i.getTime() + 1e3 * this.verifyEmailExpires);
     for (; r < 10; ) {
-      let n = _.randomValue(oe), c = D.hashEmailVerificationToken(n);
+      let n = k.randomValue(fe), c = L.hashEmailVerificationToken(n);
       try {
         return await this.keyStorage.saveKey(a, c, i, s, e), n;
       } catch {
-        n = _.randomValue(oe), c = D.hashEmailVerificationToken(n), r++;
+        n = k.randomValue(fe), c = L.hashEmailVerificationToken(n), r++;
       }
     }
     throw new o(l.Connection, "failed creating a unique key");
@@ -4198,7 +4302,7 @@ class D {
       to: e,
       subject: this.emailVerificationSubject
     }, i = { token: a, siteUrl: this.siteUrl, prefix: this.prefix };
-    return t && (i = { ...i, ...t }), this.emailVerificationTextBody && (r.text = this.render ? this.render(this.emailVerificationTextBody, i) : W.render(this.emailVerificationTextBody, i)), this.emailVerificationHtmlBody && (r.html = this.render ? this.render(this.emailVerificationHtmlBody, i) : W.render(this.emailVerificationHtmlBody, i)), (await this.createEmailer().sendMail(r)).messageId;
+    return t && (i = { ...i, ...t }), this.emailVerificationTextBody && (r.text = this.render ? this.render(this.emailVerificationTextBody, i) : Z.render(this.emailVerificationTextBody, i)), this.emailVerificationHtmlBody && (r.html = this.render ? this.render(this.emailVerificationHtmlBody, i) : Z.render(this.emailVerificationHtmlBody, i)), (await this.createEmailer().sendMail(r)).messageId;
   }
   /**
    * Send an email verification email using the Nunjucks templates.
@@ -4224,7 +4328,7 @@ class D {
         "Either emailVerificationTextBody or emailVerificationHtmlBody must be set to send email verification emails"
       );
     let { user: r } = await this.userStorage.getUserById(a, { skipEmailVerifiedCheck: !0 }), i = e;
-    i != "" ? D.validateEmail(i) : (i = r.email ?? r.username, i || (i = r.username), D.validateEmail(i)), D.validateEmail(i);
+    i != "" ? L.validateEmail(i) : (i = r.email ?? r.username, i || (i = r.username), L.validateEmail(i)), L.validateEmail(i);
     const s = await this.createAndSaveEmailVerificationToken(a, e), n = await this._sendEmailVerificationToken(s, i, t);
     h.logger.info(m({ msg: "Sent email verification email", emailMessageId: n, email: i }));
   }
@@ -4244,20 +4348,20 @@ class D {
    *          address the user is validating
    */
   async verifyEmailVerificationToken(a) {
-    const e = D.hashEmailVerificationToken(a);
+    const e = L.hashEmailVerificationToken(a);
     let t = await this.keyStorage.getKey(e);
     try {
       if (!t.userid || !t.expires) throw new o(l.InvalidKey);
       const { user: r } = await this.userStorage.getUserById(t.userid, { skipEmailVerifiedCheck: !0 });
       let i = (r.email ?? r.username).toLowerCase();
-      if (i || (i = r.username.toLowerCase()), D.validateEmail(i), (/* @__PURE__ */ new Date()).getTime() > t.expires.getTime()) throw new o(l.Expired);
+      if (i || (i = r.username.toLowerCase()), L.validateEmail(i), (/* @__PURE__ */ new Date()).getTime() > t.expires.getTime()) throw new o(l.Expired);
       return { userid: t.userid, newEmail: t.data ?? "" };
     } finally {
     }
   }
   async deleteEmailVerificationToken(a) {
     try {
-      const e = D.hashEmailVerificationToken(a);
+      const e = L.hashEmailVerificationToken(a);
       await this.keyStorage.deleteKey(e);
     } catch (e) {
       const t = o.asCrossauthError(e);
@@ -4268,11 +4372,11 @@ class D {
     let t = 0;
     const r = /* @__PURE__ */ new Date(), i = new Date(r.getTime() + 1e3 * this.passwordResetExpires);
     for (; t < 10; ) {
-      let s = _.randomValue(oe), n = D.hashPasswordResetToken(s);
+      let s = k.randomValue(fe), n = L.hashPasswordResetToken(s);
       try {
         return await this.keyStorage.saveKey(a, n, r, i), s;
       } catch {
-        s = _.randomValue(oe), n = D.hashPasswordResetToken(s), t++;
+        s = k.randomValue(fe), n = L.hashPasswordResetToken(s), t++;
       }
     }
     throw new o(l.Connection, "failed creating a unique key");
@@ -4292,7 +4396,7 @@ class D {
    * @returns the user that the token is for
    */
   async verifyPasswordResetToken(a) {
-    const e = D.hashPasswordResetToken(a);
+    const e = L.hashPasswordResetToken(a);
     h.logger.debug("verifyPasswordResetToken " + a + " " + e);
     let t = await this.keyStorage.getKey(e);
     if (!t.userid) throw new o(l.InvalidKey);
@@ -4301,7 +4405,7 @@ class D {
       t.userid,
       { skipActiveCheck: !0 }
     );
-    if (r.state != k.active && r.state != k.passwordResetNeeded && r.state != k.passwordAndFactor2ResetNeeded)
+    if (r.state != E.active && r.state != E.passwordResetNeeded && r.state != E.passwordAndFactor2ResetNeeded)
       throw new o(l.UserNotActive);
     if ((/* @__PURE__ */ new Date()).getTime() > t.expires.getTime()) throw new o(l.Expired);
     return r;
@@ -4321,7 +4425,7 @@ class D {
       to: e,
       subject: this.passwordResetSubject
     }, i = { token: a, siteUrl: this.siteUrl, prefix: this.prefix };
-    return t && (i = { ...i, ...t }), this.passwordResetTextBody && (r.text = this.render ? this.render(this.passwordResetTextBody, i) : W.render(this.passwordResetTextBody, i)), this.passwordResetHtmlBody && (r.html = this.render ? this.render(this.passwordResetHtmlBody, i) : W.render(this.passwordResetHtmlBody, i)), (await this.createEmailer().sendMail(r)).messageId;
+    return t && (i = { ...i, ...t }), this.passwordResetTextBody && (r.text = this.render ? this.render(this.passwordResetTextBody, i) : Z.render(this.passwordResetTextBody, i)), this.passwordResetHtmlBody && (r.html = this.render ? this.render(this.passwordResetHtmlBody, i) : Z.render(this.passwordResetHtmlBody, i)), (await this.createEmailer().sendMail(r)).messageId;
   }
   /**
    * Send a password reset token email using the Nunjucks templates
@@ -4338,10 +4442,10 @@ class D {
     let { user: r } = await this.userStorage.getUserById(a, {
       skipActiveCheck: !0
     });
-    if (!t && r.state != k.active && r.state != k.passwordResetNeeded && r.state != k.passwordAndFactor2ResetNeeded)
+    if (!t && r.state != E.active && r.state != E.passwordResetNeeded && r.state != E.passwordAndFactor2ResetNeeded)
       throw new o(l.UserNotActive);
     let i = (r.email ?? r.username).toLowerCase();
-    i || (i = r.username.toLowerCase()), D.validateEmail(i);
+    i || (i = r.username.toLowerCase()), L.validateEmail(i);
     const s = await this.createAndSavePasswordResetToken(a), n = await this._sendPasswordResetToken(s, i, e);
     h.logger.info(m({ msg: "Sent password reset email", emailMessageId: n, email: i }));
   }
@@ -4363,17 +4467,17 @@ class D {
    * @param email the email to validate
    */
   static validateEmail(a) {
-    if (a == null || !D.isEmailValid(a)) throw new o(l.InvalidEmail);
+    if (a == null || !L.isEmailValid(a)) throw new o(l.InvalidEmail);
   }
 }
-const be = 16, Ue = 16;
-function Wt(S) {
+const Fe = 16, Ne = 16;
+function tr(S) {
   return {
     ...S,
     path: S.path ?? "/"
   };
 }
-class ct {
+class yt {
   /**
    * Constructor.
    *
@@ -4404,7 +4508,7 @@ class ct {
    * @returns a random CSRF token.
    */
   createCsrfToken() {
-    return _.randomValue(be);
+    return k.randomValue(Fe);
   }
   /**
    * Returns a {@link Cookie } object with the given session key.
@@ -4413,7 +4517,7 @@ class ct {
    * @returns a {@link Cookie } object,
    */
   makeCsrfCookie(a) {
-    const e = _.signSecureToken(a, this.secret);
+    const e = k.signSecureToken(a, this.secret);
     let t = {};
     return this.domain && (t.domain = this.domain), this.path && (t.path = this.path), t.sameSite = this.sameSite, this.httpOnly && (t.httpOnly = this.httpOnly), this.secure && (t.secure = this.secure), {
       name: this.cookieName,
@@ -4425,7 +4529,7 @@ class ct {
     return this.maskCsrfToken(a);
   }
   unsignCookie(a) {
-    return _.unsignSecureToken(a, this.secret);
+    return k.unsignSecureToken(a, this.secret);
   }
   /**
    * Takes a session ID and creates a string representation of the cookie (value of the HTTP `Cookie` header).
@@ -4438,14 +4542,14 @@ class ct {
     return this.domain && (e += "; " + this.domain), this.path && (e += "; " + this.path), this.httpOnly && (e += "; httpOnly"), this.secure && (e += "; secure"), e;
   }
   maskCsrfToken(a) {
-    const e = _.randomValue(be), t = _.xor(a, e);
+    const e = k.randomValue(Fe), t = k.xor(a, e);
     return e + "." + t;
   }
   unmaskCsrfToken(a) {
     const e = a.split(".");
     if (e.length != 2) throw new o(l.InvalidCsrf, "CSRF token in header or form not in correct format");
     const t = e[0], r = e[1];
-    return _.xor(r, t);
+    return k.xor(r, t);
   }
   /**
    * Validates the passed CSRF token.
@@ -4462,12 +4566,12 @@ class ct {
     const t = this.unmaskCsrfToken(e);
     let r;
     try {
-      r = _.unsignSecureToken(a, this.secret);
+      r = k.unsignSecureToken(a, this.secret);
     } catch (i) {
       throw h.logger.error(m({ err: i })), new o(l.InvalidCsrf, "Invalid CSRF cookie");
     }
     if (r != t)
-      throw h.logger.warn(m({ msg: "Invalid CSRF token received - form/header value does not match", csrfCookieHash: _.hash(a) })), new o(l.InvalidCsrf);
+      throw h.logger.warn(m({ msg: "Invalid CSRF token received - form/header value does not match", csrfCookieHash: k.hash(a) })), new o(l.InvalidCsrf);
   }
   /**
    * Validates the passed CSRF cookie (doesn't check it matches the token, just that the cookie is valid).
@@ -4481,13 +4585,13 @@ class ct {
    */
   validateCsrfCookie(a) {
     try {
-      return _.unsignSecureToken(a, this.secret);
+      return k.unsignSecureToken(a, this.secret);
     } catch (e) {
       throw h.logger.error(m({ err: e })), new o(l.InvalidCsrf, "Invalid CSRF cookie");
     }
   }
 }
-class x {
+class j {
   /**
    * Constructor.
    *
@@ -4530,7 +4634,7 @@ class x {
    * @returns a base64-url-encoded string that can go into the storage
    */
   static hashSessionId(a) {
-    return b.session + _.hash(a);
+    return U.session + k.hash(a);
   }
   /**
    * Creates a session key and saves in storage
@@ -4549,17 +4653,17 @@ class x {
    *          attempts exceeded trying to create a unique session id
    */
   async createSessionKey(a, e = {}) {
-    let r = 0, i = _.randomValue(Ue);
+    let r = 0, i = k.randomValue(Ne);
     const s = /* @__PURE__ */ new Date();
     let n = this.expiry(s), c = !1;
     for (; r < 10 && !c; ) {
-      const d = x.hashSessionId(i);
+      const d = j.hashSessionId(i);
       try {
         this.idleTimeout > 0 && a && (e = { ...e, lastActivity: /* @__PURE__ */ new Date() }), await this.keyStorage.saveKey(a, d, s, n, void 0, e), c = !0;
       } catch (f) {
         let y = o.asCrossauthError(f);
         if (y.code == l.KeyExists || y.code == l.InvalidKey) {
-          if (r++, i = _.randomValue(Ue), r > 10)
+          if (r++, i = k.randomValue(Ne), r > 10)
             throw h.logger.error(m({ msg: "Max attempts exceeded trying to create session ID" })), new o(l.KeyExists);
         } else
           throw h.logger.debug(m({ err: f })), f;
@@ -4582,7 +4686,7 @@ class x {
    * @returns a {@link Cookie } object,
    */
   makeCookie(a, e) {
-    let t = _.signSecureToken(a.value, this.secret), r = {};
+    let t = k.signSecureToken(a.value, this.secret), r = {};
     return e == null && (e = this.persist), this.domain && (r.domain = this.domain), a.expires && e && (r.expires = a.expires), this.path && (r.path = this.path), r.sameSite = this.sameSite, this.httpOnly && (r.httpOnly = this.httpOnly), this.secure && (r.secure = this.secure), {
       name: this.cookieName,
       value: t,
@@ -4609,7 +4713,7 @@ class x {
    */
   async updateSessionKey(a) {
     if (!a.value) throw new o(l.InvalidKey, "No session when updating activity");
-    a.value = x.hashSessionId(a.value), await this.keyStorage.updateKey(a);
+    a.value = j.hashSessionId(a.value), await this.keyStorage.updateKey(a);
   }
   /**
    * Unsigns a cookie and returns the original value.
@@ -4619,7 +4723,7 @@ class x {
    *         is invalid.
    */
   unsignCookie(a) {
-    return _.unsignSecureToken(a, this.secret);
+    return k.unsignSecureToken(a, this.secret);
   }
   /**
    * Returns the user matching the given session key in session storage, or throws an exception.
@@ -4657,13 +4761,13 @@ class x {
    *         `Expired` or `UserNotExist`.
    */
   async getSessionKey(a) {
-    const e = Date.now(), t = x.hashSessionId(a), r = await this.keyStorage.getKey(t);
+    const e = Date.now(), t = j.hashSessionId(a), r = await this.keyStorage.getKey(t);
     if (r.value = a, r.expires && e > r.expires.getTime())
-      throw h.logger.warn(m({ msg: "Session id in cookie expired in key storage", hashedSessionCookie: _.hash(a) })), new o(l.Expired);
+      throw h.logger.warn(m({ msg: "Session id in cookie expired in key storage", hashedSessionCookie: k.hash(a) })), new o(l.Expired);
     if (r.userid && this.idleTimeout > 0 && r.lastactive && e > r.lastactive.getTime() + this.idleTimeout * 1e3)
-      throw h.logger.warn(m({ msg: "Session cookie with expired idle time received", hashedSessionCookie: _.hash(a) })), new o(l.Expired);
+      throw h.logger.warn(m({ msg: "Session cookie with expired idle time received", hashedSessionCookie: k.hash(a) })), new o(l.Expired);
     if (this.filterFunction && !this.filterFunction(r))
-      throw h.logger.warn(m({ msg: "Filter function on session id in cookie failed", hashedSessionCookie: _.hash(a) })), new o(l.InvalidKey);
+      throw h.logger.warn(m({ msg: "Filter function on session id in cookie failed", hashedSessionCookie: k.hash(a) })), new o(l.InvalidKey);
     return r;
   }
   /**
@@ -4672,10 +4776,10 @@ class x {
    * @param except if defined, don't delete this key
    */
   async deleteAllForUser(a, e) {
-    e && (e = x.hashSessionId(e)), await this.keyStorage.deleteAllForUser(a, b.session, e);
+    e && (e = j.hashSessionId(e)), await this.keyStorage.deleteAllForUser(a, U.session, e);
   }
 }
-class Jt {
+class rr {
   /**
    * Constructor
    * @param keyStorage  the {@link KeyStorage} instance to use, eg {@link PrismaKeyStorage}.
@@ -4697,9 +4801,9 @@ class Jt {
     t.userStorage && (this.userStorage = t.userStorage), this.keyStorage = a, this.authenticators = e;
     for (let r in this.authenticators)
       this.authenticators[r].factorName = r;
-    if (this.session = new x(this.keyStorage, { ...t == null ? void 0 : t.sessionCookieOptions, ...t ?? {} }), this.csrfTokens = new ct({ ...t == null ? void 0 : t.doubleSubmitCookieOptions, ...t ?? {} }), w("allowedFactor2", g.JsonArray, this, t, "ALLOWED_FACTOR2"), w("enableEmailVerification", g.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), w("enablePasswordReset", g.Boolean, this, t, "ENABLE_PASSWORD_RESET"), this.emailTokenStorage = this.keyStorage, this.userStorage && (this.enableEmailVerification || this.enablePasswordReset)) {
+    if (this.session = new j(this.keyStorage, { ...t == null ? void 0 : t.sessionCookieOptions, ...t ?? {} }), this.csrfTokens = new yt({ ...t == null ? void 0 : t.doubleSubmitCookieOptions, ...t ?? {} }), w("allowedFactor2", g.JsonArray, this, t, "ALLOWED_FACTOR2"), w("enableEmailVerification", g.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), w("enablePasswordReset", g.Boolean, this, t, "ENABLE_PASSWORD_RESET"), this.emailTokenStorage = this.keyStorage, this.userStorage && (this.enableEmailVerification || this.enablePasswordReset)) {
       let r = this.keyStorage;
-      t.emailTokenStorage && (this.emailTokenStorage = t.emailTokenStorage), this.tokenEmailer = new D(this.userStorage, r, t);
+      t.emailTokenStorage && (this.emailTokenStorage = t.emailTokenStorage), this.tokenEmailer = new L(this.userStorage, r, t);
     }
   }
   /**
@@ -4759,40 +4863,40 @@ class Jt {
     if (i)
       n = (await this.userStorage.getUserByUsername(i.username, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 })).secrets;
     else {
-      let v = { username: "", state: "active" };
+      let _ = { username: "", state: "active" };
       try {
         let T = await this.userStorage.getUserByUsername(a, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
-        n = T.secrets, i = T.user, v = T.user;
+        n = T.secrets, i = T.user, _ = T.user;
       } catch (T) {
         if (o.asCrossauthError(T).code == l.Connection) throw T;
-        for (let A in this.authenticators)
-          this.authenticators[A].requireUserEntry() || (v = { username: e.username, state: "active" }, c = A);
+        for (let b in this.authenticators)
+          this.authenticators[b].requireUserEntry() || (_ = { username: e.username, state: "active" }, c = b);
       }
-      if (v.username == "") throw new o(l.UserNotExist);
-      await this.authenticators[(i == null ? void 0 : i.factor1) ?? c].authenticateUser(v, n, e);
+      if (_.username == "") throw new o(l.UserNotExist);
+      await this.authenticators[(i == null ? void 0 : i.factor1) ?? c].authenticateUser(_, n, e);
       let p = await this.userStorage.getUserByUsername(a, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
       n = p.secrets, i = p.user;
     }
     let d;
-    if (i.state == k.passwordChangeNeeded)
+    if (i.state == E.passwordChangeNeeded)
       d = (await this.createAnonymousSession({ data: JSON.stringify({ passwordchange: { username: i.username } }) })).sessionCookie;
-    else if (i.state == k.factor2ResetNeeded)
+    else if (i.state == E.factor2ResetNeeded)
       d = (await this.createAnonymousSession({ data: JSON.stringify({ factor2change: { username: i.username } }) })).sessionCookie;
     else if (!s && i.factor2 && i.factor2 != "") {
-      const { sessionCookie: v } = await this.initiateTwoFactorLogin(i);
-      d = v;
+      const { sessionCookie: _ } = await this.initiateTwoFactorLogin(i);
+      d = _;
     } else {
-      const v = await this.session.createSessionKey(i.id, t);
-      d = this.session.makeCookie(v, r);
+      const _ = await this.session.createSessionKey(i.id, t);
+      d = this.session.makeCookie(_, r);
     }
     const f = this.csrfTokens.createCsrfToken(), y = this.csrfTokens.makeCsrfCookie(f), C = this.csrfTokens.makeCsrfFormOrHeaderToken(f);
     try {
       this.emailTokenStorage.deleteAllForUser(
         i.id,
-        b.passwordResetToken
+        U.passwordResetToken
       );
-    } catch (v) {
-      h.logger.warn(m({ msg: "Couldn't delete password reset tokens while logging in", user: a })), h.logger.debug(m({ err: v }));
+    } catch (_) {
+      h.logger.warn(m({ msg: "Couldn't delete password reset tokens while logging in", user: a })), h.logger.debug(m({ err: _ }));
     }
     return {
       sessionCookie: d,
@@ -4829,7 +4933,7 @@ class Jt {
    */
   async logout(a) {
     const e = await this.session.getSessionKey(a);
-    return await this.keyStorage.deleteKey(x.hashSessionId(e.value));
+    return await this.keyStorage.deleteKey(j.hashSessionId(e.value));
   }
   /**
    * Logs a user out from all sessions.
@@ -4977,8 +5081,8 @@ class Jt {
    * @param value new value to store
    */
   async updateSessionData(a, e, t) {
-    const r = x.hashSessionId(a);
-    h.logger.debug(m({ msg: `Updating session data value ${e}`, hashedSessionCookie: _.hash(a) })), await this.keyStorage.updateData(r, e, t);
+    const r = j.hashSessionId(a);
+    h.logger.debug(m({ msg: `Updating session data value ${e}`, hashedSessionCookie: k.hash(a) })), await this.keyStorage.updateData(r, e, t);
   }
   /**
    * Update field sin the session data.
@@ -4989,8 +5093,8 @@ class Jt {
    * @param dataArray names and values.
    */
   async updateManySessionData(a, e) {
-    const t = x.hashSessionId(a);
-    h.logger.debug(m({ msg: "Updating session data", hashedSessionCookie: _.hash(a) })), await this.keyStorage.updateManyData(t, e);
+    const t = j.hashSessionId(a);
+    h.logger.debug(m({ msg: "Updating session data", hashedSessionCookie: k.hash(a) })), await this.keyStorage.updateManyData(t, e);
   }
   /**
   * Deletes a field from the session data.
@@ -5001,8 +5105,8 @@ class Jt {
   * @param name of the field.
   */
   async deleteSessionData(a, e) {
-    const t = x.hashSessionId(a);
-    h.logger.debug(m({ msg: `Updating session data value ${e}`, hashedSessionCookie: _.hash(a) })), await this.keyStorage.deleteData(t, e);
+    const t = j.hashSessionId(a);
+    h.logger.debug(m({ msg: `Updating session data value ${e}`, hashedSessionCookie: k.hash(a) })), await this.keyStorage.deleteData(t, e);
   }
   /**
    * Deletes the given session ID from the key storage (not the cookie)
@@ -5010,7 +5114,7 @@ class Jt {
    * @param sessionId the session Id to delete
    */
   async deleteSession(a) {
-    return await this.keyStorage.deleteKey(x.hashSessionId(a));
+    return await this.keyStorage.deleteKey(j.hashSessionId(a));
   }
   /**
    * Creates a new user, sending an email verification message if necessary.
@@ -5064,8 +5168,8 @@ class Jt {
     if (!this.authenticators[a.factor1]) throw new o(l.Configuration, "Authenticator cannot create users");
     if (!this.authenticators[a.factor2]) throw new o(l.Configuration, "Two factor authentication not enabled for user");
     const i = this.authenticators[a.factor2], s = await i.prepareConfiguration(a), n = s == null ? {} : s.userData, c = s == null ? {} : s.sessionData, d = await this.authenticators[a.factor1].createPersistentSecrets(a.username, e, r);
-    return this.enableEmailVerification && !i.skipEmailVerificationOnSignup() ? a.state = k.awaitingTwoFactorSetupAndEmailVerification : a.state = k.awaitingTwoFactorSetup, await this.keyStorage.updateData(
-      x.hashSessionId(t),
+    return this.enableEmailVerification && !i.skipEmailVerificationOnSignup() ? a.state = E.awaitingTwoFactorSetupAndEmailVerification : a.state = E.awaitingTwoFactorSetup, await this.keyStorage.updateData(
+      j.hashSessionId(t),
       "2fa",
       c
     ), { userid: (await this.userStorage.createUser(a, d)).id, userData: n };
@@ -5085,13 +5189,13 @@ class Jt {
       if (!this.authenticators[e]) throw new o(l.Configuration, "Two factor authentication not enabled for user");
       const i = await this.authenticators[e].prepareConfiguration(a), s = i == null ? {} : i.userData, n = i == null ? {} : i.sessionData;
       return n && (n.userData = s), await this.keyStorage.updateData(
-        x.hashSessionId(t),
+        j.hashSessionId(t),
         "2fa",
         n
       ), s;
     }
     return await this.userStorage.updateUser({ id: a.id, factor2: e ?? "" }), await this.keyStorage.updateData(
-      x.hashSessionId(t),
+      j.hashSessionId(t),
       "2fa",
       void 0
     ), {};
@@ -5111,7 +5215,7 @@ class Jt {
    */
   async repeatTwoFactorSignup(a) {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call repeatTwoFactorSignup if no user storage provided");
-    const e = (await this.dataForSessionId(a))["2fa"], t = e.username, r = e.factor2, i = x.hashSessionId(a), s = await this.keyStorage.getKey(i), c = await this.authenticators[r].reprepareConfiguration(t, s), d = c == null ? {} : c.userData, f = c == null ? {} : c.secrets, y = c == null ? {} : c.newSessionData;
+    const e = (await this.dataForSessionId(a))["2fa"], t = e.username, r = e.factor2, i = j.hashSessionId(a), s = await this.keyStorage.getKey(i), c = await this.authenticators[r].reprepareConfiguration(t, s), d = c == null ? {} : c.userData, f = c == null ? {} : c.secrets, y = c == null ? {} : c.newSessionData;
     y && await this.keyStorage.updateData(i, "2fa", y);
     const { user: C } = await this.userStorage.getUserByUsername(t, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 });
     return { userid: C.id, userData: d, secrets: f };
@@ -5132,26 +5236,26 @@ class Jt {
     let { user: t, key: r } = await this.session.getUserForSessionId(e, {
       skipActiveCheck: !0
     });
-    if (t && t.state != k.active && t.state != k.factor2ResetNeeded)
+    if (t && t.state != E.active && t.state != E.factor2ResetNeeded)
       throw new o(l.UserNotActive);
     if (!r) throw new o(l.InvalidKey, "Session key not found");
-    let i = z.decodeData(r.data)["2fa"];
+    let i = V.decodeData(r.data)["2fa"];
     if (!(i != null && i.factor2) || !(i != null && i.username)) throw new o(l.Unauthorized, "Two factor authentication not initiated");
     let s = i.username;
     const n = this.authenticators[i.factor2];
     if (!n) throw new o(l.Configuration, "Unrecognised second factor authentication");
     const c = {}, d = n.secretNames();
-    for (let v in i)
-      d.includes(v) && (c[v] = i[v]);
+    for (let _ in i)
+      d.includes(_) && (c[_] = i[_]);
     if (await n.authenticateUser(void 0, i, a), t || (t = (await this.userStorage.getUserByUsername(s, { skipActiveCheck: !0, skipEmailVerifiedCheck: !0 })).user), !t) throw new o(l.UserNotExist, "Couldn't fetch user");
-    let f = k.active;
-    t.state == k.awaitingTwoFactorSetupAndEmailVerification && (f = k.awaitingEmailVerification);
+    let f = E.active;
+    t.state == E.awaitingTwoFactorSetupAndEmailVerification && (f = E.awaitingEmailVerification);
     const y = {
       id: t.id,
       state: f,
       factor2: i.factor2
     };
-    return n.secretNames().length > 0 ? await this.userStorage.updateUser(y, c) : await this.userStorage.updateUser(y), f == k.awaitingEmailVerification && this.tokenEmailer && await ((C = this.tokenEmailer) == null ? void 0 : C.sendEmailVerificationToken(t.id, void 0)), await this.keyStorage.updateData(x.hashSessionId(r.value), "2fa", void 0), { ...t, ...y };
+    return n.secretNames().length > 0 ? await this.userStorage.updateUser(y, c) : await this.userStorage.updateUser(y), f == E.awaitingEmailVerification && this.tokenEmailer && await ((C = this.tokenEmailer) == null ? void 0 : C.sendEmailVerificationToken(t.id, void 0)), await this.keyStorage.updateData(j.hashSessionId(r.value), "2fa", void 0), { ...t, ...y };
   }
   /**
    * Initiates the two factor login process.
@@ -5182,7 +5286,7 @@ class Jt {
   async initiateTwoFactorPageVisit(a, e, t, r, i) {
     const n = await this.authenticators[a.factor2].createOneTimeSecrets(a);
     let c, d, f;
-    const y = x.hashSessionId(e);
+    const y = j.hashSessionId(e);
     h.logger.debug("initiateTwoFactorPageVisit " + a.username + " " + e + " " + y);
     let C = { username: a.username, factor2: a.factor2, secrets: n, body: t, url: r };
     return i && (C["content-type"] = i), await this.keyStorage.updateData(y, "pre2fa", C), {
@@ -5204,14 +5308,14 @@ class Jt {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call completeTwoFactorPageVisit if no user storage provided");
     let { key: t } = await this.session.getUserForSessionId(e);
     if (!t) throw new o(l.InvalidKey, "Session key not found");
-    let r = z.decodeData(t.data);
+    let r = V.decodeData(t.data);
     if (!("pre2fa" in r)) throw new o(l.Unauthorized, "Two factor authentication not initiated");
     const { secrets: i } = await this.userStorage.getUserByUsername(r.pre2fa.username), s = this.authenticators[r.pre2fa.factor2];
     if (!s) throw new o(l.Configuration, "Unrecognised second factor authentication");
     const n = {}, c = s.secretNames();
     for (let d in i)
       c.includes(d) && d in i && (n[d] = i[d]);
-    await s.authenticateUser(void 0, { ...n, ...r.pre2fa.secrets }, a), await this.keyStorage.updateData(x.hashSessionId(t.value), "pre2fa", void 0);
+    await s.authenticateUser(void 0, { ...n, ...r.pre2fa.secrets }, a), await this.keyStorage.updateData(j.hashSessionId(t.value), "pre2fa", void 0);
   }
   /**
    * Cancels the 2FA that was previously initiated but not completed..
@@ -5225,9 +5329,9 @@ class Jt {
   async cancelTwoFactorPageVisit(a) {
     let { key: e } = await this.session.getUserForSessionId(a);
     if (!e) throw new o(l.InvalidSession, "Session key not found");
-    let t = z.decodeData(e.data);
+    let t = V.decodeData(e.data);
     if (!("pre2fa" in t)) throw new o(l.Unauthorized, "Two factor authentication not initiated");
-    return await this.keyStorage.updateData(x.hashSessionId(e.value), "pre2fa", void 0), t.pre2fa;
+    return await this.keyStorage.updateData(j.hashSessionId(e.value), "pre2fa", void 0), t.pre2fa;
   }
   /**
    * Performs the second factor authentication as the second step of the login
@@ -5250,25 +5354,25 @@ class Jt {
     if (!this.userStorage) throw new o(l.Configuration, "Cannot call completeTwoFactorLogin if no user storage provided");
     let { key: i } = await this.session.getUserForSessionId(e);
     if (!i || !i.data || i.data == "") throw new o(l.Unauthorized);
-    let s = z.decodeData(i.data)["2fa"], n = s.username, c = s.factor2;
+    let s = V.decodeData(i.data)["2fa"], n = s.username, c = s.factor2;
     const { user: d, secrets: f } = await this.userStorage.getUserByUsername(n), y = this.authenticators[c];
     if (!y) throw new o(l.Configuration, "Second factor " + c + " not enabled");
     await y.authenticateUser(d, { ...f, ...s }, a);
     const C = await this.session.createSessionKey(d.id, t);
-    await this.keyStorage.deleteKey(x.hashSessionId(i.value));
-    const v = this.session.makeCookie(C, r), p = this.csrfTokens.createCsrfToken(), T = this.csrfTokens.makeCsrfCookie(p), E = this.csrfTokens.makeCsrfFormOrHeaderToken(p);
+    await this.keyStorage.deleteKey(j.hashSessionId(i.value));
+    const _ = this.session.makeCookie(C, r), p = this.csrfTokens.createCsrfToken(), T = this.csrfTokens.makeCsrfCookie(p), v = this.csrfTokens.makeCsrfFormOrHeaderToken(p);
     try {
       this.emailTokenStorage.deleteAllForUser(
         d.id,
-        b.passwordResetToken
+        U.passwordResetToken
       );
-    } catch (A) {
-      h.logger.warn(m({ msg: "Couldn't delete password reset tokens while logging in", user: n })), h.logger.debug(m({ err: A }));
+    } catch (b) {
+      h.logger.warn(m({ msg: "Couldn't delete password reset tokens while logging in", user: n })), h.logger.debug(m({ err: b }));
     }
     return {
-      sessionCookie: v,
+      sessionCookie: _,
       csrfCookie: T,
-      csrfFormOrHeaderValue: E,
+      csrfFormOrHeaderValue: v,
       user: d
     };
   }
@@ -5282,7 +5386,7 @@ class Jt {
     const { user: e } = await this.userStorage.getUserByEmail(a, {
       skipActiveCheck: !0
     });
-    if (e.state != k.active && e.state != k.passwordResetNeeded && e.state != k.passwordAndFactor2ResetNeeded)
+    if (e.state != E.active && e.state != E.passwordResetNeeded && e.state != E.passwordAndFactor2ResetNeeded)
       throw new o(l.UserNotActive);
     await ((t = this.tokenEmailer) == null ? void 0 : t.sendPasswordResetToken(e.id));
   }
@@ -5331,7 +5435,7 @@ class Jt {
     try {
       await this.emailTokenStorage.deleteAllForUser(
         s.id,
-        b.passwordResetToken
+        U.passwordResetToken
       );
     } catch (f) {
       h.logger.warn(m({ msg: "Couldn't delete password reset tokens while logging in", user: a })), h.logger.debug(m({ err: f }));
@@ -5356,18 +5460,18 @@ class Jt {
     d.userid = a.userid, d.id = a.id;
     let f = !1;
     if (s)
-      i = s, D.validateEmail(i), f = !0;
+      i = s, L.validateEmail(i), f = !0;
     else if (n) {
       i = n;
       try {
-        D.validateEmail(a.username), f = !0;
+        L.validateEmail(a.username), f = !0;
       } catch {
       }
-      f && D.validateEmail(i);
+      f && L.validateEmail(i);
     }
-    return !t && this.enableEmailVerification && f ? await ((y = this.tokenEmailer) == null ? void 0 : y.sendEmailVerificationToken(a.id, i)) : (s && (d.email = s), n && (d.username = n)), (e.state == k.passwordResetNeeded || e.state == k.passwordAndFactor2ResetNeeded) && await ((C = this.tokenEmailer) == null ? void 0 : C.sendPasswordResetToken(a.id, {}, r)), await this.userStorage.updateUser(d), {
+    return !t && this.enableEmailVerification && f ? await ((y = this.tokenEmailer) == null ? void 0 : y.sendEmailVerificationToken(a.id, i)) : (s && (d.email = s), n && (d.username = n)), (e.state == E.passwordResetNeeded || e.state == E.passwordAndFactor2ResetNeeded) && await ((C = this.tokenEmailer) == null ? void 0 : C.sendPasswordResetToken(a.id, {}, r)), await this.userStorage.updateUser(d), {
       emailVerificationTokenSent: !t && this.enableEmailVerification && f,
-      passwordResetTokenSent: e.state == k.passwordResetNeeded || e.state == k.passwordAndFactor2ResetNeeded
+      passwordResetTokenSent: e.state == E.passwordResetNeeded || e.state == E.passwordAndFactor2ResetNeeded
     };
   }
   /**
@@ -5386,7 +5490,7 @@ class Jt {
     if (h.logger.debug(m({ msg: "resetSecret" })), !this.tokenEmailer) throw new o(l.Configuration, "Password reset not enabled");
     const i = await this.userForPasswordResetToken(a), s = e == 1 ? i.factor1 : i.factor2;
     if (!this.tokenEmailer) throw new o(l.Configuration);
-    let n = i.state == k.passwordAndFactor2ResetNeeded ? k.factor2ResetNeeded : k.active;
+    let n = i.state == E.passwordAndFactor2ResetNeeded ? E.factor2ResetNeeded : E.active;
     await this.userStorage.updateUser(
       { id: i.id, state: n },
       await this.authenticators[s].createPersistentSecrets(i.username, t, r)
@@ -5394,7 +5498,7 @@ class Jt {
     try {
       await this.emailTokenStorage.deleteAllForUser(
         i.id,
-        b.passwordResetToken
+        U.passwordResetToken
       );
     } catch (c) {
       h.logger.warn(m({ msg: "Couldn't delete password reset tokens while logging in", user: i.username })), h.logger.debug(m({ err: c }));
@@ -5402,7 +5506,7 @@ class Jt {
     return { ...i, state: n };
   }
 }
-class we {
+class ke {
   /**
    * Constructor.
    *
@@ -5416,7 +5520,7 @@ class we {
     /** The prefix to add to the hashed key in storage.  Defaults to
      * {@link @crossauth/common!KeyPrefix}.apiKey
      */
-    u(this, "prefix", b.apiKey);
+    u(this, "prefix", U.apiKey);
     /** The name of the speak in the Authorization header.  Defaults to "ApiKey" */
     u(this, "authScheme", "ApiKey");
     this.apiKeyStorage = a, w("secret", g.String, this, e, "SECRET", !0), w("keyLength", g.String, this, e, "APIKEY_LENGTH"), w("prefix", g.String, this, e, "APIKEY_PREFIX"), w("authScheme", g.String, this, e, "APIKEY_AUTHSCHEME");
@@ -5440,11 +5544,11 @@ class we {
    *          Authorization header (with the signature appended.)
    */
   async createKey(a, e, t, r, i) {
-    const s = _.randomValue(this.keyLength), n = /* @__PURE__ */ new Date(), c = r ? new Date(n.getTime() + r * 1e3) : void 0, d = we.hashApiKeyValue(s), f = {
+    const s = k.randomValue(this.keyLength), n = /* @__PURE__ */ new Date(), c = r ? new Date(n.getTime() + r * 1e3) : void 0, d = ke.hashApiKeyValue(s), f = {
       name: a,
       value: s,
       userid: e,
-      data: z.encodeData(t),
+      data: V.encodeData(t),
       expires: c,
       created: n,
       ...i
@@ -5461,7 +5565,7 @@ class we {
     return { key: f, token: y };
   }
   static hashApiKeyValue(a) {
-    return _.hash(a);
+    return k.hash(a);
   }
   /**
    * Returns the hash of the bearer value from the Authorization header.
@@ -5472,20 +5576,20 @@ class we {
    * @returns a hash of the value (without the prefix).
    */
   static hashSignedApiKeyValue(a) {
-    return _.hash(a.split(".")[0]);
+    return k.hash(a.split(".")[0]);
   }
   unsignApiKeyValue(a) {
-    return _.unsign(a, this.secret).v;
+    return k.unsign(a, this.secret).v;
   }
   signApiKeyValue(a) {
-    return _.sign({ v: a }, this.secret);
+    return k.sign({ v: a }, this.secret);
   }
   async getKey(a) {
     if (this.authScheme != "" && a.startsWith(this.authScheme + " ")) {
       const i = new RegExp(`^${this.authScheme} `);
       a = a.replace(i, "");
     }
-    const e = this.unsignApiKeyValue(a), t = we.hashApiKeyValue(e), r = await this.apiKeyStorage.getKey(this.prefix + t);
+    const e = this.unsignApiKeyValue(a), t = ke.hashApiKeyValue(e), r = await this.apiKeyStorage.getKey(this.prefix + t);
     if (!("name" in r)) throw new o(l.InvalidKey, "Not a valid API key");
     return { ...r, name: r.name };
   }
@@ -5502,8 +5606,8 @@ class we {
     return await this.getKey(e[1]);
   }
 }
-const dt = 16, ut = 32;
-class J {
+const pt = 16, Ct = 32;
+class Q {
   /**
    * Constructor
    * @param options See  {@link OAuthClientManagerOptions}
@@ -5532,16 +5636,16 @@ class J {
    *          will be populated.
    */
   async createClient(a, e, t, r = !0, i) {
-    const s = J.randomClientId();
+    const s = Q.randomClientId();
     let n, c;
-    r && (c = J.randomClientSecret(), n = await _.passwordHash(c, {
+    r && (c = Q.randomClientSecret(), n = await k.passwordHash(c, {
       encode: !0,
       iterations: this.oauthPbkdf2Iterations,
       keyLen: this.oauthPbkdf2KeyLength,
       digest: this.oauthPbkdf2Digest
     })), e.forEach((y) => {
-      J.validateUri(y);
-    }), t || (t = U.allFlows());
+      Q.validateUri(y);
+    }), t || (t = I.allFlows());
     const d = {
       client_id: s,
       client_secret: n,
@@ -5560,7 +5664,7 @@ class J {
         if (y == 4) {
           if (o.asCrossauthError(C).code != l.ClientExists) throw C;
         } else
-          d.client_id = J.randomClientId();
+          d.client_id = Q.randomClientId();
       }
     if (!f) throw new o(l.ClientExists);
     return f.client_secret && c && (f.client_secret = c), f;
@@ -5577,13 +5681,13 @@ class J {
   async updateClient(a, e, t = !1) {
     const r = await this.clientStorage.getClientById(a);
     let i = !1, s;
-    e.confidential === !0 && !r.confidential || e.confidential === !0 && t ? (s = J.randomClientSecret(), e.client_secret = await _.passwordHash(s, {
+    e.confidential === !0 && !r.confidential || e.confidential === !0 && t ? (s = Q.randomClientSecret(), e.client_secret = await k.passwordHash(s, {
       encode: !0,
       iterations: this.oauthPbkdf2Iterations,
       keyLen: this.oauthPbkdf2KeyLength,
       digest: this.oauthPbkdf2Digest
     }), i = !0) : e.confidential === !1 && (e.client_secret = null), e.redirect_uri && e.redirect_uri.forEach((c) => {
-      J.validateUri(c);
+      Q.validateUri(c);
     }), e.client_id = a, await this.clientStorage.updateClient(e);
     const n = await this.clientStorage.getClientById(a);
     return s && (n.client_secret = s), { client: n, newSecret: i };
@@ -5592,13 +5696,13 @@ class J {
    * Create a random OAuth client id
    */
   static randomClientId() {
-    return _.randomValue(dt);
+    return k.randomValue(pt);
   }
   /**
   * Create a random OAuth client secret
   */
   static randomClientSecret() {
-    return _.randomValue(ut);
+    return k.randomValue(Ct);
   }
   /** If the passed redirect URI is not in the set of valid ones,
    * throw {@link @crossauth/common!CrossauthError} with
@@ -5625,7 +5729,7 @@ class J {
       );
   }
 }
-class ht extends Fe {
+class St extends je {
   /**
    * Constructor
    *
@@ -5658,14 +5762,14 @@ class ht extends Fe {
           l.Configuration,
           "Cannot specify symmetric key and file"
         );
-      this.jwtSecretKeyFile && (this.jwtSecretKey = ie.readFileSync(this.jwtSecretKeyFile, "utf8"));
+      this.jwtSecretKeyFile && (this.jwtSecretKey = ue.readFileSync(this.jwtSecretKeyFile, "utf8"));
     } else if (this.jwtPublicKey || this.jwtPublicKeyFile) {
       if (this.jwtPublicKeyFile && this.jwtPublicKey)
         throw new o(
           l.Configuration,
           "Cannot specify both public key and public key file"
         );
-      this.jwtPublicKeyFile && (this.jwtPublicKey = ie.readFileSync(this.jwtPublicKeyFile, "utf8"));
+      this.jwtPublicKeyFile && (this.jwtPublicKey = ue.readFileSync(this.jwtPublicKeyFile, "utf8"));
     }
   }
   /**
@@ -5675,7 +5779,7 @@ class ht extends Fe {
    * @returns Base64-url-encoded hash
    */
   async hash(e) {
-    return _.hash(e);
+    return k.hash(e);
   }
   /**
    * If the given token is valid, the paylaod is returned.  Otherwise
@@ -5696,7 +5800,7 @@ class ht extends Fe {
     const i = await super.tokenAuthorized(e, t, r);
     if (i && t == "access" && this.persistAccessToken && this.keyStorage)
       try {
-        const n = b.accessToken + _.hash(i.jti ? i.jti : i.sid ? i.sid : ""), c = await this.keyStorage.getKey(n), d = /* @__PURE__ */ new Date();
+        const n = U.accessToken + k.hash(i.jti ? i.jti : i.sid ? i.sid : ""), c = await this.keyStorage.getKey(n), d = /* @__PURE__ */ new Date();
         if (c.expires && ((s = c.expires) == null ? void 0 : s.getTime()) < d.getTime()) {
           h.logger.error(m({ msg: "Access token expired in storage but not in JWT" }));
           return;
@@ -5704,14 +5808,14 @@ class ht extends Fe {
       } catch (n) {
         h.logger.warn(m({
           msg: "Couldn't get token from database - is it valid?",
-          hashedAccessToken: _.hash(i.jti ? i.jti : i.sid ? i.sid : "")
+          hashedAccessToken: k.hash(i.jti ? i.jti : i.sid ? i.sid : "")
         })), h.logger.debug(m({ err: n }));
         return;
       }
     return i;
   }
 }
-class mt extends Ne {
+class De extends He {
   /**
    * Constructor
    * @param authServerBaseUrl bsae URI for the authorization server
@@ -5723,10 +5827,10 @@ class mt extends Ne {
     const r = {
       client_id: ""
     };
-    w("client_id", g.String, r, t, "OAUTH_CLIENT_ID", !0);
+    console.log("constructor", t), w("client_id", g.String, r, t, "OAUTH_CLIENT_ID", !0);
     super({
       authServerBaseUrl: e,
-      tokenConsumer: new ht(
+      tokenConsumer: new St(
         r.client_id,
         {
           audience: r.client_id,
@@ -5744,7 +5848,7 @@ class mt extends Ne {
     u(this, "userStorage");
     this.client_id = r.client_id;
     let i = {};
-    if (w("stateLength", g.String, this, t, "OAUTH_STATE_LENGTH"), w("verifierLength", g.String, this, t, "OAUTH_VERIFIER_LENGTH"), w("client_secret", g.String, i, t, "OAUTH_CLIENT_SECRET"), w("codeChallengeMethod", g.String, this, t, "OAUTH_CODE_CHALLENGE_METHOD"), w("deviceAuthorizationUrl", g.String, this, t, "OAUTH_DEVICE_AUTHORIZATION_URL"), w("oauthLogFetch", g.Boolean, this, t, "OAUTH_LOG_FETCH"), this.deviceAuthorizationUrl.startsWith("/") && (this.deviceAuthorizationUrl = this.deviceAuthorizationUrl.substring(1)), i.client_secret && (this.client_secret = i.client_secret), w("userCreationType", g.String, this, t, "OAUTH_USER_CREATION_TYPE"), w("userMatchField", g.String, this, t, "OAUTH_USER_MATCH_FIELD"), w("idTokenMatchField", g.String, this, t, "OAUTH_IDTOKEN_MaTCH_FIELD"), this.userCreationType == "merge" ? this.userCreationFn = ft : this.userCreationType == "embed" ? this.userCreationFn = gt : t.userCreationFn && this.userCreationType == "custom" ? this.userCreationFn = t.userCreationFn : this.userCreationFn = wt, t.userStorage && (this.userStorage = t.userStorage), w("oauthPostType", g.String, this, t, "OAUTH_POST_TYPE"), w("oauthUseUserInfoEndpoint", g.Boolean, this, t, "OAUTH_USE_USER_INFO_ENDPOINT"), w("oauthAuthorizeRedirect", g.String, this, t, "OAUTH_AUTHORIZE_REDIRECT"), this.oauthPostType != "json" && this.oauthPostType != "form")
+    if (w("stateLength", g.String, this, t, "OAUTH_STATE_LENGTH"), w("verifierLength", g.String, this, t, "OAUTH_VERIFIER_LENGTH"), w("client_secret", g.String, i, t, "OAUTH_CLIENT_SECRET"), w("codeChallengeMethod", g.String, this, t, "OAUTH_CODE_CHALLENGE_METHOD"), w("deviceAuthorizationUrl", g.String, this, t, "OAUTH_DEVICE_AUTHORIZATION_URL"), w("oauthLogFetch", g.Boolean, this, t, "OAUTH_LOG_FETCH"), this.deviceAuthorizationUrl.startsWith("/") && (this.deviceAuthorizationUrl = this.deviceAuthorizationUrl.substring(1)), i.client_secret && (this.client_secret = i.client_secret), w("userCreationType", g.String, this, t, "OAUTH_USER_CREATION_TYPE"), w("userMatchField", g.String, this, t, "OAUTH_USER_MATCH_FIELD"), w("idTokenMatchField", g.String, this, t, "OAUTH_IDTOKEN_MaTCH_FIELD"), this.userCreationType == "merge" ? this.userCreationFn = Tt : this.userCreationType == "embed" ? this.userCreationFn = _t : t.userCreationFn && this.userCreationType == "custom" ? this.userCreationFn = t.userCreationFn : this.userCreationFn = kt, t.userStorage && (this.userStorage = t.userStorage), w("oauthPostType", g.String, this, t, "OAUTH_POST_TYPE"), w("oauthUseUserInfoEndpoint", g.Boolean, this, t, "OAUTH_USE_USER_INFO_ENDPOINT"), w("oauthAuthorizeRedirect", g.String, this, t, "OAUTH_AUTHORIZE_REDIRECT"), this.oauthPostType != "json" && this.oauthPostType != "form")
       throw new o(l.Configuration, "oauthPostType must be json or form");
   }
   /**
@@ -5754,7 +5858,7 @@ class mt extends Ne {
    * @returns the Base64-URL-encoded random string
    */
   randomValue(e) {
-    return _.randomValue(e);
+    return k.randomValue(e);
   }
   /**
    * Uses {@link @crossauth/backend!Crypto.sha256} to create hash a string using SHA256
@@ -5762,10 +5866,10 @@ class mt extends Ne {
    * @returns the Base64-URL-encoded hash
    */
   async sha256(e) {
-    return _.sha256(e);
+    return k.sha256(e);
   }
 }
-async function ft(S, a, e, t) {
+async function Tt(S, a, e, t) {
   if (!a) throw new o(l.Configuration, "userCreationType set to merge but no user storage set");
   try {
     let r;
@@ -5777,7 +5881,7 @@ async function ft(S, a, e, t) {
     throw h.logger.error(m({ err: r })), r;
   }
 }
-async function gt(S, a, e, t) {
+async function _t(S, a, e, t) {
   if (!a) throw new o(l.Configuration, "userCreationType set to embed but no user storage set");
   try {
     let r;
@@ -5789,14 +5893,15 @@ async function gt(S, a, e, t) {
     throw h.logger.error({ err: r }), r;
   }
 }
-async function wt(S, a, e, t) {
+async function kt(S, a, e, t) {
   return {
+    ...S,
     id: S.userid ?? S.sub,
     username: S.sub,
     state: S.state ?? "active"
   };
 }
-function yt(S) {
+function vt(S) {
   switch (S) {
     case "HS256":
     case "HS384":
@@ -5818,7 +5923,7 @@ function yt(S) {
     "Invalid JWT signing algorithm " + S
   );
 }
-class Yt {
+class ir {
   /**
    * Constructor
    *
@@ -5878,6 +5983,14 @@ class Yt {
      * The OAuth client to the upstream authz server if configured
      */
     u(this, "upstreamClientOptions");
+    /**
+     * Same as upstreamClient but for case where there is more than one
+     */
+    u(this, "upstreamClients");
+    /**
+     * Same as upstreamClientOptions but for case where there is more than one
+     */
+    u(this, "upstreamClientOptionss");
     // device code
     u(this, "userCodeExpiry", 60 * 5);
     u(this, "userCodeThrottle", 1500);
@@ -5891,7 +6004,7 @@ class Yt {
     u(this, "validFlows", ["all"]);
     /** Set from options.  See {@link OAuthAuthorizationServerOptions.allowedFactor2} */
     u(this, "allowedFactor2", []);
-    this.clientStorage = a, this.keyStorage = e, this.userStorage = r.userStorage, this.authStorage = r.authStorage, t && (this.authenticators = t), this.clientManager = new J({ clientStorage: a, ...r }), w("authServerBaseUrl", g.String, this, r, "AUTH_SERVER_BASE_URL", !0), w("oauthIssuer", g.String, this, r, "OAUTH_ISSUER"), this.oauthIssuer || (this.oauthIssuer = this.authServerBaseUrl), w("audience", g.String, this, r, "OAUTH_AUDIENCE"), w("oauthPbkdf2Iterations", g.String, this, r, "OAUTH_PBKDF2_ITERATIONS"), w("requireClientSecretOrChallenge", g.Boolean, this, r, "OAUTH_REQUIRE_CLIENT_SECRET_OR_CHALLENGE"), w("jwtAlgorithm", g.String, this, r, "JWT_ALGORITHM"), w("codeLength", g.Number, this, r, "OAUTH_CODE_LENGTH"), w("jwtKeyType", g.String, this, r, "JWT_KEY_TYPE"), w("jwtSecretKeyFile", g.String, this, r, "JWT_SECRET_KEY_FILE"), w("jwtPublicKeyFile", g.String, this, r, "JWT_PUBLIC_KEY_FILE"), w("jwtPrivateKeyFile", g.String, this, r, "JWT_PRIVATE_KEY_FILE"), w("jwtSecretKey", g.String, this, r, "JWT_SECRET_KEY"), w("jwtPublicKey", g.String, this, r, "JWT_PUBLIC_KEY"), w("jwtPrivateKey", g.String, this, r, "JWT_PRIVATE_KEY"), w("jwtKid", g.String, this, r, "JWT_KID"), w("persistAccessToken", g.String, this, r, "OAUTH_PERSIST_ACCESS_TOKEN"), w("issueRefreshToken", g.String, this, r, "OAUTH_ISSUE_REFRESH_TOKEN"), w("opaqueAccessToken", g.String, this, r, "OAUTH_OPAQUE_ACCESS_TOKEN"), w("accessTokenExpiry", g.Number, this, r, "OAUTH_ACCESS_TOKEN_EXPIRY"), w("refreshTokenExpiry", g.Number, this, r, "OAUTH_REFRESH_TOKEN_EXPIRY"), w("rollingRefreshToken", g.Boolean, this, r, "OAUTH_ROLLING_REFRESH_TOKEN"), w("authorizationCodeExpiry", g.Number, this, r, "OAUTH_AUTHORIZATION_CODE_EXPIRY"), w("mfaTokenExpiry", g.Number, this, r, "OAUTH_MFA_TOKEN_EXPIRY"), w("clockTolerance", g.Number, this, r, "OAUTH_CLOCK_TOLERANCE"), w("validateScopes", g.Boolean, this, r, "OAUTH_VALIDATE_SCOPES"), w("emptyScopeIsValid", g.Boolean, this, r, "OAUTH_EMPTY_SCOPE_VALID"), w("validScopes", g.JsonArray, this, r, "OAUTH_VALID_SCOPES"), w("validFlows", g.JsonArray, this, r, "OAUTH_validFlows"), w("idTokenClaims", g.Json, this, r, "OAUTH_ID_TOKEN_CLAIMS"), w("accessTokenClaims", g.Json, this, r, "OAUTH_ACCESS_TOKEN_CLAIMS"), w("allowedFactor2", g.JsonArray, this, r, "ALLOWED_FACTOR2"), w("userCodeExpiry", g.Number, this, r, "DEVICECODE_USERCODE_EXPIRY"), w("userCodeThrottle", g.Number, this, r, "DEVICECODE_USERCODE_THROTTLE"), w("deviceCodePollInterval", g.Number, this, r, "DEVICECODE_POLL_INTERVAL"), w("deviceCodeLength", g.Number, this, r, "DEVICECODE_LENGTH"), w("userCodeLength", g.Number, this, r, "DEVICECODE_USERCODE_LENGTH");
+    this.clientStorage = a, this.keyStorage = e, this.userStorage = r.userStorage, this.authStorage = r.authStorage, t && (this.authenticators = t), this.clientManager = new Q({ clientStorage: a, ...r }), w("authServerBaseUrl", g.String, this, r, "AUTH_SERVER_BASE_URL", !0), w("oauthIssuer", g.String, this, r, "OAUTH_ISSUER"), this.oauthIssuer || (this.oauthIssuer = this.authServerBaseUrl), w("audience", g.String, this, r, "OAUTH_AUDIENCE"), w("oauthPbkdf2Iterations", g.String, this, r, "OAUTH_PBKDF2_ITERATIONS"), w("requireClientSecretOrChallenge", g.Boolean, this, r, "OAUTH_REQUIRE_CLIENT_SECRET_OR_CHALLENGE"), w("jwtAlgorithm", g.String, this, r, "JWT_ALGORITHM"), w("codeLength", g.Number, this, r, "OAUTH_CODE_LENGTH"), w("jwtKeyType", g.String, this, r, "JWT_KEY_TYPE"), w("jwtSecretKeyFile", g.String, this, r, "JWT_SECRET_KEY_FILE"), w("jwtPublicKeyFile", g.String, this, r, "JWT_PUBLIC_KEY_FILE"), w("jwtPrivateKeyFile", g.String, this, r, "JWT_PRIVATE_KEY_FILE"), w("jwtSecretKey", g.String, this, r, "JWT_SECRET_KEY"), w("jwtPublicKey", g.String, this, r, "JWT_PUBLIC_KEY"), w("jwtPrivateKey", g.String, this, r, "JWT_PRIVATE_KEY"), w("jwtKid", g.String, this, r, "JWT_KID"), w("persistAccessToken", g.String, this, r, "OAUTH_PERSIST_ACCESS_TOKEN"), w("issueRefreshToken", g.String, this, r, "OAUTH_ISSUE_REFRESH_TOKEN"), w("opaqueAccessToken", g.String, this, r, "OAUTH_OPAQUE_ACCESS_TOKEN"), w("accessTokenExpiry", g.Number, this, r, "OAUTH_ACCESS_TOKEN_EXPIRY"), w("refreshTokenExpiry", g.Number, this, r, "OAUTH_REFRESH_TOKEN_EXPIRY"), w("rollingRefreshToken", g.Boolean, this, r, "OAUTH_ROLLING_REFRESH_TOKEN"), w("authorizationCodeExpiry", g.Number, this, r, "OAUTH_AUTHORIZATION_CODE_EXPIRY"), w("mfaTokenExpiry", g.Number, this, r, "OAUTH_MFA_TOKEN_EXPIRY"), w("clockTolerance", g.Number, this, r, "OAUTH_CLOCK_TOLERANCE"), w("validateScopes", g.Boolean, this, r, "OAUTH_VALIDATE_SCOPES"), w("emptyScopeIsValid", g.Boolean, this, r, "OAUTH_EMPTY_SCOPE_VALID"), w("validScopes", g.JsonArray, this, r, "OAUTH_VALID_SCOPES"), w("validFlows", g.JsonArray, this, r, "OAUTH_validFlows"), w("idTokenClaims", g.Json, this, r, "OAUTH_ID_TOKEN_CLAIMS"), w("accessTokenClaims", g.Json, this, r, "OAUTH_ACCESS_TOKEN_CLAIMS"), w("allowedFactor2", g.JsonArray, this, r, "ALLOWED_FACTOR2"), w("userCodeExpiry", g.Number, this, r, "DEVICECODE_USERCODE_EXPIRY"), w("userCodeThrottle", g.Number, this, r, "DEVICECODE_USERCODE_THROTTLE"), w("deviceCodePollInterval", g.Number, this, r, "DEVICECODE_POLL_INTERVAL"), w("deviceCodeLength", g.Number, this, r, "DEVICECODE_LENGTH"), w("userCodeLength", g.Number, this, r, "DEVICECODE_USERCODE_LENGTH");
     let i = {};
     if (w("userCodeDashEvery", g.String, i, r, "DEVICECODE_USERCODE_DASH_EVERY"), i.userCodeDashEvery)
       if (i.userCodeDashEvery == "" || i.userCodeDashEvery.toLowerCase() == "null") this.userCodeDashEvery = null;
@@ -5904,9 +6017,23 @@ class Yt {
             "userCodeDashEvery must be a number or null"
           );
         }
-    if (w("deviceCodeVerificationUri", g.String, this, r, "DEVICECODE_VERIFICATION_URI"), r.upstreamClient && (this.upstreamClientOptions = r.upstreamClient, this.upstreamClient = new mt(r.upstreamClient.authServerBaseUrl, r.upstreamClient.options), !r.upstreamClient.options.redirect_uri))
-      throw new o(l.Configuration, "Must define redirect_uri in upstreamClient options");
-    if (this.validFlows.length == 1 && this.validFlows[0] == U.All && (this.validFlows = U.allFlows()), this.jwtAlgorithmChecked = yt(this.jwtAlgorithm), this.jwtSecretKey || this.jwtSecretKeyFile) {
+    if (w("deviceCodeVerificationUri", g.String, this, r, "DEVICECODE_VERIFICATION_URI"), r.upstreamClient) {
+      if (this.upstreamClientOptions = r.upstreamClient, this.upstreamClient = new De(r.upstreamClient.authServerBaseUrl, r.upstreamClient.options), !r.upstreamClient.options.redirect_uri)
+        throw new o(l.Configuration, "Must define redirect_uri in upstreamClient options");
+    } else if (r.upstreamClients) {
+      this.upstreamClientOptionss = r.upstreamClients, this.upstreamClients = {};
+      let s;
+      for (let n in this.upstreamClientOptionss) {
+        let c = this.upstreamClientOptionss[n];
+        if (!s)
+          s = c.sessionDataName;
+        else if (c.sessionDataName != s)
+          throw new o(l.Configuration, "If defining multiple upstream clients, session data name must be the same for each");
+        if (this.upstreamClients[n] = new De(c.authServerBaseUrl, c.options), !c.options.redirect_uri)
+          throw new o(l.Configuration, "Must define redirect_uri in each upstreamClients options");
+      }
+    }
+    if (this.validFlows.length == 1 && this.validFlows[0] == I.All && (this.validFlows = I.allFlows()), this.jwtAlgorithmChecked = vt(this.jwtAlgorithm), this.jwtSecretKey || this.jwtSecretKeyFile) {
       if (this.jwtPublicKey || this.jwtPublicKeyFile || this.jwtPrivateKey || this.jwtPrivateKeyFile)
         throw new o(
           l.Configuration,
@@ -5917,14 +6044,14 @@ class Yt {
           l.Configuration,
           "Cannot specify symmetric key and file"
         );
-      this.jwtSecretKeyFile && (this.jwtSecretKey = ie.readFileSync(this.jwtSecretKeyFile, "utf8"));
+      this.jwtSecretKeyFile && (this.jwtSecretKey = ue.readFileSync(this.jwtSecretKeyFile, "utf8"));
     } else if ((this.jwtPrivateKey || this.jwtPrivateKeyFile) && (this.jwtPublicKey || this.jwtPublicKeyFile)) {
       if (this.jwtPrivateKeyFile && this.jwtPrivateKey)
         throw new o(
           l.Configuration,
           "Cannot specify both private key and private key file"
         );
-      if (this.jwtPrivateKeyFile && (this.jwtPrivateKey = ie.readFileSync(
+      if (this.jwtPrivateKeyFile && (this.jwtPrivateKey = ue.readFileSync(
         this.jwtPrivateKeyFile,
         "utf8"
       )), this.jwtPublicKeyFile && this.jwtPublicKey)
@@ -5932,7 +6059,7 @@ class Yt {
           l.Configuration,
           "Cannot specify both public key and public key file"
         );
-      this.jwtPublicKeyFile && (this.jwtPublicKey = ie.readFileSync(
+      this.jwtPublicKeyFile && (this.jwtPublicKey = ue.readFileSync(
         this.jwtPublicKeyFile,
         "utf8"
       ));
@@ -5946,7 +6073,7 @@ class Yt {
         l.Configuration,
         "If setting jwtPublicKey or jwtPrivate key, must also set jwtKeyType"
       );
-    if (this.opaqueAccessToken && (this.persistAccessToken = !0), (this.validFlows.includes(U.Password) || this.validFlows.includes(U.PasswordMfa)) && (!this.userStorage || Object.keys(this.authenticators).length == 0))
+    if (this.opaqueAccessToken && (this.persistAccessToken = !0), (this.validFlows.includes(I.Password) || this.validFlows.includes(I.PasswordMfa)) && (!this.userStorage || Object.keys(this.authenticators).length == 0))
       throw new o(
         l.Configuration,
         "If password flow or password MFA flow is enabled, userStorage and authenticators must be provided"
@@ -5995,11 +6122,11 @@ class Yt {
     const {
       scopes: y,
       error: C,
-      error_description: v
+      error_description: _
     } = await this.validateAndPersistScope(e, r, c);
     if (C) return {
       error: C,
-      error_description: v
+      error_description: _
     };
     const p = this.inferFlowFromGet(a, y || [], s);
     if (!p || !this.validFlows.includes(p))
@@ -6096,21 +6223,21 @@ class Yt {
   async authenticateClient(a, e, t) {
     let r = !1;
     switch (a) {
-      case U.AuthorizationCode:
-      case U.AuthorizationCodeWithPKCE:
+      case I.AuthorizationCode:
+      case I.AuthorizationCodeWithPKCE:
         r = e.confidential == !0 || e.client_secret != null || t != null;
         break;
-      case U.ClientCredentials:
+      case I.ClientCredentials:
         r = !0;
         break;
-      case U.Password:
-      case U.PasswordMfa:
+      case I.Password:
+      case I.PasswordMfa:
         r = e.confidential == !0 || e.client_secret != null || t != null;
         break;
-      case U.RefreshToken:
+      case I.RefreshToken:
         r = e.confidential == !0 || e.client_secret != null || t != null;
         break;
-      case U.DeviceCode:
+      case I.DeviceCode:
         r = e.confidential == !0 || e.client_secret != null || t != null;
         break;
     }
@@ -6120,7 +6247,7 @@ class Yt {
     } : r && (!t || !e.client_secret) ? {
       error: "access_denied",
       error_description: "Client is confidential but either secret not passed or is missing in database"
-    } : r && !await _.passwordsEqual(
+    } : r && !await k.passwordsEqual(
       t ?? "",
       e.client_secret ?? ""
     ) ? {
@@ -6167,20 +6294,20 @@ class Yt {
     mfaToken: f,
     oobCode: y,
     bindingCode: C,
-    otp: v,
+    otp: _,
     deviceCode: p
   }) {
-    var F, $, V;
+    var R, Y, W, ie;
     const T = this.inferFlowFromPost(a, s);
     if (!T) return {
       error: "server_error",
       error_description: "Unable to determine OAuth flow type"
     };
-    const E = await this.getClientById(e);
-    if (!E.client) return E;
-    const A = E.client, j = await this.authenticateClient(T, A, i);
-    if (j.error) return j;
-    if (T == U.Password && !this.validFlows.includes(T) && !this.validFlows.includes(U.PasswordMfa))
+    const v = await this.getClientById(e);
+    if (!v.client) return v;
+    const b = v.client, M = await this.authenticateClient(T, b, i);
+    if (M.error) return M;
+    if (T == I.Password && !this.validFlows.includes(T) && !this.validFlows.includes(I.PasswordMfa))
       return {
         error: "access_denied",
         error_description: "Unsupported flow type " + T
@@ -6190,115 +6317,244 @@ class Yt {
         error: "access_denied",
         error_description: "Unsupported flow type " + T
       };
-    if (A && !A.valid_flow.includes(T))
+    if (b && !b.valid_flow.includes(T))
       return {
         error: "unauthorized_client",
         error_description: "Client does not support " + T
       };
-    let H = !1;
-    this.issueRefreshToken && T != U.RefreshToken && (H = !0), this.issueRefreshToken && T == U.RefreshToken && this.rollingRefreshToken && (H = !0);
-    let K;
+    let $ = !1;
+    this.issueRefreshToken && T != I.RefreshToken && ($ = !0), this.issueRefreshToken && T == I.RefreshToken && this.rollingRefreshToken && ($ = !0);
+    let N;
     if (a == "authorization_code")
-      return this.requireClientSecretOrChallenge && A && A.client_secret && !i && !s ? {
+      return this.requireClientSecretOrChallenge && b && b.client_secret && !i && !s ? {
         error: "access_denied",
         error_description: "Must provide either a client secret or use PKCE"
-      } : A && A.client_secret && !i ? {
+      } : b && b.client_secret && !i ? {
         error: "access_denied",
         error_description: "No client secret or code verifier provided for authorization coode flow"
       } : r ? await this.makeAccessToken({
-        client: A,
+        client: b,
         code: r,
         client_secret: i,
         codeVerifier: s,
-        issueRefreshToken: H
+        issueRefreshToken: $
       }) : {
         error: "access_denied",
         error_description: "No authorization code provided for authorization code flow"
       };
     if (a == "refresh_token") {
-      if (this.upstreamClient && this.upstreamClientOptions) {
-        if (!n)
-          return {
-            error: "invalid_request",
-            error_description: "If executing the refresh token flow, must  provide a refresh token"
-          };
-        let I = await this.upstreamClient.refreshTokenFlow(n);
-        if (!I.access_token)
-          return {
-            error: "access_denied",
-            error_description: "Didn't receive an access token"
-          };
-        let P = I.access_token;
-        if (this.upstreamClientOptions.accessTokenIsJwt && (P = await this.upstreamClient.validateAccessToken(I.access_token, !1), !P))
-          return {
-            error: "access_denied",
-            error_description: "Couldn't decode access token"
-          };
-        const R = await this.upstreamClientOptions.tokenMergeFn(P, I.id_payload, this.userStorage);
-        if (R.authorized) {
-          const B = await this.createTokensFromPayload(
-            e,
-            R.access_payload,
-            R.id_payload
-          );
-          return I.access_token = B.access_token, I.id_token = B.id_token, I.id_payload = B.id_payload, I;
-        } else
-          return h.logger.warn(m({ msg: R.error_description })), {
-            error: R.error,
-            error_description: R.error_description
-          };
+      let K = this.upstreamClient, P = this.upstreamClientOptions, D, O, F;
+      if (this.upstreamClient && this.upstreamClientOptions && (K = this.upstreamClient, P = this.upstreamClientOptions, O = ""), this.upstreamClients && this.upstreamClientOptionss) {
+        let A = n == null ? void 0 : n.split(":", 2);
+        if ((A == null ? void 0 : A.length) == 2) {
+          let x = A[0];
+          if (x in this.upstreamClients)
+            K = this.upstreamClients[x], P = this.upstreamClientOptionss[x], O = A[0], D = A[1];
+          else
+            return {
+              error: "access_denied",
+              error_description: "Refresh token is invalid"
+            };
+        } else {
+          if (F = await this.getRefreshTokenData(n), !n || !F || !this.userStorage)
+            return h.logger.warn(m({ msg: "Received refresh token that is not for upstream client but also has not data" })), {
+              error: "access_denied",
+              error_description: "Refresh token is invalid"
+            };
+          D = F.upstreamRefreshToken, O = F.upstreamLabel, O && (K = this.upstreamClients[O], P = this.upstreamClientOptionss[O]);
+        }
       }
-      const N = await this.getRefreshTokenData(n);
-      if (!n || !N || !this.userStorage)
+      if (n)
+        if (h.logger.debug(m({ msg: "token endpoint: refresh token flow" })), F && D && K && P) {
+          let A;
+          if (F.username)
+            try {
+              const H = await ((R = this.userStorage) == null ? void 0 : R.getUserByUsername(F.username));
+              A = H == null ? void 0 : H.user;
+            } catch (H) {
+              return h.logger.error(m({
+                err: H,
+                msg: "Couldn't get user for refresh token.  Doesn't exist?",
+                username: F.username
+              })), {
+                error: "access_denied",
+                error_description: "Refresh token is invalid"
+              };
+            }
+          let x = F.scope;
+          try {
+            const H = U.refreshToken + k.hash(n);
+            await this.keyStorage.deleteKey(H);
+          } catch (H) {
+            const J = o.asCrossauthError(H);
+            h.logger.debug(m({ err: H })), h.logger.warn(m({ msg: "Cannot delete refresh token", cerr: J }));
+          }
+          h.logger.debug(m({ msg: "token endpoint: refresh token flow: refreshing from upstream client" }));
+          let B = await K.refreshTokenFlow(D);
+          if (!B.access_token)
+            return {
+              error: "access_denied",
+              error_description: "Didn't receive an access token"
+            };
+          let X = B.access_token;
+          if (P.accessTokenIsJwt && (X = await K.validateAccessToken(B.access_token, !1), !X))
+            return {
+              error: "access_denied",
+              error_description: "Couldn't decode access token"
+            };
+          const z = await P.tokenMergeFn(X, B.id_payload, this.userStorage);
+          if (z.authorized) {
+            const H = await this.createTokensFromPayload(
+              e,
+              typeof z.access_payload == "string" ? void 0 : z.access_payload,
+              z.id_payload
+            );
+            B.access_token = H.access_token, B.id_token = H.id_token, B.id_payload = H.id_payload, D = B.refresh_token;
+            const J = await this.createTokensFromPayload(
+              e,
+              typeof z.access_payload == "string" ? void 0 : z.access_payload,
+              z.id_payload
+            );
+            let ee = await this.createRefreshToken(b, {
+              upstreamRefreshToken: D,
+              upstreamLabel: O,
+              scopes: x,
+              username: A == null ? void 0 : A.username
+            });
+            return {
+              access_token: J.access_token,
+              id_token: J.id_token,
+              refresh_token: ee,
+              expires_in: B.expires_in ?? (this.accessTokenExpiry == null ? void 0 : this.accessTokenExpiry),
+              token_type: "Bearer",
+              scope: x
+            };
+          } else
+            return h.logger.warn(m({ msg: z.error_description })), {
+              error: z.error,
+              error_description: z.error_description
+            };
+        } else if (D && K && P) {
+          let A = await K.refreshTokenFlow(D);
+          if (!A.access_token)
+            return {
+              error: "access_denied",
+              error_description: "Didn't receive an access token"
+            };
+          let x = A.access_token;
+          if (P.accessTokenIsJwt && (x = await K.validateAccessToken(A.access_token, !1), !x))
+            return {
+              error: "access_denied",
+              error_description: "Couldn't decode access token"
+            };
+          const B = await P.tokenMergeFn(x, A.id_payload, this.userStorage);
+          if (B.authorized) {
+            const X = await this.createTokensFromPayload(
+              e,
+              typeof B.access_payload == "string" ? void 0 : B.access_payload,
+              B.id_payload
+            );
+            return A.access_token = X.access_token, A.id_token = X.id_token, A.id_payload = X.id_payload, A;
+          } else
+            return h.logger.warn(m({ msg: B.error_description })), {
+              error: B.error,
+              error_description: B.error_description
+            };
+        } else {
+          if (F = await this.getRefreshTokenData(n), !n || !F || !this.userStorage)
+            return {
+              error: "access_denied",
+              error_description: "Refresh token is invalid"
+            };
+          let A = F.upstreamAccessToken, x = F.upstreamIdToken, B;
+          if (F.username)
+            try {
+              const { user: z } = await ((Y = this.userStorage) == null ? void 0 : Y.getUserByUsername(F.username));
+              B = z;
+            } catch (z) {
+              return h.logger.error(m({
+                err: z,
+                msg: "Couldn't get user for refresh token.  Doesn't exist?",
+                username: F.username
+              })), {
+                error: "access_denied",
+                error_description: "Refresh token is invalid"
+              };
+            }
+          let X = F.scopes;
+          try {
+            const z = U.refreshToken + k.hash(n);
+            await this.keyStorage.deleteKey(z);
+          } catch (z) {
+            const H = o.asCrossauthError(z);
+            h.logger.debug(m({ err: z })), h.logger.warn(m({ msg: "Cannot delete refresh token", cerr: H }));
+          }
+          if (A && P && K) {
+            let z = A;
+            if (P.accessTokenIsJwt) {
+              let ee = await K.validateAccessToken(A, !1);
+              if (ee) z = ee;
+              else
+                return {
+                  error: "access_denied",
+                  error_description: "Couldn't decode access token"
+                };
+            }
+            let H = await this.createRefreshToken(b, {
+              upstreamAccessToken: A,
+              upstreamIdToken: x,
+              upstreamLabel: O,
+              scopes: X,
+              username: B == null ? void 0 : B.username
+            });
+            const J = await P.tokenMergeFn(z, x, this.userStorage);
+            if (J.authorized) {
+              const ee = await this.createTokensFromPayload(
+                e,
+                typeof J.access_payload == "string" ? void 0 : J.access_payload,
+                J.id_payload
+              );
+              return {
+                access_token: ee.access_token,
+                id_token: ee.id_token,
+                id_payload: ee.id_payload,
+                refresh_token: H
+              };
+            } else
+              return h.logger.warn(m({ msg: J.error_description })), {
+                error: J.error,
+                error_description: J.error_description
+              };
+          } else
+            return await this.makeAccessToken({
+              client: b,
+              client_secret: i,
+              codeVerifier: s,
+              issueRefreshToken: $,
+              scopes: F.scope,
+              user: B
+            });
+        }
+      else
         return {
           error: "access_denied",
           error_description: "Refresh token is invalid"
         };
-      let O;
-      if (N.username)
-        try {
-          const { user: I } = await ((F = this.userStorage) == null ? void 0 : F.getUserByUsername(N.username));
-          O = I;
-        } catch (I) {
-          return h.logger.error(m({
-            err: I,
-            msg: "Couldn't get user for refresh token.  Doesn't exist?",
-            username: N.username
-          })), {
-            error: "access_denied",
-            error_description: "Refresh token is invalid"
-          };
-        }
-      try {
-        const I = b.refreshToken + _.hash(n);
-        await this.keyStorage.deleteKey(I);
-      } catch (I) {
-        const P = o.asCrossauthError(I);
-        h.logger.debug(m({ err: I })), h.logger.warn(m({ msg: "Cannot delete refresh token", cerr: P }));
-      }
-      return await this.makeAccessToken({
-        client: A,
-        client_secret: i,
-        codeVerifier: s,
-        issueRefreshToken: H,
-        scopes: N.scope,
-        user: O
-      });
     } else if (a == "client_credentials") {
       const {
-        scopes: N,
-        error: O,
-        error_description: I
+        scopes: K,
+        error: P,
+        error_description: D
       } = await this.validateAndPersistScope(e, t, void 0);
-      return O ? {
-        error: O,
-        error_description: I
+      return P ? {
+        error: P,
+        error_description: D
       } : await this.makeAccessToken({
-        client: A,
+        client: b,
         client_secret: i,
         codeVerifier: s,
-        scopes: N,
-        issueRefreshToken: H
+        scopes: K,
+        issueRefreshToken: $
       });
     } else if (a == "password") {
       if (!c || !d)
@@ -6312,54 +6568,54 @@ class Yt {
             error: "server_error",
             error_description: "Password authentication not configured"
           };
-        const { user: P, secrets: R } = await this.userStorage.getUserByUsername(c), B = this.authenticators[P.factor1];
-        if (!B || !B.secretNames().includes("password"))
+        const { user: O, secrets: F } = await this.userStorage.getUserByUsername(c), A = this.authenticators[O.factor1];
+        if (!A || !A.secretNames().includes("password"))
           return {
             error: "access_denied",
             error_description: "Password flow used but factor 1 authenticator does not accept passwords"
           };
-        await B.authenticateUser(
-          P,
-          R,
+        await A.authenticateUser(
+          O,
+          F,
           { password: d }
-        ), K = P;
-      } catch (P) {
-        return h.logger.debug(m({ err: P })), {
+        ), N = O;
+      } catch (O) {
+        return h.logger.debug(m({ err: O })), {
           error: "access_denied",
           error_description: "Username and/or password do not match"
         };
       }
       const {
-        scopes: N,
-        error: O,
-        error_description: I
-      } = await this.validateAndPersistScope(e, t, K);
-      return O ? {
-        error: O,
-        error_description: I
-      } : K.factor2 ? this.allowedFactor2.length > 0 && (K.state == k.factor2ResetNeeded || !this.allowedFactor2.includes(K.factor2 ? K.factor2 : "none")) ? {
+        scopes: K,
+        error: P,
+        error_description: D
+      } = await this.validateAndPersistScope(e, t, N);
+      return P ? {
+        error: P,
+        error_description: D
+      } : N.factor2 ? this.allowedFactor2.length > 0 && (N.state == E.factor2ResetNeeded || !this.allowedFactor2.includes(N.factor2 ? N.factor2 : "none")) ? {
         error: "access_denied",
         error_description: "2FA method not allowed or needs to be reconfigured"
-      } : await this.createMfaRequest(K) : await this.makeAccessToken({
-        client: A,
+      } : await this.createMfaRequest(N) : await this.makeAccessToken({
+        client: b,
         client_secret: i,
         codeVerifier: s,
-        scopes: N,
-        issueRefreshToken: H,
-        user: K
+        scopes: K,
+        issueRefreshToken: $,
+        user: N
       });
     } else if (a == "http://auth0.com/oauth/grant-type/mfa-otp") {
       const {
-        scopes: N,
-        error: O,
-        error_description: I
+        scopes: K,
+        error: P,
+        error_description: D
       } = await this.validateAndPersistScope(e, t, void 0);
-      if (O)
+      if (P)
         return {
-          error: O,
-          error_description: I
+          error: P,
+          error_description: D
         };
-      if (!v)
+      if (!_)
         return {
           error: "access_denied",
           error_description: "OTP not provided"
@@ -6369,58 +6625,58 @@ class Yt {
           error: "access_denied",
           error_description: "MFA token not provided"
         };
-      const P = await this.validateMfaToken(f), R = b.mfaToken + _.hash(f);
-      if (!P.user || !P.key)
+      const O = await this.validateMfaToken(f), F = U.mfaToken + k.hash(f);
+      if (!O.user || !O.key)
         return {
           error: "access_denied",
           error_description: "Invalid MFA token"
         };
-      const B = this.authenticators[P.user.factor2];
-      if (!B || !this.userStorage)
+      const A = this.authenticators[O.user.factor2];
+      if (!A || !this.userStorage)
         return {
           error: "access_denied",
           error_description: "MFA type is not supported for OAuth"
         };
       try {
-        const { secrets: M } = await this.userStorage.getUserById(P.user.id);
-        await B.authenticateUser(
-          P.user,
-          M,
-          { otp: v }
+        const { secrets: x } = await this.userStorage.getUserById(O.user.id);
+        await A.authenticateUser(
+          O.user,
+          x,
+          { otp: _ }
         );
-      } catch (M) {
-        return h.logger.debug(m({ err: M })), {
+      } catch (x) {
+        return h.logger.debug(m({ err: x })), {
           error: "access_denied",
           error_description: "Invalid OTP"
         };
       }
       try {
-        await this.keyStorage.deleteKey(R);
-      } catch (M) {
-        h.logger.debug(m({ err: M })), h.logger.warn(m({
-          cerr: M,
+        await this.keyStorage.deleteKey(F);
+      } catch (x) {
+        h.logger.debug(m({ err: x })), h.logger.warn(m({
+          cerr: x,
           msg: "Couldn't delete mfa token",
-          hashedMfaToken: P.key.value
+          hashedMfaToken: O.key.value
         }));
       }
       return await this.makeAccessToken({
-        client: A,
+        client: b,
         client_secret: i,
         codeVerifier: s,
-        scopes: N,
-        issueRefreshToken: H,
-        user: P.user
+        scopes: K,
+        issueRefreshToken: $,
+        user: O.user
       });
     } else if (a == "http://auth0.com/oauth/grant-type/mfa-oob") {
       const {
-        scopes: N,
-        error: O,
-        error_description: I
+        scopes: K,
+        error: P,
+        error_description: D
       } = await this.validateAndPersistScope(e, t, void 0);
-      if (O)
+      if (P)
         return {
-          error: O,
-          error_description: I
+          error: P,
+          error_description: D
         };
       if (!y || !C)
         return {
@@ -6432,57 +6688,57 @@ class Yt {
           error: "access_denied",
           error_description: "MFA token not provided"
         };
-      const P = await this.validateMfaToken(f);
-      if (!P.user || !P.key)
+      const O = await this.validateMfaToken(f);
+      if (!O.user || !O.key)
         return {
           error: "access_denied",
           error_description: "Invalid MFA token"
         };
-      const R = this.authenticators[P.user.factor2];
-      if (!R || !this.userStorage)
+      const F = this.authenticators[O.user.factor2];
+      if (!F || !this.userStorage)
         return {
           error: "access_denied",
           error_description: "MFA type is not supported for OAuth"
         };
       try {
-        const { secrets: B } = await this.userStorage.getUserById(P.user.id), M = z.decodeData(P.key.data).omfa;
-        if (!M || !M.otp || !M.oobCode)
+        const { secrets: A } = await this.userStorage.getUserById(O.user.id), x = V.decodeData(O.key.data).omfa;
+        if (!x || !x.otp || !x.oobCode)
           return {
             error: "server_error",
             error_description: "Cannot retrieve email OTP"
           };
-        if (M.oobCode != y)
+        if (x.oobCode != y)
           return {
             error: "access_denied",
             error_description: "Invalid OOB code"
           };
-        await R.authenticateUser(
-          P.user,
-          { ...B, otp: M.otp, expiry: ($ = P.key.expires) == null ? void 0 : $.getTime() },
+        await F.authenticateUser(
+          O.user,
+          { ...A, otp: x.otp, expiry: (W = O.key.expires) == null ? void 0 : W.getTime() },
           { otp: C }
         );
-      } catch (B) {
-        return h.logger.debug(m({ err: B })), {
+      } catch (A) {
+        return h.logger.debug(m({ err: A })), {
           error: "access_denied",
           error_description: "Invalid OTP"
         };
       }
       try {
-        await this.keyStorage.deleteKey(P.key.value);
-      } catch (B) {
-        h.logger.debug(m({ err: B })), h.logger.warn(m({
-          cerr: B,
+        await this.keyStorage.deleteKey(O.key.value);
+      } catch (A) {
+        h.logger.debug(m({ err: A })), h.logger.warn(m({
+          cerr: A,
           msg: "Couldn't delete mfa token",
-          hashedMfaToken: P.key.value
+          hashedMfaToken: O.key.value
         }));
       }
       return await this.makeAccessToken({
-        client: A,
+        client: b,
         client_secret: i,
         codeVerifier: s,
-        scopes: N,
-        issueRefreshToken: H,
-        user: P.user
+        scopes: K,
+        issueRefreshToken: $,
+        user: O.user
       });
     } else if (a == "urn:ietf:params:oauth:grant-type:device_code") {
       if (!p)
@@ -6490,42 +6746,42 @@ class Yt {
           error: "invalid_request",
           error_description: "No device code given"
         };
-      let N;
+      let K;
       try {
-        N = await this.keyStorage.getKey(b.deviceCode + p);
-      } catch (O) {
-        const I = o.asCrossauthError(O);
-        return h.logger.debug(m({ err: I })), h.logger.error(m({ msg: "Couldn't get device code", cerr: I })), {
+        K = await this.keyStorage.getKey(U.deviceCode + p);
+      } catch (P) {
+        const D = o.asCrossauthError(P);
+        return h.logger.debug(m({ err: D })), h.logger.error(m({ msg: "Couldn't get device code", cerr: D })), {
           error: "accerss_denied",
           error_description: "Invalid device code"
         };
       }
       try {
-        const O = JSON.parse(N.data ?? "{}"), I = (/* @__PURE__ */ new Date()).getTime();
-        if (N.expires && I > N.expires.getTime())
+        const P = JSON.parse(K.data ?? "{}"), D = (/* @__PURE__ */ new Date()).getTime();
+        if (K.expires && D > K.expires.getTime())
           return await this.deleteDeviceCode(p), {
             error: "expired_token",
             error_description: "Code has expired"
           };
-        if (O.ok != !0)
+        if (P.ok != !0)
           return {
             error: "authorization_pending",
             error_description: "Waiting for user code to be entered"
           };
         {
-          let P = O.scope ? O.scope.split(" ") : void 0, R = O.userid ? await ((V = this.userStorage) == null ? void 0 : V.getUserById(O.userid)) : void 0;
+          let O = P.scope ? P.scope.split(" ") : void 0, F = P.userid ? await ((ie = this.userStorage) == null ? void 0 : ie.getUserById(P.userid)) : void 0;
           return await this.deleteDeviceCode(p), await this.makeAccessToken({
-            client: A,
+            client: b,
             client_secret: i,
             codeVerifier: s,
-            scopes: P,
-            issueRefreshToken: H,
-            user: R == null ? void 0 : R.user
+            scopes: O,
+            issueRefreshToken: $,
+            user: F == null ? void 0 : F.user
           });
         }
-      } catch (O) {
-        const I = o.asCrossauthError(O);
-        return h.logger.debug(m({ err: I })), h.logger.error(m({ msg: "Couldn't get device code", cerr: I })), await this.deleteDeviceCode(p), {
+      } catch (P) {
+        const D = o.asCrossauthError(P);
+        return h.logger.debug(m({ err: D })), h.logger.error(m({ msg: "Couldn't get device code", cerr: D })), await this.deleteDeviceCode(p), {
           error: "accerss_denied",
           error_description: "Invalid device code"
         };
@@ -6538,7 +6794,7 @@ class Yt {
   }
   async deleteDeviceCode(a) {
     try {
-      await this.keyStorage.deleteKey(b.deviceCode + a);
+      await this.keyStorage.deleteKey(U.deviceCode + a);
     } catch (e) {
       const t = o.asCrossauthError(e);
       h.logger.debug(m({ err: t })), h.logger.error(m({ msg: "Couldn't delete device code", cerr: t }));
@@ -6546,7 +6802,7 @@ class Yt {
   }
   async deleteUserCode(a) {
     try {
-      await this.keyStorage.deleteKey(b.userCode + a);
+      await this.keyStorage.deleteKey(U.userCode + a);
     } catch (e) {
       const t = o.asCrossauthError(e);
       h.logger.debug(m({ err: t })), h.logger.error(m({ msg: "Couldn't delete user code", cerr: t }));
@@ -6582,7 +6838,7 @@ class Yt {
         error_description: "Invalid deviceCodeVerificationUri"
       };
     }
-    const r = U.DeviceCode, i = await this.getClientById(a);
+    const r = I.DeviceCode, i = await this.getClientById(a);
     if (!i.client) return i;
     const s = i.client, n = await this.authenticateClient(r, s, t);
     if (n.error) return n;
@@ -6592,19 +6848,19 @@ class Yt {
         error_description: "Unsupported flow type " + r
       };
     if (e) {
-      const { error: T, errorDescription: E } = this.validateScope(e);
+      const { error: T, errorDescription: v } = this.validateScope(e);
       if (T) return {
         error: T,
-        error_description: E
+        error_description: v
       };
     }
     let c, d = !1;
     const f = /* @__PURE__ */ new Date(), y = this.userCodeExpiry, C = new Date(f.getTime() + this.userCodeExpiry * 1e3 + this.clockTolerance * 1e3);
     for (let T = 0; T < 10 && !d; ++T)
       try {
-        c = _.randomValue(this.deviceCodeLength), await this.keyStorage.saveKey(
+        c = k.randomValue(this.deviceCodeLength), await this.keyStorage.saveKey(
           void 0,
-          b.deviceCode + c,
+          U.deviceCode + c,
           f,
           C,
           JSON.stringify({ scope: e, client_id: a })
@@ -6617,13 +6873,13 @@ class Yt {
         error: "server_error",
         error_description: "Couldn't create device code"
       };
-    let v;
+    let _;
     d = !1;
     for (let T = 0; T < 10 && !d; ++T)
       try {
-        v = _.randomBase32(this.userCodeLength), await this.keyStorage.saveKey(
+        _ = k.randomBase32(this.userCodeLength), await this.keyStorage.saveKey(
           void 0,
-          b.userCode + v,
+          U.userCode + _,
           f,
           C,
           JSON.stringify({ deviceCode: c })
@@ -6631,20 +6887,20 @@ class Yt {
       } catch {
         h.logger.debug(m({ msg: `Attempt number${T} at creating a unique authozation code failed` }));
       }
-    if (!d || !v)
+    if (!d || !_)
       return await this.deleteDeviceCode(c), {
         error: "server_error",
         error_description: "Couldn't create device code"
       };
-    if (v && this.userCodeDashEvery) {
+    if (_ && this.userCodeDashEvery) {
       const T = new RegExp(String.raw`(.{1,${this.userCodeDashEvery}})`, "g");
-      v = (p = v.match(T)) == null ? void 0 : p.join("-");
+      _ = (p = _.match(T)) == null ? void 0 : p.join("-");
     }
     return {
       device_code: c,
-      user_code: v,
+      user_code: _,
       verification_uri: this.deviceCodeVerificationUri,
-      verification_uri_complete: this.deviceCodeVerificationUri + "?user_code=" + v,
+      verification_uri_complete: this.deviceCodeVerificationUri + "?user_code=" + _,
       expires_in: y,
       interval: this.deviceCodePollInterval
     };
@@ -6668,7 +6924,7 @@ class Yt {
     a = a.replace(/[ -]*/g, "");
     let t, r = {};
     try {
-      t = await this.keyStorage.getKey(b.userCode + a), r = JSON.parse((t == null ? void 0 : t.data) ?? "{}");
+      t = await this.keyStorage.getKey(U.userCode + a), r = JSON.parse((t == null ? void 0 : t.data) ?? "{}");
     } catch {
       return {
         ok: !1,
@@ -6677,20 +6933,20 @@ class Yt {
       };
     }
     if (!r.deviceCode)
-      return h.logger.error(m({ msg: "No device code for user code", userCodeHash: _.hash(a) })), await this.deleteUserCode(a), {
+      return h.logger.error(m({ msg: "No device code for user code", userCodeHash: k.hash(a) })), await this.deleteUserCode(a), {
         ok: !1,
         error: "server_error",
         error_description: "No device code for user code"
       };
     let i;
     try {
-      i = await this.keyStorage.getKey(b.deviceCode + r.deviceCode);
+      i = await this.keyStorage.getKey(U.deviceCode + r.deviceCode);
     } catch (y) {
       const C = o.asCrossauthError(y);
       return h.logger.debug(m({ err: C })), h.logger.error(m({
         msg: "Invalid device code for user code",
-        userCodeHash: _.hash(a),
-        deviceCodeHash: _.hash(r.deviceCode),
+        userCodeHash: k.hash(a),
+        deviceCodeHash: k.hash(r.deviceCode),
         cerr: C
       })), await this.deleteUserCode(a), {
         ok: !1,
@@ -6738,7 +6994,7 @@ class Yt {
       [null]
     ), !d) {
       try {
-        e != null && e.id && await this.keyStorage.updateData(b.deviceCode + r.deviceCode, "userid", e.id);
+        e != null && e.id && await this.keyStorage.updateData(U.deviceCode + r.deviceCode, "userid", e.id);
       } catch (y) {
         const C = o.asCrossauthError(y);
         return h.logger.debug(m({ err: C })), h.logger.warn(m({ msg: "Couldn't update user id on user code entry - deleting", cerr: C })), await this.deleteUserCode(a), await this.deleteDeviceCode(r.deviceCode), {
@@ -6756,7 +7012,7 @@ class Yt {
       };
     }
     try {
-      e != null && e.id && await this.keyStorage.updateData(b.deviceCode + r.deviceCode, "userid", e.id), await this.keyStorage.updateData(b.deviceCode + r.deviceCode, "ok", !0);
+      e != null && e.id && await this.keyStorage.updateData(U.deviceCode + r.deviceCode, "userid", e.id), await this.keyStorage.updateData(U.deviceCode + r.deviceCode, "ok", !0);
     } catch (y) {
       const C = o.asCrossauthError(y);
       return h.logger.debug(m({ err: C })), h.logger.warn(m({ msg: "Couldn't update status on user code entry - deleting", cerr: C })), await this.deleteUserCode(a), await this.deleteDeviceCode(r.deviceCode), {
@@ -6776,7 +7032,7 @@ class Yt {
     a = a.replace(/[ -]*/g, "");
     let e, t = {};
     try {
-      e = await this.keyStorage.getKey(b.userCode + a), t = JSON.parse((e == null ? void 0 : e.data) ?? "{}");
+      e = await this.keyStorage.getKey(U.userCode + a), t = JSON.parse((e == null ? void 0 : e.data) ?? "{}");
     } catch {
       return {
         ok: !1,
@@ -6785,20 +7041,20 @@ class Yt {
       };
     }
     if (!t.deviceCode)
-      return h.logger.error(m({ msg: "No device code for user code", userCodeHash: _.hash(a) })), await this.deleteUserCode(a), {
+      return h.logger.error(m({ msg: "No device code for user code", userCodeHash: k.hash(a) })), await this.deleteUserCode(a), {
         ok: !1,
         error: "server_error",
         error_description: "No device code for user code"
       };
     let r;
     try {
-      r = await this.keyStorage.getKey(b.deviceCode + t.deviceCode);
+      r = await this.keyStorage.getKey(U.deviceCode + t.deviceCode);
     } catch (n) {
       const c = o.asCrossauthError(n);
       return h.logger.debug(m({ err: c })), h.logger.error(m({
         msg: "Invalid device code for user code",
-        userCodeHash: _.hash(a),
-        deviceCodeHash: _.hash(t.deviceCode),
+        userCodeHash: k.hash(a),
+        deviceCodeHash: k.hash(t.deviceCode),
         cerr: c
       })), await this.deleteUserCode(a), {
         ok: !1,
@@ -6819,7 +7075,7 @@ class Yt {
       };
     }
     try {
-      await this.keyStorage.updateData(b.deviceCode + t.deviceCode, "ok", !0);
+      await this.keyStorage.updateData(U.deviceCode + t.deviceCode, "ok", !0);
     } catch (n) {
       const c = o.asCrossauthError(n);
       return h.logger.debug(m({ err: c })), h.logger.warn(m({ msg: "Couldn't update status on user code entry - deleting", cerr: c })), await this.deleteUserCode(a), await this.deleteDeviceCode(t.deviceCode), {
@@ -6836,7 +7092,7 @@ class Yt {
     };
   }
   async createMfaRequest(a) {
-    const e = _.randomValue(this.codeLength), t = b.mfaToken + _.hash(e), r = /* @__PURE__ */ new Date();
+    const e = k.randomValue(this.codeLength), t = U.mfaToken + k.hash(e), r = /* @__PURE__ */ new Date();
     try {
       await this.keyStorage.saveKey(
         a.id,
@@ -6862,7 +7118,7 @@ class Yt {
     var r;
     let e, t;
     try {
-      const i = b.mfaToken + _.hash(a);
+      const i = U.mfaToken + k.hash(a);
       if (t = await this.keyStorage.getKey(i), !t.userid)
         return {
           error: "access_denied",
@@ -6890,7 +7146,7 @@ class Yt {
         error_description: "Invalid MFA token"
       };
     try {
-      if (z.decodeData(t.data).omfaaid != e.factor2)
+      if (V.decodeData(t.data).omfaaid != e.factor2)
         return {
           error: "access_denied",
           error_description: "authenticatorId not valid for user"
@@ -6947,7 +7203,7 @@ class Yt {
    * @returns respond as defined by the Password MFA spec
    */
   async mfaChallengeEndpoint(a, e, t, r, i) {
-    const s = U.PasswordMfa, n = await this.getClientById(e);
+    const s = I.PasswordMfa, n = await this.getClientById(e);
     if (!n.client) return n;
     const c = n.client, d = await this.authenticateClient(s, c, t);
     if (d.error) return d;
@@ -6965,7 +7221,7 @@ class Yt {
       };
     let y = {};
     r == "oob" && (y = {
-      oobCode: _.randomValue(this.codeLength)
+      oobCode: k.randomValue(this.codeLength)
     });
     try {
       const C = this.authenticators[f.user.factor2];
@@ -6974,11 +7230,11 @@ class Yt {
           l.Configuration,
           "User's authenticator has not been loaded"
         );
-      const v = await C.createOneTimeSecrets(f.user);
+      const _ = await C.createOneTimeSecrets(f.user);
       await this.keyStorage.updateData(
         f.key.value,
         "omfa",
-        { ...y, ...v }
+        { ...y, ..._ }
       );
     } catch (C) {
       return h.logger.debug(m({ err: C })), {
@@ -7004,9 +7260,9 @@ class Yt {
    */
   inferFlowFromGet(a, e, t) {
     if (a == "code" && !e.includes("openid"))
-      return t ? U.AuthorizationCodeWithPKCE : U.AuthorizationCode;
+      return t ? I.AuthorizationCodeWithPKCE : I.AuthorizationCode;
     if (e.includes("openid") && a == "code")
-      return t ? U.AuthorizationCodeWithPKCE : U.AuthorizationCode;
+      return t ? I.AuthorizationCodeWithPKCE : I.AuthorizationCode;
   }
   /**
    * Returns the OAuth flow type that corresonds to the given
@@ -7017,19 +7273,19 @@ class Yt {
    */
   inferFlowFromPost(a, e) {
     if (a == "authorization_code")
-      return e ? U.AuthorizationCodeWithPKCE : U.AuthorizationCode;
+      return e ? I.AuthorizationCodeWithPKCE : I.AuthorizationCode;
     if (a == "client_credentials")
-      return U.ClientCredentials;
+      return I.ClientCredentials;
     if (a == "refresh_token")
-      return U.RefreshToken;
+      return I.RefreshToken;
     if (a == "urn:ietf:params:oauth:grant-type:device_code")
-      return U.DeviceCode;
+      return I.DeviceCode;
     if (a == "password")
-      return U.Password;
+      return I.Password;
     if (a == "http://auth0.com/oauth/grant-type/mfa-otp")
-      return U.PasswordMfa;
+      return I.PasswordMfa;
     if (a == "http://auth0.com/oauth/grant-type/mfa-oob")
-      return U.PasswordMfa;
+      return I.PasswordMfa;
   }
   async getAuthorizationCode(a, e, t, r, i, s, n) {
     if (i && (s || (s = "S256"), s != "S256" && s != "plain"))
@@ -7038,7 +7294,7 @@ class Yt {
         error_description: "Code challenge method must be S256 or plain"
       };
     const c = e;
-    if (J.validateUri(c), this.requireRedirectUriRegistration && !a.redirect_uri.includes(c))
+    if (Q.validateUri(c), this.requireRedirectUriRegistration && !a.redirect_uri.includes(c))
       return {
         error: "invalid_request",
         error_description: `The redirect uri ${e} is invalid`
@@ -7047,22 +7303,22 @@ class Yt {
       client_id: a.client_id,
       redirect_uri: e
     };
-    t && (y.scope = t), i && (y.challengeMethod = s, y.challenge = _.hash(i)), n && (y.username = n.username, y.id = n.id);
+    t && (y.scope = t), i && (y.challengeMethod = s, y.challenge = k.hash(i)), n && (y.username = n.username, y.id = n.id);
     const C = JSON.stringify(y);
-    let v = !1, p = "";
-    for (let T = 0; T < 10 && !v; ++T)
+    let _ = !1, p = "";
+    for (let T = 0; T < 10 && !_; ++T)
       try {
-        p = _.randomValue(this.codeLength), await this.keyStorage.saveKey(
+        p = k.randomValue(this.codeLength), await this.keyStorage.saveKey(
           void 0,
-          b.authorizationCode + _.hash(p),
+          U.authorizationCode + k.hash(p),
           d,
           f,
           C
-        ), v = !0;
+        ), _ = !0;
       } catch {
         h.logger.debug(m({ msg: `Attempt number${T} at creating a unique authozation code failed` }));
       }
-    if (!v)
+    if (!_)
       throw new o(
         l.KeyExists,
         "Couldn't create a authorization code"
@@ -7072,7 +7328,7 @@ class Yt {
   async getAuthorizationCodeData(a) {
     let e, t = {};
     try {
-      e = await this.keyStorage.getKey(b.authorizationCode + _.hash(a)), t = z.decodeData(e.data);
+      e = await this.keyStorage.getKey(U.authorizationCode + k.hash(a)), t = V.decodeData(e.data);
     } catch (r) {
       h.logger.debug(m({ err: r }));
       return;
@@ -7081,7 +7337,7 @@ class Yt {
   }
   async deleteAuthorizationCodeData(a) {
     try {
-      await this.keyStorage.deleteKey(b.authorizationCode + _.hash(a));
+      await this.keyStorage.deleteKey(U.authorizationCode + k.hash(a));
     } catch (e) {
       h.logger.warn(m({
         err: e,
@@ -7090,7 +7346,7 @@ class Yt {
     }
   }
   async setAuthorizationCodeData(a, e) {
-    const t = await this.keyStorage.getKey(b.authorizationCode + _.hash(a));
+    const t = await this.keyStorage.getKey(U.authorizationCode + k.hash(a));
     t.data = JSON.stringify(e), this.keyStorage.updateKey(t);
   }
   /**
@@ -7105,15 +7361,15 @@ class Yt {
     issueRefreshToken: s = !1,
     user: n
   }) {
-    var j, H;
+    var M, $;
     let c = !0;
     try {
-      a.client_secret != null && (c = await _.passwordsEqual(
+      a.client_secret != null && (c = await k.passwordsEqual(
         t ?? "",
         a.client_secret ?? ""
       ));
-    } catch (K) {
-      return h.logger.error(m({ err: K })), { error: "server_error", error_description: "Couldn't validate client" };
+    } catch (N) {
+      return h.logger.error(m({ err: N })), { error: "server_error", error_description: "Couldn't validate client" };
     }
     if (!c) return {
       error: "access_denied",
@@ -7121,20 +7377,20 @@ class Yt {
     };
     let d = {};
     if (e) {
-      let K;
+      let N;
       try {
-        K = await this.keyStorage.getKey(b.authorizationCode + _.hash(e)), d = z.decodeData(K.data);
-      } catch (F) {
-        return h.logger.debug(m({ err: F })), {
+        N = await this.keyStorage.getKey(U.authorizationCode + k.hash(e)), d = V.decodeData(N.data);
+      } catch (R) {
+        return h.logger.debug(m({ err: R })), {
           error: "access_denied",
           error_description: "Invalid or expired authorization code"
         };
       }
       try {
-        await this.keyStorage.deleteKey(K.value);
-      } catch (F) {
+        await this.keyStorage.deleteKey(N.value);
+      } catch (R) {
         h.logger.warn(m({
-          err: F,
+          err: R,
           msg: "Couldn't delete authorization code from storatge",
           client_id: a == null ? void 0 : a.client_id
         }));
@@ -7147,8 +7403,8 @@ class Yt {
         error_description: "Invalid code challenge/code challenge method method for authorization code"
       };
     if (d.challenge) {
-      const K = d.challengeMethod == "plain" ? r ?? "" : _.sha256(r ?? "");
-      if (_.hash(K) != d.challenge)
+      const N = d.challengeMethod == "plain" ? r ?? "" : k.sha256(r ?? "");
+      if (k.hash(N) != d.challenge)
         return {
           error: "access_denied",
           error_description: "Code verifier is incorrect"
@@ -7158,56 +7414,56 @@ class Yt {
     let C;
     if ((i && i.includes("openid") || Object.keys(this.accessTokenClaims).length > 0) && this.userStorage && d.username)
       try {
-        const { user: K } = await this.userStorage.getUserByUsername(d.username);
-        n = K;
-      } catch (K) {
-        return h.logger.error(m({ err: K })), {
+        const { user: N } = await this.userStorage.getUserByUsername(d.username);
+        n = N;
+      } catch (N) {
+        return h.logger.error(m({ err: N })), {
           error: "server_error",
           error_description: "Couldn't load user data"
         };
       }
-    const v = _.uuid();
+    const _ = k.uuid();
     let p = {
-      jti: v,
+      jti: _,
       iat: y,
       iss: this.oauthIssuer,
       sub: d.username,
       type: "access"
     };
     p = this.addClaims(p, this.accessTokenClaims, i, n), i && (p.scope = i), this.accessTokenExpiry != null && (p.exp = y + this.accessTokenExpiry, C = new Date(f.getTime() + this.accessTokenExpiry * 1e3 + this.clockTolerance * 1e3)), this.audience && (p.aud = this.audience);
-    const T = await new Promise((K, F) => {
-      te.sign(
+    const T = await new Promise((N, R) => {
+      ae.sign(
         p,
         this.secretOrPrivateKey,
         { algorithm: this.jwtAlgorithmChecked, keyid: "1" },
-        ($, V) => {
-          V ? K(V) : F($ || new o(
+        (Y, W) => {
+          W ? N(W) : R(Y || new o(
             l.Unauthorized,
             "Couldn't create jwt"
           ));
         }
       );
     });
-    this.persistAccessToken && this.keyStorage && await ((j = this.keyStorage) == null ? void 0 : j.saveKey(
+    this.persistAccessToken && this.keyStorage && await ((M = this.keyStorage) == null ? void 0 : M.saveKey(
       void 0,
       // to avoid user storage dependency, we don't set this
-      b.accessToken + _.hash(v),
+      U.accessToken + k.hash(_),
       f,
       C
     ));
-    let E;
+    let v;
     if (i && i.includes("openid")) {
-      const K = _.uuid();
-      let F = {
+      const N = k.uuid();
+      let R = {
         aud: a.client_id,
-        jti: K,
+        jti: N,
         iat: y,
         iss: this.oauthIssuer,
         sub: d.username,
         type: "id"
       };
-      if (i.includes("email") && (n != null && n.email) && (F.email = n.email), i.includes("address") && n && "address" in n && (F.address = n.address), i.includes("phone") && n && "phone" in n && (F.phone = n.phone), i.includes("profile") && n)
-        for (let $ of [
+      if (i.includes("email") && (n != null && n.email) && (R.email = n.email), i.includes("address") && n && "address" in n && (R.address = n.address), i.includes("phone") && n && "phone" in n && (R.phone = n.phone), i.includes("profile") && n)
+        for (let Y of [
           "name",
           "family_name",
           "given_name",
@@ -7223,17 +7479,17 @@ class Yt {
           "locale",
           "updated_at"
         ])
-          F[$] = n[$];
-      F = this.addClaims(F, this.idTokenClaims, i, n), F.scope = i, this.accessTokenExpiry != null && (F.exp = y + this.accessTokenExpiry), E = await new Promise(($, V) => {
-        te.sign(
-          F,
+          R[Y] = n[Y];
+      R = this.addClaims(R, this.idTokenClaims, i, n), R.scope = i, this.accessTokenExpiry != null && (R.exp = y + this.accessTokenExpiry), v = await new Promise((Y, W) => {
+        ae.sign(
+          R,
           this.secretOrPrivateKey,
           {
             algorithm: this.jwtAlgorithmChecked,
             keyid: this.jwtKid
           },
-          (N, O) => {
-            O ? $(O) : V(N || new o(
+          (ie, K) => {
+            K ? Y(K) : W(ie || new o(
               l.Unauthorized,
               "Couldn't create jwt"
             ));
@@ -7241,51 +7497,97 @@ class Yt {
         );
       });
     }
-    let A;
+    let b;
     if (s) {
-      const K = {
+      const N = {
         username: d.username,
         client_id: a.client_id
       };
-      i && (K.scope = i);
-      let F;
-      const V = {
-        jti: _.uuid(),
+      i && (N.scope = i);
+      let R;
+      const W = {
+        jti: k.uuid(),
         iat: y,
         iss: this.oauthIssuer,
         sub: d.username,
         type: "refresh"
       };
-      this.refreshTokenExpiry != null && (V.exp = y + this.refreshTokenExpiry, F = this.refreshTokenExpiry ? new Date(y + this.refreshTokenExpiry * 1e3 + this.clockTolerance * 1e3) : void 0), this.oauthIssuer && (V.aud = this.oauthIssuer), A = await new Promise((N, O) => {
-        te.sign(
-          V,
+      this.refreshTokenExpiry != null && (W.exp = y + this.refreshTokenExpiry, R = this.refreshTokenExpiry ? new Date(y + this.refreshTokenExpiry * 1e3 + this.clockTolerance * 1e3) : void 0), this.oauthIssuer && (W.aud = this.oauthIssuer), b = await new Promise((ie, K) => {
+        ae.sign(
+          W,
           this.secretOrPrivateKey,
           { algorithm: this.jwtAlgorithmChecked, keyid: "1" },
-          (I, P) => {
-            P ? N(P) : O(I || new o(
+          (P, D) => {
+            D ? ie(D) : K(P || new o(
               l.Unauthorized,
               "Couldn't create jwt"
             ));
           }
         );
-      }), A && await ((H = this.keyStorage) == null ? void 0 : H.saveKey(
+      }), b && await (($ = this.keyStorage) == null ? void 0 : $.saveKey(
         void 0,
         // to avoid user storage dependency
-        b.refreshToken + _.hash(A),
+        U.refreshToken + k.hash(b),
         f,
-        F,
-        JSON.stringify(K)
+        R,
+        JSON.stringify(N)
       ));
     }
     return {
       access_token: T,
-      id_token: E,
-      refresh_token: A,
+      id_token: v,
+      refresh_token: b,
       expires_in: this.accessTokenExpiry == null ? void 0 : this.accessTokenExpiry,
       token_type: "Bearer",
       scope: i ? i.join(" ") : void 0
     };
   }
+  async createRefreshToken(a, {
+    upstreamRefreshToken: e,
+    upstreamLabel: t,
+    scopes: r,
+    username: i,
+    upstreamAccessToken: s,
+    upstreamIdToken: n
+  }) {
+    var T;
+    const c = /* @__PURE__ */ new Date(), d = Math.ceil(c.getTime() / 1e3);
+    let f;
+    const y = {
+      username: i,
+      client_id: a.client_id
+    };
+    r && (y.scope = r), e && (y.upstreamRefreshToken = e, y.upstreamLabel = t);
+    let C;
+    const p = {
+      jti: k.uuid(),
+      iat: d,
+      iss: this.oauthIssuer,
+      sub: i,
+      type: "refresh"
+    };
+    if (this.refreshTokenExpiry != null && (p.exp = d + this.refreshTokenExpiry, C = this.refreshTokenExpiry ? new Date(d + this.refreshTokenExpiry * 1e3 + this.clockTolerance * 1e3) : void 0), this.oauthIssuer && (p.aud = this.oauthIssuer), f = await new Promise((v, b) => {
+      ae.sign(
+        p,
+        this.secretOrPrivateKey,
+        { algorithm: this.jwtAlgorithmChecked, keyid: "1" },
+        (M, $) => {
+          $ ? v($) : b(M || new o(
+            l.Unauthorized,
+            "Couldn't create jwt"
+          ));
+        }
+      );
+    }), f)
+      return f && await ((T = this.keyStorage) == null ? void 0 : T.saveKey(
+        void 0,
+        // to avoid user storage dependency
+        U.refreshToken + k.hash(f),
+        c,
+        C,
+        JSON.stringify(y)
+      )), f;
+  }
   /**
    * Create an access token
    */
@@ -7294,7 +7596,7 @@ class Yt {
     const r = /* @__PURE__ */ new Date(), i = Math.ceil(r.getTime() / 1e3);
     let s, n, c, d;
     if (e) {
-      const y = _.uuid();
+      const y = k.uuid();
       let C = {
         ...e,
         jti: y,
@@ -7302,13 +7604,13 @@ class Yt {
         iss: this.oauthIssuer,
         type: "access"
       };
-      this.accessTokenExpiry != null && (C.exp = i + this.accessTokenExpiry, s = new Date(r.getTime() + this.accessTokenExpiry * 1e3 + this.clockTolerance * 1e3)), this.audience && (C.aud = this.audience), n = await new Promise((v, p) => {
-        te.sign(
+      this.accessTokenExpiry != null && (C.exp = i + this.accessTokenExpiry, s = new Date(r.getTime() + this.accessTokenExpiry * 1e3 + this.clockTolerance * 1e3)), this.audience && (C.aud = this.audience), n = await new Promise((_, p) => {
+        ae.sign(
           C,
           this.secretOrPrivateKey,
           { algorithm: this.jwtAlgorithmChecked, keyid: "1" },
-          (T, E) => {
-            E ? v(E) : p(T || new o(
+          (T, v) => {
+            v ? _(v) : p(T || new o(
               l.Unauthorized,
               "Couldn't create jwt"
             ));
@@ -7317,13 +7619,13 @@ class Yt {
       }), d = C, this.persistAccessToken && this.keyStorage && await ((f = this.keyStorage) == null ? void 0 : f.saveKey(
         void 0,
         // to avoid user storage dependency, we don't set this
-        b.accessToken + _.hash(y),
+        U.accessToken + k.hash(y),
         r,
         s
       ));
     }
     if (t != null) {
-      const y = _.uuid();
+      const y = k.uuid();
       if (t = {
         ...t,
         aud: a,
@@ -7333,16 +7635,16 @@ class Yt {
         type: "id"
       }, t) {
         const C = t;
-        c = await new Promise((v, p) => {
-          te.sign(
+        c = await new Promise((_, p) => {
+          ae.sign(
             C,
             this.secretOrPrivateKey,
             {
               algorithm: this.jwtAlgorithmChecked,
               keyid: this.jwtKid
             },
-            (T, E) => {
-              E ? v(E) : p(T || new o(
+            (T, v) => {
+              v ? _(v) : p(T || new o(
                 l.Unauthorized,
                 "Couldn't create jwt"
               ));
@@ -7399,7 +7701,7 @@ class Yt {
    */
   async validAuthorizationCode(a) {
     try {
-      const e = b.authorizationCode + _.hash(a);
+      const e = U.authorizationCode + k.hash(a);
       return await this.keyStorage.getKey(e), !0;
     } catch (e) {
       return h.logger.debug(m({ err: e })), !1;
@@ -7413,7 +7715,7 @@ class Yt {
    */
   async validRefreshToken(a) {
     try {
-      const e = b.refreshToken + _.hash(a);
+      const e = U.refreshToken + k.hash(a);
       return await this.keyStorage.getKey(e), !0;
     } catch (e) {
       return h.logger.debug(m({ err: e })), !1;
@@ -7428,7 +7730,7 @@ class Yt {
   async getRefreshTokenData(a) {
     if (a)
       try {
-        const e = b.refreshToken + _.hash(a), t = await this.keyStorage.getKey(e);
+        const e = U.refreshToken + k.hash(a), t = await this.keyStorage.getKey(e);
         return JSON.parse(t.data || "{}");
       } catch (e) {
         h.logger.debug(m({ err: e }));
@@ -7462,7 +7764,7 @@ class Yt {
     try {
       const e = await this.validateJwt(a, "access");
       if (this.persistAccessToken) {
-        const t = b.accessToken + _.hash(e.payload.jti);
+        const t = U.accessToken + k.hash(e.payload.jti);
         await this.keyStorage.getKey(t);
       }
       return e;
@@ -7473,7 +7775,7 @@ class Yt {
   }
   async validateJwt(a, e) {
     return new Promise((t, r) => {
-      te.verify(
+      ae.verify(
         a,
         this.secretOrPublicKey,
         { clockTolerance: this.clockTolerance, complete: !0 },
@@ -7536,7 +7838,7 @@ class Yt {
    */
   responseTypesSupported() {
     let a = [];
-    return (this.validFlows.includes(U.AuthorizationCode) || this.validFlows.includes(U.AuthorizationCodeWithPKCE) || this.validFlows.includes(U.OidcAuthorizationCode)) && a.push("code"), a;
+    return (this.validFlows.includes(I.AuthorizationCode) || this.validFlows.includes(I.AuthorizationCodeWithPKCE) || this.validFlows.includes(I.OidcAuthorizationCode)) && a.push("code"), a;
   }
   /**
    * Returns an OIDC configuration object based on this authorization
@@ -7558,7 +7860,7 @@ class Yt {
   }) {
     let i = [];
     this.validFlows.forEach((n) => {
-      const c = U.grantType(n);
+      const c = I.grantType(n);
       c && (i = [...i, ...c]);
     });
     const s = [
@@ -7615,7 +7917,7 @@ class Yt {
   jwks() {
     let a = [];
     if (this.jwtPublicKey) {
-      const e = $e(this.jwtPublicKey).export({ format: "jwk" });
+      const e = Qe(this.jwtPublicKey).export({ format: "jwk" });
       e.kid = "1", e.alg = this.jwtKeyType, a.push(e);
     }
     return { keys: a };
@@ -7655,7 +7957,7 @@ class Yt {
     } : {};
   }
 }
-class Gt {
+class ar {
   /**
    * Constructor
    * @param tokenConsumers one or more consumers that will process
@@ -7686,7 +7988,7 @@ class Gt {
    */
   async accessTokenAuthorized(a) {
     try {
-      const e = qe.decodeJwt(a);
+      const e = et.decodeJwt(a);
       for (let t of this.tokenConsumers)
         if (e.iss == t.authServerBaseUrl && (e.aud == t.audience || e.aud == null && t.audience == ""))
           return await t.tokenAuthorized(a, "access");
@@ -7698,44 +8000,45 @@ class Gt {
   }
 }
 export {
-  we as ApiKeyManager,
-  ae as Authenticator,
-  _ as Crypto,
-  ct as DoubleSubmitCsrfToken,
-  Mt as DummyFactor2Authenticator,
-  X as EmailAuthenticator,
-  Rt as InMemoryKeyStorage,
-  zt as InMemoryOAuthAuthorizationStorage,
-  Bt as InMemoryOAuthClientStorage,
-  xt as InMemoryUserStorage,
-  z as KeyStorage,
-  $t as LdapAuthenticator,
-  le as LdapUserStorage,
-  Ee as LocalPasswordAuthenticator,
-  Yt as OAuthAuthorizationServer,
-  pe as OAuthAuthorizationStorage,
-  mt as OAuthClientBackend,
-  J as OAuthClientManager,
-  ye as OAuthClientStorage,
-  Gt as OAuthResourceServer,
-  ht as OAuthTokenConsumer,
+  ke as ApiKeyManager,
+  de as Authenticator,
+  k as Crypto,
+  yt as DoubleSubmitCsrfToken,
+  Zt as DummyFactor2Authenticator,
+  ne as EmailAuthenticator,
+  Mt as InMemoryKeyStorage,
+  qt as InMemoryOAuthAuthorizationStorage,
+  $t as InMemoryOAuthClientStorage,
+  Vt as InMemoryUserStorage,
+  V as KeyStorage,
+  Xt as LdapAuthenticator,
+  ge as LdapUserStorage,
+  Ke as LocalPasswordAuthenticator,
+  ir as OAuthAuthorizationServer,
+  Ee as OAuthAuthorizationStorage,
+  De as OAuthClientBackend,
+  Q as OAuthClientManager,
+  ve as OAuthClientStorage,
+  ar as OAuthResourceServer,
+  St as OAuthTokenConsumer,
+  er as OidcAuthenticator,
   g as ParamType,
-  Ie as PasswordAuthenticator,
-  jt as PostgresKeyStorage,
-  Vt as PostgresOAuthAuthorizationStorage,
-  Ht as PostgresOAuthClientStorage,
-  Lt as PostgresUserStorage,
-  Ft as PrismaKeyStorage,
-  Dt as PrismaOAuthAuthorizationStorage,
-  Nt as PrismaOAuthClientStorage,
-  Z as PrismaUserStorage,
-  x as SessionCookie,
-  Jt as SessionManager,
-  ee as SmsAuthenticator,
-  D as TokenEmailer,
-  qt as TotpAuthenticator,
-  Pe as TwilioAuthenticator,
-  L as UserStorage,
+  Re as PasswordAuthenticator,
+  Jt as PostgresKeyStorage,
+  Gt as PostgresOAuthAuthorizationStorage,
+  Yt as PostgresOAuthClientStorage,
+  Wt as PostgresUserStorage,
+  Lt as PrismaKeyStorage,
+  Ht as PrismaOAuthAuthorizationStorage,
+  jt as PrismaOAuthClientStorage,
+  se as PrismaUserStorage,
+  j as SessionCookie,
+  rr as SessionManager,
+  le as SmsAuthenticator,
+  L as TokenEmailer,
+  Qt as TotpAuthenticator,
+  Be as TwilioAuthenticator,
+  q as UserStorage,
   w as setParameter,
-  Wt as toCookieSerializeOptions
+  tr as toCookieSerializeOptions
 };