@crossauth/common 0.0.14 → 0.0.15

package/dist/index.js

@@ -4,34 +4,34 @@ var G = (e) => {
 };
 var pe = (e, t, r) => t in e ? fe(e, t, { enumerable: !0, configurable: !0, writable: !0, value: r }) : e[t] = r;
 var a = (e, t, r) => pe(e, typeof t != "symbol" ? t + "" : t, r), Y = (e, t, r) => t.has(e) || G("Cannot " + r);
-var u = (e, t, r) => (Y(e, t, "read from private field"), r ? r.call(e) : t.get(e)), O = (e, t, r) => t.has(e) ? G("Cannot add the same private member more than once") : t instanceof WeakSet ? t.add(e) : t.set(e, r), _ = (e, t, r, n) => (Y(e, t, "write to private field"), n ? n.call(e, r) : t.set(e, r), r);
-class k {
+var f = (e, t, r) => (Y(e, t, "read from private field"), r ? r.call(e) : t.get(e)), K = (e, t, r) => t.has(e) ? G("Cannot add the same private member more than once") : t instanceof WeakSet ? t.add(e) : t.set(e, r), S = (e, t, r, n) => (Y(e, t, "write to private field"), n ? n.call(e, r) : t.set(e, r), r);
+class P {
 }
 /** Ordinary, active user who can log in freely */
-a(k, "active", "active"), /** Deactivated account.  User cannot log in */
-a(k, "disabled", "disabled"), /** Two factor authentication has been actived for this user
+a(P, "active", "active"), /** Deactivated account.  User cannot log in */
+a(P, "disabled", "disabled"), /** Two factor authentication has been actived for this user
  * but has not yet been configured.  Once a user logs in,
  * they will be directed to a page to configure 2FA and will
  * not be able to do anything else (that requires login) until
  * they have done so.
  */
-a(k, "awaitingTwoFactorSetup", "awaitingtwofactorsetup"), /** Email verification has been turned on but user has not
+a(P, "awaitingTwoFactorSetup", "awaitingtwofactorsetup"), /** Email verification has been turned on but user has not
  * verified his or her email address.  Cannot log on until it has
  * been verified.
  */
-a(k, "awaitingEmailVerification", "awaitingemailverification"), /**
+a(P, "awaitingEmailVerification", "awaitingemailverification"), /**
  * If the state is set to this, the user may not access any
  * login-required functions unless he or she has changed their password.
  * 
  * Upon login, the user is redirected to the change password page.
  */
-a(k, "passwordChangeNeeded", "passwordchangeneeded"), /**
+a(P, "passwordChangeNeeded", "passwordchangeneeded"), /**
  * If the state is set to this, the user may not access any
  * login-required functions unless he or she has reset their password.
  * 
  * Upon login, the user is redirected to the reset password page.
  */
-a(k, "passwordResetNeeded", "passwordresetneeded"), /**
+a(P, "passwordResetNeeded", "passwordresetneeded"), /**
  * If the state is set to this, the user may not access any
  * login-required functions unless he or she has reset their second
  * factor configuration.
@@ -42,14 +42,14 @@ a(k, "passwordResetNeeded", "passwordresetneeded"), /**
  * this value and the user will then be prompted to configure 2FA 
  * upon login.
  */
-a(k, "factor2ResetNeeded", "factor2resetneeded"), /**
+a(P, "factor2ResetNeeded", "factor2resetneeded"), /**
  * If the state is set to this, the user may not access any
  * login-required functions unless he or she has reset their password
  * and then resets factor2.
  * 
  * Upon login, the user is redirected to the reset password page.
  */
-a(k, "passwordAndFactor2ResetNeeded", "passwordandfactor2resetneeded");
+a(P, "passwordAndFactor2ResetNeeded", "passwordandfactor2resetneeded");
 class C {
 }
 /** Session ID */
@@ -72,8 +72,8 @@ class g extends Error {
    * @param message if provided, this error will display.  Otherwise a default one for the error code will be used.
    */
   constructor(r, n = void 0) {
-    let i, s = 500;
-    r == 0 ? (i = "User does not exist", s = 401) : r == 1 ? (i = "Password doesn't match", s = 401) : r == 3 ? (i = "Username or password incorrect", s = 401) : r == 4 ? (i = "Client id is invalid", s = 401) : r == 5 ? (i = "Client ID or name already exists", s = 500) : r == 6 ? (i = "Client secret is invalid", s = 401) : r == 7 ? (i = "Client id or secret is invalid", s = 401) : r == 8 ? (i = "Redirect Uri is not registered", s = 401) : r == 9 ? (i = "Invalid OAuth flow type", s = 500) : r == 2 ? (i = "No user exists with that email address", s = 401) : r == 10 ? (i = "Account is not active", s = 403) : r == 33 ? (i = "Username is not in an allowed format", s = 400) : r == 31 ? (i = "Email is not in an allowed format", s = 400) : r == 32 ? (i = "Phone number is not in an allowed format", s = 400) : r == 11 ? (i = "Email address has not been verified", s = 403) : r == 12 ? (i = "Two-factor setup is not complete", s = 403) : r == 13 ? (i = "Not authorized", s = 401) : r == 14 ? (i = "Client not authorized", s = 401) : r == 15 ? (i = "Invalid scope", s = 403) : r == 16 ? (i = "Insufficient scope", s = 403) : r == 23 ? i = "Connection failure" : r == 22 ? (i = "Token has expired", s = 401) : r == 24 ? i = "Hash is not in a valid format" : r == 19 ? (i = "Key is invalid", s = 401) : r == 18 ? (i = "You do not have permission to access this resource", s = 403) : r == 17 ? (i = "You do not have the right privileges to access this resource", s = 401) : r == 20 ? (i = "CSRF token is invalid", s = 401) : r == 21 ? (i = "Session cookie is invalid", s = 401) : r == 25 ? i = "Algorithm not supported" : r == 26 ? i = "Attempt to create a key that already exists" : r == 27 ? (i = "User must change password", s = 403) : r == 28 ? (i = "User must reset password", s = 403) : r == 29 ? (i = "User must reset 2FA", s = 403) : r == 30 ? i = "There was an error in the configuration" : r == 34 ? (i = "Passwords do not match", s = 401) : r == 35 ? (i = "Token is not valid", s = 401) : r == 36 ? (i = "MFA is required", s = 401) : r == 37 ? (i = "Password format was incorrect", s = 401) : r == 40 ? (i = "User already exists", s = 400) : r == 42 ? (i = "The request is invalid", s = 400) : r == 38 ? (i = "Session data has unexpected format", s = 500) : r == 39 ? (i = "Couldn't execute a fetch", s = 500) : r == 43 ? (i = "Waiting for authorization", s = 200) : r == 44 ? (i = "Slow polling down by 5 seconds", s = 200) : r == 45 ? (i = "Token has expired", s = 401) : r == 46 ? (i = "Database update/insert caused a constraint violation", s = 500) : r == 47 ? (i = "This method has not been implemented", s = 500) : (i = "Unknown error", s = 500), n != null && !Array.isArray(n) ? i = n : Array.isArray(n) && (i = n.join(". "));
+    let i, o = 500;
+    r == 0 ? (i = "User does not exist", o = 401) : r == 1 ? (i = "Password doesn't match", o = 401) : r == 3 ? (i = "Username or password incorrect", o = 401) : r == 4 ? (i = "Client id is invalid", o = 401) : r == 5 ? (i = "Client ID or name already exists", o = 500) : r == 6 ? (i = "Client secret is invalid", o = 401) : r == 7 ? (i = "Client id or secret is invalid", o = 401) : r == 8 ? (i = "Redirect Uri is not registered", o = 401) : r == 9 ? (i = "Invalid OAuth flow type", o = 500) : r == 2 ? (i = "No user exists with that email address", o = 401) : r == 10 ? (i = "Account is not active", o = 403) : r == 33 ? (i = "Username is not in an allowed format", o = 400) : r == 31 ? (i = "Email is not in an allowed format", o = 400) : r == 32 ? (i = "Phone number is not in an allowed format", o = 400) : r == 11 ? (i = "Email address has not been verified", o = 403) : r == 12 ? (i = "Two-factor setup is not complete", o = 403) : r == 13 ? (i = "Not authorized", o = 401) : r == 14 ? (i = "Client not authorized", o = 401) : r == 15 ? (i = "Invalid scope", o = 403) : r == 16 ? (i = "Insufficient scope", o = 403) : r == 23 ? i = "Connection failure" : r == 22 ? (i = "Token has expired", o = 401) : r == 24 ? i = "Hash is not in a valid format" : r == 19 ? (i = "Key is invalid", o = 401) : r == 18 ? (i = "You do not have permission to access this resource", o = 403) : r == 17 ? (i = "You do not have the right privileges to access this resource", o = 401) : r == 20 ? (i = "CSRF token is invalid", o = 401) : r == 21 ? (i = "Session cookie is invalid", o = 401) : r == 25 ? i = "Algorithm not supported" : r == 26 ? i = "Attempt to create a key that already exists" : r == 27 ? (i = "User must change password", o = 403) : r == 28 ? (i = "User must reset password", o = 403) : r == 29 ? (i = "User must reset 2FA", o = 403) : r == 30 ? i = "There was an error in the configuration" : r == 34 ? (i = "Passwords do not match", o = 401) : r == 35 ? (i = "Token is not valid", o = 401) : r == 36 ? (i = "MFA is required", o = 401) : r == 37 ? (i = "Password format was incorrect", o = 401) : r == 40 ? (i = "User already exists", o = 400) : r == 42 ? (i = "The request is invalid", o = 400) : r == 38 ? (i = "Session data has unexpected format", o = 500) : r == 39 ? (i = "Couldn't execute a fetch", o = 500) : r == 43 ? (i = "Waiting for authorization", o = 200) : r == 44 ? (i = "Slow polling down by 5 seconds", o = 200) : r == 45 ? (i = "Token has expired", o = 401) : r == 46 ? (i = "Database update/insert caused a constraint violation", o = 500) : r == 47 ? (i = "This method has not been implemented", o = 500) : (i = "Unknown error", o = 500), n != null && !Array.isArray(n) ? i = n : Array.isArray(n) && (i = n.join(". "));
     super(i);
     /** `typeof` won't work on this class.  To determine if the 
      * object is a `CrossauthError`, check for presence of this member.
@@ -90,13 +90,13 @@ class g extends Error {
      * it will be a concatenation of them with `". "` in between.
      */
     a(this, "messages");
-    this.code = r, this.codeName = y[r], this.httpStatus = s, this.name = "CrossauthError", Array.isArray(n) ? this.messages = n : this.messages = [i], Object.setPrototypeOf(this, g.prototype);
+    this.code = r, this.codeName = y[r], this.httpStatus = o, this.name = "CrossauthError", Array.isArray(n) ? this.messages = n : this.messages = [i], Object.setPrototypeOf(this, g.prototype);
   }
   /**
    * OAuth defines certain error types.  To convert the error in an OAuth
    * response into a CrossauthError object, call this function.
    * 
-   * @param error as returned by an OAuth call (converted to an {@link @crossauth/common!ErrorCode}).
+   * @param error as returned by an OAuth call (converted to an {@link ErrorCode}).
    * @param error_description as returned by an OAuth call (put in the `message`)
    * @returns a `CrossauthError` instance.
    */
@@ -180,7 +180,7 @@ class g extends Error {
    * it.  
    * If not and it is an object with `errorCode` in it, creates a 
    * CrossauthError from that and `errorMessage`, if present.
-   * Otherwise creates a `CrossauthError` object with {@link @crossauth/common!ErrorCode}
+   * Otherwise creates a `CrossauthError` object with {@link ErrorCode}
    * of `Unknown` from it, setting the `message` if possible.
    * 
    * @param e the error to convert.
@@ -190,13 +190,13 @@ class g extends Error {
     if (r instanceof Error)
       return "isCrossauthError" in r ? r : new g(48, r.message);
     if ("errorCode" in r) {
-      let s = 48;
+      let o = 48;
       try {
-        s = Number(r.errorCode) ?? 48;
+        o = Number(r.errorCode) ?? 48;
       } catch {
       }
-      let o = n ?? y[s];
-      return "errorMessage" in r ? o = r.errorMessage : "message" in r && (o = r.message), new g(s, o);
+      let s = n ?? y[o];
+      return "errorMessage" in r ? s = r.errorMessage : "message" in r && (s = r.message), new g(o, s);
     }
     let i = n ?? y[
       48
@@ -326,7 +326,7 @@ a(m, "Error", 1), /** Log errors and warning */
 a(m, "Warn", 2), /** Log errors, warnings and info messages */
 a(m, "Info", 3), /** Log everything */
 a(m, "Debug", 4), a(m, "levelName", ["NONE", "ERROR", "WARN", "INFO", "DEBUG"]);
-let d = m;
+let l = m;
 function h(e) {
   let t;
   typeof e == "object" && "err" in e && typeof e.err == "object" && (t = e.err.stack);
@@ -348,7 +348,7 @@ function h(e) {
   }
   return typeof e == "string" || globalThis.crossauthLoggerAcceptsJson ? e : JSON.stringify(e);
 }
-globalThis.crossauthLogger = new d(d.None);
+globalThis.crossauthLogger = new l(l.None);
 globalThis.crossauthLoggerAcceptsJson = !0;
 const te = {
   issuer: "",
@@ -367,7 +367,7 @@ const te = {
   require_request_uri_registration: !1
 }, F = crypto, re = (e) => e instanceof CryptoKey, H = new TextEncoder(), z = new TextDecoder();
 function ge(...e) {
-  const t = e.reduce((i, { length: s }) => i + s, 0), r = new Uint8Array(t);
+  const t = e.reduce((i, { length: o }) => i + o, 0), r = new Uint8Array(t);
   let n = 0;
   for (const i of e)
     r.set(i, n), n += i.length;
@@ -378,7 +378,7 @@ const ye = (e) => {
   for (let n = 0; n < t.length; n++)
     r[n] = t.charCodeAt(n);
   return r;
-}, K = (e) => {
+}, N = (e) => {
   let t = e;
   t instanceof Uint8Array && (t = z.decode(t)), t = t.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, "");
   try {
@@ -412,7 +412,7 @@ class v extends $ {
     return "ERR_JWS_INVALID";
   }
 }
-class E extends $ {
+class O extends $ {
   constructor() {
     super(...arguments), this.code = "ERR_JWT_INVALID";
   }
@@ -428,7 +428,7 @@ class me extends $ {
     return "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
   }
 }
-function A(e, t = "algorithm.name") {
+function k(e, t = "algorithm.name") {
   return new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);
 }
 function J(e, t) {
@@ -459,51 +459,51 @@ function ve(e, t) {
     throw new TypeError(r);
   }
 }
-function Se(e, t, ...r) {
+function _e(e, t, ...r) {
   switch (t) {
     case "HS256":
     case "HS384":
     case "HS512": {
       if (!J(e.algorithm, "HMAC"))
-        throw A("HMAC");
+        throw k("HMAC");
       const n = parseInt(t.slice(2), 10);
       if (L(e.algorithm.hash) !== n)
-        throw A(`SHA-${n}`, "algorithm.hash");
+        throw k(`SHA-${n}`, "algorithm.hash");
       break;
     }
     case "RS256":
     case "RS384":
     case "RS512": {
       if (!J(e.algorithm, "RSASSA-PKCS1-v1_5"))
-        throw A("RSASSA-PKCS1-v1_5");
+        throw k("RSASSA-PKCS1-v1_5");
       const n = parseInt(t.slice(2), 10);
       if (L(e.algorithm.hash) !== n)
-        throw A(`SHA-${n}`, "algorithm.hash");
+        throw k(`SHA-${n}`, "algorithm.hash");
       break;
     }
     case "PS256":
     case "PS384":
     case "PS512": {
       if (!J(e.algorithm, "RSA-PSS"))
-        throw A("RSA-PSS");
+        throw k("RSA-PSS");
       const n = parseInt(t.slice(2), 10);
       if (L(e.algorithm.hash) !== n)
-        throw A(`SHA-${n}`, "algorithm.hash");
+        throw k(`SHA-${n}`, "algorithm.hash");
       break;
     }
     case "EdDSA": {
       if (e.algorithm.name !== "Ed25519" && e.algorithm.name !== "Ed448")
-        throw A("Ed25519 or Ed448");
+        throw k("Ed25519 or Ed448");
       break;
     }
     case "ES256":
     case "ES384":
     case "ES512": {
       if (!J(e.algorithm, "ECDSA"))
-        throw A("ECDSA");
+        throw k("ECDSA");
       const n = we(t);
       if (e.algorithm.namedCurve !== n)
-        throw A(n, "algorithm.namedCurve");
+        throw k(n, "algorithm.namedCurve");
       break;
     }
     default:
@@ -523,7 +523,7 @@ const X = (e, ...t) => ie("Key must be ", e, ...t);
 function ne(e, t, ...r) {
   return ie(`Key for the ${e} algorithm must be `, t, ...r);
 }
-const se = (e) => re(e) ? !0 : (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject", M = ["CryptoKey"], _e = (...e) => {
+const oe = (e) => re(e) ? !0 : (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject", M = ["CryptoKey"], Se = (...e) => {
   const t = e.filter(Boolean);
   if (t.length === 0 || t.length === 1)
     return !0;
@@ -534,10 +534,10 @@ const se = (e) => re(e) ? !0 : (e == null ? void 0 : e[Symbol.toStringTag]) ===
       r = new Set(i);
       continue;
     }
-    for (const s of i) {
-      if (r.has(s))
+    for (const o of i) {
+      if (r.has(o))
         return !1;
-      r.add(s);
+      r.add(o);
     }
   }
   return !0;
@@ -634,7 +634,7 @@ function Ae(e) {
   }
   return { algorithm: t, keyUsages: r };
 }
-const oe = async (e) => {
+const se = async (e) => {
   if (!e.alg)
     throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
   const { algorithm: t, keyUsages: r } = Ae(e), n = [
@@ -643,99 +643,99 @@ const oe = async (e) => {
     e.key_ops ?? r
   ], i = { ...e };
   return delete i.alg, delete i.use, F.subtle.importKey("jwk", i, ...n);
-}, ae = (e) => K(e);
+}, ae = (e) => N(e);
 let V, j;
 const ce = (e) => (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject", de = async (e, t, r, n) => {
   let i = e.get(t);
   if (i != null && i[n])
     return i[n];
-  const s = await oe({ ...r, alg: n });
-  return i ? i[n] = s : e.set(t, { [n]: s }), s;
-}, Pe = (e, t) => {
+  const o = await se({ ...r, alg: n });
+  return i ? i[n] = o : e.set(t, { [n]: o }), o;
+}, ke = (e, t) => {
   if (ce(e)) {
     let r = e.export({ format: "jwk" });
     return delete r.d, delete r.dp, delete r.dq, delete r.p, delete r.q, delete r.qi, r.k ? ae(r.k) : (j || (j = /* @__PURE__ */ new WeakMap()), de(j, e, r, t));
   }
   return e;
-}, ke = (e, t) => {
+}, Ie = (e, t) => {
   if (ce(e)) {
     let r = e.export({ format: "jwk" });
     return r.k ? ae(r.k) : (V || (V = /* @__PURE__ */ new WeakMap()), de(V, e, r, t));
   }
   return e;
-}, Ie = { normalizePublicKey: Pe, normalizePrivateKey: ke }, I = (e, t, r = 0) => {
+}, Pe = { normalizePublicKey: ke, normalizePrivateKey: Ie }, T = (e, t, r = 0) => {
   r === 0 && (t.unshift(t.length), t.unshift(6));
   const n = e.indexOf(t[0], r);
   if (n === -1)
     return !1;
   const i = e.subarray(n, n + t.length);
-  return i.length !== t.length ? !1 : i.every((s, o) => s === t[o]) || I(e, t, n + 1);
+  return i.length !== t.length ? !1 : i.every((o, s) => o === t[s]) || T(e, t, n + 1);
 }, Q = (e) => {
   switch (!0) {
-    case I(e, [42, 134, 72, 206, 61, 3, 1, 7]):
+    case T(e, [42, 134, 72, 206, 61, 3, 1, 7]):
       return "P-256";
-    case I(e, [43, 129, 4, 0, 34]):
+    case T(e, [43, 129, 4, 0, 34]):
       return "P-384";
-    case I(e, [43, 129, 4, 0, 35]):
+    case T(e, [43, 129, 4, 0, 35]):
       return "P-521";
-    case I(e, [43, 101, 110]):
+    case T(e, [43, 101, 110]):
       return "X25519";
-    case I(e, [43, 101, 111]):
+    case T(e, [43, 101, 111]):
       return "X448";
-    case I(e, [43, 101, 112]):
+    case T(e, [43, 101, 112]):
       return "Ed25519";
-    case I(e, [43, 101, 113]):
+    case T(e, [43, 101, 113]):
       return "Ed448";
     default:
       throw new b("Invalid or unsupported EC Key Curve or OKP Key Sub Type");
   }
 }, le = async (e, t, r, n, i) => {
-  let s, o;
-  const l = new Uint8Array(atob(r.replace(e, "")).split("").map((p) => p.charCodeAt(0))), f = t === "spki";
+  let o, s;
+  const c = new Uint8Array(atob(r.replace(e, "")).split("").map((p) => p.charCodeAt(0))), u = t === "spki";
   switch (n) {
     case "PS256":
     case "PS384":
     case "PS512":
-      s = { name: "RSA-PSS", hash: `SHA-${n.slice(-3)}` }, o = f ? ["verify"] : ["sign"];
+      o = { name: "RSA-PSS", hash: `SHA-${n.slice(-3)}` }, s = u ? ["verify"] : ["sign"];
       break;
     case "RS256":
     case "RS384":
     case "RS512":
-      s = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${n.slice(-3)}` }, o = f ? ["verify"] : ["sign"];
+      o = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${n.slice(-3)}` }, s = u ? ["verify"] : ["sign"];
       break;
     case "RSA-OAEP":
     case "RSA-OAEP-256":
     case "RSA-OAEP-384":
     case "RSA-OAEP-512":
-      s = {
+      o = {
         name: "RSA-OAEP",
         hash: `SHA-${parseInt(n.slice(-3), 10) || 1}`
-      }, o = f ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
+      }, s = u ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
       break;
     case "ES256":
-      s = { name: "ECDSA", namedCurve: "P-256" }, o = f ? ["verify"] : ["sign"];
+      o = { name: "ECDSA", namedCurve: "P-256" }, s = u ? ["verify"] : ["sign"];
       break;
     case "ES384":
-      s = { name: "ECDSA", namedCurve: "P-384" }, o = f ? ["verify"] : ["sign"];
+      o = { name: "ECDSA", namedCurve: "P-384" }, s = u ? ["verify"] : ["sign"];
       break;
     case "ES512":
-      s = { name: "ECDSA", namedCurve: "P-521" }, o = f ? ["verify"] : ["sign"];
+      o = { name: "ECDSA", namedCurve: "P-521" }, s = u ? ["verify"] : ["sign"];
       break;
     case "ECDH-ES":
     case "ECDH-ES+A128KW":
     case "ECDH-ES+A192KW":
     case "ECDH-ES+A256KW": {
-      const p = Q(l);
-      s = p.startsWith("P-") ? { name: "ECDH", namedCurve: p } : { name: p }, o = f ? [] : ["deriveBits"];
+      const p = Q(c);
+      o = p.startsWith("P-") ? { name: "ECDH", namedCurve: p } : { name: p }, s = u ? [] : ["deriveBits"];
       break;
     }
     case "EdDSA":
-      s = { name: Q(l) }, o = f ? ["verify"] : ["sign"];
+      o = { name: Q(c) }, s = u ? ["verify"] : ["sign"];
       break;
     default:
       throw new b('Invalid or unsupported "alg" (Algorithm) value');
   }
-  return F.subtle.importKey(t, l, s, !1, o);
+  return F.subtle.importKey(t, c, o, !1, s);
 }, Te = (e, t, r) => le(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", e, t), Re = (e, t, r) => le(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", e, t);
 async function Ee(e, t, r) {
   if (typeof e != "string" || e.indexOf("-----BEGIN PUBLIC KEY-----") !== 0)
@@ -754,26 +754,26 @@ async function Z(e, t) {
     case "oct":
       if (typeof e.k != "string" || !e.k)
         throw new TypeError('missing "k" (Key Value) Parameter value');
-      return K(e.k);
+      return N(e.k);
     case "RSA":
       if (e.oth !== void 0)
         throw new b('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
     case "EC":
     case "OKP":
-      return oe({ ...e, alg: t });
+      return se({ ...e, alg: t });
     default:
       throw new b('Unsupported "kty" (Key Type) Parameter value');
   }
 }
 const q = (e) => e == null ? void 0 : e[Symbol.toStringTag], Ke = (e, t) => {
   if (!(t instanceof Uint8Array)) {
-    if (!se(t))
+    if (!oe(t))
       throw new TypeError(ne(e, t, ...M, "Uint8Array"));
     if (t.type !== "secret")
       throw new TypeError(`${q(t)} instances for symmetric algorithms must be of type "secret"`);
   }
 }, Ne = (e, t, r) => {
-  if (!se(t))
+  if (!oe(t))
     throw new TypeError(ne(e, t, ...M));
   if (t.type === "secret")
     throw new TypeError(`${q(t)} instances for asymmetric algorithms must not be of type "secret"`);
@@ -789,17 +789,17 @@ function xe(e, t, r, n, i) {
     throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');
   if (!n || n.crit === void 0)
     return /* @__PURE__ */ new Set();
-  if (!Array.isArray(n.crit) || n.crit.length === 0 || n.crit.some((o) => typeof o != "string" || o.length === 0))
+  if (!Array.isArray(n.crit) || n.crit.length === 0 || n.crit.some((s) => typeof s != "string" || s.length === 0))
     throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
-  let s;
-  s = t;
-  for (const o of n.crit) {
-    if (!s.has(o))
-      throw new b(`Extension Header Parameter "${o}" is not recognized`);
-    if (i[o] === void 0)
-      throw new e(`Extension Header Parameter "${o}" is missing`);
-    if (s.get(o) && n[o] === void 0)
-      throw new e(`Extension Header Parameter "${o}" MUST be integrity protected`);
+  let o;
+  o = t;
+  for (const s of n.crit) {
+    if (!o.has(s))
+      throw new b(`Extension Header Parameter "${s}" is not recognized`);
+    if (i[s] === void 0)
+      throw new e(`Extension Header Parameter "${s}" is missing`);
+    if (o.get(s) && n[s] === void 0)
+      throw new e(`Extension Header Parameter "${s}" MUST be integrity protected`);
   }
   return new Set(n.crit);
 }
@@ -828,9 +828,9 @@ function ze(e, t) {
       throw new b(`alg ${e} is not supported either by JOSE or your javascript runtime`);
   }
 }
-async function We(e, t, r) {
-  if (t = await Ie.normalizePublicKey(t, e), re(t))
-    return Se(t, e, r), t;
+async function De(e, t, r) {
+  if (t = await Pe.normalizePublicKey(t, e), re(t))
+    return _e(t, e, r), t;
   if (t instanceof Uint8Array) {
     if (!e.startsWith("HS"))
       throw new TypeError(X(t, ...M));
@@ -838,12 +838,12 @@ async function We(e, t, r) {
   }
   throw new TypeError(X(t, ...M, "Uint8Array"));
 }
-const De = async (e, t, r, n) => {
-  const i = await We(e, t, "verify");
+const We = async (e, t, r, n) => {
+  const i = await De(e, t, "verify");
   be(e, i);
-  const s = ze(e, i.algorithm);
+  const o = ze(e, i.algorithm);
   try {
-    return await F.subtle.verify(s, i, r, n);
+    return await F.subtle.verify(o, i, r, n);
   } catch {
     return !1;
   }
@@ -864,60 +864,60 @@ async function He(e, t, r) {
   let n = {};
   if (e.protected)
     try {
-      const ue = K(e.protected);
+      const ue = N(e.protected);
       n = JSON.parse(z.decode(ue));
     } catch {
       throw new v("JWS Protected Header is invalid");
     }
-  if (!_e(n, e.header))
+  if (!Se(n, e.header))
     throw new v("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
   const i = {
     ...n,
     ...e.header
-  }, s = xe(v, /* @__PURE__ */ new Map([["b64", !0]]), r == null ? void 0 : r.crit, n, i);
-  let o = !0;
-  if (s.has("b64") && (o = n.b64, typeof o != "boolean"))
+  }, o = xe(v, /* @__PURE__ */ new Map([["b64", !0]]), r == null ? void 0 : r.crit, n, i);
+  let s = !0;
+  if (o.has("b64") && (s = n.b64, typeof s != "boolean"))
     throw new v('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-  const { alg: l } = i;
-  if (typeof l != "string" || !l)
+  const { alg: c } = i;
+  if (typeof c != "string" || !c)
     throw new v('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-  if (o) {
+  if (s) {
     if (typeof e.payload != "string")
       throw new v("JWS Payload must be a string");
   } else if (typeof e.payload != "string" && !(e.payload instanceof Uint8Array))
     throw new v("JWS Payload must be a string or an Uint8Array instance");
-  let f = !1;
-  typeof t == "function" && (t = await t(n, e), f = !0), Ue(l, t, "verify");
+  let u = !1;
+  typeof t == "function" && (t = await t(n, e), u = !0), Ue(c, t, "verify");
   const p = ge(H.encode(e.protected ?? ""), H.encode("."), typeof e.payload == "string" ? H.encode(e.payload) : e.payload);
-  let P;
+  let I;
   try {
-    P = K(e.signature);
+    I = N(e.signature);
   } catch {
     throw new v("Failed to base64url decode the signature");
   }
-  if (!await De(l, t, P, p))
+  if (!await We(c, t, I, p))
     throw new me();
-  let W;
-  if (o)
+  let D;
+  if (s)
     try {
-      W = K(e.payload);
+      D = N(e.payload);
     } catch {
       throw new v("Failed to base64url decode the payload");
     }
-  else typeof e.payload == "string" ? W = H.encode(e.payload) : W = e.payload;
-  const D = { payload: W };
-  return e.protected !== void 0 && (D.protectedHeader = n), e.header !== void 0 && (D.unprotectedHeader = e.header), f ? { ...D, key: t } : D;
+  else typeof e.payload == "string" ? D = H.encode(e.payload) : D = e.payload;
+  const W = { payload: D };
+  return e.protected !== void 0 && (W.protectedHeader = n), e.header !== void 0 && (W.unprotectedHeader = e.header), u ? { ...W, key: t } : W;
 }
 async function Je(e, t, r) {
   if (e instanceof Uint8Array && (e = z.decode(e)), typeof e != "string")
     throw new v("Compact JWS must be a string or Uint8Array");
-  const { 0: n, 1: i, 2: s, length: o } = e.split(".");
-  if (o !== 3)
+  const { 0: n, 1: i, 2: o, length: s } = e.split(".");
+  if (s !== 3)
     throw new v("Invalid Compact JWS");
-  const l = await He({ payload: i, protected: n, signature: s }, t, r), f = { payload: l.payload, protectedHeader: l.protectedHeader };
-  return typeof t == "function" ? { ...f, key: l.key } : f;
+  const c = await He({ payload: i, protected: n, signature: o }, t, r), u = { payload: c.payload, protectedHeader: c.protectedHeader };
+  return typeof t == "function" ? { ...u, key: c.key } : u;
 }
-const he = K;
+const he = N;
 function qe(e) {
   let t;
   if (typeof e == "string") {
@@ -941,31 +941,31 @@ function qe(e) {
 }
 function Me(e) {
   if (typeof e != "string")
-    throw new E("JWTs must use Compact JWS serialization, JWT must be a string");
+    throw new O("JWTs must use Compact JWS serialization, JWT must be a string");
   const { 1: t, length: r } = e.split(".");
   if (r === 5)
-    throw new E("Only JWTs using Compact JWS serialization can be decoded");
+    throw new O("Only JWTs using Compact JWS serialization can be decoded");
   if (r !== 3)
-    throw new E("Invalid JWT");
+    throw new O("Invalid JWT");
   if (!t)
-    throw new E("JWTs must contain a payload");
+    throw new O("JWTs must contain a payload");
   let n;
   try {
     n = he(t);
   } catch {
-    throw new E("Failed to base64url decode the payload");
+    throw new O("Failed to base64url decode the payload");
   }
   let i;
   try {
     i = JSON.parse(z.decode(n));
   } catch {
-    throw new E("Failed to parse the decoded payload as JSON");
+    throw new O("Failed to parse the decoded payload as JSON");
   }
   if (!x(i))
-    throw new E("Invalid JWT Claims Set");
+    throw new O("Invalid JWT Claims Set");
   return i;
 }
-const c = class c {
+const d = class d {
   /**
    * Returns a user-friendly name for the given flow strings.
    * 
@@ -976,7 +976,7 @@ const c = class c {
   static flowNames(t) {
     let r = {};
     return t.forEach((n) => {
-      n in c.flowName && (r[n] = c.flowName[n]);
+      n in d.flowName && (r[n] = d.flowName[n]);
     }), r;
   }
   /**
@@ -985,7 +985,7 @@ const c = class c {
    * @returns true or false.
    */
   static isValidFlow(t) {
-    return c.allFlows().includes(t);
+    return d.allFlows().includes(t);
   }
   /**
    * Returns true only if all given strings are valid flows
@@ -995,19 +995,19 @@ const c = class c {
   static areAllValidFlows(t) {
     let r = !0;
     return t.forEach((n) => {
-      c.isValidFlow(n) || (r = !1);
+      d.isValidFlow(n) || (r = !1);
     }), r;
   }
   static allFlows() {
     return [
-      c.AuthorizationCode,
-      c.AuthorizationCodeWithPKCE,
-      c.ClientCredentials,
-      c.RefreshToken,
-      c.DeviceCode,
-      c.Password,
-      c.PasswordMfa,
-      c.OidcAuthorizationCode
+      d.AuthorizationCode,
+      d.AuthorizationCodeWithPKCE,
+      d.ClientCredentials,
+      d.RefreshToken,
+      d.DeviceCode,
+      d.Password,
+      d.PasswordMfa,
+      d.OidcAuthorizationCode
     ];
   }
   /**
@@ -1018,51 +1018,51 @@ const c = class c {
    */
   static grantType(t) {
     switch (t) {
-      case c.AuthorizationCode:
-      case c.AuthorizationCodeWithPKCE:
-      case c.OidcAuthorizationCode:
+      case d.AuthorizationCode:
+      case d.AuthorizationCodeWithPKCE:
+      case d.OidcAuthorizationCode:
         return ["authorization_code"];
-      case c.ClientCredentials:
+      case d.ClientCredentials:
         return ["client_credentials"];
-      case c.RefreshToken:
+      case d.RefreshToken:
         return ["refresh_token"];
-      case c.Password:
+      case d.Password:
         return ["password"];
-      case c.PasswordMfa:
+      case d.PasswordMfa:
         return ["http://auth0.com/oauth/grant-type/mfa-otp", "http://auth0.com/oauth/grant-type/mfa-oob"];
-      case c.DeviceCode:
+      case d.DeviceCode:
         return ["urn:ietf:params:oauth:grant-type:device_code"];
     }
   }
 };
 /** All flows are allowed */
-a(c, "All", "all"), /** OAuth authorization code flow (without PKCE) */
-a(c, "AuthorizationCode", "authorizationCode"), /** OAuth authorization code flow with PKCE */
-a(c, "AuthorizationCodeWithPKCE", "authorizationCodeWithPKCE"), /** Auth client credentials flow */
-a(c, "ClientCredentials", "clientCredentials"), /** OAuth refresh token flow */
-a(c, "RefreshToken", "refreshToken"), /** OAuth device code flow */
-a(c, "DeviceCode", "deviceCode"), /** OAuth password flow */
-a(c, "Password", "password"), /** The Auth0 password MFA extension to the password flow */
-a(c, "PasswordMfa", "passwordMfa"), /** The OpenID Connect authorization code flow, with or without
+a(d, "All", "all"), /** OAuth authorization code flow (without PKCE) */
+a(d, "AuthorizationCode", "authorizationCode"), /** OAuth authorization code flow with PKCE */
+a(d, "AuthorizationCodeWithPKCE", "authorizationCodeWithPKCE"), /** Auth client credentials flow */
+a(d, "ClientCredentials", "clientCredentials"), /** OAuth refresh token flow */
+a(d, "RefreshToken", "refreshToken"), /** OAuth device code flow */
+a(d, "DeviceCode", "deviceCode"), /** OAuth password flow */
+a(d, "Password", "password"), /** The Auth0 password MFA extension to the password flow */
+a(d, "PasswordMfa", "passwordMfa"), /** The OpenID Connect authorization code flow, with or without
  * PKCE.
  */
-a(c, "OidcAuthorizationCode", "oidcAuthorizationCode"), /** A user friendly name for the given flow ID
+a(d, "OidcAuthorizationCode", "oidcAuthorizationCode"), /** A user friendly name for the given flow ID
  * 
  * For example, if you pass "authorizationCode" 
  * (`OAuthFlows.AuthorizationCode`) you will get `"Authorization Code"`.
  */
-a(c, "flowName", {
-  [c.AuthorizationCode]: "Authorization Code",
-  [c.AuthorizationCodeWithPKCE]: "Authorization Code with PKCE",
-  [c.ClientCredentials]: "Client Credentials",
-  [c.RefreshToken]: "Refresh Token",
-  [c.DeviceCode]: "Device Code",
-  [c.Password]: "Password",
-  [c.PasswordMfa]: "Password MFA",
-  [c.OidcAuthorizationCode]: "OIDC Authorization Code"
+a(d, "flowName", {
+  [d.AuthorizationCode]: "Authorization Code",
+  [d.AuthorizationCodeWithPKCE]: "Authorization Code with PKCE",
+  [d.ClientCredentials]: "Client Credentials",
+  [d.RefreshToken]: "Refresh Token",
+  [d.DeviceCode]: "Device Code",
+  [d.Password]: "Password",
+  [d.PasswordMfa]: "Password MFA",
+  [d.OidcAuthorizationCode]: "OIDC Authorization Code"
 });
-let ee = c;
-var w, S, N, T, R;
+let ee = d;
+var w, _, U, R, E;
 class Be {
   /**
    * Constructor.
@@ -1096,23 +1096,23 @@ class Be {
     client_id: r,
     client_secret: n,
     redirect_uri: i,
-    codeChallengeMethod: s,
-    stateLength: o,
-    verifierLength: l,
-    tokenConsumer: f,
+    codeChallengeMethod: o,
+    stateLength: s,
+    verifierLength: c,
+    tokenConsumer: u,
     authServerCredentials: p,
-    authServerMode: P,
-    authServerHeaders: U
+    authServerMode: I,
+    authServerHeaders: A
   }) {
     a(this, "authServerBaseUrl", "");
-    O(this, w);
-    O(this, S);
-    O(this, N);
+    K(this, w);
+    K(this, _);
+    K(this, U);
     a(this, "codeChallengeMethod", "S256");
-    O(this, T);
+    K(this, R);
     a(this, "verifierLength", 32);
     a(this, "redirect_uri");
-    O(this, R, "");
+    K(this, E, "");
     a(this, "stateLength", 32);
     a(this, "authzCode", "");
     a(this, "oidcConfig");
@@ -1120,22 +1120,22 @@ class Be {
     a(this, "authServerHeaders", {});
     a(this, "authServerMode");
     a(this, "authServerCredentials");
-    this.tokenConsumer = f, this.authServerBaseUrl = t, l && (this.verifierLength = l), o && (this.stateLength = o), r && _(this, w, r), n && _(this, S, n), i && (this.redirect_uri = i), s && (this.codeChallengeMethod = s), this.authServerBaseUrl = t, p && (this.authServerCredentials = p), P && (this.authServerMode = P), U && (this.authServerHeaders = U);
+    this.tokenConsumer = u, this.authServerBaseUrl = t, c && (this.verifierLength = c), s && (this.stateLength = s), r && S(this, w, r), n && S(this, _, n), i && (this.redirect_uri = i), o && (this.codeChallengeMethod = o), this.authServerBaseUrl = t, p && (this.authServerCredentials = p), I && (this.authServerMode = I), A && (this.authServerHeaders = A);
   }
   set client_id(t) {
-    _(this, w, t);
+    S(this, w, t);
   }
   set client_secret(t) {
-    _(this, S, t);
+    S(this, _, t);
   }
   set codeVerifier(t) {
-    _(this, T, t);
+    S(this, R, t);
   }
   set codeChallenge(t) {
-    _(this, N, t);
+    S(this, U, t);
   }
   set state(t) {
-    _(this, R, t);
+    S(this, E, t);
   }
   /**
    * Loads OpenID Connect configuration so that the client can determine
@@ -1145,12 +1145,12 @@ class Be {
    *        Otherwise, performs a fetch by appending
    *        `/.well-known/openid-configuration` to the 
    *        `authServerBaseUrl`.
-   * @throws {@link @crossauth/common!CrossauthError} with the following {@link @crossauth/common!ErrorCode}s
+   * @throws {@link CrossauthError} with the following {@link ErrorCode}s
    *   - `Connection` if data from the URL could not be fetched or parsed.
    */
   async loadConfig(t) {
     if (t) {
-      d.logger.debug(h({ msg: "Reading OIDC config locally" })), this.oidcConfig = t;
+      l.logger.debug(h({ msg: "Reading OIDC config locally" })), this.oidcConfig = t;
       return;
     }
     let r;
@@ -1158,11 +1158,11 @@ class Be {
       const n = new URL(
         this.authServerBaseUrl + "/.well-known/openid-configuration"
       );
-      d.logger.debug(h({ msg: `Fetching OIDC config from ${n}` }));
+      l.logger.debug(h({ msg: `Fetching OIDC config from ${n}` }));
       let i = { headers: this.authServerHeaders };
       this.authServerMode && (i.mode = this.authServerMode), this.authServerCredentials && (i.credentials = this.authServerCredentials), r = await fetch(n, i);
     } catch (n) {
-      d.logger.error(h({ err: n }));
+      l.logger.error(h({ err: n }));
     }
     if (!r || !r.ok)
       throw new g(
@@ -1172,8 +1172,8 @@ class Be {
     this.oidcConfig = { ...te };
     try {
       const n = await r.json();
-      for (const [i, s] of Object.entries(n))
-        this.oidcConfig[i] = s;
+      for (const [i, o] of Object.entries(n))
+        this.oidcConfig[i] = o;
     } catch {
       throw new g(
         y.Connection,
@@ -1204,18 +1204,18 @@ class Be {
    *            if no error
    */
   async startAuthorizationCodeFlow(t, r = !1) {
-    var s, o, l;
-    if (d.logger.debug(h({ msg: "Starting authorization code flow" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.response_types_supported.includes("code")) || !((o = this.oidcConfig) != null && o.response_modes_supported.includes("query")))
+    var o, s, c;
+    if (l.logger.debug(h({ msg: "Starting authorization code flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.response_types_supported.includes("code")) || !((s = this.oidcConfig) != null && s.response_modes_supported.includes("query")))
       return {
         error: "invalid_request",
         error_description: "Server does not support authorization code flow"
       };
-    if (!((l = this.oidcConfig) != null && l.authorization_endpoint))
+    if (!((c = this.oidcConfig) != null && c.authorization_endpoint))
       return {
         error: "server_error",
         error_description: "Cannot get authorize endpoint"
       };
-    if (_(this, R, this.randomValue(this.stateLength)), !u(this, w)) return {
+    if (S(this, E, this.randomValue(this.stateLength)), !f(this, w)) return {
       error: "invalid_request",
       error_description: "Cannot make authorization code flow without client id"
     };
@@ -1223,8 +1223,8 @@ class Be {
       error: "invalid_request",
       error_description: "Cannot make authorization code flow without Redirect Uri"
     };
-    let i = this.oidcConfig.authorization_endpoint + "?response_type=code&client_id=" + encodeURIComponent(u(this, w)) + "&state=" + encodeURIComponent(u(this, R)) + "&redirect_uri=" + encodeURIComponent(this.redirect_uri);
-    return t && (i += "&scope=" + encodeURIComponent(t)), r && (_(this, T, this.randomValue(this.verifierLength)), _(this, N, this.codeChallengeMethod == "plain" ? u(this, T) : await this.sha256(u(this, T))), i += "&code_challenge=" + u(this, N)), { url: i };
+    let i = this.oidcConfig.authorization_endpoint + "?response_type=code&client_id=" + encodeURIComponent(f(this, w)) + "&state=" + encodeURIComponent(f(this, E)) + "&redirect_uri=" + encodeURIComponent(this.redirect_uri);
+    return t && (i += "&scope=" + encodeURIComponent(t)), r && (S(this, R, this.randomValue(this.verifierLength)), S(this, U, this.codeChallengeMethod == "plain" ? f(this, R) : await this.sha256(f(this, R))), i += "&code_challenge=" + f(this, U)), { url: i };
   }
   /**
    * This implements the functionality behind the redirect URI
@@ -1247,34 +1247,35 @@ class Be {
    *          request, or `error` and `error_description`.
    */
   async redirectEndpoint(t, r, n, i) {
-    var p, P;
+    var p, I;
     if (this.oidcConfig || await this.loadConfig(), n || !t)
       return n || (n = "server_error"), i || (i = "Unknown error"), { error: n, error_description: i };
-    if (u(this, R) && r != u(this, R))
+    if (f(this, E) && r != f(this, E))
       return { error: "access_denied", error_description: "State is not valid" };
     if (this.authzCode = t, !((p = this.oidcConfig) != null && p.grant_types_supported.includes("authorization_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support authorization code grant"
       };
-    if (!((P = this.oidcConfig) != null && P.token_endpoint))
+    if (!((I = this.oidcConfig) != null && I.token_endpoint))
       return {
         error: "server_error",
         error_description: "Cannot get token endpoint"
       };
-    const s = this.oidcConfig.token_endpoint;
-    let o, l;
-    o = "authorization_code", l = u(this, S);
-    let f = {
-      grant_type: o,
-      client_id: u(this, w),
+    const o = this.oidcConfig.token_endpoint;
+    let s, c;
+    s = "authorization_code", c = f(this, _);
+    let u = {
+      grant_type: s,
+      client_id: f(this, w),
       code: this.authzCode
     };
-    l && (f.client_secret = l), f.code_verifier = u(this, T);
+    c && (u.client_secret = c), u.code_verifier = f(this, R);
     try {
-      return this.post(s, f, this.authServerHeaders);
-    } catch (U) {
-      return d.logger.error(h({ err: U })), {
+      const A = await this.post(o, u, this.authServerHeaders);
+      return A.id_token && !await this.validateIdToken(A.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : A;
+    } catch (A) {
+      return l.logger.error(h({ err: A })), {
         error: "server_error",
         error_description: "Unable to get access token from server"
       };
@@ -1295,29 +1296,29 @@ class Be {
    *          request, or `error` and `error_description`.
    */
   async clientCredentialsFlow(t) {
-    var i, s;
-    if (d.logger.debug(h({ msg: "Starting client credentials flow" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("client_credentials")))
+    var i, o;
+    if (l.logger.debug(h({ msg: "Starting client credentials flow" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("client_credentials")))
       return {
         error: "invalid_request",
         error_description: "Server does not support client credentials grant"
       };
-    if (!((s = this.oidcConfig) != null && s.token_endpoint))
+    if (!((o = this.oidcConfig) != null && o.token_endpoint))
       return { error: "server_error", error_description: "Cannot get token endpoint" };
-    if (!u(this, w)) return {
+    if (!f(this, w)) return {
       error: "invalid_request",
       error_description: "Cannot make client credentials flow without client id"
     };
     const r = this.oidcConfig.token_endpoint;
     let n = {
       grant_type: "client_credentials",
-      client_id: u(this, w),
-      client_secret: u(this, S)
+      client_id: f(this, w),
+      client_secret: f(this, _)
     };
     t && (n.scope = t);
     try {
       return await this.post(r, n, this.authServerHeaders);
-    } catch (o) {
-      return d.logger.error(h({ err: o })), {
+    } catch (s) {
+      return l.logger.error(h({ err: s })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1339,30 +1340,31 @@ class Be {
    * 
    */
   async passwordFlow(t, r, n) {
-    var o, l;
-    if (d.logger.debug(h({ msg: "Starting password flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("password")))
+    var s, c;
+    if (l.logger.debug(h({ msg: "Starting password flow" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("password")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password grant"
       };
-    if (!((l = this.oidcConfig) != null && l.token_endpoint))
+    if (!((c = this.oidcConfig) != null && c.token_endpoint))
       return {
         error: "server_error",
         error_description: "Cannot get token endpoint"
       };
     const i = this.oidcConfig.token_endpoint;
-    let s = {
+    let o = {
       grant_type: "password",
-      client_id: u(this, w),
-      client_secret: u(this, S),
+      client_id: f(this, w),
+      client_secret: f(this, _),
       username: t,
       password: r
     };
-    n && (s.scope = n);
+    n && (o.scope = n);
     try {
-      return await this.post(i, s, this.authServerHeaders);
-    } catch (f) {
-      return d.logger.error(h({ err: f })), {
+      let u = await this.post(i, o, this.authServerHeaders);
+      return u.id_token && !await this.validateIdToken(u.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : u;
+    } catch (u) {
+      return l.logger.error(h({ err: u })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1382,13 +1384,13 @@ class Be {
    *     documentation
    */
   async mfaAuthenticators(t) {
-    var s, o, l;
-    if (d.logger.debug(h({ msg: "Getting valid MFA authenticators" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")) && ((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
+    var o, s, c;
+    if (l.logger.debug(h({ msg: "Getting valid MFA authenticators" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")) && ((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((l = this.oidcConfig) != null && l.issuer))
+    if (!((c = this.oidcConfig) != null && c.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const r = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/authenticators", n = await this.get(r, { authorization: "Bearer " + t, ...this.authServerHeaders });
     if (!Array.isArray(n))
@@ -1397,8 +1399,8 @@ class Be {
         error_description: "Expected array of authenticators in mfa/authenticators response"
       };
     let i = [];
-    for (let f = 0; f < n.length; ++f) {
-      const p = n[f];
+    for (let u = 0; u < n.length; ++u) {
+      const p = n[u];
       if (!p.id || !p.authenticator_type || !p.active)
         return {
           error: "server_error",
@@ -1427,17 +1429,17 @@ class Be {
    * from the `mfaAuthenticators` request.
    */
   async mfaOtpRequest(t, r) {
-    var s, o;
-    if (d.logger.debug(h({ msg: "Making MFA OTB request" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    var o, s;
+    if (l.logger.debug(h({ msg: "Making MFA OTB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((o = this.oidcConfig) != null && o.issuer))
+    if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", i = await this.post(n, {
-      client_id: u(this, w),
-      client_secret: u(this, S),
+      client_id: f(this, w),
+      client_secret: f(this, _),
       challenge_type: "otp",
       mfa_token: t,
       authenticator_id: r
@@ -1465,32 +1467,32 @@ class Be {
    *   - `error_description` friendly error message
    */
   async mfaOtpComplete(t, r, n) {
-    var o, l;
-    if (d.logger.debug(h({ msg: "Completing MFA OTP request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    var s, c;
+    if (l.logger.debug(h({ msg: "Completing MFA OTP request" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((l = this.oidcConfig) != null && l.issuer))
+    if (!((c = this.oidcConfig) != null && c.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
-    const i = this.oidcConfig.token_endpoint, s = await this.post(i, {
+    const i = this.oidcConfig.token_endpoint, o = await this.post(i, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-otp",
-      client_id: u(this, w),
-      client_secret: u(this, S),
+      client_id: f(this, w),
+      client_secret: f(this, _),
       challenge_type: "otp",
       mfa_token: t,
       otp: r,
       scope: n
     }, this.authServerHeaders);
     return {
-      id_token: s.id_token,
-      access_token: s.access_token,
-      refresh_token: s.refresh_token,
-      expires_in: Number(s.expires_in),
-      scope: s.scope,
-      token_type: s.token_type,
-      error: s.error,
-      error_description: s.error_description
+      id_token: o.id_token,
+      access_token: o.access_token,
+      refresh_token: o.refresh_token,
+      expires_in: Number(o.expires_in),
+      scope: o.scope,
+      token_type: o.token_type,
+      error: o.error,
+      error_description: o.error_description
     };
   }
   /** 
@@ -1512,17 +1514,17 @@ class Be {
    *   - `error_description` friendly error message
    */
   async mfaOobRequest(t, r) {
-    var s, o;
-    if (d.logger.debug(h({ msg: "Making MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    var o, s;
+    if (l.logger.debug(h({ msg: "Making MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((o = this.oidcConfig) != null && o.issuer))
+    if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", i = await this.post(n, {
-      client_id: u(this, w),
-      client_secret: u(this, S),
+      client_id: f(this, w),
+      client_secret: f(this, _),
       challenge_type: "oob",
       mfa_token: t,
       authenticator_id: r
@@ -1547,63 +1549,64 @@ class Be {
    *          an error instead of the response fields.
    */
   async mfaOobComplete(t, r, n, i) {
-    var l, f;
-    if (d.logger.debug(h({ msg: "Completing MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((l = this.oidcConfig) != null && l.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
+    var c, u;
+    if (l.logger.debug(h({ msg: "Completing MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((c = this.oidcConfig) != null && c.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((f = this.oidcConfig) != null && f.issuer))
+    if (!((u = this.oidcConfig) != null && u.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
-    const s = this.oidcConfig.token_endpoint, o = await this.post(s, {
+    const o = this.oidcConfig.token_endpoint, s = await this.post(o, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-oob",
-      client_id: u(this, w),
-      client_secret: u(this, S),
+      client_id: f(this, w),
+      client_secret: f(this, _),
       challenge_type: "otp",
       mfa_token: t,
       oob_code: r,
       binding_code: n,
       scope: i
     }, this.authServerHeaders);
-    return o.error ? {
-      error: o.error,
-      error_description: o.error_description
-    } : {
-      id_token: o.id_token,
-      access_token: o.access_token,
-      refresh_token: o.refresh_token,
-      expires_in: "expires_in" in o ? Number(o.expires_in) : void 0,
-      scope: o.scope,
-      token_type: o.token_type
+    return s.error ? {
+      error: s.error,
+      error_description: s.error_description
+    } : s.id_token && !await this.validateIdToken(s.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : {
+      id_token: s.id_token,
+      access_token: s.access_token,
+      refresh_token: s.refresh_token,
+      expires_in: "expires_in" in s ? Number(s.expires_in) : void 0,
+      scope: s.scope,
+      token_type: s.token_type
     };
   }
   //////////////////////////////////////////////////////////////////////
   // Refresh Token Flow
   async refreshTokenFlow(t) {
-    var s, o;
-    if (d.logger.debug(h({ msg: "Starting refresh token flow" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("refresh_token")))
+    var o, s;
+    if (l.logger.debug(h({ msg: "Starting refresh token flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("refresh_token")))
       return {
         error: "invalid_request",
         error_description: "Server does not support refresh_token grant"
       };
-    if (!((o = this.oidcConfig) != null && o.token_endpoint))
+    if (!((s = this.oidcConfig) != null && s.token_endpoint))
       return {
         error: "server_error",
         error_description: "Cannot get token endpoint"
       };
     const r = this.oidcConfig.token_endpoint;
     let n;
-    n = u(this, S);
+    n = f(this, _);
     let i = {
       grant_type: "refresh_token",
       refresh_token: t,
-      client_id: u(this, w)
+      client_id: f(this, w)
     };
     n && (i.client_secret = n);
     try {
-      return await this.post(r, i, this.authServerHeaders);
-    } catch (l) {
-      return d.logger.error(h({ err: l })), {
+      let c = await this.post(r, i, this.authServerHeaders);
+      return c.id_token && !await this.validateIdToken(c.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : c;
+    } catch (c) {
+      return l.logger.error(h({ err: c })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1619,21 +1622,22 @@ class Be {
    */
   async startDeviceCodeFlow(t, r) {
     var i;
-    if (d.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
+    if (l.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support device code grant"
       };
     let n = {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: u(this, w),
-      client_secret: u(this, S)
+      client_id: f(this, w),
+      client_secret: f(this, _)
     };
     r && (n.scope = r);
     try {
-      return await this.post(t, n, this.authServerHeaders);
-    } catch (s) {
-      return d.logger.error(h({ err: s })), {
+      let o = await this.post(t, n, this.authServerHeaders);
+      return o.id_token && !await this.validateIdToken(o.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : o;
+    } catch (o) {
+      return l.logger.error(h({ err: o })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1647,8 +1651,8 @@ class Be {
    * @returns See {@link OAuthDeviceResponse}
    */
   async pollDeviceCodeFlow(t) {
-    var n, i, s;
-    if (d.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((n = this.oidcConfig) != null && n.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
+    var n, i, o;
+    if (l.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((n = this.oidcConfig) != null && n.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support device code grant"
@@ -1660,15 +1664,15 @@ class Be {
       };
     let r = {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: u(this, w),
-      client_secret: u(this, S),
+      client_id: f(this, w),
+      client_secret: f(this, _),
       device_code: t
     };
     try {
-      const o = await this.post((s = this.oidcConfig) == null ? void 0 : s.token_endpoint, r, this.authServerHeaders);
-      return o.error, o;
-    } catch (o) {
-      return d.logger.error(h({ err: o })), {
+      const s = await this.post((o = this.oidcConfig) == null ? void 0 : o.token_endpoint, r, this.authServerHeaders);
+      return s.error ? s : s.id_token && !await this.validateIdToken(s.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : s;
+    } catch (s) {
+      return l.logger.error(h({ err: s })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1683,7 +1687,7 @@ class Be {
    * @throws any exception raised by `fetch()`
    */
   async post(t, r, n = {}) {
-    d.logger.debug(h({
+    l.logger.debug(h({
       msg: "Fetch POST",
       url: t,
       params: Object.keys(r)
@@ -1709,7 +1713,7 @@ class Be {
    * @throws any exception raised by `fetch()`
    */
   async get(t, r = {}) {
-    d.logger.debug(h({ msg: "Fetch GET", url: t }));
+    l.logger.debug(h({ msg: "Fetch GET", url: t }));
     let n = {};
     return this.authServerCredentials && (n.credentials = this.authServerCredentials), this.authServerMode && (n.mode = this.authServerMode), await (await fetch(t, {
       method: "GET",
@@ -1748,7 +1752,7 @@ class Be {
     try {
       return await this.tokenConsumer.tokenAuthorized(t, "id");
     } catch (r) {
-      d.logger.warn(h({ err: r }));
+      l.logger.warn(h({ err: r }));
       return;
     }
   }
@@ -1756,7 +1760,7 @@ class Be {
     return Me(t);
   }
 }
-w = new WeakMap(), S = new WeakMap(), N = new WeakMap(), T = new WeakMap(), R = new WeakMap();
+w = new WeakMap(), _ = new WeakMap(), U = new WeakMap(), R = new WeakMap(), E = new WeakMap();
 class Le {
   /**
    * Constrctor
@@ -1824,7 +1828,7 @@ class Le {
         await this.loadJwks();
       }
     } catch (t) {
-      throw d.logger.debug(h({ err: t })), new g(y.Connection, "Couldn't load keys");
+      throw l.logger.debug(h({ err: t })), new g(y.Connection, "Couldn't load keys");
     }
   }
   /**
@@ -1833,7 +1837,7 @@ class Le {
    * to `authServerBaseUrl` )
    * @param oidcConfig the configuration, or undefined to load it from
    *        the authorization server
-   * @throws a {@link @crossauth/common!CrossauthError} object with {@link @crossauth/common!ErrorCode} of
+   * @throws a {@link CrossauthError} object with {@link ErrorCode} of
    *   - `Connection` if the fetch to the authorization server failed.
    */
   async loadConfig(t) {
@@ -1847,15 +1851,15 @@ class Le {
     try {
       r = await fetch(new URL("/.well-known/openid-configuration", this.authServerBaseUrl));
     } catch (n) {
-      d.logger.error(h({ err: n }));
+      l.logger.error(h({ err: n }));
     }
     if (!r || !r.ok)
       throw new g(y.Connection, "Couldn't get OIDC configuration");
     this.oidcConfig = { ...te };
     try {
       const n = await r.json();
-      for (const [i, s] of Object.entries(n))
-        this.oidcConfig[i] = s;
+      for (const [i, o] of Object.entries(n))
+        this.oidcConfig[i] = o;
     } catch {
       throw new g(y.Connection, "Unrecognized response from OIDC configuration endpoint");
     }
@@ -1865,7 +1869,7 @@ class Le {
    * authorization server (using the URL in the OIDC configuration).
    * @param jwks the keys to load, or undefined to fetch them from
    *        the authorization server.
-   * @throws a {@link @crossauth/common!CrossauthError} object with {@link @crossauth/common!ErrorCode} of
+   * @throws a {@link CrossauthError} object with {@link ErrorCode} of
    *   - `Connection` if the fetch to the authorization server failed,
    *     the OIDC configuration wasn't set or the keys could not be parsed.
    */
@@ -1883,7 +1887,7 @@ class Le {
       try {
         r = await fetch(new URL(this.oidcConfig.jwks_uri));
       } catch (n) {
-        d.logger.error(h({ err: n }));
+        l.logger.error(h({ err: n }));
       }
       if (!r || !r.ok)
         throw new g(y.Connection, "Couldn't get OIDC configuration");
@@ -1894,15 +1898,15 @@ class Le {
           throw new g(y.Connection, "Couldn't fetch keys");
         for (let i = 0; i < n.keys.length; ++i)
           try {
-            let s = "_default";
-            "kid" in n.keys[i] && typeof n.keys[i] == "string" && (s = String(n.keys[i]));
-            const o = await Z(n.keys[i]);
-            this.keys[s] = o;
-          } catch (s) {
-            throw d.logger.error(h({ err: s })), new g(y.Connection, "Couldn't load keys");
+            let o = "_default";
+            "kid" in n.keys[i] && typeof n.keys[i] == "string" && (o = String(n.keys[i]));
+            const s = await Z(n.keys[i]);
+            this.keys[o] = s;
+          } catch (o) {
+            throw l.logger.error(h({ err: o })), new g(y.Connection, "Couldn't load keys");
           }
       } catch (n) {
-        throw d.logger.error(h({ err: n })), new g(y.Connection, "Unrecognized response from OIDC jwks endpoint");
+        throw l.logger.error(h({ err: n })), new g(y.Connection, "Unrecognized response from OIDC jwks endpoint");
       }
     }
   }
@@ -1921,24 +1925,28 @@ class Le {
     (!this.keys || Object.keys(this.keys).length == 0) && await this.loadKeys();
     const n = await this.validateToken(t);
     if (n) {
-      if (n.type != r && d.logger.error(h({ msg: r + " expected but got " + n.type })), n.iss != this.authServerBaseUrl) {
-        d.logger.error(h({ msg: `Invalid issuer ${n.iss} in access token`, hashedAccessToken: await this.hash(n.jti) }));
+      if (n.type != r) {
+        l.logger.error(h({ msg: r + " expected but got " + n.type }));
+        return;
+      }
+      if (n.iss != this.authServerBaseUrl) {
+        l.logger.error(h({ msg: `Invalid issuer ${n.iss} in access token`, hashedAccessToken: await this.hash(n.jti) }));
         return;
       }
       if (n.aud && (Array.isArray(n.aud) && !n.aud.includes(this.audience) || !Array.isArray(n.aud) && n.aud != this.audience)) {
-        d.logger.error(h({ msg: `Invalid audience ${n.aud} in access token`, hashedAccessToken: await this.hash(n.jti) }));
+        l.logger.error(h({ msg: `Invalid audience ${n.aud} in access token`, hashedAccessToken: await this.hash(n.jti) }));
         return;
       }
       return n;
     }
   }
   async validateToken(t) {
-    (!this.keys || Object.keys(this.keys).length == 0) && d.logger.warn("No keys loaded so cannot validate tokens");
+    (!this.keys || Object.keys(this.keys).length == 0) && l.logger.warn("No keys loaded so cannot validate tokens");
     let r;
     try {
       r = qe(t).kid;
     } catch {
-      d.logger.warn(h({ msg: "Invalid access token format" }));
+      l.logger.warn(h({ msg: "Invalid access token format" }));
       return;
     }
     let n;
@@ -1949,32 +1957,32 @@ class Le {
         break;
       }
     if (!n) {
-      d.logger.warn(h({ msg: "No matching keys found for access token" }));
+      l.logger.warn(h({ msg: "No matching keys found for access token" }));
       return;
     }
     try {
-      const { payload: i } = await Je(t, n), s = JSON.parse(new TextDecoder().decode(i));
-      if (s.exp * 1e3 < Date.now() + this.clockTolerance) {
-        d.logger.warn(h({ msg: "Access token has expired" }));
+      const { payload: i } = await Je(t, n), o = JSON.parse(new TextDecoder().decode(i));
+      if (o.exp * 1e3 < Date.now() + this.clockTolerance) {
+        l.logger.warn(h({ msg: "Access token has expired" }));
         return;
       }
-      return s;
+      return o;
     } catch {
-      d.logger.warn(h({ msg: "Access token did not validate" }));
+      l.logger.warn(h({ msg: "Access token did not validate" }));
       return;
     }
   }
 }
 export {
   g as CrossauthError,
-  d as CrossauthLogger,
+  l as CrossauthLogger,
   te as DEFAULT_OIDCCONFIG,
   y as ErrorCode,
   C as KeyPrefix,
   Be as OAuthClientBase,
   ee as OAuthFlows,
   Le as OAuthTokenConsumerBase,
-  k as UserState,
+  P as UserState,
   $e as httpStatus,
   h as j
 };