@crossauth/common 0.0.30 → 0.0.33

package/dist/index.js

@@ -1,10 +1,10 @@
-var fe = Object.defineProperty;
-var G = (e) => {
+var ue = Object.defineProperty;
+var B = (e) => {
   throw TypeError(e);
 };
-var pe = (e, t, r) => t in e ? fe(e, t, { enumerable: !0, configurable: !0, writable: !0, value: r }) : e[t] = r;
-var a = (e, t, r) => pe(e, typeof t != "symbol" ? t + "" : t, r), Y = (e, t, r) => t.has(e) || G("Cannot " + r);
-var f = (e, t, r) => (Y(e, t, "read from private field"), r ? r.call(e) : t.get(e)), K = (e, t, r) => t.has(e) ? G("Cannot add the same private member more than once") : t instanceof WeakSet ? t.add(e) : t.set(e, r), S = (e, t, r, n) => (Y(e, t, "write to private field"), n ? n.call(e, r) : t.set(e, r), r);
+var he = (e, t, r) => t in e ? ue(e, t, { enumerable: !0, configurable: !0, writable: !0, value: r }) : e[t] = r;
+var a = (e, t, r) => he(e, typeof t != "symbol" ? t + "" : t, r), j = (e, t, r) => t.has(e) || B("Cannot " + r);
+var p = (e, t, r) => (j(e, t, "read from private field"), r ? r.call(e) : t.get(e)), F = (e, t, r) => t.has(e) ? B("Cannot add the same private member more than once") : t instanceof WeakSet ? t.add(e) : t.set(e, r), K = (e, t, r, n) => (j(e, t, "write to private field"), n ? n.call(e, r) : t.set(e, r), r);
 class P {
 }
 /** Ordinary, active user who can log in freely */
@@ -205,10 +205,10 @@ class g extends Error {
     return "message" in r && (i = r.message), new g(48, i);
   }
 }
-function $e(e) {
-  return typeof e == "number" && (e = "" + e), e in B ? B[e] : B[500];
+function Fe(e) {
+  return typeof e == "number" && (e = "" + e), e in q ? q[e] : q[500];
 }
-const B = {
+const q = {
   200: "OK",
   201: "Created",
   202: "Accepted",
@@ -327,7 +327,7 @@ a(m, "Warn", 2), /** Log errors, warnings and info messages */
 a(m, "Info", 3), /** Log everything */
 a(m, "Debug", 4), a(m, "levelName", ["NONE", "ERROR", "WARN", "INFO", "DEBUG"]);
 let l = m;
-function h(e) {
+function u(e) {
   let t;
   typeof e == "object" && "err" in e && typeof e.err == "object" && (t = e.err.stack);
   try {
@@ -350,7 +350,7 @@ function h(e) {
 }
 globalThis.crossauthLogger = new l(l.None);
 globalThis.crossauthLoggerAcceptsJson = !0;
-const te = {
+const Z = {
   issuer: "",
   authorization_endpoint: "",
   token_endpoint: "",
@@ -365,29 +365,29 @@ const te = {
   request_parameter_supported: !1,
   request_uri_parameter_supported: !0,
   require_request_uri_registration: !1
-}, F = crypto, re = (e) => e instanceof CryptoKey, H = new TextEncoder(), z = new TextDecoder();
-function ge(...e) {
+}, H = crypto, ee = (e) => e instanceof CryptoKey, x = new TextEncoder(), N = new TextDecoder();
+function fe(...e) {
   const t = e.reduce((i, { length: o }) => i + o, 0), r = new Uint8Array(t);
   let n = 0;
   for (const i of e)
     r.set(i, n), n += i.length;
   return r;
 }
-const ye = (e) => {
+const pe = (e) => {
   const t = atob(e), r = new Uint8Array(t.length);
   for (let n = 0; n < t.length; n++)
     r[n] = t.charCodeAt(n);
   return r;
-}, N = (e) => {
+}, O = (e) => {
   let t = e;
-  t instanceof Uint8Array && (t = z.decode(t)), t = t.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, "");
+  t instanceof Uint8Array && (t = N.decode(t)), t = t.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, "");
   try {
-    return ye(t);
+    return pe(t);
   } catch {
     throw new TypeError("The input to be decoded is not correctly encoded.");
   }
 };
-class $ extends Error {
+class J extends Error {
   static get code() {
     return "ERR_JOSE_GENERIC";
   }
@@ -396,7 +396,7 @@ class $ extends Error {
     super(t), this.code = "ERR_JOSE_GENERIC", this.name = this.constructor.name, (r = Error.captureStackTrace) == null || r.call(Error, this, this.constructor);
   }
 }
-class b extends $ {
+class b extends J {
   constructor() {
     super(...arguments), this.code = "ERR_JOSE_NOT_SUPPORTED";
   }
@@ -404,7 +404,7 @@ class b extends $ {
     return "ERR_JOSE_NOT_SUPPORTED";
   }
 }
-class v extends $ {
+class v extends J {
   constructor() {
     super(...arguments), this.code = "ERR_JWS_INVALID";
   }
@@ -412,7 +412,7 @@ class v extends $ {
     return "ERR_JWS_INVALID";
   }
 }
-class O extends $ {
+class R extends J {
   constructor() {
     super(...arguments), this.code = "ERR_JWT_INVALID";
   }
@@ -420,7 +420,7 @@ class O extends $ {
     return "ERR_JWT_INVALID";
   }
 }
-class me extends $ {
+class ge extends J {
   constructor() {
     super(...arguments), this.code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED", this.message = "signature verification failed";
   }
@@ -428,16 +428,16 @@ class me extends $ {
     return "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
   }
 }
-function k(e, t = "algorithm.name") {
+function A(e, t = "algorithm.name") {
   return new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);
 }
-function J(e, t) {
+function z(e, t) {
   return e.name === t;
 }
-function L(e) {
+function M(e) {
   return parseInt(e.name.slice(4), 10);
 }
-function we(e) {
+function ye(e) {
   switch (e) {
     case "ES256":
       return "P-256";
@@ -449,7 +449,7 @@ function we(e) {
       throw new Error("unreachable");
   }
 }
-function ve(e, t) {
+function me(e, t) {
   if (t.length && !t.some((r) => e.usages.includes(r))) {
     let r = "CryptoKey does not support this operation, its usages must include ";
     if (t.length > 2) {
@@ -459,59 +459,59 @@ function ve(e, t) {
     throw new TypeError(r);
   }
 }
-function _e(e, t, ...r) {
+function we(e, t, ...r) {
   switch (t) {
     case "HS256":
     case "HS384":
     case "HS512": {
-      if (!J(e.algorithm, "HMAC"))
-        throw k("HMAC");
+      if (!z(e.algorithm, "HMAC"))
+        throw A("HMAC");
       const n = parseInt(t.slice(2), 10);
-      if (L(e.algorithm.hash) !== n)
-        throw k(`SHA-${n}`, "algorithm.hash");
+      if (M(e.algorithm.hash) !== n)
+        throw A(`SHA-${n}`, "algorithm.hash");
       break;
     }
     case "RS256":
     case "RS384":
     case "RS512": {
-      if (!J(e.algorithm, "RSASSA-PKCS1-v1_5"))
-        throw k("RSASSA-PKCS1-v1_5");
+      if (!z(e.algorithm, "RSASSA-PKCS1-v1_5"))
+        throw A("RSASSA-PKCS1-v1_5");
       const n = parseInt(t.slice(2), 10);
-      if (L(e.algorithm.hash) !== n)
-        throw k(`SHA-${n}`, "algorithm.hash");
+      if (M(e.algorithm.hash) !== n)
+        throw A(`SHA-${n}`, "algorithm.hash");
       break;
     }
     case "PS256":
     case "PS384":
     case "PS512": {
-      if (!J(e.algorithm, "RSA-PSS"))
-        throw k("RSA-PSS");
+      if (!z(e.algorithm, "RSA-PSS"))
+        throw A("RSA-PSS");
       const n = parseInt(t.slice(2), 10);
-      if (L(e.algorithm.hash) !== n)
-        throw k(`SHA-${n}`, "algorithm.hash");
+      if (M(e.algorithm.hash) !== n)
+        throw A(`SHA-${n}`, "algorithm.hash");
       break;
     }
     case "EdDSA": {
       if (e.algorithm.name !== "Ed25519" && e.algorithm.name !== "Ed448")
-        throw k("Ed25519 or Ed448");
+        throw A("Ed25519 or Ed448");
       break;
     }
     case "ES256":
     case "ES384":
     case "ES512": {
-      if (!J(e.algorithm, "ECDSA"))
-        throw k("ECDSA");
-      const n = we(t);
+      if (!z(e.algorithm, "ECDSA"))
+        throw A("ECDSA");
+      const n = ye(t);
       if (e.algorithm.namedCurve !== n)
-        throw k(n, "algorithm.namedCurve");
+        throw A(n, "algorithm.namedCurve");
       break;
     }
     default:
       throw new TypeError("CryptoKey does not support this operation");
   }
-  ve(e, r);
+  me(e, r);
 }
-function ie(e, t, ...r) {
+function te(e, t, ...r) {
   var n;
   if (r.length > 2) {
     const i = r.pop();
@@ -519,11 +519,11 @@ function ie(e, t, ...r) {
   } else r.length === 2 ? e += `one of type ${r[0]} or ${r[1]}.` : e += `of type ${r[0]}.`;
   return t == null ? e += ` Received ${t}` : typeof t == "function" && t.name ? e += ` Received function ${t.name}` : typeof t == "object" && t != null && (n = t.constructor) != null && n.name && (e += ` Received an instance of ${t.constructor.name}`), e;
 }
-const X = (e, ...t) => ie("Key must be ", e, ...t);
-function ne(e, t, ...r) {
-  return ie(`Key for the ${e} algorithm must be `, t, ...r);
+const V = (e, ...t) => te("Key must be ", e, ...t);
+function re(e, t, ...r) {
+  return te(`Key for the ${e} algorithm must be `, t, ...r);
 }
-const oe = (e) => re(e) ? !0 : (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject", M = ["CryptoKey"], Se = (...e) => {
+const ie = (e) => ee(e) ? !0 : (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject", D = ["CryptoKey"], ve = (...e) => {
   const t = e.filter(Boolean);
   if (t.length === 0 || t.length === 1)
     return !0;
@@ -542,11 +542,11 @@ const oe = (e) => re(e) ? !0 : (e == null ? void 0 : e[Symbol.toStringTag]) ===
   }
   return !0;
 };
-function Ce(e) {
+function _e(e) {
   return typeof e == "object" && e !== null;
 }
-function x(e) {
-  if (!Ce(e) || Object.prototype.toString.call(e) !== "[object Object]")
+function U(e) {
+  if (!_e(e) || Object.prototype.toString.call(e) !== "[object Object]")
     return !1;
   if (Object.getPrototypeOf(e) === null)
     return !0;
@@ -555,14 +555,14 @@ function x(e) {
     t = Object.getPrototypeOf(t);
   return Object.getPrototypeOf(e) === t;
 }
-const be = (e, t) => {
+const Se = (e, t) => {
   if (e.startsWith("RS") || e.startsWith("PS")) {
     const { modulusLength: r } = t.algorithm;
     if (typeof r != "number" || r < 2048)
       throw new TypeError(`${e} requires key modulusLength to be 2048 bits or larger`);
   }
 };
-function Ae(e) {
+function Ce(e) {
   let t, r;
   switch (e.kty) {
     case "RSA": {
@@ -634,43 +634,43 @@ function Ae(e) {
   }
   return { algorithm: t, keyUsages: r };
 }
-const se = async (e) => {
+const ne = async (e) => {
   if (!e.alg)
     throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-  const { algorithm: t, keyUsages: r } = Ae(e), n = [
+  const { algorithm: t, keyUsages: r } = Ce(e), n = [
     t,
     e.ext ?? !1,
     e.key_ops ?? r
   ], i = { ...e };
-  return delete i.alg, delete i.use, F.subtle.importKey("jwk", i, ...n);
-}, ae = (e) => N(e);
-let V, j;
-const ce = (e) => (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject", de = async (e, t, r, n) => {
+  return delete i.alg, delete i.use, H.subtle.importKey("jwk", i, ...n);
+}, oe = (e) => O(e);
+let $, L;
+const se = (e) => (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject", ae = async (e, t, r, n) => {
   let i = e.get(t);
   if (i != null && i[n])
     return i[n];
-  const o = await se({ ...r, alg: n });
+  const o = await ne({ ...r, alg: n });
   return i ? i[n] = o : e.set(t, { [n]: o }), o;
-}, ke = (e, t) => {
-  if (ce(e)) {
+}, be = (e, t) => {
+  if (se(e)) {
     let r = e.export({ format: "jwk" });
-    return delete r.d, delete r.dp, delete r.dq, delete r.p, delete r.q, delete r.qi, r.k ? ae(r.k) : (j || (j = /* @__PURE__ */ new WeakMap()), de(j, e, r, t));
+    return delete r.d, delete r.dp, delete r.dq, delete r.p, delete r.q, delete r.qi, r.k ? oe(r.k) : (L || (L = /* @__PURE__ */ new WeakMap()), ae(L, e, r, t));
   }
   return e;
-}, Ie = (e, t) => {
-  if (ce(e)) {
+}, Ae = (e, t) => {
+  if (se(e)) {
     let r = e.export({ format: "jwk" });
-    return r.k ? ae(r.k) : (V || (V = /* @__PURE__ */ new WeakMap()), de(V, e, r, t));
+    return r.k ? oe(r.k) : ($ || ($ = /* @__PURE__ */ new WeakMap()), ae($, e, r, t));
   }
   return e;
-}, Pe = { normalizePublicKey: ke, normalizePrivateKey: Ie }, T = (e, t, r = 0) => {
+}, ke = { normalizePublicKey: be, normalizePrivateKey: Ae }, T = (e, t, r = 0) => {
   r === 0 && (t.unshift(t.length), t.unshift(6));
   const n = e.indexOf(t[0], r);
   if (n === -1)
     return !1;
   const i = e.subarray(n, n + t.length);
   return i.length !== t.length ? !1 : i.every((o, s) => o === t[s]) || T(e, t, n + 1);
-}, Q = (e) => {
+}, G = (e) => {
   switch (!0) {
     case T(e, [42, 134, 72, 206, 61, 3, 1, 7]):
       return "P-256";
@@ -689,19 +689,19 @@ const ce = (e) => (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject",
     default:
       throw new b("Invalid or unsupported EC Key Curve or OKP Key Sub Type");
   }
-}, le = async (e, t, r, n, i) => {
+}, ce = async (e, t, r, n, i) => {
   let o, s;
-  const c = new Uint8Array(atob(r.replace(e, "")).split("").map((p) => p.charCodeAt(0))), u = t === "spki";
+  const c = new Uint8Array(atob(r.replace(e, "")).split("").map((f) => f.charCodeAt(0))), d = t === "spki";
   switch (n) {
     case "PS256":
     case "PS384":
     case "PS512":
-      o = { name: "RSA-PSS", hash: `SHA-${n.slice(-3)}` }, s = u ? ["verify"] : ["sign"];
+      o = { name: "RSA-PSS", hash: `SHA-${n.slice(-3)}` }, s = d ? ["verify"] : ["sign"];
       break;
     case "RS256":
     case "RS384":
     case "RS512":
-      o = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${n.slice(-3)}` }, s = u ? ["verify"] : ["sign"];
+      o = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${n.slice(-3)}` }, s = d ? ["verify"] : ["sign"];
       break;
     case "RSA-OAEP":
     case "RSA-OAEP-256":
@@ -710,81 +710,81 @@ const ce = (e) => (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject",
       o = {
         name: "RSA-OAEP",
         hash: `SHA-${parseInt(n.slice(-3), 10) || 1}`
-      }, s = u ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
+      }, s = d ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
       break;
     case "ES256":
-      o = { name: "ECDSA", namedCurve: "P-256" }, s = u ? ["verify"] : ["sign"];
+      o = { name: "ECDSA", namedCurve: "P-256" }, s = d ? ["verify"] : ["sign"];
       break;
     case "ES384":
-      o = { name: "ECDSA", namedCurve: "P-384" }, s = u ? ["verify"] : ["sign"];
+      o = { name: "ECDSA", namedCurve: "P-384" }, s = d ? ["verify"] : ["sign"];
       break;
     case "ES512":
-      o = { name: "ECDSA", namedCurve: "P-521" }, s = u ? ["verify"] : ["sign"];
+      o = { name: "ECDSA", namedCurve: "P-521" }, s = d ? ["verify"] : ["sign"];
       break;
     case "ECDH-ES":
     case "ECDH-ES+A128KW":
     case "ECDH-ES+A192KW":
     case "ECDH-ES+A256KW": {
-      const p = Q(c);
-      o = p.startsWith("P-") ? { name: "ECDH", namedCurve: p } : { name: p }, s = u ? [] : ["deriveBits"];
+      const f = G(c);
+      o = f.startsWith("P-") ? { name: "ECDH", namedCurve: f } : { name: f }, s = d ? [] : ["deriveBits"];
       break;
     }
     case "EdDSA":
-      o = { name: Q(c) }, s = u ? ["verify"] : ["sign"];
+      o = { name: G(c) }, s = d ? ["verify"] : ["sign"];
       break;
     default:
       throw new b('Invalid or unsupported "alg" (Algorithm) value');
   }
-  return F.subtle.importKey(t, c, o, !1, s);
-}, Te = (e, t, r) => le(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", e, t), Re = (e, t, r) => le(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", e, t);
-async function Ee(e, t, r) {
+  return H.subtle.importKey(t, c, o, !1, s);
+}, Ie = (e, t, r) => ce(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", e, t), Pe = (e, t, r) => ce(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", e, t);
+async function Te(e, t, r) {
   if (typeof e != "string" || e.indexOf("-----BEGIN PUBLIC KEY-----") !== 0)
     throw new TypeError('"spki" must be SPKI formatted string');
-  return Re(e, t);
+  return Pe(e, t);
 }
-async function Oe(e, t, r) {
+async function Re(e, t, r) {
   if (typeof e != "string" || e.indexOf("-----BEGIN PRIVATE KEY-----") !== 0)
     throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
-  return Te(e, t);
+  return Ie(e, t);
 }
-async function Z(e, t) {
-  if (!x(e))
+async function Y(e, t) {
+  if (!U(e))
     throw new TypeError("JWK must be an object");
   switch (t || (t = e.alg), e.kty) {
     case "oct":
       if (typeof e.k != "string" || !e.k)
         throw new TypeError('missing "k" (Key Value) Parameter value');
-      return N(e.k);
+      return O(e.k);
     case "RSA":
       if (e.oth !== void 0)
         throw new b('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
     case "EC":
     case "OKP":
-      return se({ ...e, alg: t });
+      return ne({ ...e, alg: t });
     default:
       throw new b('Unsupported "kty" (Key Type) Parameter value');
   }
 }
-const q = (e) => e == null ? void 0 : e[Symbol.toStringTag], Ke = (e, t) => {
+const W = (e) => e == null ? void 0 : e[Symbol.toStringTag], Ee = (e, t) => {
   if (!(t instanceof Uint8Array)) {
-    if (!oe(t))
-      throw new TypeError(ne(e, t, ...M, "Uint8Array"));
+    if (!ie(t))
+      throw new TypeError(re(e, t, ...D, "Uint8Array"));
     if (t.type !== "secret")
-      throw new TypeError(`${q(t)} instances for symmetric algorithms must be of type "secret"`);
+      throw new TypeError(`${W(t)} instances for symmetric algorithms must be of type "secret"`);
   }
-}, Ne = (e, t, r) => {
-  if (!oe(t))
-    throw new TypeError(ne(e, t, ...M));
+}, Oe = (e, t, r) => {
+  if (!ie(t))
+    throw new TypeError(re(e, t, ...D));
   if (t.type === "secret")
-    throw new TypeError(`${q(t)} instances for asymmetric algorithms must not be of type "secret"`);
+    throw new TypeError(`${W(t)} instances for asymmetric algorithms must not be of type "secret"`);
   if (t.algorithm && r === "verify" && t.type === "private")
-    throw new TypeError(`${q(t)} instances for asymmetric algorithm verifying must be of type "public"`);
+    throw new TypeError(`${W(t)} instances for asymmetric algorithm verifying must be of type "public"`);
   if (t.algorithm && r === "encrypt" && t.type === "private")
-    throw new TypeError(`${q(t)} instances for asymmetric algorithm encryption must be of type "public"`);
-}, Ue = (e, t, r) => {
-  e.startsWith("HS") || e === "dir" || e.startsWith("PBES2") || /^A\d{3}(?:GCM)?KW$/.test(e) ? Ke(e, t) : Ne(e, t, r);
+    throw new TypeError(`${W(t)} instances for asymmetric algorithm encryption must be of type "public"`);
+}, Ke = (e, t, r) => {
+  e.startsWith("HS") || e === "dir" || e.startsWith("PBES2") || /^A\d{3}(?:GCM)?KW$/.test(e) ? Ee(e, t) : Oe(e, t, r);
 };
-function xe(e, t, r, n, i) {
+function Ue(e, t, r, n, i) {
   if (i.crit !== void 0 && (n == null ? void 0 : n.crit) === void 0)
     throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');
   if (!n || n.crit === void 0)
@@ -803,7 +803,7 @@ function xe(e, t, r, n, i) {
   }
   return new Set(n.crit);
 }
-function ze(e, t) {
+function Ne(e, t) {
   const r = `SHA-${e.slice(-3)}`;
   switch (e) {
     case "HS256":
@@ -828,28 +828,28 @@ function ze(e, t) {
       throw new b(`alg ${e} is not supported either by JOSE or your javascript runtime`);
   }
 }
-async function De(e, t, r) {
-  if (t = await Pe.normalizePublicKey(t, e), re(t))
-    return _e(t, e, r), t;
+async function xe(e, t, r) {
+  if (t = await ke.normalizePublicKey(t, e), ee(t))
+    return we(t, e, r), t;
   if (t instanceof Uint8Array) {
     if (!e.startsWith("HS"))
-      throw new TypeError(X(t, ...M));
-    return F.subtle.importKey("raw", t, { hash: `SHA-${e.slice(-3)}`, name: "HMAC" }, !1, [r]);
+      throw new TypeError(V(t, ...D));
+    return H.subtle.importKey("raw", t, { hash: `SHA-${e.slice(-3)}`, name: "HMAC" }, !1, [r]);
   }
-  throw new TypeError(X(t, ...M, "Uint8Array"));
+  throw new TypeError(V(t, ...D, "Uint8Array"));
 }
-const We = async (e, t, r, n) => {
-  const i = await De(e, t, "verify");
-  be(e, i);
-  const o = ze(e, i.algorithm);
+const ze = async (e, t, r, n) => {
+  const i = await xe(e, t, "verify");
+  Se(e, i);
+  const o = Ne(e, i.algorithm);
   try {
-    return await F.subtle.verify(o, i, r, n);
+    return await H.subtle.verify(o, i, r, n);
   } catch {
     return !1;
   }
 };
-async function He(e, t, r) {
-  if (!x(e))
+async function We(e, t, r) {
+  if (!U(e))
     throw new v("Flattened JWS must be an object");
   if (e.protected === void 0 && e.header === void 0)
     throw new v('Flattened JWS must have either of the "protected" or "header" members');
@@ -859,22 +859,22 @@ async function He(e, t, r) {
     throw new v("JWS Payload missing");
   if (typeof e.signature != "string")
     throw new v("JWS Signature missing or incorrect type");
-  if (e.header !== void 0 && !x(e.header))
+  if (e.header !== void 0 && !U(e.header))
     throw new v("JWS Unprotected Header incorrect type");
   let n = {};
   if (e.protected)
     try {
-      const ue = N(e.protected);
-      n = JSON.parse(z.decode(ue));
+      const le = O(e.protected);
+      n = JSON.parse(N.decode(le));
     } catch {
       throw new v("JWS Protected Header is invalid");
     }
-  if (!Se(n, e.header))
+  if (!ve(n, e.header))
     throw new v("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
   const i = {
     ...n,
     ...e.header
-  }, o = xe(v, /* @__PURE__ */ new Map([["b64", !0]]), r == null ? void 0 : r.crit, n, i);
+  }, o = Ue(v, /* @__PURE__ */ new Map([["b64", !0]]), r == null ? void 0 : r.crit, n, i);
   let s = !0;
   if (o.has("b64") && (s = n.b64, typeof s != "boolean"))
     throw new v('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
@@ -886,39 +886,39 @@ async function He(e, t, r) {
       throw new v("JWS Payload must be a string");
   } else if (typeof e.payload != "string" && !(e.payload instanceof Uint8Array))
     throw new v("JWS Payload must be a string or an Uint8Array instance");
-  let u = !1;
-  typeof t == "function" && (t = await t(n, e), u = !0), Ue(c, t, "verify");
-  const p = ge(H.encode(e.protected ?? ""), H.encode("."), typeof e.payload == "string" ? H.encode(e.payload) : e.payload);
-  let I;
+  let d = !1;
+  typeof t == "function" && (t = await t(n, e), d = !0), Ke(c, t, "verify");
+  const f = fe(x.encode(e.protected ?? ""), x.encode("."), typeof e.payload == "string" ? x.encode(e.payload) : e.payload);
+  let k;
   try {
-    I = N(e.signature);
+    k = O(e.signature);
   } catch {
     throw new v("Failed to base64url decode the signature");
   }
-  if (!await We(c, t, I, p))
-    throw new me();
-  let D;
+  if (!await ze(c, t, k, f))
+    throw new ge();
+  let S;
   if (s)
     try {
-      D = N(e.payload);
+      S = O(e.payload);
     } catch {
       throw new v("Failed to base64url decode the payload");
     }
-  else typeof e.payload == "string" ? D = H.encode(e.payload) : D = e.payload;
-  const W = { payload: D };
-  return e.protected !== void 0 && (W.protectedHeader = n), e.header !== void 0 && (W.unprotectedHeader = e.header), u ? { ...W, key: t } : W;
+  else typeof e.payload == "string" ? S = x.encode(e.payload) : S = e.payload;
+  const I = { payload: S };
+  return e.protected !== void 0 && (I.protectedHeader = n), e.header !== void 0 && (I.unprotectedHeader = e.header), d ? { ...I, key: t } : I;
 }
-async function Je(e, t, r) {
-  if (e instanceof Uint8Array && (e = z.decode(e)), typeof e != "string")
+async function De(e, t, r) {
+  if (e instanceof Uint8Array && (e = N.decode(e)), typeof e != "string")
     throw new v("Compact JWS must be a string or Uint8Array");
   const { 0: n, 1: i, 2: o, length: s } = e.split(".");
   if (s !== 3)
     throw new v("Invalid Compact JWS");
-  const c = await He({ payload: i, protected: n, signature: o }, t, r), u = { payload: c.payload, protectedHeader: c.protectedHeader };
-  return typeof t == "function" ? { ...u, key: c.key } : u;
+  const c = await We({ payload: i, protected: n, signature: o }, t, r), d = { payload: c.payload, protectedHeader: c.protectedHeader };
+  return typeof t == "function" ? { ...d, key: c.key } : d;
 }
-const he = N;
-function qe(e) {
+const de = O;
+function X(e) {
   let t;
   if (typeof e == "string") {
     const r = e.split(".");
@@ -931,41 +931,41 @@ function qe(e) {
   try {
     if (typeof t != "string" || !t)
       throw new Error();
-    const r = JSON.parse(z.decode(he(t)));
-    if (!x(r))
+    const r = JSON.parse(N.decode(de(t)));
+    if (!U(r))
       throw new Error();
     return r;
   } catch {
     throw new TypeError("Invalid Token or Protected Header formatting");
   }
 }
-function Me(e) {
+function He(e) {
   if (typeof e != "string")
-    throw new O("JWTs must use Compact JWS serialization, JWT must be a string");
+    throw new R("JWTs must use Compact JWS serialization, JWT must be a string");
   const { 1: t, length: r } = e.split(".");
   if (r === 5)
-    throw new O("Only JWTs using Compact JWS serialization can be decoded");
+    throw new R("Only JWTs using Compact JWS serialization can be decoded");
   if (r !== 3)
-    throw new O("Invalid JWT");
+    throw new R("Invalid JWT");
   if (!t)
-    throw new O("JWTs must contain a payload");
+    throw new R("JWTs must contain a payload");
   let n;
   try {
-    n = he(t);
+    n = de(t);
   } catch {
-    throw new O("Failed to base64url decode the payload");
+    throw new R("Failed to base64url decode the payload");
   }
   let i;
   try {
-    i = JSON.parse(z.decode(n));
+    i = JSON.parse(N.decode(n));
   } catch {
-    throw new O("Failed to parse the decoded payload as JSON");
+    throw new R("Failed to parse the decoded payload as JSON");
   }
-  if (!x(i))
-    throw new O("Invalid JWT Claims Set");
+  if (!U(i))
+    throw new R("Invalid JWT Claims Set");
   return i;
 }
-const d = class d {
+const h = class h {
   /**
    * Returns a user-friendly name for the given flow strings.
    * 
@@ -976,7 +976,7 @@ const d = class d {
   static flowNames(t) {
     let r = {};
     return t.forEach((n) => {
-      n in d.flowName && (r[n] = d.flowName[n]);
+      n in h.flowName && (r[n] = h.flowName[n]);
     }), r;
   }
   /**
@@ -985,7 +985,7 @@ const d = class d {
    * @returns true or false.
    */
   static isValidFlow(t) {
-    return d.allFlows().includes(t);
+    return h.allFlows().includes(t);
   }
   /**
    * Returns true only if all given strings are valid flows
@@ -995,19 +995,19 @@ const d = class d {
   static areAllValidFlows(t) {
     let r = !0;
     return t.forEach((n) => {
-      d.isValidFlow(n) || (r = !1);
+      h.isValidFlow(n) || (r = !1);
     }), r;
   }
   static allFlows() {
     return [
-      d.AuthorizationCode,
-      d.AuthorizationCodeWithPKCE,
-      d.ClientCredentials,
-      d.RefreshToken,
-      d.DeviceCode,
-      d.Password,
-      d.PasswordMfa,
-      d.OidcAuthorizationCode
+      h.AuthorizationCode,
+      h.AuthorizationCodeWithPKCE,
+      h.ClientCredentials,
+      h.RefreshToken,
+      h.DeviceCode,
+      h.Password,
+      h.PasswordMfa,
+      h.OidcAuthorizationCode
     ];
   }
   /**
@@ -1018,52 +1018,52 @@ const d = class d {
    */
   static grantType(t) {
     switch (t) {
-      case d.AuthorizationCode:
-      case d.AuthorizationCodeWithPKCE:
-      case d.OidcAuthorizationCode:
+      case h.AuthorizationCode:
+      case h.AuthorizationCodeWithPKCE:
+      case h.OidcAuthorizationCode:
         return ["authorization_code"];
-      case d.ClientCredentials:
+      case h.ClientCredentials:
         return ["client_credentials"];
-      case d.RefreshToken:
+      case h.RefreshToken:
         return ["refresh_token"];
-      case d.Password:
+      case h.Password:
         return ["password"];
-      case d.PasswordMfa:
+      case h.PasswordMfa:
         return ["http://auth0.com/oauth/grant-type/mfa-otp", "http://auth0.com/oauth/grant-type/mfa-oob"];
-      case d.DeviceCode:
+      case h.DeviceCode:
         return ["urn:ietf:params:oauth:grant-type:device_code"];
     }
   }
 };
 /** All flows are allowed */
-a(d, "All", "all"), /** OAuth authorization code flow (without PKCE) */
-a(d, "AuthorizationCode", "authorizationCode"), /** OAuth authorization code flow with PKCE */
-a(d, "AuthorizationCodeWithPKCE", "authorizationCodeWithPKCE"), /** Auth client credentials flow */
-a(d, "ClientCredentials", "clientCredentials"), /** OAuth refresh token flow */
-a(d, "RefreshToken", "refreshToken"), /** OAuth device code flow */
-a(d, "DeviceCode", "deviceCode"), /** OAuth password flow */
-a(d, "Password", "password"), /** The Auth0 password MFA extension to the password flow */
-a(d, "PasswordMfa", "passwordMfa"), /** The OpenID Connect authorization code flow, with or without
+a(h, "All", "all"), /** OAuth authorization code flow (without PKCE) */
+a(h, "AuthorizationCode", "authorizationCode"), /** OAuth authorization code flow with PKCE */
+a(h, "AuthorizationCodeWithPKCE", "authorizationCodeWithPKCE"), /** Auth client credentials flow */
+a(h, "ClientCredentials", "clientCredentials"), /** OAuth refresh token flow */
+a(h, "RefreshToken", "refreshToken"), /** OAuth device code flow */
+a(h, "DeviceCode", "deviceCode"), /** OAuth password flow */
+a(h, "Password", "password"), /** The Auth0 password MFA extension to the password flow */
+a(h, "PasswordMfa", "passwordMfa"), /** The OpenID Connect authorization code flow, with or without
  * PKCE.
  */
-a(d, "OidcAuthorizationCode", "oidcAuthorizationCode"), /** A user friendly name for the given flow ID
+a(h, "OidcAuthorizationCode", "oidcAuthorizationCode"), /** A user friendly name for the given flow ID
  * 
  * For example, if you pass "authorizationCode" 
  * (`OAuthFlows.AuthorizationCode`) you will get `"Authorization Code"`.
  */
-a(d, "flowName", {
-  [d.AuthorizationCode]: "Authorization Code",
-  [d.AuthorizationCodeWithPKCE]: "Authorization Code with PKCE",
-  [d.ClientCredentials]: "Client Credentials",
-  [d.RefreshToken]: "Refresh Token",
-  [d.DeviceCode]: "Device Code",
-  [d.Password]: "Password",
-  [d.PasswordMfa]: "Password MFA",
-  [d.OidcAuthorizationCode]: "OIDC Authorization Code"
+a(h, "flowName", {
+  [h.AuthorizationCode]: "Authorization Code",
+  [h.AuthorizationCodeWithPKCE]: "Authorization Code with PKCE",
+  [h.ClientCredentials]: "Client Credentials",
+  [h.RefreshToken]: "Refresh Token",
+  [h.DeviceCode]: "Device Code",
+  [h.Password]: "Password",
+  [h.PasswordMfa]: "Password MFA",
+  [h.OidcAuthorizationCode]: "OIDC Authorization Code"
 });
-let ee = d;
-var w, _, U, R, E;
-class Be {
+let Q = h;
+var w, _;
+class qe {
   /**
    * Constructor.
    * 
@@ -1099,20 +1099,17 @@ class Be {
     codeChallengeMethod: o,
     stateLength: s,
     verifierLength: c,
-    tokenConsumer: u,
-    authServerCredentials: p,
-    authServerMode: I,
-    authServerHeaders: A
+    tokenConsumer: d,
+    authServerCredentials: f,
+    authServerMode: k,
+    authServerHeaders: E
   }) {
     a(this, "authServerBaseUrl", "");
-    K(this, w);
-    K(this, _);
-    K(this, U);
+    F(this, w);
+    F(this, _);
     a(this, "codeChallengeMethod", "S256");
-    K(this, R);
     a(this, "verifierLength", 32);
     a(this, "redirect_uri");
-    K(this, E, "");
     a(this, "stateLength", 32);
     a(this, "authzCode", "");
     a(this, "oidcConfig");
@@ -1120,22 +1117,16 @@ class Be {
     a(this, "authServerHeaders", {});
     a(this, "authServerMode");
     a(this, "authServerCredentials");
-    this.tokenConsumer = u, this.authServerBaseUrl = t, c && (this.verifierLength = c), s && (this.stateLength = s), r && S(this, w, r), n && S(this, _, n), i && (this.redirect_uri = i), o && (this.codeChallengeMethod = o), this.authServerBaseUrl = t, p && (this.authServerCredentials = p), I && (this.authServerMode = I), A && (this.authServerHeaders = A);
+    a(this, "oauthPostType", "json");
+    a(this, "oauthLogFetch", !1);
+    a(this, "oauthUseUserInfoEndpoint", !1);
+    this.tokenConsumer = d, this.authServerBaseUrl = t, c && (this.verifierLength = c), s && (this.stateLength = s), r && K(this, w, r), n && K(this, _, n), i && (this.redirect_uri = i), o && (this.codeChallengeMethod = o), this.authServerBaseUrl = t, f && (this.authServerCredentials = f), k && (this.authServerMode = k), E && (this.authServerHeaders = E);
   }
   set client_id(t) {
-    S(this, w, t);
+    K(this, w, t);
   }
   set client_secret(t) {
-    S(this, _, t);
-  }
-  set codeVerifier(t) {
-    S(this, R, t);
-  }
-  set codeChallenge(t) {
-    S(this, U, t);
-  }
-  set state(t) {
-    S(this, E, t);
+    K(this, _, t);
   }
   /**
    * Loads OpenID Connect configuration so that the client can determine
@@ -1150,7 +1141,7 @@ class Be {
    */
   async loadConfig(t) {
     if (t) {
-      l.logger.debug(h({ msg: "Reading OIDC config locally" })), this.oidcConfig = t;
+      l.logger.debug(u({ msg: "Reading OIDC config locally" })), this.oidcConfig = t;
       return;
     }
     let r;
@@ -1158,18 +1149,18 @@ class Be {
       const n = new URL(
         this.authServerBaseUrl + "/.well-known/openid-configuration"
       );
-      l.logger.debug(h({ msg: `Fetching OIDC config from ${n}` }));
+      l.logger.debug(u({ msg: `Fetching OIDC config from ${n}` }));
       let i = { headers: this.authServerHeaders };
       this.authServerMode && (i.mode = this.authServerMode), this.authServerCredentials && (i.credentials = this.authServerCredentials), r = await fetch(n, i);
     } catch (n) {
-      l.logger.error(h({ err: n }));
+      l.logger.error(u({ err: n }));
     }
     if (!r || !r.ok)
       throw new g(
         y.Connection,
         "Couldn't get OIDC configuration from URL" + this.authServerBaseUrl + "/.well-known/openid-configuration"
       );
-    this.oidcConfig = { ...te };
+    this.oidcConfig = { ...Z };
     try {
       const n = await r.json();
       for (const [i, o] of Object.entries(n))
@@ -1203,19 +1194,19 @@ class Be {
    *          - `error_description` friendly error message or undefined
    *            if no error
    */
-  async startAuthorizationCodeFlow(t, r = !1) {
-    var o, s, c;
-    if (l.logger.debug(h({ msg: "Starting authorization code flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.response_types_supported.includes("code")) || !((s = this.oidcConfig) != null && s.response_modes_supported.includes("query")))
+  async startAuthorizationCodeFlow(t, r, n, i = !1) {
+    var c, d, f;
+    if (l.logger.debug(u({ msg: "Starting authorization code flow" })), this.oidcConfig || await this.loadConfig(), !((c = this.oidcConfig) != null && c.response_types_supported.includes("code")) || !((d = this.oidcConfig) != null && d.response_modes_supported.includes("query")))
       return {
         error: "invalid_request",
         error_description: "Server does not support authorization code flow"
       };
-    if (!((c = this.oidcConfig) != null && c.authorization_endpoint))
+    if (!((f = this.oidcConfig) != null && f.authorization_endpoint))
       return {
         error: "server_error",
         error_description: "Cannot get authorize endpoint"
       };
-    if (S(this, E, this.randomValue(this.stateLength)), !f(this, w)) return {
+    if (!p(this, w)) return {
       error: "invalid_request",
       error_description: "Cannot make authorization code flow without client id"
     };
@@ -1223,8 +1214,30 @@ class Be {
       error: "invalid_request",
       error_description: "Cannot make authorization code flow without Redirect Uri"
     };
-    let i = this.oidcConfig.authorization_endpoint + "?response_type=code&client_id=" + encodeURIComponent(f(this, w)) + "&state=" + encodeURIComponent(f(this, E)) + "&redirect_uri=" + encodeURIComponent(this.redirect_uri);
-    return t && (i += "&scope=" + encodeURIComponent(t)), r && (S(this, R, this.randomValue(this.verifierLength)), S(this, U, this.codeChallengeMethod == "plain" ? f(this, R) : await this.sha256(f(this, R))), i += "&code_challenge=" + f(this, U)), { url: i };
+    let s = this.oidcConfig.authorization_endpoint + "?response_type=code&client_id=" + encodeURIComponent(p(this, w)) + "&state=" + encodeURIComponent(t) + "&redirect_uri=" + encodeURIComponent(this.redirect_uri);
+    return r && (s += "&scope=" + encodeURIComponent(r)), i && n && (s += "&code_challenge=" + n), { url: s };
+  }
+  async codeChallengeAndVerifier() {
+    const t = this.randomValue(this.verifierLength);
+    return { codeChallenge: this.codeChallengeMethod == "plain" ? t : await this.sha256(t), codeVerifier: t };
+  }
+  async getIdPayload(t, r) {
+    let n, i;
+    try {
+      let o;
+      if (o = await this.validateIdToken(t), !o)
+        return n = "access_denied", i = "Invalid ID token received", { error: n, error_description: i };
+      if (r && this.oauthUseUserInfoEndpoint) {
+        const s = await this.userInfoEndpoint(r);
+        if (s.error)
+          return n = s.error, i = "Failed getting user info: " + (s.error_description ?? "unknown error"), { error: n, error_description: i };
+        o = { ...o, ...s };
+      }
+      return { payload: o };
+    } catch (o) {
+      const s = g.asCrossauthError(o);
+      return l.logger.debug(u({ err: s })), l.logger.error(u({ msg: "Couldn't get user info", cerr: s })), n = s.oauthErrorCode, i = "Couldn't get user info: " + s.message, { error: n, error_description: i };
+    }
   }
   /**
    * This implements the functionality behind the redirect URI
@@ -1246,36 +1259,41 @@ class Be {
    * @returns The {@link OAuthTokenResponse} from the `token` endpoint
    *          request, or `error` and `error_description`.
    */
-  async redirectEndpoint(t, r, n, i) {
-    var p, I;
-    if (this.oidcConfig || await this.loadConfig(), n || !t)
-      return n || (n = "server_error"), i || (i = "Unknown error"), { error: n, error_description: i };
-    if (f(this, E) && r != f(this, E))
-      return { error: "access_denied", error_description: "State is not valid" };
-    if (this.authzCode = t, !((p = this.oidcConfig) != null && p.grant_types_supported.includes("authorization_code")))
+  async redirectEndpoint(t, r, n, i, o) {
+    var k, E;
+    if (this.oidcConfig || await this.loadConfig(), i || !t)
+      return i || (i = "server_error"), o || (o = "Unknown error"), { error: i, error_description: o };
+    if (this.authzCode = t, !((k = this.oidcConfig) != null && k.grant_types_supported.includes("authorization_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support authorization code grant"
       };
-    if (!((I = this.oidcConfig) != null && I.token_endpoint))
+    if (!((E = this.oidcConfig) != null && E.token_endpoint))
       return {
         error: "server_error",
         error_description: "Cannot get token endpoint"
       };
-    const o = this.oidcConfig.token_endpoint;
-    let s, c;
-    s = "authorization_code", c = f(this, _);
-    let u = {
-      grant_type: s,
-      client_id: f(this, w),
-      code: this.authzCode
+    const s = this.oidcConfig.token_endpoint;
+    let c, d;
+    c = "authorization_code", d = p(this, _);
+    let f = {
+      grant_type: c,
+      client_id: p(this, w),
+      code: this.authzCode,
+      redirect_uri: this.redirect_uri
     };
-    c && (u.client_secret = c), u.code_verifier = f(this, R);
+    r && (f.scope = r), d && (f.client_secret = d), n && (f.code_verifier = n);
     try {
-      const A = await this.post(o, u, this.authServerHeaders);
-      return A.id_token && !await this.validateIdToken(A.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : A;
-    } catch (A) {
-      return l.logger.error(h({ err: A })), {
+      let S = await this.post(s, f, this.authServerHeaders);
+      if (S.id_token) {
+        const I = await this.getIdPayload(S.id_token, S.access_token);
+        if (I.error)
+          return I;
+        S.id_payload = I.payload;
+      }
+      return S;
+    } catch (S) {
+      return l.logger.error(u({ err: S })), {
         error: "server_error",
         error_description: "Unable to get access token from server"
       };
@@ -1297,28 +1315,35 @@ class Be {
    */
   async clientCredentialsFlow(t) {
     var i, o;
-    if (l.logger.debug(h({ msg: "Starting client credentials flow" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("client_credentials")))
+    if (l.logger.debug(u({ msg: "Starting client credentials flow" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("client_credentials")))
       return {
         error: "invalid_request",
         error_description: "Server does not support client credentials grant"
       };
     if (!((o = this.oidcConfig) != null && o.token_endpoint))
       return { error: "server_error", error_description: "Cannot get token endpoint" };
-    if (!f(this, w)) return {
+    if (!p(this, w)) return {
       error: "invalid_request",
       error_description: "Cannot make client credentials flow without client id"
     };
     const r = this.oidcConfig.token_endpoint;
     let n = {
       grant_type: "client_credentials",
-      client_id: f(this, w),
-      client_secret: f(this, _)
+      client_id: p(this, w),
+      client_secret: p(this, _)
     };
     t && (n.scope = t);
     try {
-      return await this.post(r, n, this.authServerHeaders);
+      let s = await this.post(r, n, this.authServerHeaders);
+      if (s.id_token) {
+        const c = await this.getIdPayload(s.id_token, s.access_token);
+        if (c.error)
+          return c;
+        s.id_payload = c.payload;
+      }
+      return s;
     } catch (s) {
-      return l.logger.error(h({ err: s })), {
+      return l.logger.error(u({ err: s })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1341,7 +1366,7 @@ class Be {
    */
   async passwordFlow(t, r, n) {
     var s, c;
-    if (l.logger.debug(h({ msg: "Starting password flow" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("password")))
+    if (l.logger.debug(u({ msg: "Starting password flow" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("password")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password grant"
@@ -1354,17 +1379,23 @@ class Be {
     const i = this.oidcConfig.token_endpoint;
     let o = {
       grant_type: "password",
-      client_id: f(this, w),
-      client_secret: f(this, _),
+      client_id: p(this, w),
+      client_secret: p(this, _),
       username: t,
       password: r
     };
     n && (o.scope = n);
     try {
-      let u = await this.post(i, o, this.authServerHeaders);
-      return u.id_token && !await this.validateIdToken(u.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : u;
-    } catch (u) {
-      return l.logger.error(h({ err: u })), {
+      let d = await this.post(i, o, this.authServerHeaders);
+      if (d.id_token) {
+        const f = await this.getIdPayload(d.id_token, d.access_token);
+        if (f.error)
+          return f;
+        d.id_payload = f.payload;
+      }
+      return d;
+    } catch (d) {
+      return l.logger.error(u({ err: d })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1385,7 +1416,7 @@ class Be {
    */
   async mfaAuthenticators(t) {
     var o, s, c;
-    if (l.logger.debug(h({ msg: "Getting valid MFA authenticators" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")) && ((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
+    if (l.logger.debug(u({ msg: "Getting valid MFA authenticators" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")) && ((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
@@ -1399,19 +1430,19 @@ class Be {
         error_description: "Expected array of authenticators in mfa/authenticators response"
       };
     let i = [];
-    for (let u = 0; u < n.length; ++u) {
-      const p = n[u];
-      if (!p.id || !p.authenticator_type || !p.active)
+    for (let d = 0; d < n.length; ++d) {
+      const f = n[d];
+      if (!f.id || !f.authenticator_type || !f.active)
         return {
           error: "server_error",
           error_description: "Invalid mfa/authenticators response"
         };
       i.push({
-        id: p.id,
-        authenticator_type: p.authenticator_type,
-        active: p.active,
-        name: p.name,
-        oob_channel: p.oob_channel
+        id: f.id,
+        authenticator_type: f.authenticator_type,
+        active: f.active,
+        name: f.name,
+        oob_channel: f.oob_channel
       });
     }
     return { authenticators: i };
@@ -1430,7 +1461,7 @@ class Be {
    */
   async mfaOtpRequest(t, r) {
     var o, s;
-    if (l.logger.debug(h({ msg: "Making MFA OTB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    if (l.logger.debug(u({ msg: "Making MFA OTB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
@@ -1438,8 +1469,8 @@ class Be {
     if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", i = await this.post(n, {
-      client_id: f(this, w),
-      client_secret: f(this, _),
+      client_id: p(this, w),
+      client_secret: p(this, _),
       challenge_type: "otp",
       mfa_token: t,
       authenticator_id: r
@@ -1468,7 +1499,7 @@ class Be {
    */
   async mfaOtpComplete(t, r, n) {
     var s, c;
-    if (l.logger.debug(h({ msg: "Completing MFA OTP request" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    if (l.logger.debug(u({ msg: "Completing MFA OTP request" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
@@ -1477,13 +1508,19 @@ class Be {
       return { error: "server_error", error_description: "Cannot get issuer" };
     const i = this.oidcConfig.token_endpoint, o = await this.post(i, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-otp",
-      client_id: f(this, w),
-      client_secret: f(this, _),
+      client_id: p(this, w),
+      client_secret: p(this, _),
       challenge_type: "otp",
       mfa_token: t,
       otp: r,
       scope: n
     }, this.authServerHeaders);
+    if (o.id_token) {
+      const d = await this.getIdPayload(o.id_token, o.access_token);
+      if (d.error)
+        return d;
+      o.id_payload = d.payload;
+    }
     return {
       id_token: o.id_token,
       access_token: o.access_token,
@@ -1515,7 +1552,7 @@ class Be {
    */
   async mfaOobRequest(t, r) {
     var o, s;
-    if (l.logger.debug(h({ msg: "Making MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    if (l.logger.debug(u({ msg: "Making MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
@@ -1523,8 +1560,8 @@ class Be {
     if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", i = await this.post(n, {
-      client_id: f(this, w),
-      client_secret: f(this, _),
+      client_id: p(this, w),
+      client_secret: p(this, _),
       challenge_type: "oob",
       mfa_token: t,
       authenticator_id: r
@@ -1549,28 +1586,36 @@ class Be {
    *          an error instead of the response fields.
    */
   async mfaOobComplete(t, r, n, i) {
-    var c, u;
-    if (l.logger.debug(h({ msg: "Completing MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((c = this.oidcConfig) != null && c.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
+    var c, d;
+    if (l.logger.debug(u({ msg: "Completing MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((c = this.oidcConfig) != null && c.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((u = this.oidcConfig) != null && u.issuer))
+    if (!((d = this.oidcConfig) != null && d.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const o = this.oidcConfig.token_endpoint, s = await this.post(o, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-oob",
-      client_id: f(this, w),
-      client_secret: f(this, _),
+      client_id: p(this, w),
+      client_secret: p(this, _),
       challenge_type: "otp",
       mfa_token: t,
       oob_code: r,
       binding_code: n,
       scope: i
     }, this.authServerHeaders);
-    return s.error ? {
-      error: s.error,
-      error_description: s.error_description
-    } : s.id_token && !await this.validateIdToken(s.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : {
+    if (s.error)
+      return {
+        error: s.error,
+        error_description: s.error_description
+      };
+    if (s.id_token) {
+      const f = await this.getIdPayload(s.id_token, s.access_token);
+      if (f.error)
+        return f;
+      s.id_payload = f.payload;
+    }
+    return {
       id_token: s.id_token,
       access_token: s.access_token,
       refresh_token: s.refresh_token,
@@ -1583,7 +1628,7 @@ class Be {
   // Refresh Token Flow
   async refreshTokenFlow(t) {
     var o, s;
-    if (l.logger.debug(h({ msg: "Starting refresh token flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("refresh_token")))
+    if (l.logger.debug(u({ msg: "Starting refresh token flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("refresh_token")))
       return {
         error: "invalid_request",
         error_description: "Server does not support refresh_token grant"
@@ -1595,18 +1640,24 @@ class Be {
       };
     const r = this.oidcConfig.token_endpoint;
     let n;
-    n = f(this, _);
+    n = p(this, _);
     let i = {
       grant_type: "refresh_token",
       refresh_token: t,
-      client_id: f(this, w)
+      client_id: p(this, w)
     };
     n && (i.client_secret = n);
     try {
       let c = await this.post(r, i, this.authServerHeaders);
-      return c.id_token && !await this.validateIdToken(c.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : c;
+      if (c.id_token) {
+        const d = await this.getIdPayload(c.id_token, c.access_token);
+        if (d.error)
+          return d;
+        c.id_payload = d.payload;
+      }
+      return c;
     } catch (c) {
-      return l.logger.error(h({ err: c })), {
+      return l.logger.error(u({ err: c })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1622,22 +1673,22 @@ class Be {
    */
   async startDeviceCodeFlow(t, r) {
     var i;
-    if (l.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
+    if (l.logger.debug(u({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support device code grant"
       };
     let n = {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: f(this, w),
-      client_secret: f(this, _)
+      client_id: p(this, w),
+      client_secret: p(this, _)
     };
     r && (n.scope = r);
     try {
       let o = await this.post(t, n, this.authServerHeaders);
       return o.id_token && !await this.validateIdToken(o.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : o;
     } catch (o) {
-      return l.logger.error(h({ err: o })), {
+      return l.logger.error(u({ err: o })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1652,7 +1703,7 @@ class Be {
    */
   async pollDeviceCodeFlow(t) {
     var n, i, o;
-    if (l.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((n = this.oidcConfig) != null && n.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
+    if (l.logger.debug(u({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((n = this.oidcConfig) != null && n.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support device code grant"
@@ -1664,20 +1715,39 @@ class Be {
       };
     let r = {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: f(this, w),
-      client_secret: f(this, _),
+      client_id: p(this, w),
+      client_secret: p(this, _),
       device_code: t
     };
     try {
       const s = await this.post((o = this.oidcConfig) == null ? void 0 : o.token_endpoint, r, this.authServerHeaders);
-      return s.error ? s : s.id_token && !await this.validateIdToken(s.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : s;
+      if (s.error) return s;
+      if (s.id_token) {
+        const c = await this.getIdPayload(s.id_token, s.access_token);
+        if (c.error)
+          return c;
+        s.id_payload = c.payload;
+      }
+      return s;
     } catch (s) {
-      return l.logger.error(h({ err: s })), {
+      return l.logger.error(u({ err: s })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
     }
   }
+  //////////////////////////////////////////////////////////////////
+  // UserInfo
+  async userInfoEndpoint(t) {
+    var i;
+    if (!((i = this.oidcConfig) != null && i.userinfo_endpoint))
+      return {
+        error: "server_error",
+        error_description: "Cannot get token endpoint"
+      };
+    const r = this.oidcConfig.userinfo_endpoint;
+    return await this.post(r, {}, { authorization: "Bearer " + t });
+  }
   /**
    * Makes a POST request to the given URL using `fetch()`.
    * 
@@ -1687,22 +1757,34 @@ class Be {
    * @throws any exception raised by `fetch()`
    */
   async post(t, r, n = {}) {
-    l.logger.debug(h({
+    l.logger.debug(u({
       msg: "Fetch POST",
       url: t,
       params: Object.keys(r)
     }));
     let i = {};
-    return this.authServerCredentials && (i.credentials = this.authServerCredentials), this.authServerMode && (i.mode = this.authServerMode), await (await fetch(t, {
+    this.authServerCredentials && (i.credentials = this.authServerCredentials), this.authServerMode && (i.mode = this.authServerMode);
+    let o = "", s = "";
+    if (this.oauthPostType == "json")
+      o = JSON.stringify(r), s = "application/json";
+    else {
+      o = "";
+      for (let f in r)
+        o != "" && (o += "&"), o += encodeURIComponent(f) + "=" + encodeURIComponent(r[f]);
+      s = "application/x-www-form-urlencoded";
+    }
+    this.oauthLogFetch && l.logger.debug(u({ msg: "OAuth fetch", method: "POST", url: t, body: o }));
+    const d = await (await fetch(t, {
       method: "POST",
       ...i,
       headers: {
         Accept: "application/json",
-        "Content-Type": "application/json",
+        "Content-Type": s,
         ...n
       },
-      body: JSON.stringify(r)
+      body: o
     })).json();
+    return this.oauthLogFetch && l.logger.debug(u({ msg: "OAuth fetch response", body: JSON.stringify(d) })), d;
   }
   /**
    * Makes a GET request to the given URL using `fetch()`.
@@ -1713,17 +1795,18 @@ class Be {
    * @throws any exception raised by `fetch()`
    */
   async get(t, r = {}) {
-    l.logger.debug(h({ msg: "Fetch GET", url: t }));
+    l.logger.debug(u({ msg: "Fetch GET", url: t }));
     let n = {};
-    return this.authServerCredentials && (n.credentials = this.authServerCredentials), this.authServerMode && (n.mode = this.authServerMode), await (await fetch(t, {
+    this.authServerCredentials && (n.credentials = this.authServerCredentials), this.authServerMode && (n.mode = this.authServerMode), this.oauthLogFetch && l.logger.debug(u({ msg: "OAuth fetch", method: "GET", url: t }));
+    const o = await (await fetch(t, {
       method: "GET",
       ...n,
       headers: {
         Accept: "application/json",
-        "Content-Type": "application/json",
         ...r
       }
     })).json();
+    return this.oauthLogFetch && l.logger.debug(u({ msg: "OAuth fetch response", body: JSON.stringify(o) })), o;
   }
   /**
    * Validates an OpenID ID token, returning undefined if it is invalid.
@@ -1752,16 +1835,16 @@ class Be {
     try {
       return await this.tokenConsumer.tokenAuthorized(t, "id");
     } catch (r) {
-      l.logger.warn(h({ err: r }));
+      l.logger.warn(u({ err: r }));
       return;
     }
   }
   getTokenPayload(t) {
-    return Me(t);
+    return He(t);
   }
 }
-w = new WeakMap(), _ = new WeakMap(), U = new WeakMap(), R = new WeakMap(), E = new WeakMap();
-class Le {
+w = new WeakMap(), _ = new WeakMap();
+class Me {
   /**
    * Constrctor
    * 
@@ -1802,7 +1885,7 @@ class Le {
    * still call this function.  This is because key loading is
    * asynchronous, and constructors may not be async.
    */
-  async loadKeys() {
+  async loadKeys(t) {
     try {
       if (this.jwtSecretKey) {
         if (!this.jwtKeyType)
@@ -1810,25 +1893,25 @@ class Le {
             y.Configuration,
             "Must specify jwtKeyType if setting jwtSecretKey"
           );
-        this.keys._default = await Oe(this.jwtSecretKey, this.jwtKeyType);
+        this.keys._default = await Re(this.jwtSecretKey, this.jwtKeyType);
       } else if (this.jwtPublicKey) {
         if (!this.jwtKeyType)
           throw new g(
             y.Configuration,
             "Must specify jwtKeyType if setting jwtPublicKey"
           );
-        const t = await Ee(this.jwtPublicKey, this.jwtKeyType);
-        this.keys._default = t;
+        const r = await Te(this.jwtPublicKey, this.jwtKeyType);
+        this.keys._default = r;
       } else {
         if (this.oidcConfig || await this.loadConfig(), !this.oidcConfig)
           throw new g(
             y.Connection,
             "Load OIDC config before Jwks"
           );
-        await this.loadJwks();
+        await this.loadJwks(void 0, t);
       }
-    } catch (t) {
-      throw l.logger.debug(h({ err: t })), new g(y.Connection, "Couldn't load keys");
+    } catch (r) {
+      throw l.logger.debug(u({ err: r })), new g(y.Connection, "Couldn't load keys");
     }
   }
   /**
@@ -1851,11 +1934,11 @@ class Le {
     try {
       r = await fetch(new URL("/.well-known/openid-configuration", this.authServerBaseUrl));
     } catch (n) {
-      l.logger.error(h({ err: n }));
+      l.logger.error(u({ err: n }));
     }
     if (!r || !r.ok)
       throw new g(y.Connection, "Couldn't get OIDC configuration");
-    this.oidcConfig = { ...te };
+    this.oidcConfig = { ...Z };
     try {
       const n = await r.json();
       for (const [i, o] of Object.entries(n))
@@ -1873,40 +1956,46 @@ class Le {
    *   - `Connection` if the fetch to the authorization server failed,
    *     the OIDC configuration wasn't set or the keys could not be parsed.
    */
-  async loadJwks(t) {
+  async loadJwks(t, r) {
     if (t) {
       this.keys = {};
-      for (let r = 0; r < t.keys.length; ++r) {
-        const n = t.keys[r];
-        this.keys[n.kid ?? "_default"] = await Z(t.keys[r]);
+      for (let n = 0; n < t.keys.length; ++n) {
+        const i = t.keys[n];
+        this.keys[i.kid ?? "_default"] = await Y(t.keys[n]);
       }
     } else {
       if (!this.oidcConfig)
         throw new g(y.Connection, "Load OIDC config before Jwks");
-      let r;
+      let n;
       try {
-        r = await fetch(new URL(this.oidcConfig.jwks_uri));
-      } catch (n) {
-        l.logger.error(h({ err: n }));
+        n = await fetch(new URL(this.oidcConfig.jwks_uri));
+      } catch (i) {
+        l.logger.error(u({ err: i }));
       }
-      if (!r || !r.ok)
+      if (!n || !n.ok)
         throw new g(y.Connection, "Couldn't get OIDC configuration");
       this.keys = {};
       try {
-        const n = await r.json();
-        if (!("keys" in n) || !Array.isArray(n.keys))
+        const i = await n.json();
+        if (!("keys" in i) || !Array.isArray(i.keys))
           throw new g(y.Connection, "Couldn't fetch keys");
-        for (let i = 0; i < n.keys.length; ++i)
+        for (let o = 0; o < i.keys.length; ++o)
           try {
-            let o = "_default";
-            "kid" in n.keys[i] && typeof n.keys[i] == "string" && (o = String(n.keys[i]));
-            const s = await Z(n.keys[i]);
-            this.keys[o] = s;
-          } catch (o) {
-            throw l.logger.error(h({ err: o })), new g(y.Connection, "Couldn't load keys");
+            let s = "_default", c = { ...i.keys[o] };
+            if ("kid" in c && typeof c.kid == "string" && (s = String(c.kid)), c && !c.alg && !c.jwk_alg && r)
+              if (r.startsWith("RS") && c.kty == "RSA")
+                c.alg = r;
+              else {
+                l.logger.debug(u({ msg: "Skipping key with " + c.kty }));
+                continue;
+              }
+            const d = await Y(c);
+            this.keys[s] = d;
+          } catch (s) {
+            throw l.logger.error(u({ err: s })), new g(y.Connection, "Couldn't load keys");
           }
-      } catch (n) {
-        throw l.logger.error(h({ err: n })), new g(y.Connection, "Unrecognized response from OIDC jwks endpoint");
+      } catch (i) {
+        throw l.logger.error(u({ err: i })), new g(y.Connection, "Unrecognized response from OIDC jwks endpoint");
       }
     }
   }
@@ -1922,20 +2011,23 @@ class Le {
    * @returns the JWT payload if the token is valid, `undefined` otherwise.
    */
   async tokenAuthorized(t, r) {
-    (!this.keys || Object.keys(this.keys).length == 0) && await this.loadKeys();
+    if (!this.keys || Object.keys(this.keys).length == 0) {
+      const i = X(t);
+      await this.loadKeys(i.alg);
+    }
     const n = await this.validateToken(t);
     if (n) {
-      if (n.type != r) {
-        l.logger.error(h({ msg: r + " expected but got " + n.type }));
-        return;
-      }
       if (n.iss != this.authServerBaseUrl) {
-        l.logger.error(h({ msg: `Invalid issuer ${n.iss} in access token`, hashedAccessToken: await this.hash(n.jti) }));
+        const i = n.jti ? n.jti : n.sid ? n.sid : "";
+        l.logger.error(u({ msg: `Invalid issuer ${n.iss} in access token`, hashedAccessToken: await this.hash(i) }));
         return;
       }
-      if (n.aud && (Array.isArray(n.aud) && !n.aud.includes(this.audience) || !Array.isArray(n.aud) && n.aud != this.audience)) {
-        l.logger.error(h({ msg: `Invalid audience ${n.aud} in access token`, hashedAccessToken: await this.hash(n.jti) }));
-        return;
+      if (n.aud) {
+        const i = n.jti ? n.jti : n.sid ? n.sid : "";
+        if (Array.isArray(n.aud) && !n.aud.includes(this.audience) || !Array.isArray(n.aud) && n.aud != this.audience) {
+          l.logger.error(u({ msg: `Invalid audience ${n.aud} in access token`, hashedAccessToken: await this.hash(i) }));
+          return;
+        }
       }
       return n;
     }
@@ -1944,31 +2036,30 @@ class Le {
     (!this.keys || Object.keys(this.keys).length == 0) && l.logger.warn("No keys loaded so cannot validate tokens");
     let r;
     try {
-      r = qe(t).kid;
+      r = X(t).kid;
     } catch {
-      l.logger.warn(h({ msg: "Invalid access token format" }));
+      l.logger.warn(u({ msg: "Invalid access token format" }));
       return;
     }
     let n;
-    "_default" in this.keys && (n = this.keys._default);
     for (let i in this.keys)
       if (r == i) {
         n = this.keys[i];
         break;
       }
-    if (!n) {
-      l.logger.warn(h({ msg: "No matching keys found for access token" }));
+    if (!n && "_default" in this.keys && (n = this.keys._default), !n) {
+      l.logger.warn(u({ msg: "No matching keys found for access token" }));
       return;
     }
     try {
-      const { payload: i } = await Je(t, n), o = JSON.parse(new TextDecoder().decode(i));
+      const { payload: i } = await De(t, n), o = JSON.parse(new TextDecoder().decode(i));
       if (o.exp * 1e3 < Date.now() + this.clockTolerance) {
-        l.logger.warn(h({ msg: "Access token has expired" }));
+        l.logger.warn(u({ msg: "Access token has expired" }));
         return;
       }
       return o;
     } catch {
-      l.logger.warn(h({ msg: "Access token did not validate" }));
+      l.logger.warn(u({ msg: "Access token did not validate" }));
       return;
     }
   }
@@ -1976,13 +2067,13 @@ class Le {
 export {
   g as CrossauthError,
   l as CrossauthLogger,
-  te as DEFAULT_OIDCCONFIG,
+  Z as DEFAULT_OIDCCONFIG,
   y as ErrorCode,
   C as KeyPrefix,
-  Be as OAuthClientBase,
-  ee as OAuthFlows,
-  Le as OAuthTokenConsumerBase,
+  qe as OAuthClientBase,
+  Q as OAuthFlows,
+  Me as OAuthTokenConsumerBase,
   P as UserState,
-  $e as httpStatus,
-  h as j
+  Fe as httpStatus,
+  u as j
 };