@crossauth/common 1.1.2 → 1.1.3

package/dist/index.js

@@ -3,41 +3,41 @@ var Y = (e) => {
   throw TypeError(e);
 };
 var me = (e, t, r) => t in e ? ye(e, t, { enumerable: !0, configurable: !0, writable: !0, value: r }) : e[t] = r;
-var a = (e, t, r) => me(e, typeof t != "symbol" ? t + "" : t, r), X = (e, t, r) => t.has(e) || Y("Cannot " + r);
-var p = (e, t, r) => (X(e, t, "read from private field"), r ? r.call(e) : t.get(e)), $ = (e, t, r) => t.has(e) ? Y("Cannot add the same private member more than once") : t instanceof WeakSet ? t.add(e) : t.set(e, r), D = (e, t, r, n) => (X(e, t, "write to private field"), n ? n.call(e, r) : t.set(e, r), r);
-class E {
+var c = (e, t, r) => me(e, typeof t != "symbol" ? t + "" : t, r), X = (e, t, r) => t.has(e) || Y("Cannot " + r);
+var g = (e, t, r) => (X(e, t, "read from private field"), r ? r.call(e) : t.get(e)), $ = (e, t, r) => t.has(e) ? Y("Cannot add the same private member more than once") : t instanceof WeakSet ? t.add(e) : t.set(e, r), D = (e, t, r, n) => (X(e, t, "write to private field"), n ? n.call(e, r) : t.set(e, r), r);
+class R {
 }
 /** Ordinary, active user who can log in freely */
-a(E, "active", "active"), /** Deactivated account.  User cannot log in */
-a(E, "disabled", "disabled"), /** Two factor authentication has been actived for this user
+c(R, "active", "active"), /** Deactivated account.  User cannot log in */
+c(R, "disabled", "disabled"), /** Two factor authentication has been actived for this user
  * but has not yet been configured.  Once a user logs in,
  * they will be directed to a page to configure 2FA and will
  * not be able to do anything else (that requires login) until
  * they have done so.
  */
-a(E, "awaitingTwoFactorSetup", "awaitingtwofactorsetup"), /** Two factor authentication has been actived for this user
+c(R, "awaitingTwoFactorSetup", "awaitingtwofactorsetup"), /** Two factor authentication has been actived for this user
  * but has not yet been configured.  Once a user logs in,
  * they will be directed to a page to configure 2FA and will
  * not be able to do anything else (that requires login) until
  * they have done so.  They will then have to verify their email
  */
-a(E, "awaitingTwoFactorSetupAndEmailVerification", "awaitingtwofactorsetupandemailverification"), /** Email verification has been turned on but user has not
+c(R, "awaitingTwoFactorSetupAndEmailVerification", "awaitingtwofactorsetupandemailverification"), /** Email verification has been turned on but user has not
  * verified his or her email address.  Cannot log on until it has
  * been verified.
  */
-a(E, "awaitingEmailVerification", "awaitingemailverification"), /**
+c(R, "awaitingEmailVerification", "awaitingemailverification"), /**
  * If the state is set to this, the user may not access any
  * login-required functions unless he or she has changed their password.
  * 
  * Upon login, the user is redirected to the change password page.
  */
-a(E, "passwordChangeNeeded", "passwordchangeneeded"), /**
+c(R, "passwordChangeNeeded", "passwordchangeneeded"), /**
  * If the state is set to this, the user may not access any
  * login-required functions unless he or she has reset their password.
  * 
  * Upon login, the user is redirected to the reset password page.
  */
-a(E, "passwordResetNeeded", "passwordresetneeded"), /**
+c(R, "passwordResetNeeded", "passwordresetneeded"), /**
  * If the state is set to this, the user may not access any
  * login-required functions unless he or she has reset their second
  * factor configuration.
@@ -48,29 +48,29 @@ a(E, "passwordResetNeeded", "passwordresetneeded"), /**
  * this value and the user will then be prompted to configure 2FA 
  * upon login.
  */
-a(E, "factor2ResetNeeded", "factor2resetneeded"), /**
+c(R, "factor2ResetNeeded", "factor2resetneeded"), /**
  * If the state is set to this, the user may not access any
  * login-required functions unless he or she has reset their password
  * and then resets factor2.
  * 
  * Upon login, the user is redirected to the reset password page.
  */
-a(E, "passwordAndFactor2ResetNeeded", "passwordandfactor2resetneeded");
-class A {
+c(R, "passwordAndFactor2ResetNeeded", "passwordandfactor2resetneeded");
+class I {
 }
 /** Session ID */
-a(A, "session", "s:"), /** Password Reset Token */
-a(A, "passwordResetToken", "p:"), /** Email verification token */
-a(A, "emailVerificationToken", "e:"), /** API key */
-a(A, "apiKey", "api:"), /** OAuth authorization code */
-a(A, "authorizationCode", "authz:"), /** OAuth access token */
-a(A, "accessToken", "access:"), /** OAuth refresh token */
-a(A, "refreshToken", "refresh:"), /** OAuth MFA key (used by the password MFA flow) */
-a(A, "mfaToken", "omfa:"), /** Device code device code */
-a(A, "deviceCode", "dc:"), /** Device code flow user code */
-a(A, "userCode", "uc:");
-var y = /* @__PURE__ */ ((e) => (e[e.UserNotExist = 0] = "UserNotExist", e[e.PasswordInvalid = 1] = "PasswordInvalid", e[e.EmailNotExist = 2] = "EmailNotExist", e[e.UsernameOrPasswordInvalid = 3] = "UsernameOrPasswordInvalid", e[e.InvalidClientId = 4] = "InvalidClientId", e[e.ClientExists = 5] = "ClientExists", e[e.InvalidClientSecret = 6] = "InvalidClientSecret", e[e.InvalidClientIdOrSecret = 7] = "InvalidClientIdOrSecret", e[e.InvalidRedirectUri = 8] = "InvalidRedirectUri", e[e.InvalidOAuthFlow = 9] = "InvalidOAuthFlow", e[e.UserNotActive = 10] = "UserNotActive", e[e.EmailNotVerified = 11] = "EmailNotVerified", e[e.TwoFactorIncomplete = 12] = "TwoFactorIncomplete", e[e.Unauthorized = 13] = "Unauthorized", e[e.UnauthorizedClient = 14] = "UnauthorizedClient", e[e.InvalidScope = 15] = "InvalidScope", e[e.InsufficientScope = 16] = "InsufficientScope", e[e.InsufficientPriviledges = 17] = "InsufficientPriviledges", e[e.Forbidden = 18] = "Forbidden", e[e.InvalidKey = 19] = "InvalidKey", e[e.InvalidCsrf = 20] = "InvalidCsrf", e[e.InvalidSession = 21] = "InvalidSession", e[e.Expired = 22] = "Expired", e[e.Connection = 23] = "Connection", e[e.InvalidHash = 24] = "InvalidHash", e[e.UnsupportedAlgorithm = 25] = "UnsupportedAlgorithm", e[e.KeyExists = 26] = "KeyExists", e[e.PasswordChangeNeeded = 27] = "PasswordChangeNeeded", e[e.PasswordResetNeeded = 28] = "PasswordResetNeeded", e[e.Factor2ResetNeeded = 29] = "Factor2ResetNeeded", e[e.Configuration = 30] = "Configuration", e[e.InvalidEmail = 31] = "InvalidEmail", e[e.InvalidPhoneNumber = 32] = "InvalidPhoneNumber", e[e.InvalidUsername = 33] = "InvalidUsername", e[e.PasswordMatch = 34] = "PasswordMatch", e[e.InvalidToken = 35] = "InvalidToken", e[e.MfaRequired = 36] = "MfaRequired", e[e.PasswordFormat = 37] = "PasswordFormat", e[e.DataFormat = 38] = "DataFormat", e[e.FetchError = 39] = "FetchError", e[e.UserExists = 40] = "UserExists", e[e.FormEntry = 41] = "FormEntry", e[e.BadRequest = 42] = "BadRequest", e[e.AuthorizationPending = 43] = "AuthorizationPending", e[e.SlowDown = 44] = "SlowDown", e[e.ExpiredToken = 45] = "ExpiredToken", e[e.ConstraintViolation = 46] = "ConstraintViolation", e[e.NotImplemented = 47] = "NotImplemented", e[e.UnknownError = 48] = "UnknownError", e))(y || {});
-class g extends Error {
+c(I, "session", "s:"), /** Password Reset Token */
+c(I, "passwordResetToken", "p:"), /** Email verification token */
+c(I, "emailVerificationToken", "e:"), /** API key */
+c(I, "apiKey", "api:"), /** OAuth authorization code */
+c(I, "authorizationCode", "authz:"), /** OAuth access token */
+c(I, "accessToken", "access:"), /** OAuth refresh token */
+c(I, "refreshToken", "refresh:"), /** OAuth MFA key (used by the password MFA flow) */
+c(I, "mfaToken", "omfa:"), /** Device code device code */
+c(I, "deviceCode", "dc:"), /** Device code flow user code */
+c(I, "userCode", "uc:");
+var m = /* @__PURE__ */ ((e) => (e[e.UserNotExist = 0] = "UserNotExist", e[e.PasswordInvalid = 1] = "PasswordInvalid", e[e.EmailNotExist = 2] = "EmailNotExist", e[e.UsernameOrPasswordInvalid = 3] = "UsernameOrPasswordInvalid", e[e.InvalidClientId = 4] = "InvalidClientId", e[e.ClientExists = 5] = "ClientExists", e[e.InvalidClientSecret = 6] = "InvalidClientSecret", e[e.InvalidClientIdOrSecret = 7] = "InvalidClientIdOrSecret", e[e.InvalidRedirectUri = 8] = "InvalidRedirectUri", e[e.InvalidOAuthFlow = 9] = "InvalidOAuthFlow", e[e.UserNotActive = 10] = "UserNotActive", e[e.EmailNotVerified = 11] = "EmailNotVerified", e[e.TwoFactorIncomplete = 12] = "TwoFactorIncomplete", e[e.Unauthorized = 13] = "Unauthorized", e[e.UnauthorizedClient = 14] = "UnauthorizedClient", e[e.InvalidScope = 15] = "InvalidScope", e[e.InsufficientScope = 16] = "InsufficientScope", e[e.InsufficientPriviledges = 17] = "InsufficientPriviledges", e[e.Forbidden = 18] = "Forbidden", e[e.InvalidKey = 19] = "InvalidKey", e[e.InvalidCsrf = 20] = "InvalidCsrf", e[e.InvalidSession = 21] = "InvalidSession", e[e.Expired = 22] = "Expired", e[e.Connection = 23] = "Connection", e[e.InvalidHash = 24] = "InvalidHash", e[e.UnsupportedAlgorithm = 25] = "UnsupportedAlgorithm", e[e.KeyExists = 26] = "KeyExists", e[e.PasswordChangeNeeded = 27] = "PasswordChangeNeeded", e[e.PasswordResetNeeded = 28] = "PasswordResetNeeded", e[e.Factor2ResetNeeded = 29] = "Factor2ResetNeeded", e[e.Configuration = 30] = "Configuration", e[e.InvalidEmail = 31] = "InvalidEmail", e[e.InvalidPhoneNumber = 32] = "InvalidPhoneNumber", e[e.InvalidUsername = 33] = "InvalidUsername", e[e.PasswordMatch = 34] = "PasswordMatch", e[e.InvalidToken = 35] = "InvalidToken", e[e.MfaRequired = 36] = "MfaRequired", e[e.PasswordFormat = 37] = "PasswordFormat", e[e.DataFormat = 38] = "DataFormat", e[e.FetchError = 39] = "FetchError", e[e.UserExists = 40] = "UserExists", e[e.FormEntry = 41] = "FormEntry", e[e.BadRequest = 42] = "BadRequest", e[e.AuthorizationPending = 43] = "AuthorizationPending", e[e.SlowDown = 44] = "SlowDown", e[e.ExpiredToken = 45] = "ExpiredToken", e[e.ConstraintViolation = 46] = "ConstraintViolation", e[e.NotImplemented = 47] = "NotImplemented", e[e.UnknownError = 48] = "UnknownError", e))(m || {});
+class p extends Error {
   /**
    * Creates a new error to throw,
    * 
@@ -84,19 +84,19 @@ class g extends Error {
     /** `typeof` won't work on this class.  To determine if the 
      * object is a `CrossauthError`, check for presence of this member.
      */
-    a(this, "isCrossauthError", !0);
+    c(this, "isCrossauthError", !0);
     /** The best HTTP status to report */
-    a(this, "httpStatus");
+    c(this, "httpStatus");
     /** All Crossauth errors have an error code */
-    a(this, "code");
+    c(this, "code");
     /** All Crossauth errors have an error code */
-    a(this, "codeName");
+    c(this, "codeName");
     /** A vector of error messages.  If there was only one, it will still be in this array.
      * The inherited property `message` is also always available.  If there were multiple messages,
      * it will be a concatenation of them with `". "` in between.
      */
-    a(this, "messages");
-    this.code = r, this.codeName = y[r], this.httpStatus = o, this.name = "CrossauthError", Array.isArray(n) ? this.messages = n : this.messages = [i], Object.setPrototypeOf(this, g.prototype);
+    c(this, "messages");
+    this.code = r, this.codeName = m[r], this.httpStatus = o, this.name = "CrossauthError", Array.isArray(n) ? this.messages = n : this.messages = [i], Object.setPrototypeOf(this, p.prototype);
   }
   /**
    * OAuth defines certain error types.  To convert the error in an OAuth
@@ -151,7 +151,7 @@ class g extends Error {
       default:
         i = 48;
     }
-    return new g(i, n);
+    return new p(i, n);
   }
   get oauthErrorCode() {
     switch (this.code) {
@@ -194,21 +194,21 @@ class g extends Error {
    */
   static asCrossauthError(r, n) {
     if (r instanceof Error)
-      return "isCrossauthError" in r ? r : new g(48, r.message);
+      return "isCrossauthError" in r ? r : new p(48, r.message);
     if ("errorCode" in r) {
       let o = 48;
       try {
         o = Number(r.errorCode) ?? 48;
       } catch {
       }
-      let s = n ?? y[o];
-      return "errorMessage" in r ? s = r.errorMessage : "message" in r && (s = r.message), new g(o, s);
+      let s = n ?? m[o];
+      return "errorMessage" in r ? s = r.errorMessage : "message" in r && (s = r.message), new p(o, s);
     }
-    let i = n ?? y[
+    let i = n ?? m[
       48
       /* UnknownError */
     ];
-    return "message" in r && (i = r.message), new g(48, i);
+    return "message" in r && (i = r.message), new p(48, i);
   }
 }
 function it(e) {
@@ -256,20 +256,20 @@ const B = {
   503: "Service Unavailable",
   504: "Gateway Timeout",
   505: "HTTP Version Not Supported"
-}, m = class m {
+}, w = class w {
   /**
    * Create a logger with the given level
    * @param level the level to report to
    */
   constructor(t) {
     /** the log level. This can be set dynamically */
-    a(this, "level");
+    c(this, "level");
     if (t) this.level = t;
     else if (typeof process < "u" && "CROSSAUTH_LOG_LEVEL" in process.env) {
       const r = (process.env.CROSSAUTH_LOG_LEVEL ?? "ERROR").toUpperCase();
-      m.levelName.includes(r) ? this.level = m.levelName.indexOf(r) : this.level = m.Error;
+      w.levelName.includes(r) ? this.level = w.levelName.indexOf(r) : this.level = w.Error;
     } else
-      this.level = m.Error;
+      this.level = w.Error;
   }
   /**
    * Return the singleton instance of the logger.
@@ -282,35 +282,35 @@ const B = {
     this.level = t;
   }
   log(t, r) {
-    t <= this.level && (typeof r == "string" ? console.log("Crossauth " + m.levelName[t] + " " + (/* @__PURE__ */ new Date()).toISOString(), r) : console.log(JSON.stringify({ level: m.levelName[t], time: (/* @__PURE__ */ new Date()).toISOString(), ...r })));
+    t <= this.level && (typeof r == "string" ? console.log("Crossauth " + w.levelName[t] + " " + (/* @__PURE__ */ new Date()).toISOString(), r) : console.log(JSON.stringify({ level: w.levelName[t], time: (/* @__PURE__ */ new Date()).toISOString(), ...r })));
   }
   /**
    * Report an error
    * @param output object to output
    */
   error(t) {
-    this.log(m.Error, t);
+    this.log(w.Error, t);
   }
   /**
    * Report an warning
    * @param output object to output
    */
   warn(t) {
-    this.log(m.Warn, t);
+    this.log(w.Warn, t);
   }
   /**
    * Report information
    * @param output object to output
    */
   info(t) {
-    this.log(m.Info, t);
+    this.log(w.Info, t);
   }
   /**
    * Print a debugging message
    * @param output object to output
    */
   debug(t) {
-    this.log(m.Debug, t);
+    this.log(w.Debug, t);
   }
   /** 
    * Override the default logger.
@@ -327,12 +327,12 @@ const B = {
   }
 };
 /** Don't log anything */
-a(m, "None", 0), /** Only log errors */
-a(m, "Error", 1), /** Log errors and warning */
-a(m, "Warn", 2), /** Log errors, warnings and info messages */
-a(m, "Info", 3), /** Log everything */
-a(m, "Debug", 4), a(m, "levelName", ["NONE", "ERROR", "WARN", "INFO", "DEBUG"]);
-let l = m;
+c(w, "None", 0), /** Only log errors */
+c(w, "Error", 1), /** Log errors and warning */
+c(w, "Warn", 2), /** Log errors, warnings and info messages */
+c(w, "Info", 3), /** Log everything */
+c(w, "Debug", 4), c(w, "levelName", ["NONE", "ERROR", "WARN", "INFO", "DEBUG"]);
+let l = w;
 function u(e) {
   let t;
   typeof e == "object" && "err" in e && typeof e.err == "object" && (t = e.err.stack);
@@ -384,7 +384,7 @@ const _e = (e) => {
   for (let n = 0; n < t.length; n++)
     r[n] = t.charCodeAt(n);
   return r;
-}, K = (e) => {
+}, O = (e) => {
   let t = e;
   t instanceof Uint8Array && (t = H.decode(t)), t = t.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, "");
   try {
@@ -393,98 +393,98 @@ const _e = (e) => {
     throw new TypeError("The input to be decoded is not correctly encoded.");
   }
 };
-class S extends Error {
+class b extends Error {
   constructor(t, r) {
     var n;
     super(t, r), this.code = "ERR_JOSE_GENERIC", this.name = this.constructor.name, (n = Error.captureStackTrace) == null || n.call(Error, this, this.constructor);
   }
 }
-S.code = "ERR_JOSE_GENERIC";
-class ve extends S {
+b.code = "ERR_JOSE_GENERIC";
+class ve extends b {
   constructor(t, r, n = "unspecified", i = "unspecified") {
     super(t, { cause: { claim: n, reason: i, payload: r } }), this.code = "ERR_JWT_CLAIM_VALIDATION_FAILED", this.claim = n, this.reason = i, this.payload = r;
   }
 }
 ve.code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-class Se extends S {
+class Se extends b {
   constructor(t, r, n = "unspecified", i = "unspecified") {
     super(t, { cause: { claim: n, reason: i, payload: r } }), this.code = "ERR_JWT_EXPIRED", this.claim = n, this.reason = i, this.payload = r;
   }
 }
 Se.code = "ERR_JWT_EXPIRED";
-class be extends S {
+class be extends b {
   constructor() {
     super(...arguments), this.code = "ERR_JOSE_ALG_NOT_ALLOWED";
   }
 }
 be.code = "ERR_JOSE_ALG_NOT_ALLOWED";
-class C extends S {
+class A extends b {
   constructor() {
     super(...arguments), this.code = "ERR_JOSE_NOT_SUPPORTED";
   }
 }
-C.code = "ERR_JOSE_NOT_SUPPORTED";
-class Ce extends S {
+A.code = "ERR_JOSE_NOT_SUPPORTED";
+class Ce extends b {
   constructor(t = "decryption operation failed", r) {
     super(t, r), this.code = "ERR_JWE_DECRYPTION_FAILED";
   }
 }
 Ce.code = "ERR_JWE_DECRYPTION_FAILED";
-class Ae extends S {
+class Ae extends b {
   constructor() {
     super(...arguments), this.code = "ERR_JWE_INVALID";
   }
 }
 Ae.code = "ERR_JWE_INVALID";
-class w extends S {
+class _ extends b {
   constructor() {
     super(...arguments), this.code = "ERR_JWS_INVALID";
   }
 }
-w.code = "ERR_JWS_INVALID";
-class P extends S {
+_.code = "ERR_JWS_INVALID";
+class k extends b {
   constructor() {
     super(...arguments), this.code = "ERR_JWT_INVALID";
   }
 }
-P.code = "ERR_JWT_INVALID";
-class Ie extends S {
+k.code = "ERR_JWT_INVALID";
+class Ie extends b {
   constructor() {
     super(...arguments), this.code = "ERR_JWK_INVALID";
   }
 }
 Ie.code = "ERR_JWK_INVALID";
-class Ee extends S {
+class Ee extends b {
   constructor() {
     super(...arguments), this.code = "ERR_JWKS_INVALID";
   }
 }
 Ee.code = "ERR_JWKS_INVALID";
-class Te extends S {
+class Re extends b {
   constructor(t = "no applicable key found in the JSON Web Key Set", r) {
     super(t, r), this.code = "ERR_JWKS_NO_MATCHING_KEY";
   }
 }
-Te.code = "ERR_JWKS_NO_MATCHING_KEY";
-class Re extends S {
+Re.code = "ERR_JWKS_NO_MATCHING_KEY";
+class Te extends b {
   constructor(t = "multiple matching keys found in the JSON Web Key Set", r) {
     super(t, r), this.code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
   }
 }
-Re.code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
-class Pe extends S {
+Te.code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+class Pe extends b {
   constructor(t = "request timed out", r) {
     super(t, r), this.code = "ERR_JWKS_TIMEOUT";
   }
 }
 Pe.code = "ERR_JWKS_TIMEOUT";
-class oe extends S {
+class oe extends b {
   constructor(t = "signature verification failed", r) {
     super(t, r), this.code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
   }
 }
 oe.code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-function I(e, t = "algorithm.name") {
+function E(e, t = "algorithm.name") {
   return new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);
 }
 function z(e, t) {
@@ -521,50 +521,50 @@ function Oe(e, t, ...r) {
     case "HS384":
     case "HS512": {
       if (!z(e.algorithm, "HMAC"))
-        throw I("HMAC");
+        throw E("HMAC");
       const n = parseInt(t.slice(2), 10);
       if (V(e.algorithm.hash) !== n)
-        throw I(`SHA-${n}`, "algorithm.hash");
+        throw E(`SHA-${n}`, "algorithm.hash");
       break;
     }
     case "RS256":
     case "RS384":
     case "RS512": {
       if (!z(e.algorithm, "RSASSA-PKCS1-v1_5"))
-        throw I("RSASSA-PKCS1-v1_5");
+        throw E("RSASSA-PKCS1-v1_5");
       const n = parseInt(t.slice(2), 10);
       if (V(e.algorithm.hash) !== n)
-        throw I(`SHA-${n}`, "algorithm.hash");
+        throw E(`SHA-${n}`, "algorithm.hash");
       break;
     }
     case "PS256":
     case "PS384":
     case "PS512": {
       if (!z(e.algorithm, "RSA-PSS"))
-        throw I("RSA-PSS");
+        throw E("RSA-PSS");
       const n = parseInt(t.slice(2), 10);
       if (V(e.algorithm.hash) !== n)
-        throw I(`SHA-${n}`, "algorithm.hash");
+        throw E(`SHA-${n}`, "algorithm.hash");
       break;
     }
     case "EdDSA": {
       if (e.algorithm.name !== "Ed25519" && e.algorithm.name !== "Ed448")
-        throw I("Ed25519 or Ed448");
+        throw E("Ed25519 or Ed448");
       break;
     }
     case "Ed25519": {
       if (!z(e.algorithm, "Ed25519"))
-        throw I("Ed25519");
+        throw E("Ed25519");
       break;
     }
     case "ES256":
     case "ES384":
     case "ES512": {
       if (!z(e.algorithm, "ECDSA"))
-        throw I("ECDSA");
+        throw E("ECDSA");
       const n = ke(t);
       if (e.algorithm.namedCurve !== n)
-        throw I(n, "algorithm.namedCurve");
+        throw E(n, "algorithm.namedCurve");
       break;
     }
     default:
@@ -584,7 +584,7 @@ const Q = (e, ...t) => se("Key must be ", e, ...t);
 function ae(e, t, ...r) {
   return se(`Key for the ${e} algorithm must be `, t, ...r);
 }
-const ce = (e) => ne(e) ? !0 : (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject", L = ["CryptoKey"], We = (...e) => {
+const ce = (e) => ne(e) ? !0 : (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject", L = ["CryptoKey"], Ne = (...e) => {
   const t = e.filter(Boolean);
   if (t.length === 0 || t.length === 1)
     return !0;
@@ -603,11 +603,11 @@ const ce = (e) => ne(e) ? !0 : (e == null ? void 0 : e[Symbol.toStringTag]) ===
   }
   return !0;
 };
-function Ne(e) {
+function We(e) {
   return typeof e == "object" && e !== null;
 }
 function x(e) {
-  if (!Ne(e) || Object.prototype.toString.call(e) !== "[object Object]")
+  if (!We(e) || Object.prototype.toString.call(e) !== "[object Object]")
     return !1;
   if (Object.getPrototypeOf(e) === null)
     return !0;
@@ -660,7 +660,7 @@ function ze(e) {
           }, r = e.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
           break;
         default:
-          throw new C('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+          throw new A('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
       }
       break;
     }
@@ -682,7 +682,7 @@ function ze(e) {
           t = { name: "ECDH", namedCurve: e.crv }, r = e.d ? ["deriveBits"] : [];
           break;
         default:
-          throw new C('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+          throw new A('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
       }
       break;
     }
@@ -701,12 +701,12 @@ function ze(e) {
           t = { name: e.crv }, r = e.d ? ["deriveBits"] : [];
           break;
         default:
-          throw new C('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+          throw new A('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
       }
       break;
     }
     default:
-      throw new C('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
+      throw new A('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
   }
   return { algorithm: t, keyUsages: r };
 }
@@ -719,8 +719,8 @@ const de = async (e) => {
     e.key_ops ?? r
   ], i = { ...e };
   return delete i.alg, delete i.use, q.subtle.importKey("jwk", i, ...n);
-}, le = (e) => K(e);
-let W, N;
+}, le = (e) => O(e);
+let N, W;
 const ue = (e) => (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject", F = async (e, t, r, n, i = !1) => {
   let o = e.get(t);
   if (o != null && o[n])
@@ -730,44 +730,44 @@ const ue = (e) => (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject",
 }, He = (e, t) => {
   if (ue(e)) {
     let r = e.export({ format: "jwk" });
-    return delete r.d, delete r.dp, delete r.dq, delete r.p, delete r.q, delete r.qi, r.k ? le(r.k) : (N || (N = /* @__PURE__ */ new WeakMap()), F(N, e, r, t));
+    return delete r.d, delete r.dp, delete r.dq, delete r.p, delete r.q, delete r.qi, r.k ? le(r.k) : (W || (W = /* @__PURE__ */ new WeakMap()), F(W, e, r, t));
   }
-  return U(e) ? e.k ? K(e.k) : (N || (N = /* @__PURE__ */ new WeakMap()), F(N, e, e, t, !0)) : e;
+  return U(e) ? e.k ? O(e.k) : (W || (W = /* @__PURE__ */ new WeakMap()), F(W, e, e, t, !0)) : e;
 }, Me = (e, t) => {
   if (ue(e)) {
     let r = e.export({ format: "jwk" });
-    return r.k ? le(r.k) : (W || (W = /* @__PURE__ */ new WeakMap()), F(W, e, r, t));
+    return r.k ? le(r.k) : (N || (N = /* @__PURE__ */ new WeakMap()), F(N, e, r, t));
   }
-  return U(e) ? e.k ? K(e.k) : (W || (W = /* @__PURE__ */ new WeakMap()), F(W, e, e, t, !0)) : e;
-}, Le = { normalizePublicKey: He, normalizePrivateKey: Me }, k = (e, t, r = 0) => {
+  return U(e) ? e.k ? O(e.k) : (N || (N = /* @__PURE__ */ new WeakMap()), F(N, e, e, t, !0)) : e;
+}, Le = { normalizePublicKey: He, normalizePrivateKey: Me }, K = (e, t, r = 0) => {
   r === 0 && (t.unshift(t.length), t.unshift(6));
   const n = e.indexOf(t[0], r);
   if (n === -1)
     return !1;
   const i = e.subarray(n, n + t.length);
-  return i.length !== t.length ? !1 : i.every((o, s) => o === t[s]) || k(e, t, n + 1);
+  return i.length !== t.length ? !1 : i.every((o, s) => o === t[s]) || K(e, t, n + 1);
 }, Z = (e) => {
   switch (!0) {
-    case k(e, [42, 134, 72, 206, 61, 3, 1, 7]):
+    case K(e, [42, 134, 72, 206, 61, 3, 1, 7]):
       return "P-256";
-    case k(e, [43, 129, 4, 0, 34]):
+    case K(e, [43, 129, 4, 0, 34]):
       return "P-384";
-    case k(e, [43, 129, 4, 0, 35]):
+    case K(e, [43, 129, 4, 0, 35]):
       return "P-521";
-    case k(e, [43, 101, 110]):
+    case K(e, [43, 101, 110]):
       return "X25519";
-    case k(e, [43, 101, 111]):
+    case K(e, [43, 101, 111]):
       return "X448";
-    case k(e, [43, 101, 112]):
+    case K(e, [43, 101, 112]):
       return "Ed25519";
-    case k(e, [43, 101, 113]):
+    case K(e, [43, 101, 113]):
       return "Ed448";
     default:
-      throw new C("Invalid or unsupported EC Key Curve or OKP Key Sub Type");
+      throw new A("Invalid or unsupported EC Key Curve or OKP Key Sub Type");
   }
 }, he = async (e, t, r, n, i) => {
   let o, s;
-  const c = new Uint8Array(atob(r.replace(e, "")).split("").map((f) => f.charCodeAt(0))), d = t === "spki";
+  const a = new Uint8Array(atob(r.replace(e, "")).split("").map((f) => f.charCodeAt(0))), d = t === "spki";
   switch (n) {
     case "PS256":
     case "PS384":
@@ -801,7 +801,7 @@ const ue = (e) => (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject",
     case "ECDH-ES+A128KW":
     case "ECDH-ES+A192KW":
     case "ECDH-ES+A256KW": {
-      const f = Z(c);
+      const f = Z(a);
       o = f.startsWith("P-") ? { name: "ECDH", namedCurve: f } : { name: f }, s = d ? [] : ["deriveBits"];
       break;
     }
@@ -809,12 +809,12 @@ const ue = (e) => (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject",
       o = { name: "Ed25519" }, s = d ? ["verify"] : ["sign"];
       break;
     case "EdDSA":
-      o = { name: Z(c) }, s = d ? ["verify"] : ["sign"];
+      o = { name: Z(a) }, s = d ? ["verify"] : ["sign"];
       break;
     default:
-      throw new C('Invalid or unsupported "alg" (Algorithm) value');
+      throw new A('Invalid or unsupported "alg" (Algorithm) value');
   }
-  return q.subtle.importKey(t, c, o, !1, s);
+  return q.subtle.importKey(t, a, o, !1, s);
 }, Fe = (e, t, r) => he(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", e, t), qe = (e, t, r) => he(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", e, t);
 async function $e(e, t, r) {
   if (typeof e != "string" || e.indexOf("-----BEGIN PUBLIC KEY-----") !== 0)
@@ -833,15 +833,15 @@ async function j(e, t) {
     case "oct":
       if (typeof e.k != "string" || !e.k)
         throw new TypeError('missing "k" (Key Value) Parameter value');
-      return K(e.k);
+      return O(e.k);
     case "RSA":
       if ("oth" in e && e.oth !== void 0)
-        throw new C('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+        throw new A('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
     case "EC":
     case "OKP":
       return de({ ...e, alg: t });
     default:
-      throw new C('Unsupported "kty" (Key Type) Parameter value');
+      throw new A('Unsupported "kty" (Key Type) Parameter value');
   }
 }
 const J = (e) => e == null ? void 0 : e[Symbol.toStringTag], G = (e, t, r) => {
@@ -906,7 +906,7 @@ function Ge(e, t, r, n, i) {
   o = t;
   for (const s of n.crit) {
     if (!o.has(s))
-      throw new C(`Extension Header Parameter "${s}" is not recognized`);
+      throw new A(`Extension Header Parameter "${s}" is not recognized`);
     if (i[s] === void 0)
       throw new e(`Extension Header Parameter "${s}" is missing`);
     if (o.get(s) && n[s] === void 0)
@@ -938,7 +938,7 @@ function Ye(e, t) {
     case "EdDSA":
       return { name: t.name };
     default:
-      throw new C(`alg ${e} is not supported either by JOSE or your javascript runtime`);
+      throw new A(`alg ${e} is not supported either by JOSE or your javascript runtime`);
   }
 }
 async function Xe(e, t, r) {
@@ -963,74 +963,74 @@ const Qe = async (e, t, r, n) => {
 };
 async function Ze(e, t, r) {
   if (!x(e))
-    throw new w("Flattened JWS must be an object");
+    throw new _("Flattened JWS must be an object");
   if (e.protected === void 0 && e.header === void 0)
-    throw new w('Flattened JWS must have either of the "protected" or "header" members');
+    throw new _('Flattened JWS must have either of the "protected" or "header" members');
   if (e.protected !== void 0 && typeof e.protected != "string")
-    throw new w("JWS Protected Header incorrect type");
+    throw new _("JWS Protected Header incorrect type");
   if (e.payload === void 0)
-    throw new w("JWS Payload missing");
+    throw new _("JWS Payload missing");
   if (typeof e.signature != "string")
-    throw new w("JWS Signature missing or incorrect type");
+    throw new _("JWS Signature missing or incorrect type");
   if (e.header !== void 0 && !x(e.header))
-    throw new w("JWS Unprotected Header incorrect type");
+    throw new _("JWS Unprotected Header incorrect type");
   let n = {};
   if (e.protected)
     try {
-      const ge = K(e.protected);
+      const ge = O(e.protected);
       n = JSON.parse(H.decode(ge));
     } catch {
-      throw new w("JWS Protected Header is invalid");
+      throw new _("JWS Protected Header is invalid");
     }
-  if (!We(n, e.header))
-    throw new w("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  if (!Ne(n, e.header))
+    throw new _("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
   const i = {
     ...n,
     ...e.header
-  }, o = Ge(w, /* @__PURE__ */ new Map([["b64", !0]]), r == null ? void 0 : r.crit, n, i);
+  }, o = Ge(_, /* @__PURE__ */ new Map([["b64", !0]]), r == null ? void 0 : r.crit, n, i);
   let s = !0;
   if (o.has("b64") && (s = n.b64, typeof s != "boolean"))
-    throw new w('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-  const { alg: c } = i;
-  if (typeof c != "string" || !c)
-    throw new w('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    throw new _('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+  const { alg: a } = i;
+  if (typeof a != "string" || !a)
+    throw new _('JWS "alg" (Algorithm) Header Parameter missing or invalid');
   if (s) {
     if (typeof e.payload != "string")
-      throw new w("JWS Payload must be a string");
+      throw new _("JWS Payload must be a string");
   } else if (typeof e.payload != "string" && !(e.payload instanceof Uint8Array))
-    throw new w("JWS Payload must be a string or an Uint8Array instance");
+    throw new _("JWS Payload must be a string or an Uint8Array instance");
   let d = !1;
-  typeof t == "function" ? (t = await t(n, e), d = !0, ee(c, t, "verify"), U(t) && (t = await j(t, c))) : ee(c, t, "verify");
+  typeof t == "function" ? (t = await t(n, e), d = !0, ee(a, t, "verify"), U(t) && (t = await j(t, a))) : ee(a, t, "verify");
   const f = we(M.encode(e.protected ?? ""), M.encode("."), typeof e.payload == "string" ? M.encode(e.payload) : e.payload);
-  let T;
+  let y;
   try {
-    T = K(e.signature);
+    y = O(e.signature);
   } catch {
-    throw new w("Failed to base64url decode the signature");
+    throw new _("Failed to base64url decode the signature");
   }
-  if (!await Qe(c, t, T, f))
+  if (!await Qe(a, t, y, f))
     throw new oe();
-  let b;
+  let C;
   if (s)
     try {
-      b = K(e.payload);
+      C = O(e.payload);
     } catch {
-      throw new w("Failed to base64url decode the payload");
+      throw new _("Failed to base64url decode the payload");
     }
-  else typeof e.payload == "string" ? b = M.encode(e.payload) : b = e.payload;
-  const R = { payload: b };
-  return e.protected !== void 0 && (R.protectedHeader = n), e.header !== void 0 && (R.unprotectedHeader = e.header), d ? { ...R, key: t } : R;
+  else typeof e.payload == "string" ? C = M.encode(e.payload) : C = e.payload;
+  const P = { payload: C };
+  return e.protected !== void 0 && (P.protectedHeader = n), e.header !== void 0 && (P.unprotectedHeader = e.header), d ? { ...P, key: t } : P;
 }
 async function et(e, t, r) {
   if (e instanceof Uint8Array && (e = H.decode(e)), typeof e != "string")
-    throw new w("Compact JWS must be a string or Uint8Array");
+    throw new _("Compact JWS must be a string or Uint8Array");
   const { 0: n, 1: i, 2: o, length: s } = e.split(".");
   if (s !== 3)
-    throw new w("Invalid Compact JWS");
-  const c = await Ze({ payload: i, protected: n, signature: o }, t, r), d = { payload: c.payload, protectedHeader: c.protectedHeader };
-  return typeof t == "function" ? { ...d, key: c.key } : d;
+    throw new _("Invalid Compact JWS");
+  const a = await Ze({ payload: i, protected: n, signature: o }, t, r), d = { payload: a.payload, protectedHeader: a.protectedHeader };
+  return typeof t == "function" ? { ...d, key: a.key } : d;
 }
-const pe = K;
+const pe = O;
 function te(e) {
   let t;
   if (typeof e == "string") {
@@ -1054,28 +1054,28 @@ function te(e) {
 }
 function tt(e) {
   if (typeof e != "string")
-    throw new P("JWTs must use Compact JWS serialization, JWT must be a string");
+    throw new k("JWTs must use Compact JWS serialization, JWT must be a string");
   const { 1: t, length: r } = e.split(".");
   if (r === 5)
-    throw new P("Only JWTs using Compact JWS serialization can be decoded");
+    throw new k("Only JWTs using Compact JWS serialization can be decoded");
   if (r !== 3)
-    throw new P("Invalid JWT");
+    throw new k("Invalid JWT");
   if (!t)
-    throw new P("JWTs must contain a payload");
+    throw new k("JWTs must contain a payload");
   let n;
   try {
     n = pe(t);
   } catch {
-    throw new P("Failed to base64url decode the payload");
+    throw new k("Failed to base64url decode the payload");
   }
   let i;
   try {
     i = JSON.parse(H.decode(n));
   } catch {
-    throw new P("Failed to parse the decoded payload as JSON");
+    throw new k("Failed to parse the decoded payload as JSON");
   }
   if (!x(i))
-    throw new P("Invalid JWT Claims Set");
+    throw new k("Invalid JWT Claims Set");
   return i;
 }
 const h = class h {
@@ -1149,22 +1149,22 @@ const h = class h {
   }
 };
 /** All flows are allowed */
-a(h, "All", "all"), /** OAuth authorization code flow (without PKCE) */
-a(h, "AuthorizationCode", "authorizationCode"), /** OAuth authorization code flow with PKCE */
-a(h, "AuthorizationCodeWithPKCE", "authorizationCodeWithPKCE"), /** Auth client credentials flow */
-a(h, "ClientCredentials", "clientCredentials"), /** OAuth refresh token flow */
-a(h, "RefreshToken", "refreshToken"), /** OAuth device code flow */
-a(h, "DeviceCode", "deviceCode"), /** OAuth password flow */
-a(h, "Password", "password"), /** The Auth0 password MFA extension to the password flow */
-a(h, "PasswordMfa", "passwordMfa"), /** The OpenID Connect authorization code flow, with or without
+c(h, "All", "all"), /** OAuth authorization code flow (without PKCE) */
+c(h, "AuthorizationCode", "authorizationCode"), /** OAuth authorization code flow with PKCE */
+c(h, "AuthorizationCodeWithPKCE", "authorizationCodeWithPKCE"), /** Auth client credentials flow */
+c(h, "ClientCredentials", "clientCredentials"), /** OAuth refresh token flow */
+c(h, "RefreshToken", "refreshToken"), /** OAuth device code flow */
+c(h, "DeviceCode", "deviceCode"), /** OAuth password flow */
+c(h, "Password", "password"), /** The Auth0 password MFA extension to the password flow */
+c(h, "PasswordMfa", "passwordMfa"), /** The OpenID Connect authorization code flow, with or without
  * PKCE.
  */
-a(h, "OidcAuthorizationCode", "oidcAuthorizationCode"), /** A user friendly name for the given flow ID
+c(h, "OidcAuthorizationCode", "oidcAuthorizationCode"), /** A user friendly name for the given flow ID
  * 
  * For example, if you pass "authorizationCode" 
  * (`OAuthFlows.AuthorizationCode`) you will get `"Authorization Code"`.
  */
-a(h, "flowName", {
+c(h, "flowName", {
   [h.AuthorizationCode]: "Authorization Code",
   [h.AuthorizationCodeWithPKCE]: "Authorization Code with PKCE",
   [h.ClientCredentials]: "Client Credentials",
@@ -1175,7 +1175,7 @@ a(h, "flowName", {
   [h.OidcAuthorizationCode]: "OIDC Authorization Code"
 });
 let re = h;
-var _, v;
+var v, S;
 class nt {
   /**
    * Constructor.
@@ -1211,36 +1211,36 @@ class nt {
     redirect_uri: i,
     codeChallengeMethod: o,
     stateLength: s,
-    verifierLength: c,
+    verifierLength: a,
     tokenConsumer: d,
     authServerCredentials: f,
-    authServerMode: T,
-    authServerHeaders: O
+    authServerMode: y,
+    authServerHeaders: T
   }) {
-    a(this, "authServerBaseUrl", "");
-    $(this, _);
+    c(this, "authServerBaseUrl", "");
     $(this, v);
-    a(this, "codeChallengeMethod", "S256");
-    a(this, "verifierLength", 32);
-    a(this, "redirect_uri");
-    a(this, "stateLength", 32);
-    a(this, "authzCode", "");
-    a(this, "oidcConfig");
-    a(this, "tokenConsumer");
-    a(this, "authServerHeaders", {});
-    a(this, "authServerMode");
-    a(this, "authServerCredentials");
-    a(this, "oauthPostType", "json");
-    a(this, "oauthLogFetch", !1);
-    a(this, "oauthUseUserInfoEndpoint", !1);
-    a(this, "oauthAuthorizeRedirect");
-    this.tokenConsumer = d, this.authServerBaseUrl = t, c && (this.verifierLength = c), s && (this.stateLength = s), r && D(this, _, r), n && D(this, v, n), i && (this.redirect_uri = i), o && (this.codeChallengeMethod = o), this.authServerBaseUrl = t, f && (this.authServerCredentials = f), T && (this.authServerMode = T), O && (this.authServerHeaders = O);
+    $(this, S);
+    c(this, "codeChallengeMethod", "S256");
+    c(this, "verifierLength", 32);
+    c(this, "redirect_uri");
+    c(this, "stateLength", 32);
+    c(this, "authzCode", "");
+    c(this, "oidcConfig");
+    c(this, "tokenConsumer");
+    c(this, "authServerHeaders", {});
+    c(this, "authServerMode");
+    c(this, "authServerCredentials");
+    c(this, "oauthPostType", "json");
+    c(this, "oauthLogFetch", !1);
+    c(this, "oauthUseUserInfoEndpoint", !1);
+    c(this, "oauthAuthorizeRedirect");
+    this.tokenConsumer = d, this.authServerBaseUrl = t, a && (this.verifierLength = a), s && (this.stateLength = s), r && D(this, v, r), n && D(this, S, n), i && (this.redirect_uri = i), o && (this.codeChallengeMethod = o), this.authServerBaseUrl = t, f && (this.authServerCredentials = f), y && (this.authServerMode = y), T && (this.authServerHeaders = T);
   }
   set client_id(t) {
-    D(this, _, t);
+    D(this, v, t);
   }
   set client_secret(t) {
-    D(this, v, t);
+    D(this, S, t);
   }
   /**
    * Loads OpenID Connect configuration so that the client can determine
@@ -1270,8 +1270,8 @@ class nt {
       l.logger.error(u({ err: n }));
     }
     if (!r || !r.ok)
-      throw new g(
-        y.Connection,
+      throw new p(
+        m.Connection,
         "Couldn't get OIDC configuration from URL" + this.authServerBaseUrl + "/.well-known/openid-configuration"
       );
     this.oidcConfig = { ...ie };
@@ -1280,8 +1280,8 @@ class nt {
       for (const [i, o] of Object.entries(n))
         this.oidcConfig[i] = o;
     } catch {
-      throw new g(
-        y.Connection,
+      throw new p(
+        m.Connection,
         "Unrecognized response from OIDC configuration endpoint"
       );
     }
@@ -1308,19 +1308,24 @@ class nt {
    *          - `error_description` friendly error message or undefined
    *            if no error
    */
-  async startAuthorizationCodeFlow(t, r, n, i = !1) {
-    var c, d, f;
-    if (l.logger.debug(u({ msg: "Starting authorization code flow" })), this.oidcConfig || await this.loadConfig(), !((c = this.oidcConfig) != null && c.response_types_supported.includes("code")) || !((d = this.oidcConfig) != null && d.response_modes_supported.includes("query")))
+  async startAuthorizationCodeFlow(t, {
+    scope: r,
+    codeChallenge: n,
+    pkce: i = !1,
+    upstream: o
+  }) {
+    var d, f, y;
+    if (l.logger.debug(u({ msg: "Starting authorization code flow, scope " + r })), this.oidcConfig || await this.loadConfig(), !((d = this.oidcConfig) != null && d.response_types_supported.includes("code")) || !((f = this.oidcConfig) != null && f.response_modes_supported.includes("query")))
       return {
         error: "invalid_request",
         error_description: "Server does not support authorization code flow"
       };
-    if (!((f = this.oidcConfig) != null && f.authorization_endpoint))
+    if (!((y = this.oidcConfig) != null && y.authorization_endpoint))
       return {
         error: "server_error",
         error_description: "Cannot get authorize endpoint"
       };
-    if (!p(this, _)) return {
+    if (!g(this, v)) return {
       error: "invalid_request",
       error_description: "Cannot make authorization code flow without client id"
     };
@@ -1328,10 +1333,10 @@ class nt {
       error: "invalid_request",
       error_description: "Cannot make authorization code flow without Redirect Uri"
     };
-    let o = this.oidcConfig.authorization_endpoint;
-    this.oauthAuthorizeRedirect && (o = this.oauthAuthorizeRedirect);
-    let s = o + "?response_type=code&client_id=" + encodeURIComponent(p(this, _)) + "&state=" + encodeURIComponent(t) + "&redirect_uri=" + encodeURIComponent(this.redirect_uri);
-    return r && (s += "&scope=" + encodeURIComponent(r)), i && n && (s += "&code_challenge=" + n), { url: s };
+    let s = this.oidcConfig.authorization_endpoint;
+    this.oauthAuthorizeRedirect && (s = this.oauthAuthorizeRedirect);
+    let a = s + "?response_type=code&client_id=" + encodeURIComponent(g(this, v)) + "&state=" + encodeURIComponent(t) + "&redirect_uri=" + encodeURIComponent(this.redirect_uri);
+    return r && (a += "&scope=" + encodeURIComponent(r)), i && n && (a += "&code_challenge=" + n), { url: a };
   }
   async codeChallengeAndVerifier() {
     const t = this.randomValue(this.verifierLength);
@@ -1351,7 +1356,7 @@ class nt {
       }
       return { payload: o };
     } catch (o) {
-      const s = g.asCrossauthError(o);
+      const s = p.asCrossauthError(o);
       return l.logger.debug(u({ err: s })), l.logger.error(u({ msg: "Couldn't get user info", cerr: s })), n = s.oauthErrorCode, i = "Couldn't get user info: " + s.message, { error: n, error_description: i };
     }
   }
@@ -1361,7 +1366,7 @@ class nt {
       let o;
       return o = await this.validateAccessToken(t, r), o ? { payload: o } : (n = "access_denied", i = "Invalid access token received", { error: n, error_description: i });
     } catch (o) {
-      const s = g.asCrossauthError(o);
+      const s = p.asCrossauthError(o);
       return l.logger.debug(u({ err: s })), l.logger.error(u({ msg: "Couldn't get user info", cerr: s })), n = s.oauthErrorCode, i = "Couldn't get user info: " + s.message, { error: n, error_description: i };
     }
   }
@@ -1385,41 +1390,47 @@ class nt {
    * @returns The {@link OAuthTokenResponse} from the `token` endpoint
    *          request, or `error` and `error_description`.
    */
-  async redirectEndpoint(t, r, n, i, o) {
-    var T, O;
+  async redirectEndpoint({
+    code: t,
+    scope: r,
+    codeVerifier: n,
+    error: i,
+    errorDescription: o
+  }) {
+    var y, T;
     if (this.oidcConfig || await this.loadConfig(), i || !t)
       return i || (i = "server_error"), o || (o = "Unknown error"), { error: i, error_description: o };
-    if (this.authzCode = t, !((T = this.oidcConfig) != null && T.grant_types_supported.includes("authorization_code")))
+    if (this.authzCode = t, !((y = this.oidcConfig) != null && y.grant_types_supported.includes("authorization_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support authorization code grant"
       };
-    if (!((O = this.oidcConfig) != null && O.token_endpoint))
+    if (!((T = this.oidcConfig) != null && T.token_endpoint))
       return {
         error: "server_error",
         error_description: "Cannot get token endpoint"
       };
     const s = this.oidcConfig.token_endpoint;
-    let c, d;
-    c = "authorization_code", d = p(this, v);
+    let a, d;
+    a = "authorization_code", d = g(this, S);
     let f = {
-      grant_type: c,
-      client_id: p(this, _),
+      grant_type: a,
+      client_id: g(this, v),
       code: this.authzCode,
       redirect_uri: this.redirect_uri
     };
     r && (f.scope = r), d && (f.client_secret = d), n && (f.code_verifier = n);
     try {
-      let b = await this.post(s, f, this.authServerHeaders);
-      if (b.id_token) {
-        const R = await this.getIdPayload(b.id_token, b.access_token);
-        if (R.error)
-          return R;
-        b.id_payload = R.payload;
+      let C = await this.post(s, f, this.authServerHeaders);
+      if (C.id_token) {
+        const P = await this.getIdPayload(C.id_token, C.access_token);
+        if (P.error)
+          return P;
+        C.id_payload = P.payload;
       }
-      return b;
-    } catch (b) {
-      return l.logger.error(u({ err: b })), {
+      return C;
+    } catch (C) {
+      return l.logger.error(u({ err: C })), {
         error: "server_error",
         error_description: "Unable to get access token from server"
       };
@@ -1448,24 +1459,24 @@ class nt {
       };
     if (!((o = this.oidcConfig) != null && o.token_endpoint))
       return { error: "server_error", error_description: "Cannot get token endpoint" };
-    if (!p(this, _)) return {
+    if (!g(this, v)) return {
       error: "invalid_request",
       error_description: "Cannot make client credentials flow without client id"
     };
     const r = this.oidcConfig.token_endpoint;
     let n = {
       grant_type: "client_credentials",
-      client_id: p(this, _),
-      client_secret: p(this, v)
+      client_id: g(this, v),
+      client_secret: g(this, S)
     };
     t && (n.scope = t);
     try {
       let s = await this.post(r, n, this.authServerHeaders);
       if (s.id_token) {
-        const c = await this.getIdPayload(s.id_token, s.access_token);
-        if (c.error)
-          return c;
-        s.id_payload = c.payload;
+        const a = await this.getIdPayload(s.id_token, s.access_token);
+        if (a.error)
+          return a;
+        s.id_payload = a.payload;
       }
       return s;
     } catch (s) {
@@ -1491,13 +1502,13 @@ class nt {
    * 
    */
   async passwordFlow(t, r, n) {
-    var s, c;
+    var s, a;
     if (l.logger.debug(u({ msg: "Starting password flow" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("password")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password grant"
       };
-    if (!((c = this.oidcConfig) != null && c.token_endpoint))
+    if (!((a = this.oidcConfig) != null && a.token_endpoint))
       return {
         error: "server_error",
         error_description: "Cannot get token endpoint"
@@ -1505,8 +1516,8 @@ class nt {
     const i = this.oidcConfig.token_endpoint;
     let o = {
       grant_type: "password",
-      client_id: p(this, _),
-      client_secret: p(this, v),
+      client_id: g(this, v),
+      client_secret: g(this, S),
       username: t,
       password: r
     };
@@ -1541,13 +1552,13 @@ class nt {
    *     documentation
    */
   async mfaAuthenticators(t) {
-    var o, s, c;
+    var o, s, a;
     if (l.logger.debug(u({ msg: "Getting valid MFA authenticators" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")) && ((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((c = this.oidcConfig) != null && c.issuer))
+    if (!((a = this.oidcConfig) != null && a.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const r = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/authenticators", n = await this.get(r, { authorization: "Bearer " + t, ...this.authServerHeaders });
     if (!Array.isArray(n))
@@ -1595,8 +1606,8 @@ class nt {
     if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", i = await this.post(n, {
-      client_id: p(this, _),
-      client_secret: p(this, v),
+      client_id: g(this, v),
+      client_secret: g(this, S),
       challenge_type: "otp",
       mfa_token: t,
       authenticator_id: r
@@ -1624,18 +1635,18 @@ class nt {
    *   - `error_description` friendly error message
    */
   async mfaOtpComplete(t, r, n) {
-    var s, c;
+    var s, a;
     if (l.logger.debug(u({ msg: "Completing MFA OTP request" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((c = this.oidcConfig) != null && c.issuer))
+    if (!((a = this.oidcConfig) != null && a.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const i = this.oidcConfig.token_endpoint, o = await this.post(i, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-otp",
-      client_id: p(this, _),
-      client_secret: p(this, v),
+      client_id: g(this, v),
+      client_secret: g(this, S),
       challenge_type: "otp",
       mfa_token: t,
       otp: r,
@@ -1686,8 +1697,8 @@ class nt {
     if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", i = await this.post(n, {
-      client_id: p(this, _),
-      client_secret: p(this, v),
+      client_id: g(this, v),
+      client_secret: g(this, S),
       challenge_type: "oob",
       mfa_token: t,
       authenticator_id: r
@@ -1712,8 +1723,8 @@ class nt {
    *          an error instead of the response fields.
    */
   async mfaOobComplete(t, r, n, i) {
-    var c, d;
-    if (l.logger.debug(u({ msg: "Completing MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((c = this.oidcConfig) != null && c.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
+    var a, d;
+    if (l.logger.debug(u({ msg: "Completing MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((a = this.oidcConfig) != null && a.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
@@ -1722,8 +1733,8 @@ class nt {
       return { error: "server_error", error_description: "Cannot get issuer" };
     const o = this.oidcConfig.token_endpoint, s = await this.post(o, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-oob",
-      client_id: p(this, _),
-      client_secret: p(this, v),
+      client_id: g(this, v),
+      client_secret: g(this, S),
       challenge_type: "otp",
       mfa_token: t,
       oob_code: r,
@@ -1766,24 +1777,24 @@ class nt {
       };
     const r = this.oidcConfig.token_endpoint;
     let n;
-    n = p(this, v);
+    n = g(this, S);
     let i = {
       grant_type: "refresh_token",
       refresh_token: t,
-      client_id: p(this, _)
+      client_id: g(this, v)
     };
     n && (i.client_secret = n);
     try {
-      let c = await this.post(r, i, this.authServerHeaders);
-      if (c.id_token) {
-        const d = await this.getIdPayload(c.id_token, c.access_token);
+      let a = await this.post(r, i, this.authServerHeaders);
+      if (a.id_token) {
+        const d = await this.getIdPayload(a.id_token, a.access_token);
         if (d.error)
           return d;
-        c.id_payload = d.payload;
+        a.id_payload = d.payload;
       }
-      return c;
-    } catch (c) {
-      return l.logger.error(u({ err: c })), {
+      return a;
+    } catch (a) {
+      return l.logger.error(u({ err: a })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1806,8 +1817,8 @@ class nt {
       };
     let n = {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: p(this, _),
-      client_secret: p(this, v)
+      client_id: g(this, v),
+      client_secret: g(this, S)
     };
     r && (n.scope = r);
     try {
@@ -1841,18 +1852,18 @@ class nt {
       };
     let r = {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: p(this, _),
-      client_secret: p(this, v),
+      client_id: g(this, v),
+      client_secret: g(this, S),
       device_code: t
     };
     try {
       const s = await this.post((o = this.oidcConfig) == null ? void 0 : o.token_endpoint, r, this.authServerHeaders);
       if (s.error) return s;
       if (s.id_token) {
-        const c = await this.getIdPayload(s.id_token, s.access_token);
-        if (c.error)
-          return c;
-        s.id_payload = c.payload;
+        const a = await this.getIdPayload(s.id_token, s.access_token);
+        if (a.error)
+          return a;
+        s.id_payload = a.payload;
       }
       return s;
     } catch (s) {
@@ -1882,35 +1893,44 @@ class nt {
    * @returns the parsed JSON response as an object.
    * @throws any exception raised by `fetch()`
    */
-  async post(t, r, n = {}) {
+  async post(t, r, n = {}, i) {
     l.logger.debug(u({
       msg: "Fetch POST",
       url: t,
       params: Object.keys(r)
     }));
-    let i = {};
-    this.authServerCredentials && (i.credentials = this.authServerCredentials), this.authServerMode && (i.mode = this.authServerMode);
-    let o = "", s = "";
+    let o = {};
+    this.authServerCredentials && (o.credentials = this.authServerCredentials), this.authServerMode && (o.mode = this.authServerMode);
+    let s = "", a = "";
     if (this.oauthPostType == "json")
-      o = JSON.stringify(r), s = "application/json";
+      s = JSON.stringify(r), a = "application/json";
     else {
-      o = "";
-      for (let f in r)
-        o != "" && (o += "&"), o += encodeURIComponent(f) + "=" + encodeURIComponent(r[f]);
-      s = "application/x-www-form-urlencoded";
+      s = "";
+      for (let y in r)
+        s != "" && (s += "&"), s += encodeURIComponent(y) + "=" + encodeURIComponent(r[y]);
+      a = "application/x-www-form-urlencoded";
     }
-    this.oauthLogFetch && l.logger.debug(u({ msg: "OAuth fetch", method: "POST", url: t, body: o }));
-    const d = await (await fetch(t, {
+    this.oauthLogFetch && l.logger.debug(u({ msg: "OAuth fetch", method: "POST", url: t, body: s }));
+    let d = {};
+    i && (d = i);
+    const f = await fetch(t, {
       method: "POST",
-      ...i,
+      ...o,
       headers: {
         Accept: "application/json",
-        "Content-Type": s,
+        "Content-Type": a,
         ...n
       },
-      body: o
-    })).json();
-    return this.oauthLogFetch && l.logger.debug(u({ msg: "OAuth fetch response", body: JSON.stringify(d) })), d;
+      ...d,
+      body: s
+    });
+    try {
+      const y = await f.clone().json();
+      return this.oauthLogFetch && l.logger.debug(u({ msg: "OAuth fetch response", body: JSON.stringify(y) })), await f.json(), y;
+    } catch (y) {
+      let T = p.asCrossauthError(y);
+      throw s = await f.text(), l.logger.debug(u({ msg: "Response is not JSON", response: s })), T;
+    }
   }
   /**
    * Makes a GET request to the given URL using `fetch()`.
@@ -1985,7 +2005,7 @@ class nt {
     return tt(t);
   }
 }
-_ = new WeakMap(), v = new WeakMap();
+v = new WeakMap(), S = new WeakMap();
 class ot {
   /**
    * Constrctor
@@ -1995,27 +2015,27 @@ class ot {
    * @param options See {@link OAuthTokenConsumerBaseOptions}.
    */
   constructor(t, r = {}) {
-    a(this, "audience");
-    a(this, "jwtKeyType");
-    a(this, "jwtSecretKey");
-    a(this, "jwtPublicKey");
-    a(this, "clockTolerance", 10);
-    a(this, "authServerBaseUrl", "");
+    c(this, "audience");
+    c(this, "jwtKeyType");
+    c(this, "jwtSecretKey");
+    c(this, "jwtPublicKey");
+    c(this, "clockTolerance", 10);
+    c(this, "authServerBaseUrl", "");
     /**
      * The OpenID Connect configuration for the authorization server,
      * either passed to the constructor or fetched from the authorization
      * server.
      */
-    a(this, "oidcConfig");
+    c(this, "oidcConfig");
     /**
      * The RSA public keys or symmetric keys for the authorization server,
      * either passed to the constructor or fetched from the authorization
      * server.
      */
-    a(this, "keys", {});
+    c(this, "keys", {});
     if (this.audience = t, r.authServerBaseUrl && (this.authServerBaseUrl = r.authServerBaseUrl), r.jwtKeyType && (this.jwtKeyType = r.jwtKeyType), r.jwtSecretKey && (this.jwtSecretKey = r.jwtSecretKey), r.jwtPublicKey && (this.jwtPublicKey = r.jwtPublicKey), r.clockTolerance && (this.clockTolerance = r.clockTolerance), r.oidcConfig && (this.oidcConfig = r.oidcConfig), this.jwtPublicKey && !this.jwtKeyType)
-      throw new g(
-        y.Configuration,
+      throw new p(
+        m.Configuration,
         "If specifying jwtPublic key, must also specify jwtKeyType"
       );
   }
@@ -2031,29 +2051,29 @@ class ot {
     try {
       if (this.jwtSecretKey) {
         if (!this.jwtKeyType)
-          throw new g(
-            y.Configuration,
+          throw new p(
+            m.Configuration,
             "Must specify jwtKeyType if setting jwtSecretKey"
           );
         this.keys._default = await Be(this.jwtSecretKey, this.jwtKeyType);
       } else if (this.jwtPublicKey) {
         if (!this.jwtKeyType)
-          throw new g(
-            y.Configuration,
+          throw new p(
+            m.Configuration,
             "Must specify jwtKeyType if setting jwtPublicKey"
           );
         const r = await $e(this.jwtPublicKey, this.jwtKeyType);
         this.keys._default = r;
       } else {
         if (this.oidcConfig || await this.loadConfig(), !this.oidcConfig)
-          throw new g(
-            y.Connection,
+          throw new p(
+            m.Connection,
             "Load OIDC config before Jwks"
           );
         await this.loadJwks(void 0, t);
       }
     } catch (r) {
-      throw l.logger.debug(u({ err: r })), new g(y.Connection, "Couldn't load keys");
+      throw l.logger.debug(u({ err: r })), new p(m.Connection, "Couldn't load keys");
     }
   }
   /**
@@ -2071,7 +2091,7 @@ class ot {
       return;
     }
     if (!this.authServerBaseUrl)
-      throw new g(y.Connection, "Couldn't get OIDC configuration.  Either set authServerBaseUrl or set config manually");
+      throw new p(m.Connection, "Couldn't get OIDC configuration.  Either set authServerBaseUrl or set config manually");
     let r;
     try {
       let n = this.authServerBaseUrl;
@@ -2080,14 +2100,14 @@ class ot {
       l.logger.error(u({ err: n }));
     }
     if (!r || !r.ok)
-      throw new g(y.Connection, "Couldn't get OIDC configuration");
+      throw new p(m.Connection, "Couldn't get OIDC configuration");
     this.oidcConfig = { ...ie };
     try {
       const n = await r.json();
       for (const [i, o] of Object.entries(n))
         this.oidcConfig[i] = o;
     } catch {
-      throw new g(y.Connection, "Unrecognized response from OIDC configuration endpoint");
+      throw new p(m.Connection, "Unrecognized response from OIDC configuration endpoint");
     }
   }
   /**
@@ -2108,7 +2128,7 @@ class ot {
       }
     } else {
       if (!this.oidcConfig)
-        throw new g(y.Connection, "Load OIDC config before Jwks");
+        throw new p(m.Connection, "Load OIDC config before Jwks");
       let n;
       try {
         n = await fetch(new URL(this.oidcConfig.jwks_uri));
@@ -2116,29 +2136,29 @@ class ot {
         l.logger.error(u({ err: i }));
       }
       if (!n || !n.ok)
-        throw new g(y.Connection, "Couldn't get OIDC configuration");
+        throw new p(m.Connection, "Couldn't get OIDC configuration");
       this.keys = {};
       try {
         const i = await n.json();
         if (!("keys" in i) || !Array.isArray(i.keys))
-          throw new g(y.Connection, "Couldn't fetch keys");
+          throw new p(m.Connection, "Couldn't fetch keys");
         for (let o = 0; o < i.keys.length; ++o)
           try {
-            let s = "_default", c = { ...i.keys[o] };
-            if ("kid" in c && typeof c.kid == "string" && (s = String(c.kid)), c && !c.alg && !c.jwk_alg && r)
-              if (r.startsWith("RS") && c.kty == "RSA")
-                c.alg = r;
+            let s = "_default", a = { ...i.keys[o] };
+            if ("kid" in a && typeof a.kid == "string" && (s = String(a.kid)), a && !a.alg && !a.jwk_alg && r)
+              if (r.startsWith("RS") && a.kty == "RSA")
+                a.alg = r;
               else {
-                l.logger.debug(u({ msg: "Skipping key with " + c.kty }));
+                l.logger.debug(u({ msg: "Skipping key with " + a.kty }));
                 continue;
               }
-            const d = await j(c);
+            const d = await j(a);
             this.keys[s] = d;
           } catch (s) {
-            throw l.logger.error(u({ err: s })), new g(y.Connection, "Couldn't load keys");
+            throw l.logger.error(u({ err: s })), new p(m.Connection, "Couldn't load keys");
           }
       } catch (i) {
-        throw l.logger.error(u({ err: i })), new g(y.Connection, "Unrecognized response from OIDC jwks endpoint");
+        throw l.logger.error(u({ err: i })), new p(m.Connection, "Unrecognized response from OIDC jwks endpoint");
       }
     }
   }
@@ -2202,22 +2222,22 @@ class ot {
       }
       return o;
     } catch (i) {
-      const o = g.asCrossauthError(i);
+      const o = p.asCrossauthError(i);
       l.logger.debug(u({ err: o })), l.logger.warn(u({ msg: "Access token did not validate", cerr: o }));
       return;
     }
   }
 }
 export {
-  g as CrossauthError,
+  p as CrossauthError,
   l as CrossauthLogger,
   ie as DEFAULT_OIDCCONFIG,
-  y as ErrorCode,
-  A as KeyPrefix,
+  m as ErrorCode,
+  I as KeyPrefix,
   nt as OAuthClientBase,
   re as OAuthFlows,
   ot as OAuthTokenConsumerBase,
-  E as UserState,
+  R as UserState,
   it as httpStatus,
   u as j
 };