@crossauth/common 1.1.7 → 1.1.9

package/dist/index.js

@@ -56,20 +56,21 @@ c(R, "factor2ResetNeeded", "factor2resetneeded"), /**
  * Upon login, the user is redirected to the reset password page.
  */
 c(R, "passwordAndFactor2ResetNeeded", "passwordandfactor2resetneeded");
-class I {
+class A {
 }
 /** Session ID */
-c(I, "session", "s:"), /** Password Reset Token */
-c(I, "passwordResetToken", "p:"), /** Email verification token */
-c(I, "emailVerificationToken", "e:"), /** API key */
-c(I, "apiKey", "api:"), /** OAuth authorization code */
-c(I, "authorizationCode", "authz:"), /** OAuth access token */
-c(I, "accessToken", "access:"), /** OAuth refresh token */
-c(I, "refreshToken", "refresh:"), /** OAuth MFA key (used by the password MFA flow) */
-c(I, "mfaToken", "omfa:"), /** Device code device code */
-c(I, "deviceCode", "dc:"), /** Device code flow user code */
-c(I, "userCode", "uc:");
-var m = /* @__PURE__ */ ((e) => (e[e.UserNotExist = 0] = "UserNotExist", e[e.PasswordInvalid = 1] = "PasswordInvalid", e[e.EmailNotExist = 2] = "EmailNotExist", e[e.UsernameOrPasswordInvalid = 3] = "UsernameOrPasswordInvalid", e[e.InvalidClientId = 4] = "InvalidClientId", e[e.ClientExists = 5] = "ClientExists", e[e.InvalidClientSecret = 6] = "InvalidClientSecret", e[e.InvalidClientIdOrSecret = 7] = "InvalidClientIdOrSecret", e[e.InvalidRedirectUri = 8] = "InvalidRedirectUri", e[e.InvalidOAuthFlow = 9] = "InvalidOAuthFlow", e[e.UserNotActive = 10] = "UserNotActive", e[e.EmailNotVerified = 11] = "EmailNotVerified", e[e.TwoFactorIncomplete = 12] = "TwoFactorIncomplete", e[e.Unauthorized = 13] = "Unauthorized", e[e.UnauthorizedClient = 14] = "UnauthorizedClient", e[e.InvalidScope = 15] = "InvalidScope", e[e.InsufficientScope = 16] = "InsufficientScope", e[e.InsufficientPriviledges = 17] = "InsufficientPriviledges", e[e.Forbidden = 18] = "Forbidden", e[e.InvalidKey = 19] = "InvalidKey", e[e.InvalidCsrf = 20] = "InvalidCsrf", e[e.InvalidSession = 21] = "InvalidSession", e[e.Expired = 22] = "Expired", e[e.Connection = 23] = "Connection", e[e.InvalidHash = 24] = "InvalidHash", e[e.UnsupportedAlgorithm = 25] = "UnsupportedAlgorithm", e[e.KeyExists = 26] = "KeyExists", e[e.PasswordChangeNeeded = 27] = "PasswordChangeNeeded", e[e.PasswordResetNeeded = 28] = "PasswordResetNeeded", e[e.Factor2ResetNeeded = 29] = "Factor2ResetNeeded", e[e.Configuration = 30] = "Configuration", e[e.InvalidEmail = 31] = "InvalidEmail", e[e.InvalidPhoneNumber = 32] = "InvalidPhoneNumber", e[e.InvalidUsername = 33] = "InvalidUsername", e[e.PasswordMatch = 34] = "PasswordMatch", e[e.InvalidToken = 35] = "InvalidToken", e[e.MfaRequired = 36] = "MfaRequired", e[e.PasswordFormat = 37] = "PasswordFormat", e[e.DataFormat = 38] = "DataFormat", e[e.FetchError = 39] = "FetchError", e[e.UserExists = 40] = "UserExists", e[e.FormEntry = 41] = "FormEntry", e[e.BadRequest = 42] = "BadRequest", e[e.AuthorizationPending = 43] = "AuthorizationPending", e[e.SlowDown = 44] = "SlowDown", e[e.ExpiredToken = 45] = "ExpiredToken", e[e.ConstraintViolation = 46] = "ConstraintViolation", e[e.NotImplemented = 47] = "NotImplemented", e[e.UnknownError = 48] = "UnknownError", e))(m || {});
+c(A, "session", "s:"), /** Password Reset Token */
+c(A, "passwordResetToken", "p:"), /** Email verification token */
+c(A, "emailVerificationToken", "e:"), /** API key */
+c(A, "apiKey", "api:"), /** OAuth authorization code */
+c(A, "authorizationCode", "authz:"), /** OAuth access token */
+c(A, "accessToken", "access:"), /** OAuth refresh token */
+c(A, "refreshToken", "refresh:"), /** OAuth MFA key (used by the password MFA flow) */
+c(A, "mfaToken", "omfa:"), /** Device code device code */
+c(A, "deviceCode", "dc:"), /** Device code flow user code */
+c(A, "userCode", "uc:"), /** Device code flow user code */
+c(A, "knownDevice", "kd:");
+var y = /* @__PURE__ */ ((e) => (e[e.UserNotExist = 0] = "UserNotExist", e[e.PasswordInvalid = 1] = "PasswordInvalid", e[e.EmailNotExist = 2] = "EmailNotExist", e[e.UsernameOrPasswordInvalid = 3] = "UsernameOrPasswordInvalid", e[e.InvalidClientId = 4] = "InvalidClientId", e[e.ClientExists = 5] = "ClientExists", e[e.InvalidClientSecret = 6] = "InvalidClientSecret", e[e.InvalidClientIdOrSecret = 7] = "InvalidClientIdOrSecret", e[e.InvalidRedirectUri = 8] = "InvalidRedirectUri", e[e.InvalidOAuthFlow = 9] = "InvalidOAuthFlow", e[e.UserNotActive = 10] = "UserNotActive", e[e.EmailNotVerified = 11] = "EmailNotVerified", e[e.TwoFactorIncomplete = 12] = "TwoFactorIncomplete", e[e.Unauthorized = 13] = "Unauthorized", e[e.UnauthorizedClient = 14] = "UnauthorizedClient", e[e.InvalidScope = 15] = "InvalidScope", e[e.InsufficientScope = 16] = "InsufficientScope", e[e.InsufficientPriviledges = 17] = "InsufficientPriviledges", e[e.Forbidden = 18] = "Forbidden", e[e.InvalidKey = 19] = "InvalidKey", e[e.InvalidCsrf = 20] = "InvalidCsrf", e[e.InvalidSession = 21] = "InvalidSession", e[e.Expired = 22] = "Expired", e[e.Connection = 23] = "Connection", e[e.InvalidHash = 24] = "InvalidHash", e[e.UnsupportedAlgorithm = 25] = "UnsupportedAlgorithm", e[e.KeyExists = 26] = "KeyExists", e[e.PasswordChangeNeeded = 27] = "PasswordChangeNeeded", e[e.PasswordResetNeeded = 28] = "PasswordResetNeeded", e[e.Factor2ResetNeeded = 29] = "Factor2ResetNeeded", e[e.Configuration = 30] = "Configuration", e[e.InvalidEmail = 31] = "InvalidEmail", e[e.InvalidPhoneNumber = 32] = "InvalidPhoneNumber", e[e.InvalidUsername = 33] = "InvalidUsername", e[e.PasswordMatch = 34] = "PasswordMatch", e[e.InvalidToken = 35] = "InvalidToken", e[e.MfaRequired = 36] = "MfaRequired", e[e.PasswordFormat = 37] = "PasswordFormat", e[e.DataFormat = 38] = "DataFormat", e[e.FetchError = 39] = "FetchError", e[e.UserExists = 40] = "UserExists", e[e.FormEntry = 41] = "FormEntry", e[e.BadRequest = 42] = "BadRequest", e[e.AuthorizationPending = 43] = "AuthorizationPending", e[e.SlowDown = 44] = "SlowDown", e[e.ExpiredToken = 45] = "ExpiredToken", e[e.ConstraintViolation = 46] = "ConstraintViolation", e[e.NotImplemented = 47] = "NotImplemented", e[e.UnknownError = 48] = "UnknownError", e))(y || {});
 class p extends Error {
   /**
    * Creates a new error to throw,
@@ -96,7 +97,7 @@ class p extends Error {
      * it will be a concatenation of them with `". "` in between.
      */
     c(this, "messages");
-    this.code = r, this.codeName = m[r], this.httpStatus = o, this.name = "CrossauthError", Array.isArray(n) ? this.messages = n : this.messages = [i], Object.setPrototypeOf(this, p.prototype);
+    this.code = r, this.codeName = y[r], this.httpStatus = o, this.name = "CrossauthError", Array.isArray(n) ? this.messages = n : this.messages = [i], Object.setPrototypeOf(this, p.prototype);
   }
   /**
    * OAuth defines certain error types.  To convert the error in an OAuth
@@ -201,10 +202,10 @@ class p extends Error {
         o = Number(r.errorCode) ?? 48;
       } catch {
       }
-      let s = n ?? m[o];
+      let s = n ?? y[o];
       return "errorMessage" in r ? s = r.errorMessage : "message" in r && (s = r.message), new p(o, s);
     }
-    let i = n ?? m[
+    let i = n ?? y[
       48
       /* UnknownError */
     ];
@@ -256,7 +257,7 @@ const B = {
   503: "Service Unavailable",
   504: "Gateway Timeout",
   505: "HTTP Version Not Supported"
-}, w = class w {
+}, m = class m {
   /**
    * Create a logger with the given level
    * @param level the level to report to
@@ -267,9 +268,9 @@ const B = {
     if (t) this.level = t;
     else if (typeof process < "u" && "CROSSAUTH_LOG_LEVEL" in process.env) {
       const r = (process.env.CROSSAUTH_LOG_LEVEL ?? "ERROR").toUpperCase();
-      w.levelName.includes(r) ? this.level = w.levelName.indexOf(r) : this.level = w.Error;
+      m.levelName.includes(r) ? this.level = m.levelName.indexOf(r) : this.level = m.Error;
     } else
-      this.level = w.Error;
+      this.level = m.Error;
   }
   /**
    * Return the singleton instance of the logger.
@@ -282,35 +283,35 @@ const B = {
     this.level = t;
   }
   log(t, r) {
-    t <= this.level && (typeof r == "string" ? console.log("Crossauth " + w.levelName[t] + " " + (/* @__PURE__ */ new Date()).toISOString(), r) : console.log(JSON.stringify({ level: w.levelName[t], time: (/* @__PURE__ */ new Date()).toISOString(), ...r })));
+    t <= this.level && (typeof r == "string" ? console.log("Crossauth " + m.levelName[t] + " " + (/* @__PURE__ */ new Date()).toISOString(), r) : console.log(JSON.stringify({ level: m.levelName[t], time: (/* @__PURE__ */ new Date()).toISOString(), ...r })));
   }
   /**
    * Report an error
    * @param output object to output
    */
   error(t) {
-    this.log(w.Error, t);
+    this.log(m.Error, t);
   }
   /**
    * Report an warning
    * @param output object to output
    */
   warn(t) {
-    this.log(w.Warn, t);
+    this.log(m.Warn, t);
   }
   /**
    * Report information
    * @param output object to output
    */
   info(t) {
-    this.log(w.Info, t);
+    this.log(m.Info, t);
   }
   /**
    * Print a debugging message
    * @param output object to output
    */
   debug(t) {
-    this.log(w.Debug, t);
+    this.log(m.Debug, t);
   }
   /** 
    * Override the default logger.
@@ -327,12 +328,12 @@ const B = {
   }
 };
 /** Don't log anything */
-c(w, "None", 0), /** Only log errors */
-c(w, "Error", 1), /** Log errors and warning */
-c(w, "Warn", 2), /** Log errors, warnings and info messages */
-c(w, "Info", 3), /** Log everything */
-c(w, "Debug", 4), c(w, "levelName", ["NONE", "ERROR", "WARN", "INFO", "DEBUG"]);
-let l = w;
+c(m, "None", 0), /** Only log errors */
+c(m, "Error", 1), /** Log errors and warning */
+c(m, "Warn", 2), /** Log errors, warnings and info messages */
+c(m, "Info", 3), /** Log everything */
+c(m, "Debug", 4), c(m, "levelName", ["NONE", "ERROR", "WARN", "INFO", "DEBUG"]);
+let l = m;
 function u(e) {
   let t;
   typeof e == "object" && "err" in e && typeof e.err == "object" && (t = e.err.stack);
@@ -418,12 +419,12 @@ class be extends b {
   }
 }
 be.code = "ERR_JOSE_ALG_NOT_ALLOWED";
-class A extends b {
+class I extends b {
   constructor() {
     super(...arguments), this.code = "ERR_JOSE_NOT_SUPPORTED";
   }
 }
-A.code = "ERR_JOSE_NOT_SUPPORTED";
+I.code = "ERR_JOSE_NOT_SUPPORTED";
 class Ce extends b {
   constructor(t = "decryption operation failed", r) {
     super(t, r), this.code = "ERR_JWE_DECRYPTION_FAILED";
@@ -436,18 +437,18 @@ class Ae extends b {
   }
 }
 Ae.code = "ERR_JWE_INVALID";
-class _ extends b {
+class w extends b {
   constructor() {
     super(...arguments), this.code = "ERR_JWS_INVALID";
   }
 }
-_.code = "ERR_JWS_INVALID";
-class k extends b {
+w.code = "ERR_JWS_INVALID";
+class P extends b {
   constructor() {
     super(...arguments), this.code = "ERR_JWT_INVALID";
   }
 }
-k.code = "ERR_JWT_INVALID";
+P.code = "ERR_JWT_INVALID";
 class Ie extends b {
   constructor() {
     super(...arguments), this.code = "ERR_JWK_INVALID";
@@ -472,12 +473,12 @@ class Te extends b {
   }
 }
 Te.code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
-class Pe extends b {
+class ke extends b {
   constructor(t = "request timed out", r) {
     super(t, r), this.code = "ERR_JWKS_TIMEOUT";
   }
 }
-Pe.code = "ERR_JWKS_TIMEOUT";
+ke.code = "ERR_JWKS_TIMEOUT";
 class oe extends b {
   constructor(t = "signature verification failed", r) {
     super(t, r), this.code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
@@ -493,7 +494,7 @@ function z(e, t) {
 function V(e) {
   return parseInt(e.name.slice(4), 10);
 }
-function ke(e) {
+function Pe(e) {
   switch (e) {
     case "ES256":
       return "P-256";
@@ -562,7 +563,7 @@ function Oe(e, t, ...r) {
     case "ES512": {
       if (!z(e.algorithm, "ECDSA"))
         throw E("ECDSA");
-      const n = ke(t);
+      const n = Pe(t);
       if (e.algorithm.namedCurve !== n)
         throw E(n, "algorithm.namedCurve");
       break;
@@ -660,7 +661,7 @@ function ze(e) {
           }, r = e.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
           break;
         default:
-          throw new A('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+          throw new I('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
       }
       break;
     }
@@ -682,7 +683,7 @@ function ze(e) {
           t = { name: "ECDH", namedCurve: e.crv }, r = e.d ? ["deriveBits"] : [];
           break;
         default:
-          throw new A('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+          throw new I('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
       }
       break;
     }
@@ -701,12 +702,12 @@ function ze(e) {
           t = { name: e.crv }, r = e.d ? ["deriveBits"] : [];
           break;
         default:
-          throw new A('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+          throw new I('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
       }
       break;
     }
     default:
-      throw new A('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
+      throw new I('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
   }
   return { algorithm: t, keyUsages: r };
 }
@@ -763,7 +764,7 @@ const ue = (e) => (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject",
     case K(e, [43, 101, 113]):
       return "Ed448";
     default:
-      throw new A("Invalid or unsupported EC Key Curve or OKP Key Sub Type");
+      throw new I("Invalid or unsupported EC Key Curve or OKP Key Sub Type");
   }
 }, he = async (e, t, r, n, i) => {
   let o, s;
@@ -812,7 +813,7 @@ const ue = (e) => (e == null ? void 0 : e[Symbol.toStringTag]) === "KeyObject",
       o = { name: Z(a) }, s = d ? ["verify"] : ["sign"];
       break;
     default:
-      throw new A('Invalid or unsupported "alg" (Algorithm) value');
+      throw new I('Invalid or unsupported "alg" (Algorithm) value');
   }
   return q.subtle.importKey(t, a, o, !1, s);
 }, Fe = (e, t, r) => he(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", e, t), qe = (e, t, r) => he(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", e, t);
@@ -836,12 +837,12 @@ async function j(e, t) {
       return O(e.k);
     case "RSA":
       if ("oth" in e && e.oth !== void 0)
-        throw new A('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+        throw new I('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
     case "EC":
     case "OKP":
       return de({ ...e, alg: t });
     default:
-      throw new A('Unsupported "kty" (Key Type) Parameter value');
+      throw new I('Unsupported "kty" (Key Type) Parameter value');
   }
 }
 const J = (e) => e == null ? void 0 : e[Symbol.toStringTag], G = (e, t, r) => {
@@ -906,7 +907,7 @@ function Ge(e, t, r, n, i) {
   o = t;
   for (const s of n.crit) {
     if (!o.has(s))
-      throw new A(`Extension Header Parameter "${s}" is not recognized`);
+      throw new I(`Extension Header Parameter "${s}" is not recognized`);
     if (i[s] === void 0)
       throw new e(`Extension Header Parameter "${s}" is missing`);
     if (o.get(s) && n[s] === void 0)
@@ -938,7 +939,7 @@ function Ye(e, t) {
     case "EdDSA":
       return { name: t.name };
     default:
-      throw new A(`alg ${e} is not supported either by JOSE or your javascript runtime`);
+      throw new I(`alg ${e} is not supported either by JOSE or your javascript runtime`);
   }
 }
 async function Xe(e, t, r) {
@@ -963,70 +964,70 @@ const Qe = async (e, t, r, n) => {
 };
 async function Ze(e, t, r) {
   if (!x(e))
-    throw new _("Flattened JWS must be an object");
+    throw new w("Flattened JWS must be an object");
   if (e.protected === void 0 && e.header === void 0)
-    throw new _('Flattened JWS must have either of the "protected" or "header" members');
+    throw new w('Flattened JWS must have either of the "protected" or "header" members');
   if (e.protected !== void 0 && typeof e.protected != "string")
-    throw new _("JWS Protected Header incorrect type");
+    throw new w("JWS Protected Header incorrect type");
   if (e.payload === void 0)
-    throw new _("JWS Payload missing");
+    throw new w("JWS Payload missing");
   if (typeof e.signature != "string")
-    throw new _("JWS Signature missing or incorrect type");
+    throw new w("JWS Signature missing or incorrect type");
   if (e.header !== void 0 && !x(e.header))
-    throw new _("JWS Unprotected Header incorrect type");
+    throw new w("JWS Unprotected Header incorrect type");
   let n = {};
   if (e.protected)
     try {
       const ge = O(e.protected);
       n = JSON.parse(H.decode(ge));
     } catch {
-      throw new _("JWS Protected Header is invalid");
+      throw new w("JWS Protected Header is invalid");
     }
   if (!Ne(n, e.header))
-    throw new _("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+    throw new w("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
   const i = {
     ...n,
     ...e.header
-  }, o = Ge(_, /* @__PURE__ */ new Map([["b64", !0]]), r == null ? void 0 : r.crit, n, i);
+  }, o = Ge(w, /* @__PURE__ */ new Map([["b64", !0]]), r == null ? void 0 : r.crit, n, i);
   let s = !0;
   if (o.has("b64") && (s = n.b64, typeof s != "boolean"))
-    throw new _('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    throw new w('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
   const { alg: a } = i;
   if (typeof a != "string" || !a)
-    throw new _('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    throw new w('JWS "alg" (Algorithm) Header Parameter missing or invalid');
   if (s) {
     if (typeof e.payload != "string")
-      throw new _("JWS Payload must be a string");
+      throw new w("JWS Payload must be a string");
   } else if (typeof e.payload != "string" && !(e.payload instanceof Uint8Array))
-    throw new _("JWS Payload must be a string or an Uint8Array instance");
+    throw new w("JWS Payload must be a string or an Uint8Array instance");
   let d = !1;
   typeof t == "function" ? (t = await t(n, e), d = !0, ee(a, t, "verify"), U(t) && (t = await j(t, a))) : ee(a, t, "verify");
   const f = we(M.encode(e.protected ?? ""), M.encode("."), typeof e.payload == "string" ? M.encode(e.payload) : e.payload);
-  let y;
+  let v;
   try {
-    y = O(e.signature);
+    v = O(e.signature);
   } catch {
-    throw new _("Failed to base64url decode the signature");
+    throw new w("Failed to base64url decode the signature");
   }
-  if (!await Qe(a, t, y, f))
+  if (!await Qe(a, t, v, f))
     throw new oe();
   let C;
   if (s)
     try {
       C = O(e.payload);
     } catch {
-      throw new _("Failed to base64url decode the payload");
+      throw new w("Failed to base64url decode the payload");
     }
   else typeof e.payload == "string" ? C = M.encode(e.payload) : C = e.payload;
-  const P = { payload: C };
-  return e.protected !== void 0 && (P.protectedHeader = n), e.header !== void 0 && (P.unprotectedHeader = e.header), d ? { ...P, key: t } : P;
+  const k = { payload: C };
+  return e.protected !== void 0 && (k.protectedHeader = n), e.header !== void 0 && (k.unprotectedHeader = e.header), d ? { ...k, key: t } : k;
 }
 async function et(e, t, r) {
   if (e instanceof Uint8Array && (e = H.decode(e)), typeof e != "string")
-    throw new _("Compact JWS must be a string or Uint8Array");
+    throw new w("Compact JWS must be a string or Uint8Array");
   const { 0: n, 1: i, 2: o, length: s } = e.split(".");
   if (s !== 3)
-    throw new _("Invalid Compact JWS");
+    throw new w("Invalid Compact JWS");
   const a = await Ze({ payload: i, protected: n, signature: o }, t, r), d = { payload: a.payload, protectedHeader: a.protectedHeader };
   return typeof t == "function" ? { ...d, key: a.key } : d;
 }
@@ -1054,28 +1055,28 @@ function te(e) {
 }
 function tt(e) {
   if (typeof e != "string")
-    throw new k("JWTs must use Compact JWS serialization, JWT must be a string");
+    throw new P("JWTs must use Compact JWS serialization, JWT must be a string");
   const { 1: t, length: r } = e.split(".");
   if (r === 5)
-    throw new k("Only JWTs using Compact JWS serialization can be decoded");
+    throw new P("Only JWTs using Compact JWS serialization can be decoded");
   if (r !== 3)
-    throw new k("Invalid JWT");
+    throw new P("Invalid JWT");
   if (!t)
-    throw new k("JWTs must contain a payload");
+    throw new P("JWTs must contain a payload");
   let n;
   try {
     n = pe(t);
   } catch {
-    throw new k("Failed to base64url decode the payload");
+    throw new P("Failed to base64url decode the payload");
   }
   let i;
   try {
     i = JSON.parse(H.decode(n));
   } catch {
-    throw new k("Failed to parse the decoded payload as JSON");
+    throw new P("Failed to parse the decoded payload as JSON");
   }
   if (!x(i))
-    throw new k("Invalid JWT Claims Set");
+    throw new P("Invalid JWT Claims Set");
   return i;
 }
 const h = class h {
@@ -1175,7 +1176,7 @@ c(h, "flowName", {
   [h.OidcAuthorizationCode]: "OIDC Authorization Code"
 });
 let re = h;
-var v, S;
+var _, S;
 class nt {
   /**
    * Constructor.
@@ -1214,11 +1215,11 @@ class nt {
     verifierLength: a,
     tokenConsumer: d,
     authServerCredentials: f,
-    authServerMode: y,
+    authServerMode: v,
     authServerHeaders: T
   }) {
     c(this, "authServerBaseUrl", "");
-    $(this, v);
+    $(this, _);
     $(this, S);
     c(this, "codeChallengeMethod", "S256");
     c(this, "verifierLength", 32);
@@ -1234,10 +1235,10 @@ class nt {
     c(this, "oauthLogFetch", !1);
     c(this, "oauthUseUserInfoEndpoint", !1);
     c(this, "oauthAuthorizeRedirect");
-    this.tokenConsumer = d, this.authServerBaseUrl = t, a && (this.verifierLength = a), s && (this.stateLength = s), r && D(this, v, r), n && D(this, S, n), i && (this.redirect_uri = i), o && (this.codeChallengeMethod = o), this.authServerBaseUrl = t, f && (this.authServerCredentials = f), y && (this.authServerMode = y), T && (this.authServerHeaders = T);
+    this.tokenConsumer = d, this.authServerBaseUrl = t, a && (this.verifierLength = a), s && (this.stateLength = s), r && D(this, _, r), n && D(this, S, n), i && (this.redirect_uri = i), o && (this.codeChallengeMethod = o), this.authServerBaseUrl = t, f && (this.authServerCredentials = f), v && (this.authServerMode = v), T && (this.authServerHeaders = T);
   }
   set client_id(t) {
-    D(this, v, t);
+    D(this, _, t);
   }
   set client_secret(t) {
     D(this, S, t);
@@ -1271,7 +1272,7 @@ class nt {
     }
     if (!r || !r.ok)
       throw new p(
-        m.Connection,
+        y.Connection,
         "Couldn't get OIDC configuration from URL" + this.authServerBaseUrl + "/.well-known/openid-configuration"
       );
     this.oidcConfig = { ...ie };
@@ -1281,7 +1282,7 @@ class nt {
         this.oidcConfig[i] = o;
     } catch {
       throw new p(
-        m.Connection,
+        y.Connection,
         "Unrecognized response from OIDC configuration endpoint"
       );
     }
@@ -1311,21 +1312,20 @@ class nt {
   async startAuthorizationCodeFlow(t, {
     scope: r,
     codeChallenge: n,
-    pkce: i = !1,
-    upstream: o
+    pkce: i = !1
   }) {
-    var d, f, y;
-    if (l.logger.debug(u({ msg: "Starting authorization code flow, scope " + r })), this.oidcConfig || await this.loadConfig(), !((d = this.oidcConfig) != null && d.response_types_supported.includes("code")) || !((f = this.oidcConfig) != null && f.response_modes_supported.includes("query")))
+    var a, d, f;
+    if (l.logger.debug(u({ msg: "Starting authorization code flow, scope " + r })), this.oidcConfig || await this.loadConfig(), !((a = this.oidcConfig) != null && a.response_types_supported.includes("code")) || !((d = this.oidcConfig) != null && d.response_modes_supported.includes("query")))
       return {
         error: "invalid_request",
         error_description: "Server does not support authorization code flow"
       };
-    if (!((y = this.oidcConfig) != null && y.authorization_endpoint))
+    if (!((f = this.oidcConfig) != null && f.authorization_endpoint))
       return {
         error: "server_error",
         error_description: "Cannot get authorize endpoint"
       };
-    if (!g(this, v)) return {
+    if (!g(this, _)) return {
       error: "invalid_request",
       error_description: "Cannot make authorization code flow without client id"
     };
@@ -1333,10 +1333,10 @@ class nt {
       error: "invalid_request",
       error_description: "Cannot make authorization code flow without Redirect Uri"
     };
-    let s = this.oidcConfig.authorization_endpoint;
-    this.oauthAuthorizeRedirect && (s = this.oauthAuthorizeRedirect);
-    let a = s + "?response_type=code&client_id=" + encodeURIComponent(g(this, v)) + "&state=" + encodeURIComponent(t) + "&redirect_uri=" + encodeURIComponent(this.redirect_uri);
-    return r && (a += "&scope=" + encodeURIComponent(r)), i && n && (a += "&code_challenge=" + n), { url: a };
+    let o = this.oidcConfig.authorization_endpoint;
+    this.oauthAuthorizeRedirect && (o = this.oauthAuthorizeRedirect);
+    let s = o + "?response_type=code&client_id=" + encodeURIComponent(g(this, _)) + "&state=" + encodeURIComponent(t) + "&redirect_uri=" + encodeURIComponent(this.redirect_uri);
+    return r && (s += "&scope=" + encodeURIComponent(r)), i && n && (s += "&code_challenge=" + n), { url: s };
   }
   async codeChallengeAndVerifier() {
     const t = this.randomValue(this.verifierLength);
@@ -1397,10 +1397,10 @@ class nt {
     error: i,
     errorDescription: o
   }) {
-    var y, T;
+    var v, T;
     if (this.oidcConfig || await this.loadConfig(), i || !t)
       return i || (i = "server_error"), o || (o = "Unknown error"), { error: i, error_description: o };
-    if (this.authzCode = t, !((y = this.oidcConfig) != null && y.grant_types_supported.includes("authorization_code")))
+    if (this.authzCode = t, !((v = this.oidcConfig) != null && v.grant_types_supported.includes("authorization_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support authorization code grant"
@@ -1415,7 +1415,7 @@ class nt {
     a = "authorization_code", d = g(this, S);
     let f = {
       grant_type: a,
-      client_id: g(this, v),
+      client_id: g(this, _),
       code: this.authzCode,
       redirect_uri: this.redirect_uri
     };
@@ -1423,10 +1423,10 @@ class nt {
     try {
       let C = await this.post(s, f, this.authServerHeaders);
       if (C.id_token) {
-        const P = await this.getIdPayload(C.id_token, C.access_token);
-        if (P.error)
-          return P;
-        C.id_payload = P.payload;
+        const k = await this.getIdPayload(C.id_token, C.access_token);
+        if (k.error)
+          return k;
+        C.id_payload = k.payload;
       }
       return C;
     } catch (C) {
@@ -1459,14 +1459,14 @@ class nt {
       };
     if (!((o = this.oidcConfig) != null && o.token_endpoint))
       return { error: "server_error", error_description: "Cannot get token endpoint" };
-    if (!g(this, v)) return {
+    if (!g(this, _)) return {
       error: "invalid_request",
       error_description: "Cannot make client credentials flow without client id"
     };
     const r = this.oidcConfig.token_endpoint;
     let n = {
       grant_type: "client_credentials",
-      client_id: g(this, v),
+      client_id: g(this, _),
       client_secret: g(this, S)
     };
     t && (n.scope = t);
@@ -1516,7 +1516,7 @@ class nt {
     const i = this.oidcConfig.token_endpoint;
     let o = {
       grant_type: "password",
-      client_id: g(this, v),
+      client_id: g(this, _),
       client_secret: g(this, S),
       username: t,
       password: r
@@ -1606,7 +1606,7 @@ class nt {
     if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", i = await this.post(n, {
-      client_id: g(this, v),
+      client_id: g(this, _),
       client_secret: g(this, S),
       challenge_type: "otp",
       mfa_token: t,
@@ -1645,7 +1645,7 @@ class nt {
       return { error: "server_error", error_description: "Cannot get issuer" };
     const i = this.oidcConfig.token_endpoint, o = await this.post(i, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-otp",
-      client_id: g(this, v),
+      client_id: g(this, _),
       client_secret: g(this, S),
       challenge_type: "otp",
       mfa_token: t,
@@ -1697,7 +1697,7 @@ class nt {
     if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", i = await this.post(n, {
-      client_id: g(this, v),
+      client_id: g(this, _),
       client_secret: g(this, S),
       challenge_type: "oob",
       mfa_token: t,
@@ -1733,7 +1733,7 @@ class nt {
       return { error: "server_error", error_description: "Cannot get issuer" };
     const o = this.oidcConfig.token_endpoint, s = await this.post(o, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-oob",
-      client_id: g(this, v),
+      client_id: g(this, _),
       client_secret: g(this, S),
       challenge_type: "otp",
       mfa_token: t,
@@ -1781,7 +1781,7 @@ class nt {
     let i = {
       grant_type: "refresh_token",
       refresh_token: t,
-      client_id: g(this, v)
+      client_id: g(this, _)
     };
     n && (i.client_secret = n);
     try {
@@ -1817,7 +1817,7 @@ class nt {
       };
     let n = {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: g(this, v),
+      client_id: g(this, _),
       client_secret: g(this, S)
     };
     r && (n.scope = r);
@@ -1852,7 +1852,7 @@ class nt {
       };
     let r = {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: g(this, v),
+      client_id: g(this, _),
       client_secret: g(this, S),
       device_code: t
     };
@@ -1906,8 +1906,8 @@ class nt {
       s = JSON.stringify(r), a = "application/json";
     else {
       s = "";
-      for (let y in r)
-        s != "" && (s += "&"), s += encodeURIComponent(y) + "=" + encodeURIComponent(r[y]);
+      for (let v in r)
+        s != "" && (s += "&"), s += encodeURIComponent(v) + "=" + encodeURIComponent(r[v]);
       a = "application/x-www-form-urlencoded";
     }
     this.oauthLogFetch && l.logger.debug(u({ msg: "OAuth fetch", method: "POST", url: t, body: s }));
@@ -1925,10 +1925,10 @@ class nt {
       body: s
     });
     try {
-      const y = await f.clone().json();
-      return this.oauthLogFetch && l.logger.debug(u({ msg: "OAuth fetch response", body: JSON.stringify(y) })), await f.json(), y;
-    } catch (y) {
-      let T = p.asCrossauthError(y);
+      const v = await f.clone().json();
+      return this.oauthLogFetch && l.logger.debug(u({ msg: "OAuth fetch response", body: JSON.stringify(v) })), await f.json(), v;
+    } catch (v) {
+      let T = p.asCrossauthError(v);
       throw s = await f.text(), l.logger.debug(u({ msg: "Response is not JSON", response: s })), T;
     }
   }
@@ -2007,7 +2007,7 @@ class nt {
     return tt(t);
   }
 }
-v = new WeakMap(), S = new WeakMap();
+_ = new WeakMap(), S = new WeakMap();
 class ot {
   /**
    * Constrctor
@@ -2037,7 +2037,7 @@ class ot {
     c(this, "keys", {});
     if (this.audience = t, r.authServerBaseUrl && (this.authServerBaseUrl = r.authServerBaseUrl), r.jwtKeyType && (this.jwtKeyType = r.jwtKeyType), r.jwtSecretKey && (this.jwtSecretKey = r.jwtSecretKey), r.jwtPublicKey && (this.jwtPublicKey = r.jwtPublicKey), r.clockTolerance && (this.clockTolerance = r.clockTolerance), r.oidcConfig && (this.oidcConfig = r.oidcConfig), this.jwtPublicKey && !this.jwtKeyType)
       throw new p(
-        m.Configuration,
+        y.Configuration,
         "If specifying jwtPublic key, must also specify jwtKeyType"
       );
   }
@@ -2054,14 +2054,14 @@ class ot {
       if (this.jwtSecretKey) {
         if (!this.jwtKeyType)
           throw new p(
-            m.Configuration,
+            y.Configuration,
             "Must specify jwtKeyType if setting jwtSecretKey"
           );
         this.keys._default = await Be(this.jwtSecretKey, this.jwtKeyType);
       } else if (this.jwtPublicKey) {
         if (!this.jwtKeyType)
           throw new p(
-            m.Configuration,
+            y.Configuration,
             "Must specify jwtKeyType if setting jwtPublicKey"
           );
         const r = await $e(this.jwtPublicKey, this.jwtKeyType);
@@ -2069,13 +2069,13 @@ class ot {
       } else {
         if (this.oidcConfig || await this.loadConfig(), !this.oidcConfig)
           throw new p(
-            m.Connection,
+            y.Connection,
             "Load OIDC config before Jwks"
           );
         await this.loadJwks(void 0, t);
       }
     } catch (r) {
-      throw l.logger.debug(u({ err: r })), new p(m.Connection, "Couldn't load keys");
+      throw l.logger.debug(u({ err: r })), new p(y.Connection, "Couldn't load keys");
     }
   }
   /**
@@ -2093,7 +2093,7 @@ class ot {
       return;
     }
     if (!this.authServerBaseUrl)
-      throw new p(m.Connection, "Couldn't get OIDC configuration.  Either set authServerBaseUrl or set config manually");
+      throw new p(y.Connection, "Couldn't get OIDC configuration.  Either set authServerBaseUrl or set config manually");
     let r;
     try {
       let n = this.authServerBaseUrl;
@@ -2102,14 +2102,14 @@ class ot {
       l.logger.error(u({ err: n }));
     }
     if (!r || !r.ok)
-      throw new p(m.Connection, "Couldn't get OIDC configuration");
+      throw new p(y.Connection, "Couldn't get OIDC configuration");
     this.oidcConfig = { ...ie };
     try {
       const n = await r.json();
       for (const [i, o] of Object.entries(n))
         this.oidcConfig[i] = o;
     } catch {
-      throw new p(m.Connection, "Unrecognized response from OIDC configuration endpoint");
+      throw new p(y.Connection, "Unrecognized response from OIDC configuration endpoint");
     }
   }
   /**
@@ -2130,7 +2130,7 @@ class ot {
       }
     } else {
       if (!this.oidcConfig)
-        throw new p(m.Connection, "Load OIDC config before Jwks");
+        throw new p(y.Connection, "Load OIDC config before Jwks");
       let n;
       try {
         n = await fetch(new URL(this.oidcConfig.jwks_uri));
@@ -2138,12 +2138,12 @@ class ot {
         l.logger.error(u({ err: i }));
       }
       if (!n || !n.ok)
-        throw new p(m.Connection, "Couldn't get OIDC configuration");
+        throw new p(y.Connection, "Couldn't get OIDC configuration");
       this.keys = {};
       try {
         const i = await n.json();
         if (!("keys" in i) || !Array.isArray(i.keys))
-          throw new p(m.Connection, "Couldn't fetch keys");
+          throw new p(y.Connection, "Couldn't fetch keys");
         for (let o = 0; o < i.keys.length; ++o)
           try {
             let s = "_default", a = { ...i.keys[o] };
@@ -2157,10 +2157,10 @@ class ot {
             const d = await j(a);
             this.keys[s] = d;
           } catch (s) {
-            throw l.logger.error(u({ err: s })), new p(m.Connection, "Couldn't load keys");
+            throw l.logger.error(u({ err: s })), new p(y.Connection, "Couldn't load keys");
           }
       } catch (i) {
-        throw l.logger.error(u({ err: i })), new p(m.Connection, "Unrecognized response from OIDC jwks endpoint");
+        throw l.logger.error(u({ err: i })), new p(y.Connection, "Unrecognized response from OIDC jwks endpoint");
       }
     }
   }
@@ -2234,8 +2234,8 @@ export {
   p as CrossauthError,
   l as CrossauthLogger,
   ie as DEFAULT_OIDCCONFIG,
-  m as ErrorCode,
-  I as KeyPrefix,
+  y as ErrorCode,
+  A as KeyPrefix,
   nt as OAuthClientBase,
   re as OAuthFlows,
   ot as OAuthTokenConsumerBase,