@crossauth/frontend 0.0.14 → 0.0.15

package/dist/index.js

@@ -73,14 +73,14 @@ class g extends Error {
    * @param message if provided, this error will display.  Otherwise a default one for the error code will be used.
    */
   constructor(e, t = void 0) {
-    let o, s = 500;
-    e == 0 ? (o = "User does not exist", s = 401) : e == 1 ? (o = "Password doesn't match", s = 401) : e == 3 ? (o = "Username or password incorrect", s = 401) : e == 4 ? (o = "Client id is invalid", s = 401) : e == 5 ? (o = "Client ID or name already exists", s = 500) : e == 6 ? (o = "Client secret is invalid", s = 401) : e == 7 ? (o = "Client id or secret is invalid", s = 401) : e == 8 ? (o = "Redirect Uri is not registered", s = 401) : e == 9 ? (o = "Invalid OAuth flow type", s = 500) : e == 2 ? (o = "No user exists with that email address", s = 401) : e == 10 ? (o = "Account is not active", s = 403) : e == 33 ? (o = "Username is not in an allowed format", s = 400) : e == 31 ? (o = "Email is not in an allowed format", s = 400) : e == 32 ? (o = "Phone number is not in an allowed format", s = 400) : e == 11 ? (o = "Email address has not been verified", s = 403) : e == 12 ? (o = "Two-factor setup is not complete", s = 403) : e == 13 ? (o = "Not authorized", s = 401) : e == 14 ? (o = "Client not authorized", s = 401) : e == 15 ? (o = "Invalid scope", s = 403) : e == 16 ? (o = "Insufficient scope", s = 403) : e == 23 ? o = "Connection failure" : e == 22 ? (o = "Token has expired", s = 401) : e == 24 ? o = "Hash is not in a valid format" : e == 19 ? (o = "Key is invalid", s = 401) : e == 18 ? (o = "You do not have permission to access this resource", s = 403) : e == 17 ? (o = "You do not have the right privileges to access this resource", s = 401) : e == 20 ? (o = "CSRF token is invalid", s = 401) : e == 21 ? (o = "Session cookie is invalid", s = 401) : e == 25 ? o = "Algorithm not supported" : e == 26 ? o = "Attempt to create a key that already exists" : e == 27 ? (o = "User must change password", s = 403) : e == 28 ? (o = "User must reset password", s = 403) : e == 29 ? (o = "User must reset 2FA", s = 403) : e == 30 ? o = "There was an error in the configuration" : e == 34 ? (o = "Passwords do not match", s = 401) : e == 35 ? (o = "Token is not valid", s = 401) : e == 36 ? (o = "MFA is required", s = 401) : e == 37 ? (o = "Password format was incorrect", s = 401) : e == 40 ? (o = "User already exists", s = 400) : e == 42 ? (o = "The request is invalid", s = 400) : e == 38 ? (o = "Session data has unexpected format", s = 500) : e == 39 ? (o = "Couldn't execute a fetch", s = 500) : e == 43 ? (o = "Waiting for authorization", s = 200) : e == 44 ? (o = "Slow polling down by 5 seconds", s = 200) : e == 45 ? (o = "Token has expired", s = 401) : e == 46 ? (o = "Database update/insert caused a constraint violation", s = 500) : e == 47 ? (o = "This method has not been implemented", s = 500) : (o = "Unknown error", s = 500), t != null && !Array.isArray(t) ? o = t : Array.isArray(t) && (o = t.join(". ")), super(o), l(this, "isCrossauthError", !0), l(this, "httpStatus"), l(this, "code"), l(this, "codeName"), l(this, "messages"), this.code = e, this.codeName = m[e], this.httpStatus = s, this.name = "CrossauthError", Array.isArray(t) ? this.messages = t : this.messages = [o], Object.setPrototypeOf(this, g.prototype);
+    let o, i = 500;
+    e == 0 ? (o = "User does not exist", i = 401) : e == 1 ? (o = "Password doesn't match", i = 401) : e == 3 ? (o = "Username or password incorrect", i = 401) : e == 4 ? (o = "Client id is invalid", i = 401) : e == 5 ? (o = "Client ID or name already exists", i = 500) : e == 6 ? (o = "Client secret is invalid", i = 401) : e == 7 ? (o = "Client id or secret is invalid", i = 401) : e == 8 ? (o = "Redirect Uri is not registered", i = 401) : e == 9 ? (o = "Invalid OAuth flow type", i = 500) : e == 2 ? (o = "No user exists with that email address", i = 401) : e == 10 ? (o = "Account is not active", i = 403) : e == 33 ? (o = "Username is not in an allowed format", i = 400) : e == 31 ? (o = "Email is not in an allowed format", i = 400) : e == 32 ? (o = "Phone number is not in an allowed format", i = 400) : e == 11 ? (o = "Email address has not been verified", i = 403) : e == 12 ? (o = "Two-factor setup is not complete", i = 403) : e == 13 ? (o = "Not authorized", i = 401) : e == 14 ? (o = "Client not authorized", i = 401) : e == 15 ? (o = "Invalid scope", i = 403) : e == 16 ? (o = "Insufficient scope", i = 403) : e == 23 ? o = "Connection failure" : e == 22 ? (o = "Token has expired", i = 401) : e == 24 ? o = "Hash is not in a valid format" : e == 19 ? (o = "Key is invalid", i = 401) : e == 18 ? (o = "You do not have permission to access this resource", i = 403) : e == 17 ? (o = "You do not have the right privileges to access this resource", i = 401) : e == 20 ? (o = "CSRF token is invalid", i = 401) : e == 21 ? (o = "Session cookie is invalid", i = 401) : e == 25 ? o = "Algorithm not supported" : e == 26 ? o = "Attempt to create a key that already exists" : e == 27 ? (o = "User must change password", i = 403) : e == 28 ? (o = "User must reset password", i = 403) : e == 29 ? (o = "User must reset 2FA", i = 403) : e == 30 ? o = "There was an error in the configuration" : e == 34 ? (o = "Passwords do not match", i = 401) : e == 35 ? (o = "Token is not valid", i = 401) : e == 36 ? (o = "MFA is required", i = 401) : e == 37 ? (o = "Password format was incorrect", i = 401) : e == 40 ? (o = "User already exists", i = 400) : e == 42 ? (o = "The request is invalid", i = 400) : e == 38 ? (o = "Session data has unexpected format", i = 500) : e == 39 ? (o = "Couldn't execute a fetch", i = 500) : e == 43 ? (o = "Waiting for authorization", i = 200) : e == 44 ? (o = "Slow polling down by 5 seconds", i = 200) : e == 45 ? (o = "Token has expired", i = 401) : e == 46 ? (o = "Database update/insert caused a constraint violation", i = 500) : e == 47 ? (o = "This method has not been implemented", i = 500) : (o = "Unknown error", i = 500), t != null && !Array.isArray(t) ? o = t : Array.isArray(t) && (o = t.join(". ")), super(o), l(this, "isCrossauthError", !0), l(this, "httpStatus"), l(this, "code"), l(this, "codeName"), l(this, "messages"), this.code = e, this.codeName = m[e], this.httpStatus = i, this.name = "CrossauthError", Array.isArray(t) ? this.messages = t : this.messages = [o], Object.setPrototypeOf(this, g.prototype);
   }
   /**
    * OAuth defines certain error types.  To convert the error in an OAuth
    * response into a CrossauthError object, call this function.
    * 
-   * @param error as returned by an OAuth call (converted to an {@link @crossauth/common!ErrorCode}).
+   * @param error as returned by an OAuth call (converted to an {@link ErrorCode}).
    * @param error_description as returned by an OAuth call (put in the `message`)
    * @returns a `CrossauthError` instance.
    */
@@ -164,7 +164,7 @@ class g extends Error {
    * it.  
    * If not and it is an object with `errorCode` in it, creates a 
    * CrossauthError from that and `errorMessage`, if present.
-   * Otherwise creates a `CrossauthError` object with {@link @crossauth/common!ErrorCode}
+   * Otherwise creates a `CrossauthError` object with {@link ErrorCode}
    * of `Unknown` from it, setting the `message` if possible.
    * 
    * @param e the error to convert.
@@ -174,13 +174,13 @@ class g extends Error {
     if (e instanceof Error)
       return "isCrossauthError" in e ? e : new g(48, e.message);
     if ("errorCode" in e) {
-      let s = 48;
+      let i = 48;
       try {
-        s = Number(e.errorCode) ?? 48;
+        i = Number(e.errorCode) ?? 48;
       } catch {
       }
-      let n = t ?? m[s];
-      return "errorMessage" in e ? n = e.errorMessage : "message" in e && (n = e.message), new g(s, n);
+      let n = t ?? m[i];
+      return "errorMessage" in e ? n = e.errorMessage : "message" in e && (n = e.message), new g(i, n);
     }
     let o = t ?? m[
       48
@@ -262,8 +262,8 @@ l(W, "Error", 1), /** Log errors and warning */
 l(W, "Warn", 2), /** Log errors, warnings and info messages */
 l(W, "Info", 3), /** Log everything */
 l(W, "Debug", 4), l(W, "levelName", ["NONE", "ERROR", "WARN", "INFO", "DEBUG"]);
-let c = W;
-function d(r) {
+let d = W;
+function h(r) {
   let e;
   typeof r == "object" && "err" in r && typeof r.err == "object" && (e = r.err.stack);
   try {
@@ -284,7 +284,7 @@ function d(r) {
   }
   return typeof r == "string" || globalThis.crossauthLoggerAcceptsJson ? r : JSON.stringify(r);
 }
-globalThis.crossauthLogger = new c(c.None);
+globalThis.crossauthLogger = new d(d.None);
 globalThis.crossauthLoggerAcceptsJson = !0;
 const ye = {
   issuer: "",
@@ -303,10 +303,10 @@ const ye = {
   require_request_uri_registration: !1
 }, te = crypto, we = (r) => r instanceof CryptoKey, X = new TextEncoder(), G = new TextDecoder();
 function He(...r) {
-  const e = r.reduce((s, { length: n }) => s + n, 0), t = new Uint8Array(e);
+  const e = r.reduce((i, { length: n }) => i + n, 0), t = new Uint8Array(e);
   let o = 0;
-  for (const s of r)
-    t.set(s, o), o += s.length;
+  for (const i of r)
+    t.set(i, o), o += i.length;
   return t;
 }
 const xe = (r) => {
@@ -348,7 +348,7 @@ class S extends oe {
     return "ERR_JWS_INVALID";
   }
 }
-class D extends oe {
+class z extends oe {
   constructor() {
     super(...arguments), this.code = "ERR_JWT_INVALID";
   }
@@ -370,7 +370,7 @@ function U(r, e = "algorithm.name") {
 function Q(r, e) {
   return r.name === e;
 }
-function se(r) {
+function ie(r) {
   return parseInt(r.name.slice(4), 10);
 }
 function Ke(r) {
@@ -385,7 +385,7 @@ function Ke(r) {
       throw new Error("unreachable");
   }
 }
-function ze(r, e) {
+function De(r, e) {
   if (e.length && !e.some((t) => r.usages.includes(t))) {
     let t = "CryptoKey does not support this operation, its usages must include ";
     if (e.length > 2) {
@@ -395,7 +395,7 @@ function ze(r, e) {
     throw new TypeError(t);
   }
 }
-function De(r, e, ...t) {
+function ze(r, e, ...t) {
   switch (e) {
     case "HS256":
     case "HS384":
@@ -403,7 +403,7 @@ function De(r, e, ...t) {
       if (!Q(r.algorithm, "HMAC"))
         throw U("HMAC");
       const o = parseInt(e.slice(2), 10);
-      if (se(r.algorithm.hash) !== o)
+      if (ie(r.algorithm.hash) !== o)
         throw U(`SHA-${o}`, "algorithm.hash");
       break;
     }
@@ -413,7 +413,7 @@ function De(r, e, ...t) {
       if (!Q(r.algorithm, "RSASSA-PKCS1-v1_5"))
         throw U("RSASSA-PKCS1-v1_5");
       const o = parseInt(e.slice(2), 10);
-      if (se(r.algorithm.hash) !== o)
+      if (ie(r.algorithm.hash) !== o)
         throw U(`SHA-${o}`, "algorithm.hash");
       break;
     }
@@ -423,7 +423,7 @@ function De(r, e, ...t) {
       if (!Q(r.algorithm, "RSA-PSS"))
         throw U("RSA-PSS");
       const o = parseInt(e.slice(2), 10);
-      if (se(r.algorithm.hash) !== o)
+      if (ie(r.algorithm.hash) !== o)
         throw U(`SHA-${o}`, "algorithm.hash");
       break;
     }
@@ -445,13 +445,13 @@ function De(r, e, ...t) {
     default:
       throw new TypeError("CryptoKey does not support this operation");
   }
-  ze(r, t);
+  De(r, t);
 }
 function me(r, e, ...t) {
   var o;
   if (t.length > 2) {
-    const s = t.pop();
-    r += `one of type ${t.join(", ")}, or ${s}.`;
+    const i = t.pop();
+    r += `one of type ${t.join(", ")}, or ${i}.`;
   } else t.length === 2 ? r += `one of type ${t[0]} or ${t[1]}.` : r += `of type ${t[0]}.`;
   return e == null ? r += ` Received ${e}` : typeof e == "function" && e.name ? r += ` Received function ${e.name}` : typeof e == "object" && e != null && (o = e.constructor) != null && o.name && (r += ` Received an instance of ${e.constructor.name}`), r;
 }
@@ -459,18 +459,18 @@ const he = (r, ...e) => me("Key must be ", r, ...e);
 function ve(r, e, ...t) {
   return me(`Key for the ${r} algorithm must be `, e, ...t);
 }
-const Ce = (r) => we(r) ? !0 : (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject", re = ["CryptoKey"], We = (...r) => {
+const ke = (r) => we(r) ? !0 : (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject", re = ["CryptoKey"], We = (...r) => {
   const e = r.filter(Boolean);
   if (e.length === 0 || e.length === 1)
     return !0;
   let t;
   for (const o of e) {
-    const s = Object.keys(o);
+    const i = Object.keys(o);
     if (!t || t.size === 0) {
-      t = new Set(s);
+      t = new Set(i);
       continue;
     }
-    for (const n of s) {
+    for (const n of i) {
       if (t.has(n))
         return !1;
       t.add(n);
@@ -570,33 +570,33 @@ function Me(r) {
   }
   return { algorithm: e, keyUsages: t };
 }
-const ke = async (r) => {
+const Ce = async (r) => {
   if (!r.alg)
     throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
   const { algorithm: e, keyUsages: t } = Me(r), o = [
     e,
     r.ext ?? !1,
     r.key_ops ?? t
-  ], s = { ...r };
-  return delete s.alg, delete s.use, te.subtle.importKey("jwk", s, ...o);
-}, Se = (r) => M(r);
-let ie, ne;
-const _e = (r) => (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject", Te = async (r, e, t, o) => {
-  let s = r.get(e);
-  if (s != null && s[o])
-    return s[o];
-  const n = await ke({ ...t, alg: o });
-  return s ? s[o] = n : r.set(e, { [o]: n }), n;
+  ], i = { ...r };
+  return delete i.alg, delete i.use, te.subtle.importKey("jwk", i, ...o);
+}, _e = (r) => M(r);
+let se, ne;
+const Se = (r) => (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject", Te = async (r, e, t, o) => {
+  let i = r.get(e);
+  if (i != null && i[o])
+    return i[o];
+  const n = await Ce({ ...t, alg: o });
+  return i ? i[o] = n : r.set(e, { [o]: n }), n;
 }, Be = (r, e) => {
-  if (_e(r)) {
+  if (Se(r)) {
     let t = r.export({ format: "jwk" });
-    return delete t.d, delete t.dp, delete t.dq, delete t.p, delete t.q, delete t.qi, t.k ? Se(t.k) : (ne || (ne = /* @__PURE__ */ new WeakMap()), Te(ne, r, t, e));
+    return delete t.d, delete t.dp, delete t.dq, delete t.p, delete t.q, delete t.qi, t.k ? _e(t.k) : (ne || (ne = /* @__PURE__ */ new WeakMap()), Te(ne, r, t, e));
   }
   return r;
 }, Le = (r, e) => {
-  if (_e(r)) {
+  if (Se(r)) {
     let t = r.export({ format: "jwk" });
-    return t.k ? Se(t.k) : (ie || (ie = /* @__PURE__ */ new WeakMap()), Te(ie, r, t, e));
+    return t.k ? _e(t.k) : (se || (se = /* @__PURE__ */ new WeakMap()), Te(se, r, t, e));
   }
   return r;
 }, $e = { normalizePublicKey: Be, normalizePrivateKey: Le }, x = (r, e, t = 0) => {
@@ -604,8 +604,8 @@ const _e = (r) => (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject",
   const o = r.indexOf(e[0], t);
   if (o === -1)
     return !1;
-  const s = r.subarray(o, o + e.length);
-  return s.length !== e.length ? !1 : s.every((n, i) => n === e[i]) || x(r, e, o + 1);
+  const i = r.subarray(o, o + e.length);
+  return i.length !== e.length ? !1 : i.every((n, s) => n === e[s]) || x(r, e, o + 1);
 }, le = (r) => {
   switch (!0) {
     case x(r, [42, 134, 72, 206, 61, 3, 1, 7]):
@@ -625,19 +625,19 @@ const _e = (r) => (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject",
     default:
       throw new I("Invalid or unsupported EC Key Curve or OKP Key Sub Type");
   }
-}, be = async (r, e, t, o, s) => {
-  let n, i;
-  const a = new Uint8Array(atob(t.replace(r, "")).split("").map((u) => u.charCodeAt(0))), h = e === "spki";
+}, be = async (r, e, t, o, i) => {
+  let n, s;
+  const a = new Uint8Array(atob(t.replace(r, "")).split("").map((u) => u.charCodeAt(0))), c = e === "spki";
   switch (o) {
     case "PS256":
     case "PS384":
     case "PS512":
-      n = { name: "RSA-PSS", hash: `SHA-${o.slice(-3)}` }, i = h ? ["verify"] : ["sign"];
+      n = { name: "RSA-PSS", hash: `SHA-${o.slice(-3)}` }, s = c ? ["verify"] : ["sign"];
       break;
     case "RS256":
     case "RS384":
     case "RS512":
-      n = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${o.slice(-3)}` }, i = h ? ["verify"] : ["sign"];
+      n = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${o.slice(-3)}` }, s = c ? ["verify"] : ["sign"];
       break;
     case "RSA-OAEP":
     case "RSA-OAEP-256":
@@ -646,32 +646,32 @@ const _e = (r) => (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject",
       n = {
         name: "RSA-OAEP",
         hash: `SHA-${parseInt(o.slice(-3), 10) || 1}`
-      }, i = h ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
+      }, s = c ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
       break;
     case "ES256":
-      n = { name: "ECDSA", namedCurve: "P-256" }, i = h ? ["verify"] : ["sign"];
+      n = { name: "ECDSA", namedCurve: "P-256" }, s = c ? ["verify"] : ["sign"];
       break;
     case "ES384":
-      n = { name: "ECDSA", namedCurve: "P-384" }, i = h ? ["verify"] : ["sign"];
+      n = { name: "ECDSA", namedCurve: "P-384" }, s = c ? ["verify"] : ["sign"];
       break;
     case "ES512":
-      n = { name: "ECDSA", namedCurve: "P-521" }, i = h ? ["verify"] : ["sign"];
+      n = { name: "ECDSA", namedCurve: "P-521" }, s = c ? ["verify"] : ["sign"];
       break;
     case "ECDH-ES":
     case "ECDH-ES+A128KW":
     case "ECDH-ES+A192KW":
     case "ECDH-ES+A256KW": {
       const u = le(a);
-      n = u.startsWith("P-") ? { name: "ECDH", namedCurve: u } : { name: u }, i = h ? [] : ["deriveBits"];
+      n = u.startsWith("P-") ? { name: "ECDH", namedCurve: u } : { name: u }, s = c ? [] : ["deriveBits"];
       break;
     }
     case "EdDSA":
-      n = { name: le(a) }, i = h ? ["verify"] : ["sign"];
+      n = { name: le(a) }, s = c ? ["verify"] : ["sign"];
       break;
     default:
       throw new I('Invalid or unsupported "alg" (Algorithm) value');
   }
-  return te.subtle.importKey(e, a, n, !1, i);
+  return te.subtle.importKey(e, a, n, !1, s);
 }, qe = (r, e, t) => be(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", r, e), Ve = (r, e, t) => be(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", r, e);
 async function Ge(r, e, t) {
   if (typeof r != "string" || r.indexOf("-----BEGIN PUBLIC KEY-----") !== 0)
@@ -696,20 +696,20 @@ async function ue(r, e) {
         throw new I('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
     case "EC":
     case "OKP":
-      return ke({ ...r, alg: e });
+      return Ce({ ...r, alg: e });
     default:
       throw new I('Unsupported "kty" (Key Type) Parameter value');
   }
 }
 const ee = (r) => r == null ? void 0 : r[Symbol.toStringTag], Xe = (r, e) => {
   if (!(e instanceof Uint8Array)) {
-    if (!Ce(e))
+    if (!ke(e))
       throw new TypeError(ve(r, e, ...re, "Uint8Array"));
     if (e.type !== "secret")
       throw new TypeError(`${ee(e)} instances for symmetric algorithms must be of type "secret"`);
   }
 }, Qe = (r, e, t) => {
-  if (!Ce(e))
+  if (!ke(e))
     throw new TypeError(ve(r, e, ...re));
   if (e.type === "secret")
     throw new TypeError(`${ee(e)} instances for asymmetric algorithms must not be of type "secret"`);
@@ -720,22 +720,22 @@ const ee = (r) => r == null ? void 0 : r[Symbol.toStringTag], Xe = (r, e) => {
 }, Ze = (r, e, t) => {
   r.startsWith("HS") || r === "dir" || r.startsWith("PBES2") || /^A\d{3}(?:GCM)?KW$/.test(r) ? Xe(r, e) : Qe(r, e, t);
 };
-function er(r, e, t, o, s) {
-  if (s.crit !== void 0 && (o == null ? void 0 : o.crit) === void 0)
+function er(r, e, t, o, i) {
+  if (i.crit !== void 0 && (o == null ? void 0 : o.crit) === void 0)
     throw new r('"crit" (Critical) Header Parameter MUST be integrity protected');
   if (!o || o.crit === void 0)
     return /* @__PURE__ */ new Set();
-  if (!Array.isArray(o.crit) || o.crit.length === 0 || o.crit.some((i) => typeof i != "string" || i.length === 0))
+  if (!Array.isArray(o.crit) || o.crit.length === 0 || o.crit.some((s) => typeof s != "string" || s.length === 0))
     throw new r('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
   let n;
   n = e;
-  for (const i of o.crit) {
-    if (!n.has(i))
-      throw new I(`Extension Header Parameter "${i}" is not recognized`);
-    if (s[i] === void 0)
-      throw new r(`Extension Header Parameter "${i}" is missing`);
-    if (n.get(i) && o[i] === void 0)
-      throw new r(`Extension Header Parameter "${i}" MUST be integrity protected`);
+  for (const s of o.crit) {
+    if (!n.has(s))
+      throw new I(`Extension Header Parameter "${s}" is not recognized`);
+    if (i[s] === void 0)
+      throw new r(`Extension Header Parameter "${s}" is missing`);
+    if (n.get(s) && o[s] === void 0)
+      throw new r(`Extension Header Parameter "${s}" MUST be integrity protected`);
   }
   return new Set(o.crit);
 }
@@ -766,7 +766,7 @@ function rr(r, e) {
 }
 async function tr(r, e, t) {
   if (e = await $e.normalizePublicKey(e, r), we(e))
-    return De(e, r, t), e;
+    return ze(e, r, t), e;
   if (e instanceof Uint8Array) {
     if (!r.startsWith("HS"))
       throw new TypeError(he(e, ...re));
@@ -775,16 +775,16 @@ async function tr(r, e, t) {
   throw new TypeError(he(e, ...re, "Uint8Array"));
 }
 const or = async (r, e, t, o) => {
-  const s = await tr(r, e, "verify");
-  Je(r, s);
-  const n = rr(r, s.algorithm);
+  const i = await tr(r, e, "verify");
+  Je(r, i);
+  const n = rr(r, i.algorithm);
   try {
-    return await te.subtle.verify(n, s, t, o);
+    return await te.subtle.verify(n, i, t, o);
   } catch {
     return !1;
   }
 };
-async function sr(r, e, t) {
+async function ir(r, e, t) {
   if (!V(r))
     throw new S("Flattened JWS must be an object");
   if (r.protected === void 0 && r.header === void 0)
@@ -807,23 +807,23 @@ async function sr(r, e, t) {
     }
   if (!We(o, r.header))
     throw new S("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-  const s = {
+  const i = {
     ...o,
     ...r.header
-  }, n = er(S, /* @__PURE__ */ new Map([["b64", !0]]), void 0, o, s);
-  let i = !0;
-  if (n.has("b64") && (i = o.b64, typeof i != "boolean"))
+  }, n = er(S, /* @__PURE__ */ new Map([["b64", !0]]), void 0, o, i);
+  let s = !0;
+  if (n.has("b64") && (s = o.b64, typeof s != "boolean"))
     throw new S('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-  const { alg: a } = s;
+  const { alg: a } = i;
   if (typeof a != "string" || !a)
     throw new S('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-  if (i) {
+  if (s) {
     if (typeof r.payload != "string")
       throw new S("JWS Payload must be a string");
   } else if (typeof r.payload != "string" && !(r.payload instanceof Uint8Array))
     throw new S("JWS Payload must be a string or an Uint8Array instance");
-  let h = !1;
-  typeof e == "function" && (e = await e(o, r), h = !0), Ze(a, e, "verify");
+  let c = !1;
+  typeof e == "function" && (e = await e(o, r), c = !0), Ze(a, e, "verify");
   const u = He(X.encode(r.protected ?? ""), X.encode("."), typeof r.payload == "string" ? X.encode(r.payload) : r.payload);
   let y;
   try {
@@ -833,25 +833,25 @@ async function sr(r, e, t) {
   }
   if (!await or(a, e, y, u))
     throw new je();
-  let _;
-  if (i)
+  let k;
+  if (s)
     try {
-      _ = M(r.payload);
+      k = M(r.payload);
     } catch {
       throw new S("Failed to base64url decode the payload");
     }
-  else typeof r.payload == "string" ? _ = X.encode(r.payload) : _ = r.payload;
-  const Y = { payload: _ };
-  return r.protected !== void 0 && (Y.protectedHeader = o), r.header !== void 0 && (Y.unprotectedHeader = r.header), h ? { ...Y, key: e } : Y;
+  else typeof r.payload == "string" ? k = X.encode(r.payload) : k = r.payload;
+  const Y = { payload: k };
+  return r.protected !== void 0 && (Y.protectedHeader = o), r.header !== void 0 && (Y.unprotectedHeader = r.header), c ? { ...Y, key: e } : Y;
 }
-async function ir(r, e, t) {
+async function sr(r, e, t) {
   if (r instanceof Uint8Array && (r = G.decode(r)), typeof r != "string")
     throw new S("Compact JWS must be a string or Uint8Array");
-  const { 0: o, 1: s, 2: n, length: i } = r.split(".");
-  if (i !== 3)
+  const { 0: o, 1: i, 2: n, length: s } = r.split(".");
+  if (s !== 3)
     throw new S("Invalid Compact JWS");
-  const a = await sr({ payload: s, protected: o, signature: n }, e), h = { payload: a.payload, protectedHeader: a.protectedHeader };
-  return typeof e == "function" ? { ...h, key: a.key } : h;
+  const a = await ir({ payload: i, protected: o, signature: n }, e), c = { payload: a.payload, protectedHeader: a.protectedHeader };
+  return typeof e == "function" ? { ...c, key: a.key } : c;
 }
 const Ee = M;
 function nr(r) {
@@ -877,29 +877,29 @@ function nr(r) {
 }
 function ar(r) {
   if (typeof r != "string")
-    throw new D("JWTs must use Compact JWS serialization, JWT must be a string");
+    throw new z("JWTs must use Compact JWS serialization, JWT must be a string");
   const { 1: e, length: t } = r.split(".");
   if (t === 5)
-    throw new D("Only JWTs using Compact JWS serialization can be decoded");
+    throw new z("Only JWTs using Compact JWS serialization can be decoded");
   if (t !== 3)
-    throw new D("Invalid JWT");
+    throw new z("Invalid JWT");
   if (!e)
-    throw new D("JWTs must contain a payload");
+    throw new z("JWTs must contain a payload");
   let o;
   try {
     o = Ee(e);
   } catch {
-    throw new D("Failed to base64url decode the payload");
+    throw new z("Failed to base64url decode the payload");
   }
-  let s;
+  let i;
   try {
-    s = JSON.parse(G.decode(o));
+    i = JSON.parse(G.decode(o));
   } catch {
-    throw new D("Failed to parse the decoded payload as JSON");
+    throw new z("Failed to parse the decoded payload as JSON");
   }
-  if (!V(s))
-    throw new D("Invalid JWT Claims Set");
-  return s;
+  if (!V(i))
+    throw new z("Invalid JWT Claims Set");
+  return i;
 }
 const C = class v {
   /**
@@ -996,7 +996,7 @@ l(C, "flowName", {
   [C.PasswordMfa]: "Password MFA",
   [C.OidcAuthorizationCode]: "OIDC Authorization Code"
 });
-var k, T, q, F, J;
+var _, T, q, F, J;
 class cr {
   /**
    * Constructor.
@@ -1029,19 +1029,19 @@ class cr {
     authServerBaseUrl: e,
     client_id: t,
     client_secret: o,
-    redirect_uri: s,
+    redirect_uri: i,
     codeChallengeMethod: n,
-    stateLength: i,
+    stateLength: s,
     verifierLength: a,
-    tokenConsumer: h,
+    tokenConsumer: c,
     authServerCredentials: u,
     authServerMode: y,
-    authServerHeaders: _
+    authServerHeaders: k
   }) {
-    l(this, "authServerBaseUrl", ""), $(this, k), $(this, T), $(this, q), l(this, "codeChallengeMethod", "S256"), $(this, F), l(this, "verifierLength", 32), l(this, "redirect_uri"), $(this, J, ""), l(this, "stateLength", 32), l(this, "authzCode", ""), l(this, "oidcConfig"), l(this, "tokenConsumer"), l(this, "authServerHeaders", {}), l(this, "authServerMode"), l(this, "authServerCredentials"), this.tokenConsumer = h, this.authServerBaseUrl = e, a && (this.verifierLength = a), i && (this.stateLength = i), t && A(this, k, t), o && A(this, T, o), s && (this.redirect_uri = s), n && (this.codeChallengeMethod = n), this.authServerBaseUrl = e, u && (this.authServerCredentials = u), y && (this.authServerMode = y), _ && (this.authServerHeaders = _);
+    l(this, "authServerBaseUrl", ""), $(this, _), $(this, T), $(this, q), l(this, "codeChallengeMethod", "S256"), $(this, F), l(this, "verifierLength", 32), l(this, "redirect_uri"), $(this, J, ""), l(this, "stateLength", 32), l(this, "authzCode", ""), l(this, "oidcConfig"), l(this, "tokenConsumer"), l(this, "authServerHeaders", {}), l(this, "authServerMode"), l(this, "authServerCredentials"), this.tokenConsumer = c, this.authServerBaseUrl = e, a && (this.verifierLength = a), s && (this.stateLength = s), t && A(this, _, t), o && A(this, T, o), i && (this.redirect_uri = i), n && (this.codeChallengeMethod = n), this.authServerBaseUrl = e, u && (this.authServerCredentials = u), y && (this.authServerMode = y), k && (this.authServerHeaders = k);
   }
   set client_id(e) {
-    A(this, k, e);
+    A(this, _, e);
   }
   set client_secret(e) {
     A(this, T, e);
@@ -1063,12 +1063,12 @@ class cr {
    *        Otherwise, performs a fetch by appending
    *        `/.well-known/openid-configuration` to the 
    *        `authServerBaseUrl`.
-   * @throws {@link @crossauth/common!CrossauthError} with the following {@link @crossauth/common!ErrorCode}s
+   * @throws {@link CrossauthError} with the following {@link ErrorCode}s
    *   - `Connection` if data from the URL could not be fetched or parsed.
    */
   async loadConfig(e) {
     if (e) {
-      c.logger.debug(d({ msg: "Reading OIDC config locally" })), this.oidcConfig = e;
+      d.logger.debug(h({ msg: "Reading OIDC config locally" })), this.oidcConfig = e;
       return;
     }
     let t;
@@ -1076,11 +1076,11 @@ class cr {
       const o = new URL(
         this.authServerBaseUrl + "/.well-known/openid-configuration"
       );
-      c.logger.debug(d({ msg: `Fetching OIDC config from ${o}` }));
-      let s = { headers: this.authServerHeaders };
-      this.authServerMode && (s.mode = this.authServerMode), this.authServerCredentials && (s.credentials = this.authServerCredentials), t = await fetch(o, s);
+      d.logger.debug(h({ msg: `Fetching OIDC config from ${o}` }));
+      let i = { headers: this.authServerHeaders };
+      this.authServerMode && (i.mode = this.authServerMode), this.authServerCredentials && (i.credentials = this.authServerCredentials), t = await fetch(o, i);
     } catch (o) {
-      c.logger.error(d({ err: o }));
+      d.logger.error(h({ err: o }));
     }
     if (!t || !t.ok)
       throw new g(
@@ -1090,8 +1090,8 @@ class cr {
     this.oidcConfig = { ...ye };
     try {
       const o = await t.json();
-      for (const [s, n] of Object.entries(o))
-        this.oidcConfig[s] = n;
+      for (const [i, n] of Object.entries(o))
+        this.oidcConfig[i] = n;
     } catch {
       throw new g(
         m.Connection,
@@ -1122,8 +1122,8 @@ class cr {
    *            if no error
    */
   async startAuthorizationCodeFlow(e, t = !1) {
-    var o, s, n;
-    if (c.logger.debug(d({ msg: "Starting authorization code flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.response_types_supported.includes("code")) || !((s = this.oidcConfig) != null && s.response_modes_supported.includes("query")))
+    var o, i, n;
+    if (d.logger.debug(h({ msg: "Starting authorization code flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.response_types_supported.includes("code")) || !((i = this.oidcConfig) != null && i.response_modes_supported.includes("query")))
       return {
         error: "invalid_request",
         error_description: "Server does not support authorization code flow"
@@ -1133,7 +1133,7 @@ class cr {
         error: "server_error",
         error_description: "Cannot get authorize endpoint"
       };
-    if (A(this, J, this.randomValue(this.stateLength)), !p(this, k)) return {
+    if (A(this, J, this.randomValue(this.stateLength)), !p(this, _)) return {
       error: "invalid_request",
       error_description: "Cannot make authorization code flow without client id"
     };
@@ -1141,8 +1141,8 @@ class cr {
       error: "invalid_request",
       error_description: "Cannot make authorization code flow without Redirect Uri"
     };
-    let i = this.oidcConfig.authorization_endpoint + "?response_type=code&client_id=" + encodeURIComponent(p(this, k)) + "&state=" + encodeURIComponent(p(this, J)) + "&redirect_uri=" + encodeURIComponent(this.redirect_uri);
-    return e && (i += "&scope=" + encodeURIComponent(e)), t && (A(this, F, this.randomValue(this.verifierLength)), A(this, q, this.codeChallengeMethod == "plain" ? p(this, F) : await this.sha256(p(this, F))), i += "&code_challenge=" + p(this, q)), { url: i };
+    let s = this.oidcConfig.authorization_endpoint + "?response_type=code&client_id=" + encodeURIComponent(p(this, _)) + "&state=" + encodeURIComponent(p(this, J)) + "&redirect_uri=" + encodeURIComponent(this.redirect_uri);
+    return e && (s += "&scope=" + encodeURIComponent(e)), t && (A(this, F, this.randomValue(this.verifierLength)), A(this, q, this.codeChallengeMethod == "plain" ? p(this, F) : await this.sha256(p(this, F))), s += "&code_challenge=" + p(this, q)), { url: s };
   }
   /**
    * This implements the functionality behind the redirect URI
@@ -1164,10 +1164,10 @@ class cr {
    * @returns The {@link OAuthTokenResponse} from the `token` endpoint
    *          request, or `error` and `error_description`.
    */
-  async redirectEndpoint(e, t, o, s) {
-    var n, i;
+  async redirectEndpoint(e, t, o, i) {
+    var n, s;
     if (this.oidcConfig || await this.loadConfig(), o || !e)
-      return o || (o = "server_error"), s || (s = "Unknown error"), { error: o, error_description: s };
+      return o || (o = "server_error"), i || (i = "Unknown error"), { error: o, error_description: i };
     if (p(this, J) && t != p(this, J))
       return { error: "access_denied", error_description: "State is not valid" };
     if (this.authzCode = e, !((n = this.oidcConfig) != null && n.grant_types_supported.includes("authorization_code")))
@@ -1175,24 +1175,25 @@ class cr {
         error: "invalid_request",
         error_description: "Server does not support authorization code grant"
       };
-    if (!((i = this.oidcConfig) != null && i.token_endpoint))
+    if (!((s = this.oidcConfig) != null && s.token_endpoint))
       return {
         error: "server_error",
         error_description: "Cannot get token endpoint"
       };
     const a = this.oidcConfig.token_endpoint;
-    let h, u;
-    h = "authorization_code", u = p(this, T);
+    let c, u;
+    c = "authorization_code", u = p(this, T);
     let y = {
-      grant_type: h,
-      client_id: p(this, k),
+      grant_type: c,
+      client_id: p(this, _),
       code: this.authzCode
     };
     u && (y.client_secret = u), y.code_verifier = p(this, F);
     try {
-      return this.post(a, y, this.authServerHeaders);
-    } catch (_) {
-      return c.logger.error(d({ err: _ })), {
+      const k = await this.post(a, y, this.authServerHeaders);
+      return k.id_token && !await this.validateIdToken(k.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : k;
+    } catch (k) {
+      return d.logger.error(h({ err: k })), {
         error: "server_error",
         error_description: "Unable to get access token from server"
       };
@@ -1214,28 +1215,28 @@ class cr {
    */
   async clientCredentialsFlow(e) {
     var t, o;
-    if (c.logger.debug(d({ msg: "Starting client credentials flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("client_credentials")))
+    if (d.logger.debug(h({ msg: "Starting client credentials flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("client_credentials")))
       return {
         error: "invalid_request",
         error_description: "Server does not support client credentials grant"
       };
     if (!((o = this.oidcConfig) != null && o.token_endpoint))
       return { error: "server_error", error_description: "Cannot get token endpoint" };
-    if (!p(this, k)) return {
+    if (!p(this, _)) return {
       error: "invalid_request",
       error_description: "Cannot make client credentials flow without client id"
     };
-    const s = this.oidcConfig.token_endpoint;
+    const i = this.oidcConfig.token_endpoint;
     let n = {
       grant_type: "client_credentials",
-      client_id: p(this, k),
+      client_id: p(this, _),
       client_secret: p(this, T)
     };
     e && (n.scope = e);
     try {
-      return await this.post(s, n, this.authServerHeaders);
-    } catch (i) {
-      return c.logger.error(d({ err: i })), {
+      return await this.post(i, n, this.authServerHeaders);
+    } catch (s) {
+      return d.logger.error(h({ err: s })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1257,8 +1258,8 @@ class cr {
    * 
    */
   async passwordFlow(e, t, o) {
-    var s, n;
-    if (c.logger.debug(d({ msg: "Starting password flow" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("password")))
+    var i, n;
+    if (d.logger.debug(h({ msg: "Starting password flow" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("password")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password grant"
@@ -1268,19 +1269,20 @@ class cr {
         error: "server_error",
         error_description: "Cannot get token endpoint"
       };
-    const i = this.oidcConfig.token_endpoint;
+    const s = this.oidcConfig.token_endpoint;
     let a = {
       grant_type: "password",
-      client_id: p(this, k),
+      client_id: p(this, _),
       client_secret: p(this, T),
       username: e,
       password: t
     };
     o && (a.scope = o);
     try {
-      return await this.post(i, a, this.authServerHeaders);
-    } catch (h) {
-      return c.logger.error(d({ err: h })), {
+      let c = await this.post(s, a, this.authServerHeaders);
+      return c.id_token && !await this.validateIdToken(c.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : c;
+    } catch (c) {
+      return d.logger.error(h({ err: c })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1300,23 +1302,23 @@ class cr {
    *     documentation
    */
   async mfaAuthenticators(e) {
-    var t, o, s;
-    if (c.logger.debug(d({ msg: "Getting valid MFA authenticators" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")) && (o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob"))
+    var t, o, i;
+    if (d.logger.debug(h({ msg: "Getting valid MFA authenticators" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")) && (o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob"))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((s = this.oidcConfig) != null && s.issuer))
+    if (!((i = this.oidcConfig) != null && i.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
-    const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/authenticators", i = await this.get(n, { authorization: "Bearer " + e, ...this.authServerHeaders });
-    if (!Array.isArray(i))
+    const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/authenticators", s = await this.get(n, { authorization: "Bearer " + e, ...this.authServerHeaders });
+    if (!Array.isArray(s))
       return {
         error: "server_error",
         error_description: "Expected array of authenticators in mfa/authenticators response"
       };
     let a = [];
-    for (let h = 0; h < i.length; ++h) {
-      const u = i[h];
+    for (let c = 0; c < s.length; ++c) {
+      const u = s[c];
       if (!u.id || !u.authenticator_type || !u.active)
         return {
           error: "server_error",
@@ -1345,25 +1347,25 @@ class cr {
    * from the `mfaAuthenticators` request.
    */
   async mfaOtpRequest(e, t) {
-    var o, s;
-    if (c.logger.debug(d({ msg: "Making MFA OTB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    var o, i;
+    if (d.logger.debug(h({ msg: "Making MFA OTB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((s = this.oidcConfig) != null && s.issuer))
+    if (!((i = this.oidcConfig) != null && i.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
-    const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", i = await this.post(n, {
-      client_id: p(this, k),
+    const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", s = await this.post(n, {
+      client_id: p(this, _),
       client_secret: p(this, T),
       challenge_type: "otp",
       mfa_token: e,
       authenticator_id: t
     }, this.authServerHeaders);
-    return i.challenge_type != "otp" ? {
-      error: i.error ?? "server_error",
-      error_description: i.error_description ?? "Invalid OTP challenge response"
-    } : i;
+    return s.challenge_type != "otp" ? {
+      error: s.error ?? "server_error",
+      error_description: s.error_description ?? "Invalid OTP challenge response"
+    } : s;
   }
   /**
    * Completes the Password MFA OTP flow.
@@ -1383,17 +1385,17 @@ class cr {
    *   - `error_description` friendly error message
    */
   async mfaOtpComplete(e, t, o) {
-    var s, n;
-    if (c.logger.debug(d({ msg: "Completing MFA OTP request" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    var i, n;
+    if (d.logger.debug(h({ msg: "Completing MFA OTP request" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
     if (!((n = this.oidcConfig) != null && n.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
-    const i = this.oidcConfig.token_endpoint, a = await this.post(i, {
+    const s = this.oidcConfig.token_endpoint, a = await this.post(s, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-otp",
-      client_id: p(this, k),
+      client_id: p(this, _),
       client_secret: p(this, T),
       challenge_type: "otp",
       mfa_token: e,
@@ -1430,27 +1432,27 @@ class cr {
    *   - `error_description` friendly error message
    */
   async mfaOobRequest(e, t) {
-    var o, s;
-    if (c.logger.debug(d({ msg: "Making MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    var o, i;
+    if (d.logger.debug(h({ msg: "Making MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((s = this.oidcConfig) != null && s.issuer))
+    if (!((i = this.oidcConfig) != null && i.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
-    const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", i = await this.post(n, {
-      client_id: p(this, k),
+    const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", s = await this.post(n, {
+      client_id: p(this, _),
       client_secret: p(this, T),
       challenge_type: "oob",
       mfa_token: e,
       authenticator_id: t
     }, this.authServerHeaders);
-    return i.challenge_type != "oob" || !i.oob_code || !i.binding_method ? { error: i.error ?? "server_error", error_description: i.error_description ?? "Invalid OOB challenge response" } : {
-      challenge_type: i.challenge_type,
-      oob_code: i.oob_code,
-      binding_method: i.binding_method,
-      error: i.error,
-      error_description: i.error_description
+    return s.challenge_type != "oob" || !s.oob_code || !s.binding_method ? { error: s.error ?? "server_error", error_description: s.error_description ?? "Invalid OOB challenge response" } : {
+      challenge_type: s.challenge_type,
+      oob_code: s.oob_code,
+      binding_method: s.binding_method,
+      error: s.error,
+      error_description: s.error_description
     };
   }
   /**
@@ -1464,42 +1466,42 @@ class cr {
    * @returns an {@link OAuthTokenResponse} object, which may contain
    *          an error instead of the response fields.
    */
-  async mfaOobComplete(e, t, o, s) {
-    var n, i;
-    if (c.logger.debug(d({ msg: "Completing MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((n = this.oidcConfig) != null && n.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
+  async mfaOobComplete(e, t, o, i) {
+    var n, s;
+    if (d.logger.debug(h({ msg: "Completing MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((n = this.oidcConfig) != null && n.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((i = this.oidcConfig) != null && i.issuer))
+    if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
-    const a = this.oidcConfig.token_endpoint, h = await this.post(a, {
+    const a = this.oidcConfig.token_endpoint, c = await this.post(a, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-oob",
-      client_id: p(this, k),
+      client_id: p(this, _),
       client_secret: p(this, T),
       challenge_type: "otp",
       mfa_token: e,
       oob_code: t,
       binding_code: o,
-      scope: s
+      scope: i
     }, this.authServerHeaders);
-    return h.error ? {
-      error: h.error,
-      error_description: h.error_description
-    } : {
-      id_token: h.id_token,
-      access_token: h.access_token,
-      refresh_token: h.refresh_token,
-      expires_in: "expires_in" in h ? Number(h.expires_in) : void 0,
-      scope: h.scope,
-      token_type: h.token_type
+    return c.error ? {
+      error: c.error,
+      error_description: c.error_description
+    } : c.id_token && !await this.validateIdToken(c.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : {
+      id_token: c.id_token,
+      access_token: c.access_token,
+      refresh_token: c.refresh_token,
+      expires_in: "expires_in" in c ? Number(c.expires_in) : void 0,
+      scope: c.scope,
+      token_type: c.token_type
     };
   }
   //////////////////////////////////////////////////////////////////////
   // Refresh Token Flow
   async refreshTokenFlow(e) {
     var t, o;
-    if (c.logger.debug(d({ msg: "Starting refresh token flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("refresh_token")))
+    if (d.logger.debug(h({ msg: "Starting refresh token flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("refresh_token")))
       return {
         error: "invalid_request",
         error_description: "Server does not support refresh_token grant"
@@ -1509,19 +1511,20 @@ class cr {
         error: "server_error",
         error_description: "Cannot get token endpoint"
       };
-    const s = this.oidcConfig.token_endpoint;
+    const i = this.oidcConfig.token_endpoint;
     let n;
     n = p(this, T);
-    let i = {
+    let s = {
       grant_type: "refresh_token",
       refresh_token: e,
-      client_id: p(this, k)
+      client_id: p(this, _)
     };
-    n && (i.client_secret = n);
+    n && (s.client_secret = n);
     try {
-      return await this.post(s, i, this.authServerHeaders);
+      let a = await this.post(i, s, this.authServerHeaders);
+      return a.id_token && !await this.validateIdToken(a.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : a;
     } catch (a) {
-      return c.logger.error(d({ err: a })), {
+      return d.logger.error(h({ err: a })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1537,21 +1540,22 @@ class cr {
    */
   async startDeviceCodeFlow(e, t) {
     var o;
-    if (c.logger.debug(d({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
+    if (d.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support device code grant"
       };
-    let s = {
+    let i = {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: p(this, k),
+      client_id: p(this, _),
       client_secret: p(this, T)
     };
-    t && (s.scope = t);
+    t && (i.scope = t);
     try {
-      return await this.post(e, s, this.authServerHeaders);
+      let n = await this.post(e, i, this.authServerHeaders);
+      return n.id_token && !await this.validateIdToken(n.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : n;
     } catch (n) {
-      return c.logger.error(d({ err: n })), {
+      return d.logger.error(h({ err: n })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1565,8 +1569,8 @@ class cr {
    * @returns See {@link OAuthDeviceResponse}
    */
   async pollDeviceCodeFlow(e) {
-    var t, o, s;
-    if (c.logger.debug(d({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
+    var t, o, i;
+    if (d.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support device code grant"
@@ -1578,15 +1582,15 @@ class cr {
       };
     let n = {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: p(this, k),
+      client_id: p(this, _),
       client_secret: p(this, T),
       device_code: e
     };
     try {
-      const i = await this.post((s = this.oidcConfig) == null ? void 0 : s.token_endpoint, n, this.authServerHeaders);
-      return i.error, i;
-    } catch (i) {
-      return c.logger.error(d({ err: i })), {
+      const s = await this.post((i = this.oidcConfig) == null ? void 0 : i.token_endpoint, n, this.authServerHeaders);
+      return s.error ? s : s.id_token && !await this.validateIdToken(s.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : s;
+    } catch (s) {
+      return d.logger.error(h({ err: s })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1601,15 +1605,15 @@ class cr {
    * @throws any exception raised by `fetch()`
    */
   async post(e, t, o = {}) {
-    c.logger.debug(d({
+    d.logger.debug(h({
       msg: "Fetch POST",
       url: e,
       params: Object.keys(t)
     }));
-    let s = {};
-    return this.authServerCredentials && (s.credentials = this.authServerCredentials), this.authServerMode && (s.mode = this.authServerMode), await (await fetch(e, {
+    let i = {};
+    return this.authServerCredentials && (i.credentials = this.authServerCredentials), this.authServerMode && (i.mode = this.authServerMode), await (await fetch(e, {
       method: "POST",
-      ...s,
+      ...i,
       headers: {
         Accept: "application/json",
         "Content-Type": "application/json",
@@ -1627,7 +1631,7 @@ class cr {
    * @throws any exception raised by `fetch()`
    */
   async get(e, t = {}) {
-    c.logger.debug(d({ msg: "Fetch GET", url: e }));
+    d.logger.debug(h({ msg: "Fetch GET", url: e }));
     let o = {};
     return this.authServerCredentials && (o.credentials = this.authServerCredentials), this.authServerMode && (o.mode = this.authServerMode), await (await fetch(e, {
       method: "GET",
@@ -1666,7 +1670,7 @@ class cr {
     try {
       return await this.tokenConsumer.tokenAuthorized(e, "id");
     } catch (t) {
-      c.logger.warn(d({ err: t }));
+      d.logger.warn(h({ err: t }));
       return;
     }
   }
@@ -1674,7 +1678,7 @@ class cr {
     return ar(e);
   }
 }
-k = /* @__PURE__ */ new WeakMap(), T = /* @__PURE__ */ new WeakMap(), q = /* @__PURE__ */ new WeakMap(), F = /* @__PURE__ */ new WeakMap(), J = /* @__PURE__ */ new WeakMap();
+_ = /* @__PURE__ */ new WeakMap(), T = /* @__PURE__ */ new WeakMap(), q = /* @__PURE__ */ new WeakMap(), F = /* @__PURE__ */ new WeakMap(), J = /* @__PURE__ */ new WeakMap();
 class dr {
   /**
    * Constrctor
@@ -1724,7 +1728,7 @@ class dr {
         await this.loadJwks();
       }
     } catch (e) {
-      throw c.logger.debug(d({ err: e })), new g(m.Connection, "Couldn't load keys");
+      throw d.logger.debug(h({ err: e })), new g(m.Connection, "Couldn't load keys");
     }
   }
   /**
@@ -1733,7 +1737,7 @@ class dr {
    * to `authServerBaseUrl` )
    * @param oidcConfig the configuration, or undefined to load it from
    *        the authorization server
-   * @throws a {@link @crossauth/common!CrossauthError} object with {@link @crossauth/common!ErrorCode} of
+   * @throws a {@link CrossauthError} object with {@link ErrorCode} of
    *   - `Connection` if the fetch to the authorization server failed.
    */
   async loadConfig(e) {
@@ -1747,15 +1751,15 @@ class dr {
     try {
       t = await fetch(new URL("/.well-known/openid-configuration", this.authServerBaseUrl));
     } catch (o) {
-      c.logger.error(d({ err: o }));
+      d.logger.error(h({ err: o }));
     }
     if (!t || !t.ok)
       throw new g(m.Connection, "Couldn't get OIDC configuration");
     this.oidcConfig = { ...ye };
     try {
       const o = await t.json();
-      for (const [s, n] of Object.entries(o))
-        this.oidcConfig[s] = n;
+      for (const [i, n] of Object.entries(o))
+        this.oidcConfig[i] = n;
     } catch {
       throw new g(m.Connection, "Unrecognized response from OIDC configuration endpoint");
     }
@@ -1765,7 +1769,7 @@ class dr {
    * authorization server (using the URL in the OIDC configuration).
    * @param jwks the keys to load, or undefined to fetch them from
    *        the authorization server.
-   * @throws a {@link @crossauth/common!CrossauthError} object with {@link @crossauth/common!ErrorCode} of
+   * @throws a {@link CrossauthError} object with {@link ErrorCode} of
    *   - `Connection` if the fetch to the authorization server failed,
    *     the OIDC configuration wasn't set or the keys could not be parsed.
    */
@@ -1783,7 +1787,7 @@ class dr {
       try {
         t = await fetch(new URL(this.oidcConfig.jwks_uri));
       } catch (o) {
-        c.logger.error(d({ err: o }));
+        d.logger.error(h({ err: o }));
       }
       if (!t || !t.ok)
         throw new g(m.Connection, "Couldn't get OIDC configuration");
@@ -1792,17 +1796,17 @@ class dr {
         const o = await t.json();
         if (!("keys" in o) || !Array.isArray(o.keys))
           throw new g(m.Connection, "Couldn't fetch keys");
-        for (let s = 0; s < o.keys.length; ++s)
+        for (let i = 0; i < o.keys.length; ++i)
           try {
             let n = "_default";
-            "kid" in o.keys[s] && typeof o.keys[s] == "string" && (n = String(o.keys[s]));
-            const i = await ue(o.keys[s]);
-            this.keys[n] = i;
+            "kid" in o.keys[i] && typeof o.keys[i] == "string" && (n = String(o.keys[i]));
+            const s = await ue(o.keys[i]);
+            this.keys[n] = s;
           } catch (n) {
-            throw c.logger.error(d({ err: n })), new g(m.Connection, "Couldn't load keys");
+            throw d.logger.error(h({ err: n })), new g(m.Connection, "Couldn't load keys");
           }
       } catch (o) {
-        throw c.logger.error(d({ err: o })), new g(m.Connection, "Unrecognized response from OIDC jwks endpoint");
+        throw d.logger.error(h({ err: o })), new g(m.Connection, "Unrecognized response from OIDC jwks endpoint");
       }
     }
   }
@@ -1821,46 +1825,50 @@ class dr {
     (!this.keys || Object.keys(this.keys).length == 0) && await this.loadKeys();
     const o = await this.validateToken(e);
     if (o) {
-      if (o.type != t && c.logger.error(d({ msg: t + " expected but got " + o.type })), o.iss != this.authServerBaseUrl) {
-        c.logger.error(d({ msg: `Invalid issuer ${o.iss} in access token`, hashedAccessToken: await this.hash(o.jti) }));
+      if (o.type != t) {
+        d.logger.error(h({ msg: t + " expected but got " + o.type }));
+        return;
+      }
+      if (o.iss != this.authServerBaseUrl) {
+        d.logger.error(h({ msg: `Invalid issuer ${o.iss} in access token`, hashedAccessToken: await this.hash(o.jti) }));
         return;
       }
       if (o.aud && (Array.isArray(o.aud) && !o.aud.includes(this.audience) || !Array.isArray(o.aud) && o.aud != this.audience)) {
-        c.logger.error(d({ msg: `Invalid audience ${o.aud} in access token`, hashedAccessToken: await this.hash(o.jti) }));
+        d.logger.error(h({ msg: `Invalid audience ${o.aud} in access token`, hashedAccessToken: await this.hash(o.jti) }));
         return;
       }
       return o;
     }
   }
   async validateToken(e) {
-    (!this.keys || Object.keys(this.keys).length == 0) && c.logger.warn("No keys loaded so cannot validate tokens");
+    (!this.keys || Object.keys(this.keys).length == 0) && d.logger.warn("No keys loaded so cannot validate tokens");
     let t;
     try {
       t = nr(e).kid;
     } catch {
-      c.logger.warn(d({ msg: "Invalid access token format" }));
+      d.logger.warn(h({ msg: "Invalid access token format" }));
       return;
     }
     let o;
     "_default" in this.keys && (o = this.keys._default);
-    for (let s in this.keys)
-      if (t == s) {
-        o = this.keys[s];
+    for (let i in this.keys)
+      if (t == i) {
+        o = this.keys[i];
         break;
       }
     if (!o) {
-      c.logger.warn(d({ msg: "No matching keys found for access token" }));
+      d.logger.warn(h({ msg: "No matching keys found for access token" }));
       return;
     }
     try {
-      const { payload: s } = await ir(e, o), n = JSON.parse(new TextDecoder().decode(s));
+      const { payload: i } = await sr(e, o), n = JSON.parse(new TextDecoder().decode(i));
       if (n.exp * 1e3 < Date.now() + this.clockTolerance) {
-        c.logger.warn(d({ msg: "Access token has expired" }));
+        d.logger.warn(h({ msg: "Access token has expired" }));
         return;
       }
       return n;
     } catch {
-      c.logger.warn(d({ msg: "Access token did not validate" }));
+      d.logger.warn(h({ msg: "Access token did not validate" }));
       return;
     }
   }
@@ -1890,43 +1898,43 @@ class Ae {
     this.tokenProvider = e.tokenProvider, this.autoRefreshUrl = e.autoRefreshUrl, e.csrfHeader && (this.csrfHeader = e.csrfHeader), e.headers && (this.headers = e.headers), e.mode && (this.mode = e.mode), e.credentials && (this.credentials = e.credentials);
   }
   async startAutoRefresh(e = ["access", "id"], t) {
-    this.autoRefreshActive || (this.autoRefreshActive = !0, c.logger.debug(d({ msg: "Starting auto refresh" })), await this.scheduleAutoRefresh(e, t));
+    this.autoRefreshActive || (this.autoRefreshActive = !0, d.logger.debug(h({ msg: "Starting auto refresh" })), await this.scheduleAutoRefresh(e, t));
   }
   stopAutoRefresh() {
-    this.autoRefreshActive = !1, c.logger.debug(d({ msg: "Stopping auto refresh" }));
+    this.autoRefreshActive = !1, d.logger.debug(h({ msg: "Stopping auto refresh" }));
   }
   async scheduleAutoRefresh(e, t) {
-    const o = this.tokenProvider.getCsrfToken(), s = o ? await o : void 0, n = await this.tokenProvider.getTokenExpiries([...e, "refresh"], s);
+    const o = this.tokenProvider.getCsrfToken(), i = o ? await o : void 0, n = await this.tokenProvider.getTokenExpiries([...e, "refresh"], i);
     if (n.refresh == null) {
-      c.logger.debug(d({ msg: "No refresh token found" }));
+      d.logger.debug(h({ msg: "No refresh token found" }));
       return;
     }
-    const i = Date.now();
+    const s = Date.now();
     let a = n.id;
     if ((!a || n.access && n.access < a) && (a = n.access), !a) {
-      c.logger.debug(d({ msg: "No tokens expire" }));
+      d.logger.debug(h({ msg: "No tokens expire" }));
       return;
     }
-    const h = a * 1e3 - i - fe;
-    if (h < 0) {
-      c.logger.debug(d({ msg: "Expiry time has passed" }));
+    const c = a * 1e3 - s - fe;
+    if (c < 0) {
+      d.logger.debug(h({ msg: "Expiry time has passed" }));
       return;
     }
-    if (n.refresh && n.refresh - fe < h) {
-      c.logger.debug(d({ msg: "Refresh token has expired" }));
+    if (n.refresh && n.refresh - fe < c) {
+      d.logger.debug(h({ msg: "Refresh token has expired" }));
       return;
     }
-    let u = (y) => new Promise((_) => setTimeout(_, y));
-    c.logger.debug(d({ msg: `Waiting ${h} before refreshing tokens` })), await u(h), await this.autoRefresh(e, s, t);
+    let u = (y) => new Promise((k) => setTimeout(k, y));
+    d.logger.debug(h({ msg: `Waiting ${c} before refreshing tokens` })), await u(c), await this.autoRefresh(e, i, t);
   }
   async autoRefresh(e, t, o) {
     if (this.autoRefreshActive) {
-      let s, n = !1, i = 0;
-      for (; !n && i <= Z; )
+      let i, n = !1, s = 0;
+      for (; !n && s <= Z; )
         try {
           let a = { ...this.headers };
-          t && (a[this.csrfHeader] = t), c.logger.debug(d({ msg: "Initiating auto refresh" }));
-          const h = await this.tokenProvider.jsonFetchWithToken(
+          t && (a[this.csrfHeader] = t), d.logger.debug(h({ msg: "Initiating auto refresh" }));
+          const c = await this.tokenProvider.jsonFetchWithToken(
             this.autoRefreshUrl,
             {
               method: "POST",
@@ -1943,19 +1951,19 @@ class Ae {
             },
             "refresh"
           );
-          if (h.ok || c.logger.error(d({ msg: "Failed auto refreshing tokens", status: h.status })), s = await h.json(), s != null && s.ok) {
+          if (c.ok || d.logger.error(h({ msg: "Failed auto refreshing tokens", status: c.status })), i = await c.json(), i != null && i.ok) {
             await this.scheduleAutoRefresh(e, o), n = !0;
             try {
-              await this.tokenProvider.receiveTokens(s);
+              await this.tokenProvider.receiveTokens(i);
             } catch (u) {
               const y = g.asCrossauthError(u);
-              o ? o("Couldn't receive tokens", y) : (c.logger.debug(d({ err: u })), c.logger.error(d({ msg: "Error receiving tokens", cerr: y })));
+              o ? o("Couldn't receive tokens", y) : (d.logger.debug(h({ err: u })), d.logger.error(h({ msg: "Error receiving tokens", cerr: y })));
             }
           } else
-            i < Z ? (c.logger.error(d({ msg: `Failed auto refreshing tokens.  Retrying in ${ae} seconds` })), await ((y) => new Promise((_) => setTimeout(_, y)))(ae * 1e3)) : (c.logger.error(d({ msg: "Failed auto refreshing tokens.  Number of retries exceeded" })), o && o("Failed auto refreshing tokens")), i++;
+            s < Z ? (d.logger.error(h({ msg: `Failed auto refreshing tokens.  Retrying in ${ae} seconds` })), await ((y) => new Promise((k) => setTimeout(k, y)))(ae * 1e3)) : (d.logger.error(h({ msg: "Failed auto refreshing tokens.  Number of retries exceeded" })), o && o("Failed auto refreshing tokens")), s++;
         } catch (a) {
-          const h = g.asCrossauthError(a);
-          c.logger.debug(d({ err: h })), i < Z ? (c.logger.error(d({ msg: `Failed auto refreshing tokens.  Retrying in ${Z} seconds` })), await ((y) => new Promise((_) => setTimeout(_, y)))(ae)) : (c.logger.error(d({ msg: "Failed auto refreshing tokens.  Number of retries exceeded" })), o && o(h.message, h)), i++;
+          const c = g.asCrossauthError(a);
+          d.logger.debug(h({ err: c })), s < Z ? (d.logger.error(h({ msg: `Failed auto refreshing tokens.  Retrying in ${Z} seconds` })), await ((y) => new Promise((k) => setTimeout(k, y)))(ae)) : (d.logger.error(h({ msg: "Failed auto refreshing tokens.  Number of retries exceeded" })), o && o(c.message, c)), s++;
         }
     }
   }
@@ -1981,29 +1989,29 @@ class Pe {
     this.oauthClient = e.oauthClient, e.deviceCodePollUrl != null && (this.deviceCodePollUrl = e.deviceCodePollUrl), e.headers && (this.headers = e.headers), e.mode && (this.mode = e.mode), e.credentials && (this.credentials = e.credentials);
   }
   async startPolling(e, t, o = 5) {
-    this.pollingActive || (this.pollingActive = !0, c.logger.debug(d({ msg: "Starting auto refresh" })), await this.poll(e, o, t));
+    this.pollingActive || (this.pollingActive = !0, d.logger.debug(h({ msg: "Starting auto refresh" })), await this.poll(e, o, t));
   }
   stopPolling() {
-    this.pollingActive = !1, c.logger.debug(d({ msg: "Stopping auto refresh" }));
+    this.pollingActive = !1, d.logger.debug(h({ msg: "Stopping auto refresh" }));
   }
   async poll(e, t, o) {
-    var s;
+    var i;
     if (!e)
-      c.logger.debug(d({ msg: "device code poll: no device code provided" })), o("error", "Error waiting for authorization");
+      d.logger.debug(h({ msg: "device code poll: no device code provided" })), o("error", "Error waiting for authorization");
     else
       try {
-        if (c.logger.debug(d({ msg: "device code poll: poll" })), !this.deviceCodePollUrl && this.oauthClient) {
-          if (this.oauthClient.getOidcConfig() || await this.oauthClient.loadConfig(), !((s = this.oauthClient.getOidcConfig()) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
+        if (d.logger.debug(h({ msg: "device code poll: poll" })), !this.deviceCodePollUrl && this.oauthClient) {
+          if (this.oauthClient.getOidcConfig() || await this.oauthClient.loadConfig(), !((i = this.oauthClient.getOidcConfig()) != null && i.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
             return {
               error: "invalid_request",
               error_description: "Server does not support password_mfa grant"
             };
-          let i = this.oauthClient.getOidcConfig();
-          if (!(i != null && i.token_endpoint)) return {
+          let s = this.oauthClient.getOidcConfig();
+          if (!(s != null && s.token_endpoint)) return {
             error: "server_error",
             error_description: "Couldn't get OIDC configuration"
           };
-          this.deviceCodePollUrl = i.token_endpoint;
+          this.deviceCodePollUrl = s.token_endpoint;
         }
         if (!this.deviceCodePollUrl)
           return {
@@ -2020,19 +2028,19 @@ class Pe {
         else if (!n.ok)
           this.pollingActive = !1, o("error", "Received an error from the authorization server");
         else {
-          const i = await n.json();
-          if (c.logger.debug(d({ msg: "device code poll: received" + JSON.stringify(i) })), i.error == "expired_token")
+          const s = await n.json();
+          if (d.logger.debug(h({ msg: "device code poll: received" + JSON.stringify(s) })), s.error == "expired_token")
             this.pollingActive = !1, o("expired_token", "Timeout waiting for authorization");
-          else if (i.error == "authorization_pending" || i.error == "slow_down") {
-            i.error == "slow_down" && (t += 5);
-            let a = i.interval ?? t, h = (u) => new Promise((y) => setTimeout(y, u));
-            c.logger.debug(d({ msg: "device code poll: waiting " + String(a) + " seconds" })), await h(a * 1e3), this.pollingActive && this.poll(e, t, o);
-          } else i.error ? (this.pollingActive = !1, o("error", i.error_description ?? i.error)) : (this.pollingActive = !1, o("complete"));
+          else if (s.error == "authorization_pending" || s.error == "slow_down") {
+            s.error == "slow_down" && (t += 5);
+            let a = s.interval ?? t, c = (u) => new Promise((y) => setTimeout(y, u));
+            d.logger.debug(h({ msg: "device code poll: waiting " + String(a) + " seconds" })), await c(a * 1e3), this.pollingActive && this.poll(e, t, o);
+          } else s.error ? (this.pollingActive = !1, o("error", s.error_description ?? s.error)) : (this.pollingActive = !1, o("complete"));
         }
       } catch (n) {
         this.pollingActive = !1;
-        const i = g.asCrossauthError(n);
-        c.logger.debug(d({ err: i })), c.logger.error(d({ msg: "Polling failed", cerr: i })), o("error", i.message);
+        const s = g.asCrossauthError(n);
+        d.logger.debug(h({ err: s })), d.logger.error(h({ msg: "Polling failed", cerr: s })), o("error", s.message);
       }
   }
 }
@@ -2100,7 +2108,7 @@ class ur {
    * This only returns something if the ID token was returned to the BFF
    * client in a previous OAuth call.  Otherwise it returns an empty JSON.
    * 
-   * @param crfToken the CSRF token.  If emtpy, one will be fetched before
+   * @param csrfToken the CSRF token.  If emtpy, one will be fetched before
    *        making the request
    * @returns the ID token payload or an empty object if there isn't one
    */
@@ -2112,7 +2120,7 @@ class ur {
    * Returns whether or not there is an ID token stored in the BFF server
    * for this client.
    * 
-   * @param crfToken the CSRF token.  If emtpy, one will be fetched before
+   * @param csrfToken the CSRF token.  If emtpy, one will be fetched before
    *        making the request
    * @returns true or false
    */
@@ -2126,10 +2134,8 @@ class ur {
    * This only returns something if the access token was returned to the BFF
    * client in a previous OAuth call.  Otherwise it returns an empty JSON.
    * 
-   * @param crfToken the CSRF token.  If emtpy, one will be fetched before
+   * @param csrfToken the CSRF token.  If emtpy, one will be fetched before
    *        making the request
-   * @param headers any additional headers to add (will be added to
-   *         the ones given with {@link OAuthBffClient.addHeader} )
    * @returns the access token payload or an empty object if there isn't one
    */
   async getAccessToken(e) {
@@ -2140,7 +2146,7 @@ class ur {
    * Returns whether or not there is an access token stored in the BFF server
    * for this client.
    * 
-   * @param crfToken the CSRF token.  If emtpy, one will be fetched before
+   * @param csrfToken the CSRF token.  If emtpy, one will be fetched before
    *        making the request
    * @returns true or false
    */
@@ -2154,7 +2160,7 @@ class ur {
    * This only returns something if the refresh token was returned to the BFF
    * client in a previous OAuth call.  Otherwise it returns an empty JSON.
    * 
-   * @param crfToken the CSRF token.  If emtpy, one will be fetched before
+   * @param csrfToken the CSRF token.  If emtpy, one will be fetched before
    *        making the request
    * @returns the refresh token payload or an empty object if there isn't one
    */
@@ -2166,7 +2172,7 @@ class ur {
    * Returns whether or not there is a refresh token stored in the BFF server
    * for this client.
    * 
-   * @param crfToken the CSRF token.  If emtpy, one will be fetched before
+   * @param csrfToken the CSRF token.  If emtpy, one will be fetched before
    *        making the request
    * @returns true or false
    */
@@ -2182,11 +2188,11 @@ class ur {
    * @param csrfToken : the CSRF token
    * @returns the HTTP status code and the body or null
    */
-  async api(e, t, o, s) {
+  async api(e, t, o, i) {
     let n = { ...this.headers };
-    !s && !["GET", "HEAD", "OPTIONS"].includes(e) && (s = await this.getCsrfToken(), s && (n[this.csrfHeader] = s)), t.startsWith("/") && (t = t.substring(1));
-    let i = {};
-    o && (i.body = JSON.stringify(o));
+    !i && !["GET", "HEAD", "OPTIONS"].includes(e) && (i = await this.getCsrfToken(), i && (n[this.csrfHeader] = i)), t.startsWith("/") && (t = t.substring(1));
+    let s = {};
+    o && (s.body = JSON.stringify(o));
     const a = await fetch(
       this.bffPrefix + t,
       {
@@ -2194,11 +2200,11 @@ class ur {
         method: e,
         mode: this.mode,
         credentials: this.credentials,
-        ...i
+        ...s
       }
     );
-    let h = null;
-    return a.body && (h = await a.json()), { status: a.status, body: h };
+    let c = null;
+    return a.body && (c = await a.json()), { status: a.status, body: c };
   }
   /**
    * Return all tokens that the client has been enabled to return.
@@ -2244,8 +2250,8 @@ class ur {
   }
   /**
    * Turns polling for a device code
-   * @param tokensToFetch which tokens to fetch
-   * @param errorFn what to call in case of error
+   * @param deviceCode the device code to poll for (returned when the device code flow was started)
+   * @param pollResultFn THis function will be called with the result of each poll
    */
   async startDeviceCodePolling(e, t, o = 5) {
     return this.deviceCodePoller.startPolling(e, t, o);
@@ -2260,18 +2266,18 @@ class ur {
   // OAuthTokenProvider interface
   /**
    * Fetches the expiry times for each token.
-   * @param crfToken the CSRF token.  If emtpy
+   * @param csrfToken the CSRF token.  If emtpy
    * , one will be fetched before
    *        making the request
    * @returns for each token, either the expiry, `null` if it does not
    *          expire, or `undefined` if the token does not exist
    */
   async getTokenExpiries(e, t) {
-    const o = await this.getTokens(t), s = e.includes("id") ? (o == null ? void 0 : o.id_token) ?? null : null, n = e.includes("access") ? (o == null ? void 0 : o.access_token) ?? null : null, i = e.includes("refresh") ? (o == null ? void 0 : o.refresh_token) ?? null : null;
-    let a, h, u;
-    return s && (a = s.exp ? s.exp : null), n && (h = n.exp ? n.exp : null), i && (u = i.exp ? i.exp : null), {
+    const o = await this.getTokens(t), i = e.includes("id") ? (o == null ? void 0 : o.id_token) ?? null : null, n = e.includes("access") ? (o == null ? void 0 : o.access_token) ?? null : null, s = e.includes("refresh") ? (o == null ? void 0 : o.refresh_token) ?? null : null;
+    let a, c, u;
+    return i && (a = i.exp ? i.exp : null), n && (c = n.exp ? n.exp : null), s && (u = s.exp ? s.exp : null), {
       id: a,
-      access: h,
+      access: c,
       refresh: u
     };
   }
@@ -2279,7 +2285,7 @@ class ur {
    * Makes a fetch, adding in the requested token
    * @param url the URL to fetch
    * @param params parameters to add to the fetch
-   * @param token which token to add
+   * @param _token unused
    * @returns parsed JSON response
    */
   async jsonFetchWithToken(e, t, o) {
@@ -2290,6 +2296,17 @@ class ur {
     });
   }
 }
+class fr {
+  /**
+   * Gets a CSRF token from the server
+   * @returns the CSRF token that can be included in
+   *          the `X-CROSSAUTH-CSRF` header
+   */
+  getCsrfToken() {
+    return new Promise((e) => {
+    });
+  }
+}
 class hr extends dr {
   /**
    * SHA256 and Base64-url-encodes the given test
@@ -2297,12 +2314,12 @@ class hr extends dr {
    * @returns the SHA256 hash, Base64-url-encode
    */
   async hash(e) {
-    const o = new TextEncoder().encode(e), s = await crypto.subtle.digest("SHA-256", o), n = Array.from(new Uint8Array(s));
-    return btoa(n.reduce((i, a) => i + String.fromCharCode(a), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
+    const o = new TextEncoder().encode(e), i = await crypto.subtle.digest("SHA-256", o), n = Array.from(new Uint8Array(i));
+    return btoa(n.reduce((s, a) => s + String.fromCharCode(a), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
   }
 }
-var j, O, R, K, z, B, L;
-class fr extends cr {
+var j, O, R, K, D, B, L;
+class gr extends cr {
   /**
    * Constructor
    * 
@@ -2341,7 +2358,7 @@ class fr extends cr {
    *   - `deviceAuthorization` URL, relative to the authorization server base, 
    *      for starting the device code flow.  Default `device_authorization`
    *      Default is `/devicecodepoll`
-   *  For other options see {@link @crossauth/common/OAuthClientBase}.
+   *  For other options see {@link OAuthClientBase}.
    */
   constructor(t) {
     t.tokenConsumer || (t.tokenConsumer = new hr(
@@ -2365,7 +2382,7 @@ class fr extends cr {
     N(this, O);
     N(this, R);
     N(this, K);
-    N(this, z);
+    N(this, D);
     N(this, B);
     N(this, L);
     f(this, "autoRefresher");
@@ -2376,34 +2393,34 @@ class fr extends cr {
       autoRefreshUrl: this.authServerBaseUrl + "/token",
       tokenProvider: this
     }), this.deviceCodePoller = new Pe({ ...t, oauthClient: this, deviceCodePollUrl: null });
-    let o, s, n;
-    if (this.idTokenResponseType == "sessionStorage" ? o = sessionStorage.getItem(this.idTokenName) : this.idTokenResponseType == "localStorage" && (o = localStorage.getItem(this.idTokenName)), this.accessTokenResponseType == "sessionStorage" ? s = sessionStorage.getItem(this.accessTokenName) : this.accessTokenResponseType == "localStorage" && (s = localStorage.getItem(this.accessTokenName)), this.refreshTokenResponseType == "sessionStorage" ? n = sessionStorage.getItem(this.refreshTokenName) : this.refreshTokenResponseType == "localStorage" && (n = localStorage.getItem(this.refreshTokenName)), this.receiveTokens({
-      access_token: s,
+    let o, i, n;
+    if (this.idTokenResponseType == "sessionStorage" ? o = sessionStorage.getItem(this.idTokenName) : this.idTokenResponseType == "localStorage" && (o = localStorage.getItem(this.idTokenName)), this.accessTokenResponseType == "sessionStorage" ? i = sessionStorage.getItem(this.accessTokenName) : this.accessTokenResponseType == "localStorage" && (i = localStorage.getItem(this.accessTokenName)), this.refreshTokenResponseType == "sessionStorage" ? n = sessionStorage.getItem(this.refreshTokenName) : this.refreshTokenResponseType == "localStorage" && (n = localStorage.getItem(this.refreshTokenName)), this.receiveTokens({
+      access_token: i,
       id_token: o,
       refresh_token: n
-    }), s) {
-      const i = this.getTokenPayload(s);
-      i && (b(this, j, s), b(this, K, i));
+    }), i) {
+      const s = this.getTokenPayload(i);
+      s && (b(this, j, i), b(this, K, s));
     }
     if (n) {
-      const i = this.getTokenPayload(n);
-      i && (b(this, O, n), b(this, z, i));
+      const s = this.getTokenPayload(n);
+      s && (b(this, O, n), b(this, D, s));
     }
-    o ? this.validateIdToken(o).then((i) => {
-      b(this, R, i), t.autoRefresh && this.startAutoRefresh(t.autoRefresh).then().catch((a) => {
-        c.logger.debug(d({ err: a, msg: "Couldn't start auto refresh" }));
+    o ? this.validateIdToken(o).then((s) => {
+      b(this, R, s), t.autoRefresh && this.startAutoRefresh(t.autoRefresh).then().catch((a) => {
+        d.logger.debug(h({ err: a, msg: "Couldn't start auto refresh" }));
       });
-    }).catch((i) => {
-      c.logger.debug(d({ err: i, msg: "Couldn't validate ID token" }));
-    }) : w(this, j) && t.autoRefresh && n ? this.startAutoRefresh(t.autoRefresh).then().catch((i) => {
-      c.logger.debug(d({ err: i, msg: "Couldn't start auto refresh" }));
-    }) : n && !s && this.refreshTokenFlow(n).then((i) => {
-      c.logger.debug(d({ msg: "Refreshed tokens" })), t.autoRefresh && this.startAutoRefresh(t.autoRefresh).then().catch((a) => {
-        c.logger.debug(d({ err: a, msg: "Couldn't start auto refresh" }));
+    }).catch((s) => {
+      d.logger.debug(h({ err: s, msg: "Couldn't validate ID token" }));
+    }) : w(this, j) && t.autoRefresh && n ? this.startAutoRefresh(t.autoRefresh).then().catch((s) => {
+      d.logger.debug(h({ err: s, msg: "Couldn't start auto refresh" }));
+    }) : n && !i && this.refreshTokenFlow(n).then((s) => {
+      d.logger.debug(h({ msg: "Refreshed tokens" })), t.autoRefresh && this.startAutoRefresh(t.autoRefresh).then().catch((a) => {
+        d.logger.debug(h({ err: a, msg: "Couldn't start auto refresh" }));
       });
-    }).catch((i) => {
-      const a = g.asCrossauthError(i);
-      c.logger.debug(d({ err: a })), c.logger.error(d({ msg: "failed refreshing tokens", cerr: a }));
+    }).catch((s) => {
+      const a = g.asCrossauthError(s);
+      d.logger.debug(h({ err: a })), d.logger.error(h({ msg: "failed refreshing tokens", cerr: a }));
     });
   }
   get idTokenPayload() {
@@ -2426,34 +2443,29 @@ class fr extends cr {
    * endpoint is called.  Depending on whether that returned an error,
    * either `receiveTokenFn` or `errorFn` will be called.
    * 
-   * @param receiveTokenFn if defined, called if a token is returned.
-   *        
-   * @param errorFn if defined, called if any OAuth endpoint returned `error`, 
-   *        or if the `state` was not correct.
-   * 
-   * @returns the result of `receiveTokenFn`, `errorFn` or `undefined`.  If
-   *          `receiveTokenFn`/`errorFn` is not defined, rather than calling
-   *          it, this function just returns the OAuth response.
+   * @returns the result of `receiveTokenFn` or undefined if there was
+   *          neither a code in the URL search params nor an error `undefined`.  If
+   * @throws CrossauthError if an `error` was passed in the URL search params
    *       
    */
   async handleRedirectUri() {
     const t = new URL(window.location.href);
     if (t.origin + t.pathname != this.redirect_uri) return;
     const o = new URLSearchParams(window.location.search);
-    let s, n, i, a;
+    let i, n, s, a;
     for (const [u, y] of o)
-      u == "code" && (s = y), u == "state" && (n = y), u == "error" && (i = y), u == "error_description" && (a = y);
-    if (!i && !s) return;
-    if (i) {
-      const u = g.fromOAuthError(i, a);
-      throw c.logger.debug(d({ err: u })), c.logger.error(d({ cerr: u, msg: "Error from authorize endpoint: " + i })), u;
+      u == "code" && (i = y), u == "state" && (n = y), u == "error" && (s = y), u == "error_description" && (a = y);
+    if (!s && !i) return;
+    if (s) {
+      const u = g.fromOAuthError(s, a);
+      throw d.logger.debug(h({ err: u })), d.logger.error(h({ cerr: u, msg: "Error from authorize endpoint: " + s })), u;
     }
-    const h = await this.redirectEndpoint(s, n, i, a);
-    if (h.error) {
-      const u = g.fromOAuthError(h.error, a);
-      throw c.logger.debug(d({ err: u })), c.logger.error(d({ cerr: u, msg: "Error from redirect endpoint: " + h.error })), u;
+    const c = await this.redirectEndpoint(i, n, s, a);
+    if (c.error) {
+      const u = g.fromOAuthError(c.error, a);
+      throw d.logger.debug(h({ err: u })), d.logger.error(h({ cerr: u, msg: "Error from redirect endpoint: " + c.error })), u;
     }
-    return await this.receiveTokens(h), h;
+    return await this.receiveTokens(c), c;
   }
   /**
    * Turns auto refresh of tokens on
@@ -2471,11 +2483,11 @@ class fr extends cr {
   }
   /**
    * Turns polling for a device code
-   * @param tokensToFetch which tokens to fetch
-   * @param errorFn what to call in case of error
+   * @param deviceCode the device code to poll for (this was returned when the device code flow was started)
+   * @param pollResultFn called with the result of each poll
    */
-  async startDeviceCodePolling(t, o, s = 5) {
-    return this.deviceCodePoller.startPolling(t, o, s);
+  async startDeviceCodePolling(t, o, i = 5) {
+    return this.deviceCodePoller.startPolling(t, o, i);
   }
   /**
    * Turns off polling for a device code
@@ -2504,7 +2516,7 @@ class fr extends cr {
    */
   randomValue(t) {
     const o = new Uint8Array(t);
-    return self.crypto.getRandomValues(o), btoa(o.reduce((s, n) => s + String.fromCharCode(n), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
+    return self.crypto.getRandomValues(o), btoa(o.reduce((i, n) => i + String.fromCharCode(n), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
   }
   /**
    * SHA256 and Base64-url-encodes the given test
@@ -2512,8 +2524,8 @@ class fr extends cr {
    * @returns the SHA256 hash, Base64-url-encode
    */
   async sha256(t) {
-    const s = new TextEncoder().encode(t), n = await crypto.subtle.digest("SHA-256", s), i = Array.from(new Uint8Array(n));
-    return btoa(i.reduce((a, h) => a + String.fromCharCode(h), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
+    const i = new TextEncoder().encode(t), n = await crypto.subtle.digest("SHA-256", i), s = Array.from(new Uint8Array(n));
+    return btoa(s.reduce((a, c) => a + String.fromCharCode(c), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
   }
   /**
    * Calls an API endpoint on the resource server
@@ -2522,42 +2534,41 @@ class fr extends cr {
    * @param body : the body to pass to the call
    * @returns the HTTP status code and the body or null
    */
-  async api(t, o, s) {
+  async api(t, o, i) {
     let n = { ...this.resServerHeaders };
     o.startsWith("/") && (o = o.substring(1));
-    let i = {};
-    s && (i.body = JSON.stringify(s));
+    let s = {};
+    i && (s.body = JSON.stringify(i));
     let a;
     this.accessTokenResponseType == "sessionStorage" ? a = sessionStorage.getItem(this.accessTokenName) : this.accessTokenResponseType == "localStorage" && (a = localStorage.getItem(this.accessTokenName)), n.authorization = "Bearer " + a;
-    const h = await fetch(
+    const c = await fetch(
       this.resServerBaseUrl + o,
       {
         headers: n,
         method: t,
         mode: this.resServerMode,
         credentials: this.resServerCredentials,
-        ...i
+        ...s
       }
     );
     let u = null;
-    return h.body && (u = await h.json()), { status: h.status, body: u };
+    return c.body && (u = await c.json()), { status: c.status, body: u };
   }
   ///////////////////////////////////////////////////////////
   // OAuthTokenProvider interface
   /**
    * Fetches the expiry times for each token.
-   * @param crfToken the CSRF token.  If emtpy
-   * , one will be fetched before
-   *        making the request
+   * @param _tokensToFetch unused
+   * @param _csrfToken unused
    * @returns for each token, either the expiry, `null` if it does not
    *          expire, or `undefined` if the token does not exist
    */
   async getTokenExpiries(t, o) {
-    let s, n, i;
-    return w(this, R) && (s = w(this, R).exp ? w(this, R).exp : null), w(this, K) && (n = w(this, K).exp ? w(this, K).exp : null), w(this, z) && (i = w(this, z).exp ? w(this, z).exp : null), {
-      id: s,
+    let i, n, s;
+    return w(this, R) && (i = w(this, R).exp ? w(this, R).exp : null), w(this, K) && (n = w(this, K).exp ? w(this, K).exp : null), w(this, D) && (s = w(this, D).exp ? w(this, D).exp : null), {
+      id: i,
       access: n,
-      refresh: i
+      refresh: s
     };
   }
   /**
@@ -2570,8 +2581,8 @@ class fr extends cr {
    * @param token which token to add
    * @returns parsed JSON response
    */
-  async jsonFetchWithToken(t, o, s) {
-    if (s == "access") {
+  async jsonFetchWithToken(t, o, i) {
+    if (i == "access") {
       if (!w(this, j))
         throw new g(m.InvalidToken, "Cannot make fetch with access token - no access token defined");
       o.headers || (o.headers = {}), o.headers.authorization = "Bearer " + w(this, j);
@@ -2595,7 +2606,7 @@ class fr extends cr {
     }
     if (t.refresh_token) {
       const o = this.getTokenPayload(t.refresh_token);
-      o && (b(this, O, t.refresh_token), b(this, z, o)), this.refreshTokenResponseType == "localStorage" ? localStorage.setItem(this.refreshTokenName, t.refresh_token) : this.accessTokenResponseType == "sessionStorage" && sessionStorage.setItem(this.refreshTokenName, t.refresh_token);
+      o && (b(this, O, t.refresh_token), b(this, D, o)), this.refreshTokenResponseType == "localStorage" ? localStorage.setItem(this.refreshTokenName, t.refresh_token) : this.accessTokenResponseType == "sessionStorage" && sessionStorage.setItem(this.refreshTokenName, t.refresh_token);
     }
     if (t.id_token) {
       const o = await this.validateIdToken(t.id_token);
@@ -2605,7 +2616,7 @@ class fr extends cr {
   /////////
   // Wrap flow functions
   /**
-   * See {@link @crossuath/common!OAuthClientBase}.  Calls the base function
+   * See {@link OAuthClientBase}.  Calls the base function
    * then saves the tokens, as per the requested method
    * @param scope 
    */
@@ -2614,16 +2625,16 @@ class fr extends cr {
     return await this.receiveTokens(o), o;
   }
   /**
-   * See {@link @crossuath/common!OAuthClientBase}.  Calls the base function
+   * See {@link OAuthClientBase}.  Calls the base function
    * then saves the tokens, as per the requested method
    * @param scope 
    */
-  async passwordFlow(t, o, s) {
-    const n = await super.passwordFlow(t, o, s);
+  async passwordFlow(t, o, i) {
+    const n = await super.passwordFlow(t, o, i);
     return await this.receiveTokens(n), n;
   }
   /**
-   * See {@link @crossuath/common!OAuthClientBase}.  Calls the base function
+   * See {@link OAuthClientBase}.  Calls the base function
    * then saves the tokens, as per the requested method
    * @param scope 
    */
@@ -2632,27 +2643,32 @@ class fr extends cr {
     return o.endsWith("/") || (o += "/"), o += this.deviceAuthorizationUrl, await super.startDeviceCodeFlow(o, t);
   }
   /**
-   * See {@link @crossuath/common!OAuthClientBase}.  Calls the base function
+   * See {@link OAuthClientBase}.  Calls the base function
    * then saves the tokens, as per the requested method
-   * @param scope 
+   * @param mfaToken the MFA token returned when the flow was started
+   * @param otp the One time password entered by the user
+   * @return the response from the MFA OTP OAuth call
    */
   async mfaOtpComplete(t, o) {
-    const s = await super.mfaOtpComplete(t, o);
-    return await this.receiveTokens(s), s;
+    const i = await super.mfaOtpComplete(t, o);
+    return await this.receiveTokens(i), i;
   }
   /**
-   * See {@link @crossuath/common!OAuthClientBase}.  Calls the base function
+   * See {@link OAuthClientBase}.  Calls the base function
    * then saves the tokens, as per the requested method
-   * @param scope 
+   * @param mfaToken the MFA token returned when the flow was started
+   * @param oobCode the code entered by the user
+   * @return the response from the MFA OOB OAuth call
    */
-  async mfaOobComplete(t, o, s) {
-    const n = await super.mfaOobComplete(t, o, s);
+  async mfaOobComplete(t, o, i) {
+    const n = await super.mfaOobComplete(t, o, i);
     return await this.receiveTokens(n), n;
   }
   /**
-   * See {@link @crossuath/common!OAuthClientBase}.  Calls the base function
+   * See {@link OAuthClientBase}.  Calls the base function
    * then saves the tokens, as per the requested method
-   * @param scope 
+   * @param refreshToken  the refresh token.  Do not pass this if you have
+   * it stored in this object already
    */
   async refreshTokenFlow(t) {
     if (!t)
@@ -2669,22 +2685,26 @@ class fr extends cr {
    * @param pkce whether or not to use PKCE.
    */
   async authorizationCodeFlow(t, o = !1) {
-    const s = await super.startAuthorizationCodeFlow(t, o);
-    if (s.error || !s.url) {
+    const i = await super.startAuthorizationCodeFlow(t, o);
+    if (i.error || !i.url) {
       const n = g.fromOAuthError(
-        s.error ?? "Couldn't create URL for authorization code flow",
-        s.error_description
+        i.error ?? "Couldn't create URL for authorization code flow",
+        i.error_description
       );
-      throw c.logger.debug(d({ err: n })), n;
+      throw d.logger.debug(h({ err: n })), n;
     }
-    location.href = s.url;
+    location.href = i.url;
   }
 }
-j = new WeakMap(), O = new WeakMap(), R = new WeakMap(), K = new WeakMap(), z = new WeakMap(), B = new WeakMap(), L = new WeakMap();
+j = new WeakMap(), O = new WeakMap(), R = new WeakMap(), K = new WeakMap(), D = new WeakMap(), B = new WeakMap(), L = new WeakMap();
 export {
   g as CrossauthError,
-  c as CrossauthLogger,
+  d as CrossauthLogger,
+  Ae as OAuthAutoRefresher,
   ur as OAuthBffClient,
-  fr as OAuthClient,
-  d as j
+  gr as OAuthClient,
+  Pe as OAuthDeviceCodePoller,
+  hr as OAuthTokenConsumer,
+  fr as OAuthTokenProvider,
+  h as j
 };