@crossauth/frontend 0.0.23 → 0.0.25

package/dist/index.js

@@ -262,7 +262,7 @@ l(W, "Error", 1), /** Log errors and warning */
 l(W, "Warn", 2), /** Log errors, warnings and info messages */
 l(W, "Info", 3), /** Log everything */
 l(W, "Debug", 4), l(W, "levelName", ["NONE", "ERROR", "WARN", "INFO", "DEBUG"]);
-let d = W;
+let c = W;
 function h(r) {
   let e;
   typeof r == "object" && "err" in r && typeof r.err == "object" && (e = r.err.stack);
@@ -284,7 +284,7 @@ function h(r) {
   }
   return typeof r == "string" || globalThis.crossauthLoggerAcceptsJson ? r : JSON.stringify(r);
 }
-globalThis.crossauthLogger = new d(d.None);
+globalThis.crossauthLogger = new c(c.None);
 globalThis.crossauthLoggerAcceptsJson = !0;
 const ye = {
   issuer: "",
@@ -627,17 +627,17 @@ const Se = (r) => (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject",
   }
 }, be = async (r, e, t, o, i) => {
   let n, s;
-  const a = new Uint8Array(atob(t.replace(r, "")).split("").map((u) => u.charCodeAt(0))), c = e === "spki";
+  const a = new Uint8Array(atob(t.replace(r, "")).split("").map((u) => u.charCodeAt(0))), d = e === "spki";
   switch (o) {
     case "PS256":
     case "PS384":
     case "PS512":
-      n = { name: "RSA-PSS", hash: `SHA-${o.slice(-3)}` }, s = c ? ["verify"] : ["sign"];
+      n = { name: "RSA-PSS", hash: `SHA-${o.slice(-3)}` }, s = d ? ["verify"] : ["sign"];
       break;
     case "RS256":
     case "RS384":
     case "RS512":
-      n = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${o.slice(-3)}` }, s = c ? ["verify"] : ["sign"];
+      n = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${o.slice(-3)}` }, s = d ? ["verify"] : ["sign"];
       break;
     case "RSA-OAEP":
     case "RSA-OAEP-256":
@@ -646,27 +646,27 @@ const Se = (r) => (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject",
       n = {
         name: "RSA-OAEP",
         hash: `SHA-${parseInt(o.slice(-3), 10) || 1}`
-      }, s = c ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
+      }, s = d ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
       break;
     case "ES256":
-      n = { name: "ECDSA", namedCurve: "P-256" }, s = c ? ["verify"] : ["sign"];
+      n = { name: "ECDSA", namedCurve: "P-256" }, s = d ? ["verify"] : ["sign"];
       break;
     case "ES384":
-      n = { name: "ECDSA", namedCurve: "P-384" }, s = c ? ["verify"] : ["sign"];
+      n = { name: "ECDSA", namedCurve: "P-384" }, s = d ? ["verify"] : ["sign"];
       break;
     case "ES512":
-      n = { name: "ECDSA", namedCurve: "P-521" }, s = c ? ["verify"] : ["sign"];
+      n = { name: "ECDSA", namedCurve: "P-521" }, s = d ? ["verify"] : ["sign"];
       break;
     case "ECDH-ES":
     case "ECDH-ES+A128KW":
     case "ECDH-ES+A192KW":
     case "ECDH-ES+A256KW": {
       const u = le(a);
-      n = u.startsWith("P-") ? { name: "ECDH", namedCurve: u } : { name: u }, s = c ? [] : ["deriveBits"];
+      n = u.startsWith("P-") ? { name: "ECDH", namedCurve: u } : { name: u }, s = d ? [] : ["deriveBits"];
       break;
     }
     case "EdDSA":
-      n = { name: le(a) }, s = c ? ["verify"] : ["sign"];
+      n = { name: le(a) }, s = d ? ["verify"] : ["sign"];
       break;
     default:
       throw new I('Invalid or unsupported "alg" (Algorithm) value');
@@ -822,8 +822,8 @@ async function ir(r, e, t) {
       throw new S("JWS Payload must be a string");
   } else if (typeof r.payload != "string" && !(r.payload instanceof Uint8Array))
     throw new S("JWS Payload must be a string or an Uint8Array instance");
-  let c = !1;
-  typeof e == "function" && (e = await e(o, r), c = !0), Ze(a, e, "verify");
+  let d = !1;
+  typeof e == "function" && (e = await e(o, r), d = !0), Ze(a, e, "verify");
   const u = He(X.encode(r.protected ?? ""), X.encode("."), typeof r.payload == "string" ? X.encode(r.payload) : r.payload);
   let y;
   try {
@@ -842,7 +842,7 @@ async function ir(r, e, t) {
     }
   else typeof r.payload == "string" ? k = X.encode(r.payload) : k = r.payload;
   const Y = { payload: k };
-  return r.protected !== void 0 && (Y.protectedHeader = o), r.header !== void 0 && (Y.unprotectedHeader = r.header), c ? { ...Y, key: e } : Y;
+  return r.protected !== void 0 && (Y.protectedHeader = o), r.header !== void 0 && (Y.unprotectedHeader = r.header), d ? { ...Y, key: e } : Y;
 }
 async function sr(r, e, t) {
   if (r instanceof Uint8Array && (r = G.decode(r)), typeof r != "string")
@@ -850,8 +850,8 @@ async function sr(r, e, t) {
   const { 0: o, 1: i, 2: n, length: s } = r.split(".");
   if (s !== 3)
     throw new S("Invalid Compact JWS");
-  const a = await ir({ payload: i, protected: o, signature: n }, e), c = { payload: a.payload, protectedHeader: a.protectedHeader };
-  return typeof e == "function" ? { ...c, key: a.key } : c;
+  const a = await ir({ payload: i, protected: o, signature: n }, e), d = { payload: a.payload, protectedHeader: a.protectedHeader };
+  return typeof e == "function" ? { ...d, key: a.key } : d;
 }
 const Ee = M;
 function nr(r) {
@@ -1033,12 +1033,12 @@ class cr {
     codeChallengeMethod: n,
     stateLength: s,
     verifierLength: a,
-    tokenConsumer: c,
+    tokenConsumer: d,
     authServerCredentials: u,
     authServerMode: y,
     authServerHeaders: k
   }) {
-    l(this, "authServerBaseUrl", ""), $(this, _), $(this, T), $(this, q), l(this, "codeChallengeMethod", "S256"), $(this, F), l(this, "verifierLength", 32), l(this, "redirect_uri"), $(this, J, ""), l(this, "stateLength", 32), l(this, "authzCode", ""), l(this, "oidcConfig"), l(this, "tokenConsumer"), l(this, "authServerHeaders", {}), l(this, "authServerMode"), l(this, "authServerCredentials"), this.tokenConsumer = c, this.authServerBaseUrl = e, a && (this.verifierLength = a), s && (this.stateLength = s), t && A(this, _, t), o && A(this, T, o), i && (this.redirect_uri = i), n && (this.codeChallengeMethod = n), this.authServerBaseUrl = e, u && (this.authServerCredentials = u), y && (this.authServerMode = y), k && (this.authServerHeaders = k);
+    l(this, "authServerBaseUrl", ""), $(this, _), $(this, T), $(this, q), l(this, "codeChallengeMethod", "S256"), $(this, F), l(this, "verifierLength", 32), l(this, "redirect_uri"), $(this, J, ""), l(this, "stateLength", 32), l(this, "authzCode", ""), l(this, "oidcConfig"), l(this, "tokenConsumer"), l(this, "authServerHeaders", {}), l(this, "authServerMode"), l(this, "authServerCredentials"), this.tokenConsumer = d, this.authServerBaseUrl = e, a && (this.verifierLength = a), s && (this.stateLength = s), t && A(this, _, t), o && A(this, T, o), i && (this.redirect_uri = i), n && (this.codeChallengeMethod = n), this.authServerBaseUrl = e, u && (this.authServerCredentials = u), y && (this.authServerMode = y), k && (this.authServerHeaders = k);
   }
   set client_id(e) {
     A(this, _, e);
@@ -1068,7 +1068,7 @@ class cr {
    */
   async loadConfig(e) {
     if (e) {
-      d.logger.debug(h({ msg: "Reading OIDC config locally" })), this.oidcConfig = e;
+      c.logger.debug(h({ msg: "Reading OIDC config locally" })), this.oidcConfig = e;
       return;
     }
     let t;
@@ -1076,11 +1076,11 @@ class cr {
       const o = new URL(
         this.authServerBaseUrl + "/.well-known/openid-configuration"
       );
-      d.logger.debug(h({ msg: `Fetching OIDC config from ${o}` }));
+      c.logger.debug(h({ msg: `Fetching OIDC config from ${o}` }));
       let i = { headers: this.authServerHeaders };
       this.authServerMode && (i.mode = this.authServerMode), this.authServerCredentials && (i.credentials = this.authServerCredentials), t = await fetch(o, i);
     } catch (o) {
-      d.logger.error(h({ err: o }));
+      c.logger.error(h({ err: o }));
     }
     if (!t || !t.ok)
       throw new g(
@@ -1123,7 +1123,7 @@ class cr {
    */
   async startAuthorizationCodeFlow(e, t = !1) {
     var o, i, n;
-    if (d.logger.debug(h({ msg: "Starting authorization code flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.response_types_supported.includes("code")) || !((i = this.oidcConfig) != null && i.response_modes_supported.includes("query")))
+    if (c.logger.debug(h({ msg: "Starting authorization code flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.response_types_supported.includes("code")) || !((i = this.oidcConfig) != null && i.response_modes_supported.includes("query")))
       return {
         error: "invalid_request",
         error_description: "Server does not support authorization code flow"
@@ -1181,10 +1181,10 @@ class cr {
         error_description: "Cannot get token endpoint"
       };
     const a = this.oidcConfig.token_endpoint;
-    let c, u;
-    c = "authorization_code", u = p(this, T);
+    let d, u;
+    d = "authorization_code", u = p(this, T);
     let y = {
-      grant_type: c,
+      grant_type: d,
       client_id: p(this, _),
       code: this.authzCode
     };
@@ -1193,7 +1193,7 @@ class cr {
       const k = await this.post(a, y, this.authServerHeaders);
       return k.id_token && !await this.validateIdToken(k.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : k;
     } catch (k) {
-      return d.logger.error(h({ err: k })), {
+      return c.logger.error(h({ err: k })), {
         error: "server_error",
         error_description: "Unable to get access token from server"
       };
@@ -1215,7 +1215,7 @@ class cr {
    */
   async clientCredentialsFlow(e) {
     var t, o;
-    if (d.logger.debug(h({ msg: "Starting client credentials flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("client_credentials")))
+    if (c.logger.debug(h({ msg: "Starting client credentials flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("client_credentials")))
       return {
         error: "invalid_request",
         error_description: "Server does not support client credentials grant"
@@ -1236,7 +1236,7 @@ class cr {
     try {
       return await this.post(i, n, this.authServerHeaders);
     } catch (s) {
-      return d.logger.error(h({ err: s })), {
+      return c.logger.error(h({ err: s })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1259,7 +1259,7 @@ class cr {
    */
   async passwordFlow(e, t, o) {
     var i, n;
-    if (d.logger.debug(h({ msg: "Starting password flow" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("password")))
+    if (c.logger.debug(h({ msg: "Starting password flow" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("password")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password grant"
@@ -1279,10 +1279,10 @@ class cr {
     };
     o && (a.scope = o);
     try {
-      let c = await this.post(s, a, this.authServerHeaders);
-      return c.id_token && !await this.validateIdToken(c.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : c;
-    } catch (c) {
-      return d.logger.error(h({ err: c })), {
+      let d = await this.post(s, a, this.authServerHeaders);
+      return d.id_token && !await this.validateIdToken(d.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : d;
+    } catch (d) {
+      return c.logger.error(h({ err: d })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1303,7 +1303,7 @@ class cr {
    */
   async mfaAuthenticators(e) {
     var t, o, i;
-    if (d.logger.debug(h({ msg: "Getting valid MFA authenticators" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")) && (o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob"))
+    if (c.logger.debug(h({ msg: "Getting valid MFA authenticators" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")) && (o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob"))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
@@ -1317,8 +1317,8 @@ class cr {
         error_description: "Expected array of authenticators in mfa/authenticators response"
       };
     let a = [];
-    for (let c = 0; c < s.length; ++c) {
-      const u = s[c];
+    for (let d = 0; d < s.length; ++d) {
+      const u = s[d];
       if (!u.id || !u.authenticator_type || !u.active)
         return {
           error: "server_error",
@@ -1348,7 +1348,7 @@ class cr {
    */
   async mfaOtpRequest(e, t) {
     var o, i;
-    if (d.logger.debug(h({ msg: "Making MFA OTB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    if (c.logger.debug(h({ msg: "Making MFA OTB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
@@ -1386,7 +1386,7 @@ class cr {
    */
   async mfaOtpComplete(e, t, o) {
     var i, n;
-    if (d.logger.debug(h({ msg: "Completing MFA OTP request" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    if (c.logger.debug(h({ msg: "Completing MFA OTP request" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
@@ -1433,7 +1433,7 @@ class cr {
    */
   async mfaOobRequest(e, t) {
     var o, i;
-    if (d.logger.debug(h({ msg: "Making MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    if (c.logger.debug(h({ msg: "Making MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
@@ -1468,14 +1468,14 @@ class cr {
    */
   async mfaOobComplete(e, t, o, i) {
     var n, s;
-    if (d.logger.debug(h({ msg: "Completing MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((n = this.oidcConfig) != null && n.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
+    if (c.logger.debug(h({ msg: "Completing MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((n = this.oidcConfig) != null && n.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
     if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
-    const a = this.oidcConfig.token_endpoint, c = await this.post(a, {
+    const a = this.oidcConfig.token_endpoint, d = await this.post(a, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-oob",
       client_id: p(this, _),
       client_secret: p(this, T),
@@ -1485,23 +1485,23 @@ class cr {
       binding_code: o,
       scope: i
     }, this.authServerHeaders);
-    return c.error ? {
-      error: c.error,
-      error_description: c.error_description
-    } : c.id_token && !await this.validateIdToken(c.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : {
-      id_token: c.id_token,
-      access_token: c.access_token,
-      refresh_token: c.refresh_token,
-      expires_in: "expires_in" in c ? Number(c.expires_in) : void 0,
-      scope: c.scope,
-      token_type: c.token_type
+    return d.error ? {
+      error: d.error,
+      error_description: d.error_description
+    } : d.id_token && !await this.validateIdToken(d.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : {
+      id_token: d.id_token,
+      access_token: d.access_token,
+      refresh_token: d.refresh_token,
+      expires_in: "expires_in" in d ? Number(d.expires_in) : void 0,
+      scope: d.scope,
+      token_type: d.token_type
     };
   }
   //////////////////////////////////////////////////////////////////////
   // Refresh Token Flow
   async refreshTokenFlow(e) {
     var t, o;
-    if (d.logger.debug(h({ msg: "Starting refresh token flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("refresh_token")))
+    if (c.logger.debug(h({ msg: "Starting refresh token flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("refresh_token")))
       return {
         error: "invalid_request",
         error_description: "Server does not support refresh_token grant"
@@ -1524,7 +1524,7 @@ class cr {
       let a = await this.post(i, s, this.authServerHeaders);
       return a.id_token && !await this.validateIdToken(a.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : a;
     } catch (a) {
-      return d.logger.error(h({ err: a })), {
+      return c.logger.error(h({ err: a })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1540,7 +1540,7 @@ class cr {
    */
   async startDeviceCodeFlow(e, t) {
     var o;
-    if (d.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
+    if (c.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support device code grant"
@@ -1555,7 +1555,7 @@ class cr {
       let n = await this.post(e, i, this.authServerHeaders);
       return n.id_token && !await this.validateIdToken(n.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : n;
     } catch (n) {
-      return d.logger.error(h({ err: n })), {
+      return c.logger.error(h({ err: n })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1570,7 +1570,7 @@ class cr {
    */
   async pollDeviceCodeFlow(e) {
     var t, o, i;
-    if (d.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
+    if (c.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support device code grant"
@@ -1590,7 +1590,7 @@ class cr {
       const s = await this.post((i = this.oidcConfig) == null ? void 0 : i.token_endpoint, n, this.authServerHeaders);
       return s.error ? s : s.id_token && !await this.validateIdToken(s.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : s;
     } catch (s) {
-      return d.logger.error(h({ err: s })), {
+      return c.logger.error(h({ err: s })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1605,7 +1605,7 @@ class cr {
    * @throws any exception raised by `fetch()`
    */
   async post(e, t, o = {}) {
-    d.logger.debug(h({
+    c.logger.debug(h({
       msg: "Fetch POST",
       url: e,
       params: Object.keys(t)
@@ -1631,7 +1631,7 @@ class cr {
    * @throws any exception raised by `fetch()`
    */
   async get(e, t = {}) {
-    d.logger.debug(h({ msg: "Fetch GET", url: e }));
+    c.logger.debug(h({ msg: "Fetch GET", url: e }));
     let o = {};
     return this.authServerCredentials && (o.credentials = this.authServerCredentials), this.authServerMode && (o.mode = this.authServerMode), await (await fetch(e, {
       method: "GET",
@@ -1670,7 +1670,7 @@ class cr {
     try {
       return await this.tokenConsumer.tokenAuthorized(e, "id");
     } catch (t) {
-      d.logger.warn(h({ err: t }));
+      c.logger.warn(h({ err: t }));
       return;
     }
   }
@@ -1728,7 +1728,7 @@ class dr {
         await this.loadJwks();
       }
     } catch (e) {
-      throw d.logger.debug(h({ err: e })), new g(m.Connection, "Couldn't load keys");
+      throw c.logger.debug(h({ err: e })), new g(m.Connection, "Couldn't load keys");
     }
   }
   /**
@@ -1751,7 +1751,7 @@ class dr {
     try {
       t = await fetch(new URL("/.well-known/openid-configuration", this.authServerBaseUrl));
     } catch (o) {
-      d.logger.error(h({ err: o }));
+      c.logger.error(h({ err: o }));
     }
     if (!t || !t.ok)
       throw new g(m.Connection, "Couldn't get OIDC configuration");
@@ -1787,7 +1787,7 @@ class dr {
       try {
         t = await fetch(new URL(this.oidcConfig.jwks_uri));
       } catch (o) {
-        d.logger.error(h({ err: o }));
+        c.logger.error(h({ err: o }));
       }
       if (!t || !t.ok)
         throw new g(m.Connection, "Couldn't get OIDC configuration");
@@ -1803,10 +1803,10 @@ class dr {
             const s = await ue(o.keys[i]);
             this.keys[n] = s;
           } catch (n) {
-            throw d.logger.error(h({ err: n })), new g(m.Connection, "Couldn't load keys");
+            throw c.logger.error(h({ err: n })), new g(m.Connection, "Couldn't load keys");
           }
       } catch (o) {
-        throw d.logger.error(h({ err: o })), new g(m.Connection, "Unrecognized response from OIDC jwks endpoint");
+        throw c.logger.error(h({ err: o })), new g(m.Connection, "Unrecognized response from OIDC jwks endpoint");
       }
     }
   }
@@ -1826,27 +1826,27 @@ class dr {
     const o = await this.validateToken(e);
     if (o) {
       if (o.type != t) {
-        d.logger.error(h({ msg: t + " expected but got " + o.type }));
+        c.logger.error(h({ msg: t + " expected but got " + o.type }));
         return;
       }
       if (o.iss != this.authServerBaseUrl) {
-        d.logger.error(h({ msg: `Invalid issuer ${o.iss} in access token`, hashedAccessToken: await this.hash(o.jti) }));
+        c.logger.error(h({ msg: `Invalid issuer ${o.iss} in access token`, hashedAccessToken: await this.hash(o.jti) }));
         return;
       }
       if (o.aud && (Array.isArray(o.aud) && !o.aud.includes(this.audience) || !Array.isArray(o.aud) && o.aud != this.audience)) {
-        d.logger.error(h({ msg: `Invalid audience ${o.aud} in access token`, hashedAccessToken: await this.hash(o.jti) }));
+        c.logger.error(h({ msg: `Invalid audience ${o.aud} in access token`, hashedAccessToken: await this.hash(o.jti) }));
         return;
       }
       return o;
     }
   }
   async validateToken(e) {
-    (!this.keys || Object.keys(this.keys).length == 0) && d.logger.warn("No keys loaded so cannot validate tokens");
+    (!this.keys || Object.keys(this.keys).length == 0) && c.logger.warn("No keys loaded so cannot validate tokens");
     let t;
     try {
       t = nr(e).kid;
     } catch {
-      d.logger.warn(h({ msg: "Invalid access token format" }));
+      c.logger.warn(h({ msg: "Invalid access token format" }));
       return;
     }
     let o;
@@ -1857,18 +1857,18 @@ class dr {
         break;
       }
     if (!o) {
-      d.logger.warn(h({ msg: "No matching keys found for access token" }));
+      c.logger.warn(h({ msg: "No matching keys found for access token" }));
       return;
     }
     try {
       const { payload: i } = await sr(e, o), n = JSON.parse(new TextDecoder().decode(i));
       if (n.exp * 1e3 < Date.now() + this.clockTolerance) {
-        d.logger.warn(h({ msg: "Access token has expired" }));
+        c.logger.warn(h({ msg: "Access token has expired" }));
         return;
       }
       return n;
     } catch {
-      d.logger.warn(h({ msg: "Access token did not validate" }));
+      c.logger.warn(h({ msg: "Access token did not validate" }));
       return;
     }
   }
@@ -1898,34 +1898,42 @@ class Ae {
     this.tokenProvider = e.tokenProvider, this.autoRefreshUrl = e.autoRefreshUrl, e.csrfHeader && (this.csrfHeader = e.csrfHeader), e.headers && (this.headers = e.headers), e.mode && (this.mode = e.mode), e.credentials && (this.credentials = e.credentials);
   }
   async startAutoRefresh(e = ["access", "id"], t) {
-    this.autoRefreshActive || (this.autoRefreshActive = !0, d.logger.debug(h({ msg: "Starting auto refresh" })), await this.scheduleAutoRefresh(e, t));
+    if (!this.autoRefreshActive) {
+      this.autoRefreshActive = !0, c.logger.debug(h({ msg: "Starting auto refresh" }));
+      try {
+        await this.scheduleAutoRefresh(e, t);
+      } catch (o) {
+        const i = g.asCrossauthError(o);
+        c.logger.error(h({ cerr: i })), c.logger.debug(h({ err: i }));
+      }
+    }
   }
   stopAutoRefresh() {
-    this.autoRefreshActive = !1, d.logger.debug(h({ msg: "Stopping auto refresh" }));
+    this.autoRefreshActive = !1, c.logger.debug(h({ msg: "Stopping auto refresh" }));
   }
   async scheduleAutoRefresh(e, t) {
     const o = this.tokenProvider.getCsrfToken(), i = o ? await o : void 0, n = await this.tokenProvider.getTokenExpiries([...e, "refresh"], i);
     if (n.refresh == null) {
-      d.logger.debug(h({ msg: "No refresh token found" }));
+      c.logger.debug(h({ msg: "No refresh token found" }));
       return;
     }
     const s = Date.now();
     let a = n.id;
     if ((!a || n.access && n.access < a) && (a = n.access), !a) {
-      d.logger.debug(h({ msg: "No tokens expire" }));
+      c.logger.debug(h({ msg: "No tokens expire" }));
       return;
     }
-    const c = a * 1e3 - s - fe;
-    if (c < 0) {
-      d.logger.debug(h({ msg: "Expiry time has passed" }));
+    const d = a * 1e3 - s - fe;
+    if (d < 0) {
+      c.logger.debug(h({ msg: "Expiry time has passed" }));
       return;
     }
-    if (n.refresh && n.refresh - fe < c) {
-      d.logger.debug(h({ msg: "Refresh token has expired" }));
+    if (n.refresh && n.refresh - fe < d) {
+      c.logger.debug(h({ msg: "Refresh token has expired" }));
       return;
     }
     let u = (y) => new Promise((k) => setTimeout(k, y));
-    d.logger.debug(h({ msg: `Waiting ${c} before refreshing tokens` })), await u(c), await this.autoRefresh(e, i, t);
+    c.logger.debug(h({ msg: `Waiting ${d} before refreshing tokens` })), await u(d), await this.autoRefresh(e, i, t);
   }
   async autoRefresh(e, t, o) {
     if (this.autoRefreshActive) {
@@ -1933,8 +1941,8 @@ class Ae {
       for (; !n && s <= Z; )
         try {
           let a = { ...this.headers };
-          t && (a[this.csrfHeader] = t), d.logger.debug(h({ msg: "Initiating auto refresh" }));
-          const c = await this.tokenProvider.jsonFetchWithToken(
+          t && (a[this.csrfHeader] = t), c.logger.debug(h({ msg: "Initiating auto refresh" }));
+          const d = await this.tokenProvider.jsonFetchWithToken(
             this.autoRefreshUrl,
             {
               method: "POST",
@@ -1951,19 +1959,19 @@ class Ae {
             },
             "refresh"
           );
-          if (c.ok || d.logger.error(h({ msg: "Failed auto refreshing tokens", status: c.status })), i = await c.json(), i != null && i.ok) {
+          if (d.ok || c.logger.error(h({ msg: "Failed auto refreshing tokens", status: d.status })), i = await d.json(), i != null && i.ok) {
             await this.scheduleAutoRefresh(e, o), n = !0;
             try {
               await this.tokenProvider.receiveTokens(i);
             } catch (u) {
               const y = g.asCrossauthError(u);
-              o ? o("Couldn't receive tokens", y) : (d.logger.debug(h({ err: u })), d.logger.error(h({ msg: "Error receiving tokens", cerr: y })));
+              o ? o("Couldn't receive tokens", y) : (c.logger.debug(h({ err: u })), c.logger.error(h({ msg: "Error receiving tokens", cerr: y })));
             }
           } else
-            s < Z ? (d.logger.error(h({ msg: `Failed auto refreshing tokens.  Retrying in ${ae} seconds` })), await ((y) => new Promise((k) => setTimeout(k, y)))(ae * 1e3)) : (d.logger.error(h({ msg: "Failed auto refreshing tokens.  Number of retries exceeded" })), o && o("Failed auto refreshing tokens")), s++;
+            s < Z ? (c.logger.error(h({ msg: `Failed auto refreshing tokens.  Retrying in ${ae} seconds` })), await ((y) => new Promise((k) => setTimeout(k, y)))(ae * 1e3)) : (c.logger.error(h({ msg: "Failed auto refreshing tokens.  Number of retries exceeded" })), o && o("Failed auto refreshing tokens")), s++;
         } catch (a) {
-          const c = g.asCrossauthError(a);
-          d.logger.debug(h({ err: c })), s < Z ? (d.logger.error(h({ msg: `Failed auto refreshing tokens.  Retrying in ${Z} seconds` })), await ((y) => new Promise((k) => setTimeout(k, y)))(ae)) : (d.logger.error(h({ msg: "Failed auto refreshing tokens.  Number of retries exceeded" })), o && o(c.message, c)), s++;
+          const d = g.asCrossauthError(a);
+          c.logger.debug(h({ err: d })), s < Z ? (c.logger.error(h({ msg: `Failed auto refreshing tokens.  Retrying in ${Z} seconds` })), await ((y) => new Promise((k) => setTimeout(k, y)))(ae)) : (c.logger.error(h({ msg: "Failed auto refreshing tokens.  Number of retries exceeded" })), o && o(d.message, d)), s++;
         }
     }
   }
@@ -1989,18 +1997,18 @@ class Pe {
     this.oauthClient = e.oauthClient, e.deviceCodePollUrl != null && (this.deviceCodePollUrl = e.deviceCodePollUrl), e.headers && (this.headers = e.headers), e.mode && (this.mode = e.mode), e.credentials && (this.credentials = e.credentials);
   }
   async startPolling(e, t, o = 5) {
-    this.pollingActive || (this.pollingActive = !0, d.logger.debug(h({ msg: "Starting auto refresh" })), await this.poll(e, o, t));
+    this.pollingActive || (this.pollingActive = !0, c.logger.debug(h({ msg: "Starting auto refresh" })), await this.poll(e, o, t));
   }
   stopPolling() {
-    this.pollingActive = !1, d.logger.debug(h({ msg: "Stopping auto refresh" }));
+    this.pollingActive = !1, c.logger.debug(h({ msg: "Stopping auto refresh" }));
   }
   async poll(e, t, o) {
     var i;
     if (!e)
-      d.logger.debug(h({ msg: "device code poll: no device code provided" })), o("error", "Error waiting for authorization");
+      c.logger.debug(h({ msg: "device code poll: no device code provided" })), o("error", "Error waiting for authorization");
     else
       try {
-        if (d.logger.debug(h({ msg: "device code poll: poll" })), !this.deviceCodePollUrl && this.oauthClient) {
+        if (c.logger.debug(h({ msg: "device code poll: poll" })), !this.deviceCodePollUrl && this.oauthClient) {
           if (this.oauthClient.getOidcConfig() || await this.oauthClient.loadConfig(), !((i = this.oauthClient.getOidcConfig()) != null && i.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
             return {
               error: "invalid_request",
@@ -2029,18 +2037,18 @@ class Pe {
           this.pollingActive = !1, o("error", "Received an error from the authorization server");
         else {
           const s = await n.json();
-          if (d.logger.debug(h({ msg: "device code poll: received" + JSON.stringify(s) })), s.error == "expired_token")
+          if (c.logger.debug(h({ msg: "device code poll: received" + JSON.stringify(s) })), s.error == "expired_token")
             this.pollingActive = !1, o("expired_token", "Timeout waiting for authorization");
           else if (s.error == "authorization_pending" || s.error == "slow_down") {
             s.error == "slow_down" && (t += 5);
-            let a = s.interval ?? t, c = (u) => new Promise((y) => setTimeout(y, u));
-            d.logger.debug(h({ msg: "device code poll: waiting " + String(a) + " seconds" })), await c(a * 1e3), this.pollingActive && this.poll(e, t, o);
+            let a = s.interval ?? t, d = (u) => new Promise((y) => setTimeout(y, u));
+            c.logger.debug(h({ msg: "device code poll: waiting " + String(a) + " seconds" })), await d(a * 1e3), this.pollingActive && this.poll(e, t, o);
           } else s.error ? (this.pollingActive = !1, o("error", s.error_description ?? s.error)) : (this.pollingActive = !1, o("complete"));
         }
       } catch (n) {
         this.pollingActive = !1;
         const s = g.asCrossauthError(n);
-        d.logger.debug(h({ err: s })), d.logger.error(h({ msg: "Polling failed", cerr: s })), o("error", s.message);
+        c.logger.debug(h({ err: s })), c.logger.error(h({ msg: "Polling failed", cerr: s })), o("error", s.message);
       }
   }
 }
@@ -2203,8 +2211,8 @@ class ur {
         ...s
       }
     );
-    let c = null;
-    return a.body && (c = await a.json()), { status: a.status, body: c };
+    let d = null;
+    return a.body && (d = await a.json()), { status: a.status, body: d };
   }
   /**
    * Return all tokens that the client has been enabled to return.
@@ -2274,10 +2282,10 @@ class ur {
    */
   async getTokenExpiries(e, t) {
     const o = await this.getTokens(t), i = e.includes("id") ? (o == null ? void 0 : o.id_token) ?? null : null, n = e.includes("access") ? (o == null ? void 0 : o.access_token) ?? null : null, s = e.includes("refresh") ? (o == null ? void 0 : o.refresh_token) ?? null : null;
-    let a, c, u;
-    return i && (a = i.exp ? i.exp : null), n && (c = n.exp ? n.exp : null), s && (u = s.exp ? s.exp : null), {
+    let a, d, u;
+    return i && (a = i.exp ? i.exp : null), n && (d = n.exp ? n.exp : null), s && (u = s.exp ? s.exp : null), {
       id: a,
-      access: c,
+      access: d,
       refresh: u
     };
   }
@@ -2408,19 +2416,19 @@ class gr extends cr {
     }
     o ? this.validateIdToken(o).then((s) => {
       b(this, R, s), t.autoRefresh && this.startAutoRefresh(t.autoRefresh).then().catch((a) => {
-        d.logger.debug(h({ err: a, msg: "Couldn't start auto refresh" }));
+        c.logger.debug(h({ err: a, msg: "Couldn't start auto refresh" }));
       });
     }).catch((s) => {
-      d.logger.debug(h({ err: s, msg: "Couldn't validate ID token" }));
+      c.logger.debug(h({ err: s, msg: "Couldn't validate ID token" }));
     }) : w(this, j) && t.autoRefresh && n ? this.startAutoRefresh(t.autoRefresh).then().catch((s) => {
-      d.logger.debug(h({ err: s, msg: "Couldn't start auto refresh" }));
+      c.logger.debug(h({ err: s, msg: "Couldn't start auto refresh" }));
     }) : n && !i && this.refreshTokenFlow(n).then((s) => {
-      d.logger.debug(h({ msg: "Refreshed tokens" })), t.autoRefresh && this.startAutoRefresh(t.autoRefresh).then().catch((a) => {
-        d.logger.debug(h({ err: a, msg: "Couldn't start auto refresh" }));
+      c.logger.debug(h({ msg: "Refreshed tokens" })), t.autoRefresh && this.startAutoRefresh(t.autoRefresh).then().catch((a) => {
+        c.logger.debug(h({ err: a, msg: "Couldn't start auto refresh" }));
       });
     }).catch((s) => {
       const a = g.asCrossauthError(s);
-      d.logger.debug(h({ err: a })), d.logger.error(h({ msg: "failed refreshing tokens", cerr: a }));
+      c.logger.debug(h({ err: a })), c.logger.error(h({ msg: "failed refreshing tokens", cerr: a }));
     });
   }
   get idTokenPayload() {
@@ -2458,14 +2466,14 @@ class gr extends cr {
     if (!s && !i) return;
     if (s) {
       const u = g.fromOAuthError(s, a);
-      throw d.logger.debug(h({ err: u })), d.logger.error(h({ cerr: u, msg: "Error from authorize endpoint: " + s })), u;
+      throw c.logger.debug(h({ err: u })), c.logger.error(h({ cerr: u, msg: "Error from authorize endpoint: " + s })), u;
     }
-    const c = await this.redirectEndpoint(i, n, s, a);
-    if (c.error) {
-      const u = g.fromOAuthError(c.error, a);
-      throw d.logger.debug(h({ err: u })), d.logger.error(h({ cerr: u, msg: "Error from redirect endpoint: " + c.error })), u;
+    const d = await this.redirectEndpoint(i, n, s, a);
+    if (d.error) {
+      const u = g.fromOAuthError(d.error, a);
+      throw c.logger.debug(h({ err: u })), c.logger.error(h({ cerr: u, msg: "Error from redirect endpoint: " + d.error })), u;
     }
-    return await this.receiveTokens(c), c;
+    return await this.receiveTokens(d), d;
   }
   /**
    * Turns auto refresh of tokens on
@@ -2525,7 +2533,7 @@ class gr extends cr {
    */
   async sha256(t) {
     const i = new TextEncoder().encode(t), n = await crypto.subtle.digest("SHA-256", i), s = Array.from(new Uint8Array(n));
-    return btoa(s.reduce((a, c) => a + String.fromCharCode(c), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
+    return btoa(s.reduce((a, d) => a + String.fromCharCode(d), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
   }
   /**
    * Calls an API endpoint on the resource server
@@ -2541,7 +2549,7 @@ class gr extends cr {
     i && (s.body = JSON.stringify(i));
     let a;
     this.accessTokenResponseType == "sessionStorage" ? a = sessionStorage.getItem(this.accessTokenName) : this.accessTokenResponseType == "localStorage" && (a = localStorage.getItem(this.accessTokenName)), n.authorization = "Bearer " + a;
-    const c = await fetch(
+    const d = await fetch(
       this.resServerBaseUrl + o,
       {
         headers: n,
@@ -2552,7 +2560,7 @@ class gr extends cr {
       }
     );
     let u = null;
-    return c.body && (u = await c.json()), { status: c.status, body: u };
+    return d.body && (u = await d.json()), { status: d.status, body: u };
   }
   ///////////////////////////////////////////////////////////
   // OAuthTokenProvider interface
@@ -2691,7 +2699,7 @@ class gr extends cr {
         i.error ?? "Couldn't create URL for authorization code flow",
         i.error_description
       );
-      throw d.logger.debug(h({ err: n })), n;
+      throw c.logger.debug(h({ err: n })), n;
     }
     location.href = i.url;
   }
@@ -2699,7 +2707,7 @@ class gr extends cr {
 j = new WeakMap(), O = new WeakMap(), R = new WeakMap(), K = new WeakMap(), D = new WeakMap(), B = new WeakMap(), L = new WeakMap();
 export {
   g as CrossauthError,
-  d as CrossauthLogger,
+  c as CrossauthLogger,
   Ae as OAuthAutoRefresher,
   ur as OAuthBffClient,
   gr as OAuthClient,