@crossauth/frontend 1.0.0 → 1.1.0

package/dist/index.js

@@ -1,39 +1,45 @@
-var Ue = Object.defineProperty;
-var ce = (r) => {
+var xe = Object.defineProperty;
+var ue = (r) => {
   throw TypeError(r);
 };
-var Oe = (r, e, t) => e in r ? Ue(r, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : r[e] = t;
-var f = (r, e, t) => Oe(r, typeof e != "symbol" ? e + "" : e, t), de = (r, e, t) => e.has(r) || ce("Cannot " + t);
-var p = (r, e, t) => (de(r, e, "read from private field"), t ? t.call(r) : e.get(r)), E = (r, e, t) => e.has(r) ? ce("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(r) : e.set(r, t), T = (r, e, t, o) => (de(r, e, "write to private field"), o ? o.call(r, t) : e.set(r, t), t);
-var Ne = Object.defineProperty, ye = (r) => {
+var He = (r, e, t) => e in r ? xe(r, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : r[e] = t;
+var f = (r, e, t) => He(r, typeof e != "symbol" ? e + "" : e, t), fe = (r, e, t) => e.has(r) || ue("Cannot " + t);
+var p = (r, e, t) => (fe(r, e, "read from private field"), t ? t.call(r) : e.get(r)), R = (r, e, t) => e.has(r) ? ue("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(r) : e.set(r, t), T = (r, e, t, o) => (fe(r, e, "write to private field"), o ? o.call(r, t) : e.set(r, t), t);
+var je = Object.defineProperty, _e = (r) => {
   throw TypeError(r);
-}, He = (r, e, t) => e in r ? Ne(r, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : r[e] = t, u = (r, e, t) => He(r, typeof e != "symbol" ? e + "" : e, t), we = (r, e, t) => e.has(r) || ye("Cannot " + t), w = (r, e, t) => (we(r, e, "read from private field"), e.get(r)), he = (r, e, t) => e.has(r) ? ye("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(r) : e.set(r, t), Y = (r, e, t, o) => (we(r, e, "write to private field"), e.set(r, t), t);
-class H {
+}, De = (r, e, t) => e in r ? je(r, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : r[e] = t, u = (r, e, t) => De(r, typeof e != "symbol" ? e + "" : e, t), ke = (r, e, t) => e.has(r) || _e("Cannot " + t), w = (r, e, t) => (ke(r, e, "read from private field"), e.get(r)), ge = (r, e, t) => e.has(r) ? _e("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(r) : e.set(r, t), te = (r, e, t, o) => (ke(r, e, "write to private field"), e.set(r, t), t);
+class K {
 }
-u(H, "active", "active"), /** Deactivated account.  User cannot log in */
-u(H, "disabled", "disabled"), /** Two factor authentication has been actived for this user
+u(K, "active", "active"), /** Deactivated account.  User cannot log in */
+u(K, "disabled", "disabled"), /** Two factor authentication has been actived for this user
 * but has not yet been configured.  Once a user logs in,
 * they will be directed to a page to configure 2FA and will
 * not be able to do anything else (that requires login) until
 * they have done so.
 */
-u(H, "awaitingTwoFactorSetup", "awaitingtwofactorsetup"), /** Email verification has been turned on but user has not
+u(K, "awaitingTwoFactorSetup", "awaitingtwofactorsetup"), /** Two factor authentication has been actived for this user
+* but has not yet been configured.  Once a user logs in,
+* they will be directed to a page to configure 2FA and will
+* not be able to do anything else (that requires login) until
+* they have done so.  They will then have to verify their email
+*/
+u(K, "awaitingTwoFactorSetupAndEmailVerification", "awaitingtwofactorsetupandemailverification"), /** Email verification has been turned on but user has not
 * verified his or her email address.  Cannot log on until it has
 * been verified.
 */
-u(H, "awaitingEmailVerification", "awaitingemailverification"), /**
+u(K, "awaitingEmailVerification", "awaitingemailverification"), /**
 * If the state is set to this, the user may not access any
 * login-required functions unless he or she has changed their password.
 * 
 * Upon login, the user is redirected to the change password page.
 */
-u(H, "passwordChangeNeeded", "passwordchangeneeded"), /**
+u(K, "passwordChangeNeeded", "passwordchangeneeded"), /**
 * If the state is set to this, the user may not access any
 * login-required functions unless he or she has reset their password.
 * 
 * Upon login, the user is redirected to the reset password page.
 */
-u(H, "passwordResetNeeded", "passwordresetneeded"), /**
+u(K, "passwordResetNeeded", "passwordresetneeded"), /**
 * If the state is set to this, the user may not access any
 * login-required functions unless he or she has reset their second
 * factor configuration.
@@ -44,26 +50,26 @@ u(H, "passwordResetNeeded", "passwordresetneeded"), /**
 * this value and the user will then be prompted to configure 2FA 
 * upon login.
 */
-u(H, "factor2ResetNeeded", "factor2resetneeded"), /**
+u(K, "factor2ResetNeeded", "factor2resetneeded"), /**
 * If the state is set to this, the user may not access any
 * login-required functions unless he or she has reset their password
 * and then resets factor2.
 * 
 * Upon login, the user is redirected to the reset password page.
 */
-u(H, "passwordAndFactor2ResetNeeded", "passwordandfactor2resetneeded");
-class R {
+u(K, "passwordAndFactor2ResetNeeded", "passwordandfactor2resetneeded");
+class O {
 }
-u(R, "session", "s:"), /** Password Reset Token */
-u(R, "passwordResetToken", "p:"), /** Email verification token */
-u(R, "emailVerificationToken", "e:"), /** API key */
-u(R, "apiKey", "api:"), /** OAuth authorization code */
-u(R, "authorizationCode", "authz:"), /** OAuth access token */
-u(R, "accessToken", "access:"), /** OAuth refresh token */
-u(R, "refreshToken", "refresh:"), /** OAuth MFA key (used by the password MFA flow) */
-u(R, "mfaToken", "omfa:"), /** Device code device code */
-u(R, "deviceCode", "dc:"), /** Device code flow user code */
-u(R, "userCode", "uc:");
+u(O, "session", "s:"), /** Password Reset Token */
+u(O, "passwordResetToken", "p:"), /** Email verification token */
+u(O, "emailVerificationToken", "e:"), /** API key */
+u(O, "apiKey", "api:"), /** OAuth authorization code */
+u(O, "authorizationCode", "authz:"), /** OAuth access token */
+u(O, "accessToken", "access:"), /** OAuth refresh token */
+u(O, "refreshToken", "refresh:"), /** OAuth MFA key (used by the password MFA flow) */
+u(O, "mfaToken", "omfa:"), /** Device code device code */
+u(O, "deviceCode", "dc:"), /** Device code flow user code */
+u(O, "userCode", "uc:");
 var m = /* @__PURE__ */ ((r) => (r[r.UserNotExist = 0] = "UserNotExist", r[r.PasswordInvalid = 1] = "PasswordInvalid", r[r.EmailNotExist = 2] = "EmailNotExist", r[r.UsernameOrPasswordInvalid = 3] = "UsernameOrPasswordInvalid", r[r.InvalidClientId = 4] = "InvalidClientId", r[r.ClientExists = 5] = "ClientExists", r[r.InvalidClientSecret = 6] = "InvalidClientSecret", r[r.InvalidClientIdOrSecret = 7] = "InvalidClientIdOrSecret", r[r.InvalidRedirectUri = 8] = "InvalidRedirectUri", r[r.InvalidOAuthFlow = 9] = "InvalidOAuthFlow", r[r.UserNotActive = 10] = "UserNotActive", r[r.EmailNotVerified = 11] = "EmailNotVerified", r[r.TwoFactorIncomplete = 12] = "TwoFactorIncomplete", r[r.Unauthorized = 13] = "Unauthorized", r[r.UnauthorizedClient = 14] = "UnauthorizedClient", r[r.InvalidScope = 15] = "InvalidScope", r[r.InsufficientScope = 16] = "InsufficientScope", r[r.InsufficientPriviledges = 17] = "InsufficientPriviledges", r[r.Forbidden = 18] = "Forbidden", r[r.InvalidKey = 19] = "InvalidKey", r[r.InvalidCsrf = 20] = "InvalidCsrf", r[r.InvalidSession = 21] = "InvalidSession", r[r.Expired = 22] = "Expired", r[r.Connection = 23] = "Connection", r[r.InvalidHash = 24] = "InvalidHash", r[r.UnsupportedAlgorithm = 25] = "UnsupportedAlgorithm", r[r.KeyExists = 26] = "KeyExists", r[r.PasswordChangeNeeded = 27] = "PasswordChangeNeeded", r[r.PasswordResetNeeded = 28] = "PasswordResetNeeded", r[r.Factor2ResetNeeded = 29] = "Factor2ResetNeeded", r[r.Configuration = 30] = "Configuration", r[r.InvalidEmail = 31] = "InvalidEmail", r[r.InvalidPhoneNumber = 32] = "InvalidPhoneNumber", r[r.InvalidUsername = 33] = "InvalidUsername", r[r.PasswordMatch = 34] = "PasswordMatch", r[r.InvalidToken = 35] = "InvalidToken", r[r.MfaRequired = 36] = "MfaRequired", r[r.PasswordFormat = 37] = "PasswordFormat", r[r.DataFormat = 38] = "DataFormat", r[r.FetchError = 39] = "FetchError", r[r.UserExists = 40] = "UserExists", r[r.FormEntry = 41] = "FormEntry", r[r.BadRequest = 42] = "BadRequest", r[r.AuthorizationPending = 43] = "AuthorizationPending", r[r.SlowDown = 44] = "SlowDown", r[r.ExpiredToken = 45] = "ExpiredToken", r[r.ConstraintViolation = 46] = "ConstraintViolation", r[r.NotImplemented = 47] = "NotImplemented", r[r.UnknownError = 48] = "UnknownError", r))(m || {});
 class g extends Error {
   /**
@@ -73,14 +79,14 @@ class g extends Error {
    * @param message if provided, this error will display.  Otherwise a default one for the error code will be used.
    */
   constructor(e, t = void 0) {
-    let o, i = 500;
-    e == 0 ? (o = "User does not exist", i = 401) : e == 1 ? (o = "Password doesn't match", i = 401) : e == 3 ? (o = "Username or password incorrect", i = 401) : e == 4 ? (o = "Client id is invalid", i = 401) : e == 5 ? (o = "Client ID or name already exists", i = 500) : e == 6 ? (o = "Client secret is invalid", i = 401) : e == 7 ? (o = "Client id or secret is invalid", i = 401) : e == 8 ? (o = "Redirect Uri is not registered", i = 401) : e == 9 ? (o = "Invalid OAuth flow type", i = 500) : e == 2 ? (o = "No user exists with that email address", i = 401) : e == 10 ? (o = "Account is not active", i = 403) : e == 33 ? (o = "Username is not in an allowed format", i = 400) : e == 31 ? (o = "Email is not in an allowed format", i = 400) : e == 32 ? (o = "Phone number is not in an allowed format", i = 400) : e == 11 ? (o = "Email address has not been verified", i = 403) : e == 12 ? (o = "Two-factor setup is not complete", i = 403) : e == 13 ? (o = "Not authorized", i = 401) : e == 14 ? (o = "Client not authorized", i = 401) : e == 15 ? (o = "Invalid scope", i = 403) : e == 16 ? (o = "Insufficient scope", i = 403) : e == 23 ? o = "Connection failure" : e == 22 ? (o = "Token has expired", i = 401) : e == 24 ? o = "Hash is not in a valid format" : e == 19 ? (o = "Key is invalid", i = 401) : e == 18 ? (o = "You do not have permission to access this resource", i = 403) : e == 17 ? (o = "You do not have the right privileges to access this resource", i = 401) : e == 20 ? (o = "CSRF token is invalid", i = 401) : e == 21 ? (o = "Session cookie is invalid", i = 401) : e == 25 ? o = "Algorithm not supported" : e == 26 ? o = "Attempt to create a key that already exists" : e == 27 ? (o = "User must change password", i = 403) : e == 28 ? (o = "User must reset password", i = 403) : e == 29 ? (o = "User must reset 2FA", i = 403) : e == 30 ? o = "There was an error in the configuration" : e == 34 ? (o = "Passwords do not match", i = 401) : e == 35 ? (o = "Token is not valid", i = 401) : e == 36 ? (o = "MFA is required", i = 401) : e == 37 ? (o = "Password format was incorrect", i = 401) : e == 40 ? (o = "User already exists", i = 400) : e == 42 ? (o = "The request is invalid", i = 400) : e == 38 ? (o = "Session data has unexpected format", i = 500) : e == 39 ? (o = "Couldn't execute a fetch", i = 500) : e == 43 ? (o = "Waiting for authorization", i = 200) : e == 44 ? (o = "Slow polling down by 5 seconds", i = 200) : e == 45 ? (o = "Token has expired", i = 401) : e == 46 ? (o = "Database update/insert caused a constraint violation", i = 500) : e == 47 ? (o = "This method has not been implemented", i = 500) : (o = "Unknown error", i = 500), t != null && !Array.isArray(t) ? o = t : Array.isArray(t) && (o = t.join(". ")), super(o), u(this, "isCrossauthError", !0), u(this, "httpStatus"), u(this, "code"), u(this, "codeName"), u(this, "messages"), this.code = e, this.codeName = m[e], this.httpStatus = i, this.name = "CrossauthError", Array.isArray(t) ? this.messages = t : this.messages = [o], Object.setPrototypeOf(this, g.prototype);
+    let o, s = 500;
+    e == 0 ? (o = "User does not exist", s = 401) : e == 1 ? (o = "Password doesn't match", s = 401) : e == 3 ? (o = "Username or password incorrect", s = 401) : e == 4 ? (o = "Client id is invalid", s = 401) : e == 5 ? (o = "Client ID or name already exists", s = 500) : e == 6 ? (o = "Client secret is invalid", s = 401) : e == 7 ? (o = "Client id or secret is invalid", s = 401) : e == 8 ? (o = "Redirect Uri is not registered", s = 401) : e == 9 ? (o = "Invalid OAuth flow type", s = 500) : e == 2 ? (o = "No user exists with that email address", s = 401) : e == 10 ? (o = "Account is not active", s = 403) : e == 33 ? (o = "Username is not in an allowed format", s = 400) : e == 31 ? (o = "Email is not in an allowed format", s = 400) : e == 32 ? (o = "Phone number is not in an allowed format", s = 400) : e == 11 ? (o = "Email address has not been verified", s = 403) : e == 12 ? (o = "Two-factor setup is not complete", s = 403) : e == 13 ? (o = "Not authorized", s = 401) : e == 14 ? (o = "Client not authorized", s = 401) : e == 15 ? (o = "Invalid scope", s = 403) : e == 16 ? (o = "Insufficient scope", s = 403) : e == 23 ? o = "Connection failure" : e == 22 ? (o = "Token has expired", s = 401) : e == 24 ? o = "Hash is not in a valid format" : e == 19 ? (o = "Key is invalid", s = 401) : e == 18 ? (o = "You do not have permission to access this resource", s = 403) : e == 17 ? (o = "You do not have the right privileges to access this resource", s = 401) : e == 20 ? (o = "CSRF token is invalid", s = 401) : e == 21 ? (o = "Session cookie is invalid", s = 401) : e == 25 ? o = "Algorithm not supported" : e == 26 ? o = "Attempt to create a key that already exists" : e == 27 ? (o = "User must change password", s = 403) : e == 28 ? (o = "User must reset password", s = 403) : e == 29 ? (o = "User must reset 2FA", s = 403) : e == 30 ? o = "There was an error in the configuration" : e == 34 ? (o = "Passwords do not match", s = 401) : e == 35 ? (o = "Token is not valid", s = 401) : e == 36 ? (o = "MFA is required", s = 401) : e == 37 ? (o = "Password format was incorrect", s = 401) : e == 40 ? (o = "User already exists", s = 400) : e == 42 ? (o = "The request is invalid", s = 400) : e == 38 ? (o = "Session data has unexpected format", s = 500) : e == 39 ? (o = "Couldn't execute a fetch", s = 500) : e == 43 ? (o = "Waiting for authorization", s = 200) : e == 44 ? (o = "Slow polling down by 5 seconds", s = 200) : e == 45 ? (o = "Token has expired", s = 401) : e == 46 ? (o = "Database update/insert caused a constraint violation", s = 500) : e == 47 ? (o = "This method has not been implemented", s = 500) : (o = "Unknown error", s = 500), t != null && !Array.isArray(t) ? o = t : Array.isArray(t) && (o = t.join(". ")), super(o), u(this, "isCrossauthError", !0), u(this, "httpStatus"), u(this, "code"), u(this, "codeName"), u(this, "messages"), this.code = e, this.codeName = m[e], this.httpStatus = s, this.name = "CrossauthError", Array.isArray(t) ? this.messages = t : this.messages = [o], Object.setPrototypeOf(this, g.prototype);
   }
   /**
    * OAuth defines certain error types.  To convert the error in an OAuth
    * response into a CrossauthError object, call this function.
    * 
-   * @param error as returned by an OAuth call (converted to an {@link ErrorCode}).
+   * @param error as returned by an OAuth call (converted to an {@link @crossauth/common!ErrorCode}).
    * @param error_description as returned by an OAuth call (put in the `message`)
    * @returns a `CrossauthError` instance.
    */
@@ -164,7 +170,7 @@ class g extends Error {
    * it.  
    * If not and it is an object with `errorCode` in it, creates a 
    * CrossauthError from that and `errorMessage`, if present.
-   * Otherwise creates a `CrossauthError` object with {@link ErrorCode}
+   * Otherwise creates a `CrossauthError` object with {@link @crossauth/common!ErrorCode}
    * of `Unknown` from it, setting the `message` if possible.
    * 
    * @param e the error to convert.
@@ -174,13 +180,13 @@ class g extends Error {
     if (e instanceof Error)
       return "isCrossauthError" in e ? e : new g(48, e.message);
     if ("errorCode" in e) {
-      let i = 48;
+      let s = 48;
       try {
-        i = Number(e.errorCode) ?? 48;
+        s = Number(e.errorCode) ?? 48;
       } catch {
       }
-      let n = t ?? m[i];
-      return "errorMessage" in e ? n = e.errorMessage : "message" in e && (n = e.message), new g(i, n);
+      let n = t ?? m[s];
+      return "errorMessage" in e ? n = e.errorMessage : "message" in e && (n = e.message), new g(s, n);
     }
     let o = t ?? m[
       48
@@ -189,7 +195,7 @@ class g extends Error {
     return "message" in e && (o = e.message), new g(48, o);
   }
 }
-const W = class P {
+const L = class P {
   /**
    * Create a logger with the given level
    * @param level the level to report to
@@ -257,13 +263,13 @@ const W = class P {
     globalThis.crossauthLogger = e, globalThis.crossauthLoggerAcceptsJson = t;
   }
 };
-u(W, "None", 0), /** Only log errors */
-u(W, "Error", 1), /** Log errors and warning */
-u(W, "Warn", 2), /** Log errors, warnings and info messages */
-u(W, "Info", 3), /** Log everything */
-u(W, "Debug", 4), u(W, "levelName", ["NONE", "ERROR", "WARN", "INFO", "DEBUG"]);
-let d = W;
-function h(r) {
+u(L, "None", 0), /** Only log errors */
+u(L, "Error", 1), /** Log errors and warning */
+u(L, "Warn", 2), /** Log errors, warnings and info messages */
+u(L, "Info", 3), /** Log everything */
+u(L, "Debug", 4), u(L, "levelName", ["NONE", "ERROR", "WARN", "INFO", "DEBUG"]);
+let d = L;
+function l(r) {
   let e;
   typeof r == "object" && "err" in r && typeof r.err == "object" && (e = r.err.stack);
   try {
@@ -286,7 +292,7 @@ function h(r) {
 }
 globalThis.crossauthLogger = new d();
 globalThis.crossauthLoggerAcceptsJson = !0;
-const me = {
+const Ce = {
   issuer: "",
   authorization_endpoint: "",
   token_endpoint: "",
@@ -301,79 +307,129 @@ const me = {
   request_parameter_supported: !1,
   request_uri_parameter_supported: !0,
   require_request_uri_registration: !1
-}, te = crypto, ve = (r) => r instanceof CryptoKey, X = new TextEncoder(), G = new TextDecoder();
-function je(...r) {
-  const e = r.reduce((i, { length: n }) => i + n, 0), t = new Uint8Array(e);
+}, ae = crypto, Se = (r) => r instanceof CryptoKey, oe = new TextEncoder(), re = new TextDecoder();
+function Je(...r) {
+  const e = r.reduce((s, { length: n }) => s + n, 0), t = new Uint8Array(e);
   let o = 0;
-  for (const i of r)
-    t.set(i, o), o += i.length;
+  for (const s of r)
+    t.set(s, o), o += s.length;
   return t;
 }
-const xe = (r) => {
+const ze = (r) => {
   const e = atob(r), t = new Uint8Array(e.length);
   for (let o = 0; o < e.length; o++)
     t[o] = e.charCodeAt(o);
   return t;
-}, F = (r) => {
+}, z = (r) => {
   let e = r;
-  e instanceof Uint8Array && (e = G.decode(e)), e = e.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, "");
+  e instanceof Uint8Array && (e = re.decode(e)), e = e.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, "");
   try {
-    return xe(e);
+    return ze(e);
   } catch {
     throw new TypeError("The input to be decoded is not correctly encoded.");
   }
 };
-class oe extends Error {
-  static get code() {
-    return "ERR_JOSE_GENERIC";
+class E extends Error {
+  constructor(e, t) {
+    var o;
+    super(e, t), this.code = "ERR_JOSE_GENERIC", this.name = this.constructor.name, (o = Error.captureStackTrace) == null || o.call(Error, this, this.constructor);
   }
-  constructor(e) {
-    var t;
-    super(e), this.code = "ERR_JOSE_GENERIC", this.name = this.constructor.name, (t = Error.captureStackTrace) == null || t.call(Error, this, this.constructor);
+}
+E.code = "ERR_JOSE_GENERIC";
+class Le extends E {
+  constructor(e, t, o = "unspecified", s = "unspecified") {
+    super(e, { cause: { claim: o, reason: s, payload: t } }), this.code = "ERR_JWT_CLAIM_VALIDATION_FAILED", this.claim = o, this.reason = s, this.payload = t;
   }
 }
-class U extends oe {
+Le.code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+class Fe extends E {
+  constructor(e, t, o = "unspecified", s = "unspecified") {
+    super(e, { cause: { claim: o, reason: s, payload: t } }), this.code = "ERR_JWT_EXPIRED", this.claim = o, this.reason = s, this.payload = t;
+  }
+}
+Fe.code = "ERR_JWT_EXPIRED";
+class Me extends E {
+  constructor() {
+    super(...arguments), this.code = "ERR_JOSE_ALG_NOT_ALLOWED";
+  }
+}
+Me.code = "ERR_JOSE_ALG_NOT_ALLOWED";
+class I extends E {
   constructor() {
     super(...arguments), this.code = "ERR_JOSE_NOT_SUPPORTED";
   }
-  static get code() {
-    return "ERR_JOSE_NOT_SUPPORTED";
+}
+I.code = "ERR_JOSE_NOT_SUPPORTED";
+class $e extends E {
+  constructor(e = "decryption operation failed", t) {
+    super(e, t), this.code = "ERR_JWE_DECRYPTION_FAILED";
   }
 }
-class S extends oe {
+$e.code = "ERR_JWE_DECRYPTION_FAILED";
+class Be extends E {
   constructor() {
-    super(...arguments), this.code = "ERR_JWS_INVALID";
+    super(...arguments), this.code = "ERR_JWE_INVALID";
   }
-  static get code() {
-    return "ERR_JWS_INVALID";
+}
+Be.code = "ERR_JWE_INVALID";
+class C extends E {
+  constructor() {
+    super(...arguments), this.code = "ERR_JWS_INVALID";
   }
 }
-class D extends oe {
+C.code = "ERR_JWS_INVALID";
+class x extends E {
   constructor() {
     super(...arguments), this.code = "ERR_JWT_INVALID";
   }
-  static get code() {
-    return "ERR_JWT_INVALID";
+}
+x.code = "ERR_JWT_INVALID";
+class qe extends E {
+  constructor() {
+    super(...arguments), this.code = "ERR_JWK_INVALID";
   }
 }
-class Ke extends oe {
+qe.code = "ERR_JWK_INVALID";
+class Ve extends E {
   constructor() {
-    super(...arguments), this.code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED", this.message = "signature verification failed";
+    super(...arguments), this.code = "ERR_JWKS_INVALID";
+  }
+}
+Ve.code = "ERR_JWKS_INVALID";
+class Ge extends E {
+  constructor(e = "no applicable key found in the JSON Web Key Set", t) {
+    super(e, t), this.code = "ERR_JWKS_NO_MATCHING_KEY";
+  }
+}
+Ge.code = "ERR_JWKS_NO_MATCHING_KEY";
+class Ye extends E {
+  constructor(e = "multiple matching keys found in the JSON Web Key Set", t) {
+    super(e, t), this.code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
   }
-  static get code() {
-    return "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+}
+Ye.code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+class Xe extends E {
+  constructor(e = "request timed out", t) {
+    super(e, t), this.code = "ERR_JWKS_TIMEOUT";
+  }
+}
+Xe.code = "ERR_JWKS_TIMEOUT";
+class Te extends E {
+  constructor(e = "signature verification failed", t) {
+    super(e, t), this.code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
   }
 }
-function O(r, e = "algorithm.name") {
+Te.code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+function U(r, e = "algorithm.name") {
   return new TypeError(`CryptoKey does not support this operation, its ${e} must be ${r}`);
 }
-function Z(r, e) {
+function Q(r, e) {
   return r.name === e;
 }
-function ie(r) {
+function ce(r) {
   return parseInt(r.name.slice(4), 10);
 }
-function ze(r) {
+function Qe(r) {
   switch (r) {
     case "ES256":
       return "P-256";
@@ -385,7 +441,7 @@ function ze(r) {
       throw new Error("unreachable");
   }
 }
-function De(r, e) {
+function Ze(r, e) {
   if (e.length && !e.some((t) => r.usages.includes(t))) {
     let t = "CryptoKey does not support this operation, its usages must include ";
     if (e.length > 2) {
@@ -395,82 +451,87 @@ function De(r, e) {
     throw new TypeError(t);
   }
 }
-function We(r, e, ...t) {
+function er(r, e, ...t) {
   switch (e) {
     case "HS256":
     case "HS384":
     case "HS512": {
-      if (!Z(r.algorithm, "HMAC"))
-        throw O("HMAC");
+      if (!Q(r.algorithm, "HMAC"))
+        throw U("HMAC");
       const o = parseInt(e.slice(2), 10);
-      if (ie(r.algorithm.hash) !== o)
-        throw O(`SHA-${o}`, "algorithm.hash");
+      if (ce(r.algorithm.hash) !== o)
+        throw U(`SHA-${o}`, "algorithm.hash");
       break;
     }
     case "RS256":
     case "RS384":
     case "RS512": {
-      if (!Z(r.algorithm, "RSASSA-PKCS1-v1_5"))
-        throw O("RSASSA-PKCS1-v1_5");
+      if (!Q(r.algorithm, "RSASSA-PKCS1-v1_5"))
+        throw U("RSASSA-PKCS1-v1_5");
       const o = parseInt(e.slice(2), 10);
-      if (ie(r.algorithm.hash) !== o)
-        throw O(`SHA-${o}`, "algorithm.hash");
+      if (ce(r.algorithm.hash) !== o)
+        throw U(`SHA-${o}`, "algorithm.hash");
       break;
     }
     case "PS256":
     case "PS384":
     case "PS512": {
-      if (!Z(r.algorithm, "RSA-PSS"))
-        throw O("RSA-PSS");
+      if (!Q(r.algorithm, "RSA-PSS"))
+        throw U("RSA-PSS");
       const o = parseInt(e.slice(2), 10);
-      if (ie(r.algorithm.hash) !== o)
-        throw O(`SHA-${o}`, "algorithm.hash");
+      if (ce(r.algorithm.hash) !== o)
+        throw U(`SHA-${o}`, "algorithm.hash");
       break;
     }
     case "EdDSA": {
       if (r.algorithm.name !== "Ed25519" && r.algorithm.name !== "Ed448")
-        throw O("Ed25519 or Ed448");
+        throw U("Ed25519 or Ed448");
+      break;
+    }
+    case "Ed25519": {
+      if (!Q(r.algorithm, "Ed25519"))
+        throw U("Ed25519");
       break;
     }
     case "ES256":
     case "ES384":
     case "ES512": {
-      if (!Z(r.algorithm, "ECDSA"))
-        throw O("ECDSA");
-      const o = ze(e);
+      if (!Q(r.algorithm, "ECDSA"))
+        throw U("ECDSA");
+      const o = Qe(e);
       if (r.algorithm.namedCurve !== o)
-        throw O(o, "algorithm.namedCurve");
+        throw U(o, "algorithm.namedCurve");
       break;
     }
     default:
       throw new TypeError("CryptoKey does not support this operation");
   }
-  De(r, t);
+  Ze(r, t);
 }
-function ke(r, e, ...t) {
+function Ee(r, e, ...t) {
   var o;
-  if (t.length > 2) {
-    const i = t.pop();
-    r += `one of type ${t.join(", ")}, or ${i}.`;
+  if (t = t.filter(Boolean), t.length > 2) {
+    const s = t.pop();
+    r += `one of type ${t.join(", ")}, or ${s}.`;
   } else t.length === 2 ? r += `one of type ${t[0]} or ${t[1]}.` : r += `of type ${t[0]}.`;
   return e == null ? r += ` Received ${e}` : typeof e == "function" && e.name ? r += ` Received function ${e.name}` : typeof e == "object" && e != null && (o = e.constructor) != null && o.name && (r += ` Received an instance of ${e.constructor.name}`), r;
 }
-const le = (r, ...e) => ke("Key must be ", r, ...e);
-function Ce(r, e, ...t) {
-  return ke(`Key for the ${r} algorithm must be `, e, ...t);
+const pe = (r, ...e) => Ee("Key must be ", r, ...e);
+function be(r, e, ...t) {
+  return Ee(`Key for the ${r} algorithm must be `, e, ...t);
 }
-const _e = (r) => ve(r) ? !0 : (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject", re = ["CryptoKey"], Fe = (...r) => {
+const Ae = (r) => Se(r) ? !0 : (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject", ie = ["CryptoKey"], rr = (...r) => {
   const e = r.filter(Boolean);
   if (e.length === 0 || e.length === 1)
     return !0;
   let t;
   for (const o of e) {
-    const i = Object.keys(o);
+    const s = Object.keys(o);
     if (!t || t.size === 0) {
-      t = new Set(i);
+      t = new Set(s);
       continue;
     }
-    for (const n of i) {
+    for (const n of s) {
       if (t.has(n))
         return !1;
       t.add(n);
@@ -478,11 +539,11 @@ const _e = (r) => ve(r) ? !0 : (r == null ? void 0 : r[Symbol.toStringTag]) ===
   }
   return !0;
 };
-function Je(r) {
+function tr(r) {
   return typeof r == "object" && r !== null;
 }
-function $(r) {
-  if (!Je(r) || Object.prototype.toString.call(r) !== "[object Object]")
+function G(r) {
+  if (!tr(r) || Object.prototype.toString.call(r) !== "[object Object]")
     return !1;
   if (Object.getPrototypeOf(r) === null)
     return !0;
@@ -491,14 +552,26 @@ function $(r) {
     e = Object.getPrototypeOf(e);
   return Object.getPrototypeOf(r) === e;
 }
-const Me = (r, e) => {
+const or = (r, e) => {
   if (r.startsWith("RS") || r.startsWith("PS")) {
     const { modulusLength: t } = e.algorithm;
     if (typeof t != "number" || t < 2048)
       throw new TypeError(`${r} requires key modulusLength to be 2048 bits or larger`);
   }
 };
-function Be(r) {
+function Y(r) {
+  return G(r) && typeof r.kty == "string";
+}
+function sr(r) {
+  return r.kty !== "oct" && typeof r.d == "string";
+}
+function ir(r) {
+  return r.kty !== "oct" && typeof r.d > "u";
+}
+function nr(r) {
+  return Y(r) && r.kty === "oct" && typeof r.k == "string";
+}
+function ar(r) {
   let e, t;
   switch (r.kty) {
     case "RSA": {
@@ -523,7 +596,7 @@ function Be(r) {
           }, t = r.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
           break;
         default:
-          throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+          throw new I('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
       }
       break;
     }
@@ -545,12 +618,15 @@ function Be(r) {
           e = { name: "ECDH", namedCurve: r.crv }, t = r.d ? ["deriveBits"] : [];
           break;
         default:
-          throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+          throw new I('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
       }
       break;
     }
     case "OKP": {
       switch (r.alg) {
+        case "Ed25519":
+          e = { name: "Ed25519" }, t = r.d ? ["sign"] : ["verify"];
+          break;
         case "EdDSA":
           e = { name: r.crv }, t = r.d ? ["sign"] : ["verify"];
           break;
@@ -561,83 +637,83 @@ function Be(r) {
           e = { name: r.crv }, t = r.d ? ["deriveBits"] : [];
           break;
         default:
-          throw new U('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+          throw new I('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
       }
       break;
     }
     default:
-      throw new U('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
+      throw new I('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
   }
   return { algorithm: e, keyUsages: t };
 }
-const Se = async (r) => {
+const Re = async (r) => {
   if (!r.alg)
     throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-  const { algorithm: e, keyUsages: t } = Be(r), o = [
+  const { algorithm: e, keyUsages: t } = ar(r), o = [
     e,
     r.ext ?? !1,
     r.key_ops ?? t
-  ], i = { ...r };
-  return delete i.alg, delete i.use, te.subtle.importKey("jwk", i, ...o);
-}, Te = (r) => F(r);
-let se, ne;
-const be = (r) => (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject", Ae = async (r, e, t, o) => {
-  let i = r.get(e);
-  if (i != null && i[o])
-    return i[o];
-  const n = await Se({ ...t, alg: o });
-  return i ? i[o] = n : r.set(e, { [o]: n }), n;
-}, Le = (r, e) => {
-  if (be(r)) {
+  ], s = { ...r };
+  return delete s.alg, delete s.use, ae.subtle.importKey("jwk", s, ...o);
+}, Pe = (r) => z(r);
+let F, M;
+const Ie = (r) => (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject", ne = async (r, e, t, o, s = !1) => {
+  let n = r.get(e);
+  if (n != null && n[o])
+    return n[o];
+  const i = await Re({ ...t, alg: o });
+  return s && Object.freeze(e), n ? n[o] = i : r.set(e, { [o]: i }), i;
+}, cr = (r, e) => {
+  if (Ie(r)) {
     let t = r.export({ format: "jwk" });
-    return delete t.d, delete t.dp, delete t.dq, delete t.p, delete t.q, delete t.qi, t.k ? Te(t.k) : (ne || (ne = /* @__PURE__ */ new WeakMap()), Ae(ne, r, t, e));
+    return delete t.d, delete t.dp, delete t.dq, delete t.p, delete t.q, delete t.qi, t.k ? Pe(t.k) : (M || (M = /* @__PURE__ */ new WeakMap()), ne(M, r, t, e));
   }
-  return r;
-}, $e = (r, e) => {
-  if (be(r)) {
+  return Y(r) ? r.k ? z(r.k) : (M || (M = /* @__PURE__ */ new WeakMap()), ne(M, r, r, e, !0)) : r;
+}, dr = (r, e) => {
+  if (Ie(r)) {
     let t = r.export({ format: "jwk" });
-    return t.k ? Te(t.k) : (se || (se = /* @__PURE__ */ new WeakMap()), Ae(se, r, t, e));
+    return t.k ? Pe(t.k) : (F || (F = /* @__PURE__ */ new WeakMap()), ne(F, r, t, e));
   }
-  return r;
-}, qe = { normalizePublicKey: Le, normalizePrivateKey: $e }, j = (r, e, t = 0) => {
+  return Y(r) ? r.k ? z(r.k) : (F || (F = /* @__PURE__ */ new WeakMap()), ne(F, r, r, e, !0)) : r;
+}, lr = { normalizePublicKey: cr, normalizePrivateKey: dr }, H = (r, e, t = 0) => {
   t === 0 && (e.unshift(e.length), e.unshift(6));
   const o = r.indexOf(e[0], t);
   if (o === -1)
     return !1;
-  const i = r.subarray(o, o + e.length);
-  return i.length !== e.length ? !1 : i.every((n, s) => n === e[s]) || j(r, e, o + 1);
-}, ue = (r) => {
+  const s = r.subarray(o, o + e.length);
+  return s.length !== e.length ? !1 : s.every((n, i) => n === e[i]) || H(r, e, o + 1);
+}, ye = (r) => {
   switch (!0) {
-    case j(r, [42, 134, 72, 206, 61, 3, 1, 7]):
+    case H(r, [42, 134, 72, 206, 61, 3, 1, 7]):
       return "P-256";
-    case j(r, [43, 129, 4, 0, 34]):
+    case H(r, [43, 129, 4, 0, 34]):
       return "P-384";
-    case j(r, [43, 129, 4, 0, 35]):
+    case H(r, [43, 129, 4, 0, 35]):
       return "P-521";
-    case j(r, [43, 101, 110]):
+    case H(r, [43, 101, 110]):
       return "X25519";
-    case j(r, [43, 101, 111]):
+    case H(r, [43, 101, 111]):
       return "X448";
-    case j(r, [43, 101, 112]):
+    case H(r, [43, 101, 112]):
       return "Ed25519";
-    case j(r, [43, 101, 113]):
+    case H(r, [43, 101, 113]):
       return "Ed448";
     default:
-      throw new U("Invalid or unsupported EC Key Curve or OKP Key Sub Type");
+      throw new I("Invalid or unsupported EC Key Curve or OKP Key Sub Type");
   }
-}, Ee = async (r, e, t, o, i) => {
-  let n, s;
-  const a = new Uint8Array(atob(t.replace(r, "")).split("").map((l) => l.charCodeAt(0))), c = e === "spki";
+}, Oe = async (r, e, t, o, s) => {
+  let n, i;
+  const a = new Uint8Array(atob(t.replace(r, "")).split("").map((h) => h.charCodeAt(0))), c = e === "spki";
   switch (o) {
     case "PS256":
     case "PS384":
     case "PS512":
-      n = { name: "RSA-PSS", hash: `SHA-${o.slice(-3)}` }, s = c ? ["verify"] : ["sign"];
+      n = { name: "RSA-PSS", hash: `SHA-${o.slice(-3)}` }, i = c ? ["verify"] : ["sign"];
       break;
     case "RS256":
     case "RS384":
     case "RS512":
-      n = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${o.slice(-3)}` }, s = c ? ["verify"] : ["sign"];
+      n = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${o.slice(-3)}` }, i = c ? ["verify"] : ["sign"];
       break;
     case "RSA-OAEP":
     case "RSA-OAEP-256":
@@ -646,100 +722,135 @@ const be = (r) => (r == null ? void 0 : r[Symbol.toStringTag]) === "KeyObject",
       n = {
         name: "RSA-OAEP",
         hash: `SHA-${parseInt(o.slice(-3), 10) || 1}`
-      }, s = c ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
+      }, i = c ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
       break;
     case "ES256":
-      n = { name: "ECDSA", namedCurve: "P-256" }, s = c ? ["verify"] : ["sign"];
+      n = { name: "ECDSA", namedCurve: "P-256" }, i = c ? ["verify"] : ["sign"];
       break;
     case "ES384":
-      n = { name: "ECDSA", namedCurve: "P-384" }, s = c ? ["verify"] : ["sign"];
+      n = { name: "ECDSA", namedCurve: "P-384" }, i = c ? ["verify"] : ["sign"];
       break;
     case "ES512":
-      n = { name: "ECDSA", namedCurve: "P-521" }, s = c ? ["verify"] : ["sign"];
+      n = { name: "ECDSA", namedCurve: "P-521" }, i = c ? ["verify"] : ["sign"];
       break;
     case "ECDH-ES":
     case "ECDH-ES+A128KW":
     case "ECDH-ES+A192KW":
     case "ECDH-ES+A256KW": {
-      const l = ue(a);
-      n = l.startsWith("P-") ? { name: "ECDH", namedCurve: l } : { name: l }, s = c ? [] : ["deriveBits"];
+      const h = ye(a);
+      n = h.startsWith("P-") ? { name: "ECDH", namedCurve: h } : { name: h }, i = c ? [] : ["deriveBits"];
       break;
     }
+    case "Ed25519":
+      n = { name: "Ed25519" }, i = c ? ["verify"] : ["sign"];
+      break;
     case "EdDSA":
-      n = { name: ue(a) }, s = c ? ["verify"] : ["sign"];
+      n = { name: ye(a) }, i = c ? ["verify"] : ["sign"];
       break;
     default:
-      throw new U('Invalid or unsupported "alg" (Algorithm) value');
+      throw new I('Invalid or unsupported "alg" (Algorithm) value');
   }
-  return te.subtle.importKey(e, a, n, !1, s);
-}, Ve = (r, e, t) => Ee(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", r, e), Ge = (r, e, t) => Ee(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", r, e);
-async function Ye(r, e, t) {
+  return ae.subtle.importKey(e, a, n, !1, i);
+}, hr = (r, e, t) => Oe(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", r, e), ur = (r, e, t) => Oe(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", r, e);
+async function fr(r, e, t) {
   if (typeof r != "string" || r.indexOf("-----BEGIN PUBLIC KEY-----") !== 0)
     throw new TypeError('"spki" must be SPKI formatted string');
-  return Ge(r, e);
+  return ur(r, e);
 }
-async function Xe(r, e, t) {
+async function gr(r, e, t) {
   if (typeof r != "string" || r.indexOf("-----BEGIN PRIVATE KEY-----") !== 0)
     throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
-  return Ve(r, e);
+  return hr(r, e);
 }
-async function fe(r, e) {
-  if (!$(r))
+async function le(r, e) {
+  if (!G(r))
     throw new TypeError("JWK must be an object");
   switch (e || (e = r.alg), r.kty) {
     case "oct":
       if (typeof r.k != "string" || !r.k)
         throw new TypeError('missing "k" (Key Value) Parameter value');
-      return F(r.k);
+      return z(r.k);
     case "RSA":
-      if (r.oth !== void 0)
-        throw new U('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+      if ("oth" in r && r.oth !== void 0)
+        throw new I('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
     case "EC":
     case "OKP":
-      return Se({ ...r, alg: e });
+      return Re({ ...r, alg: e });
     default:
-      throw new U('Unsupported "kty" (Key Type) Parameter value');
+      throw new I('Unsupported "kty" (Key Type) Parameter value');
   }
 }
-const ee = (r) => r == null ? void 0 : r[Symbol.toStringTag], Ze = (r, e) => {
+const $ = (r) => r == null ? void 0 : r[Symbol.toStringTag], he = (r, e, t) => {
+  var o, s;
+  if (e.use !== void 0 && e.use !== "sig")
+    throw new TypeError("Invalid key for this operation, when present its use must be sig");
+  if (e.key_ops !== void 0 && ((s = (o = e.key_ops).includes) == null ? void 0 : s.call(o, t)) !== !0)
+    throw new TypeError(`Invalid key for this operation, when present its key_ops must include ${t}`);
+  if (e.alg !== void 0 && e.alg !== r)
+    throw new TypeError(`Invalid key for this operation, when present its alg must be ${r}`);
+  return !0;
+}, pr = (r, e, t, o) => {
   if (!(e instanceof Uint8Array)) {
-    if (!_e(e))
-      throw new TypeError(Ce(r, e, ...re, "Uint8Array"));
+    if (o && Y(e)) {
+      if (nr(e) && he(r, e, t))
+        return;
+      throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present');
+    }
+    if (!Ae(e))
+      throw new TypeError(be(r, e, ...ie, "Uint8Array", o ? "JSON Web Key" : null));
     if (e.type !== "secret")
-      throw new TypeError(`${ee(e)} instances for symmetric algorithms must be of type "secret"`);
+      throw new TypeError(`${$(e)} instances for symmetric algorithms must be of type "secret"`);
   }
-}, Qe = (r, e, t) => {
-  if (!_e(e))
-    throw new TypeError(Ce(r, e, ...re));
+}, yr = (r, e, t, o) => {
+  if (o && Y(e))
+    switch (t) {
+      case "sign":
+        if (sr(e) && he(r, e, t))
+          return;
+        throw new TypeError("JSON Web Key for this operation be a private JWK");
+      case "verify":
+        if (ir(e) && he(r, e, t))
+          return;
+        throw new TypeError("JSON Web Key for this operation be a public JWK");
+    }
+  if (!Ae(e))
+    throw new TypeError(be(r, e, ...ie, o ? "JSON Web Key" : null));
   if (e.type === "secret")
-    throw new TypeError(`${ee(e)} instances for asymmetric algorithms must not be of type "secret"`);
+    throw new TypeError(`${$(e)} instances for asymmetric algorithms must not be of type "secret"`);
+  if (t === "sign" && e.type === "public")
+    throw new TypeError(`${$(e)} instances for asymmetric algorithm signing must be of type "private"`);
+  if (t === "decrypt" && e.type === "public")
+    throw new TypeError(`${$(e)} instances for asymmetric algorithm decryption must be of type "private"`);
   if (e.algorithm && t === "verify" && e.type === "private")
-    throw new TypeError(`${ee(e)} instances for asymmetric algorithm verifying must be of type "public"`);
+    throw new TypeError(`${$(e)} instances for asymmetric algorithm verifying must be of type "public"`);
   if (e.algorithm && t === "encrypt" && e.type === "private")
-    throw new TypeError(`${ee(e)} instances for asymmetric algorithm encryption must be of type "public"`);
-}, er = (r, e, t) => {
-  r.startsWith("HS") || r === "dir" || r.startsWith("PBES2") || /^A\d{3}(?:GCM)?KW$/.test(r) ? Ze(r, e) : Qe(r, e, t);
+    throw new TypeError(`${$(e)} instances for asymmetric algorithm encryption must be of type "public"`);
 };
-function rr(r, e, t, o, i) {
-  if (i.crit !== void 0 && (o == null ? void 0 : o.crit) === void 0)
+function Ue(r, e, t, o) {
+  e.startsWith("HS") || e === "dir" || e.startsWith("PBES2") || /^A\d{3}(?:GCM)?KW$/.test(e) ? pr(e, t, o, r) : yr(e, t, o, r);
+}
+Ue.bind(void 0, !1);
+const we = Ue.bind(void 0, !0);
+function wr(r, e, t, o, s) {
+  if (s.crit !== void 0 && (o == null ? void 0 : o.crit) === void 0)
     throw new r('"crit" (Critical) Header Parameter MUST be integrity protected');
   if (!o || o.crit === void 0)
     return /* @__PURE__ */ new Set();
-  if (!Array.isArray(o.crit) || o.crit.length === 0 || o.crit.some((s) => typeof s != "string" || s.length === 0))
+  if (!Array.isArray(o.crit) || o.crit.length === 0 || o.crit.some((i) => typeof i != "string" || i.length === 0))
     throw new r('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
   let n;
   n = e;
-  for (const s of o.crit) {
-    if (!n.has(s))
-      throw new U(`Extension Header Parameter "${s}" is not recognized`);
-    if (i[s] === void 0)
-      throw new r(`Extension Header Parameter "${s}" is missing`);
-    if (n.get(s) && o[s] === void 0)
-      throw new r(`Extension Header Parameter "${s}" MUST be integrity protected`);
+  for (const i of o.crit) {
+    if (!n.has(i))
+      throw new I(`Extension Header Parameter "${i}" is not recognized`);
+    if (s[i] === void 0)
+      throw new r(`Extension Header Parameter "${i}" is missing`);
+    if (n.get(i) && o[i] === void 0)
+      throw new r(`Extension Header Parameter "${i}" MUST be integrity protected`);
   }
   return new Set(o.crit);
 }
-function tr(r, e) {
+function mr(r, e) {
   const t = `SHA-${r.slice(-3)}`;
   switch (r) {
     case "HS256":
@@ -758,103 +869,105 @@ function tr(r, e) {
     case "ES384":
     case "ES512":
       return { hash: t, name: "ECDSA", namedCurve: e.namedCurve };
+    case "Ed25519":
+      return { name: "Ed25519" };
     case "EdDSA":
       return { name: e.name };
     default:
-      throw new U(`alg ${r} is not supported either by JOSE or your javascript runtime`);
+      throw new I(`alg ${r} is not supported either by JOSE or your javascript runtime`);
   }
 }
-async function or(r, e, t) {
-  if (e = await qe.normalizePublicKey(e, r), ve(e))
-    return We(e, r, t), e;
+async function vr(r, e, t) {
+  if (e = await lr.normalizePublicKey(e, r), Se(e))
+    return er(e, r, t), e;
   if (e instanceof Uint8Array) {
     if (!r.startsWith("HS"))
-      throw new TypeError(le(e, ...re));
-    return te.subtle.importKey("raw", e, { hash: `SHA-${r.slice(-3)}`, name: "HMAC" }, !1, [t]);
+      throw new TypeError(pe(e, ...ie));
+    return ae.subtle.importKey("raw", e, { hash: `SHA-${r.slice(-3)}`, name: "HMAC" }, !1, [t]);
   }
-  throw new TypeError(le(e, ...re, "Uint8Array"));
+  throw new TypeError(pe(e, ...ie, "Uint8Array", "JSON Web Key"));
 }
-const ir = async (r, e, t, o) => {
-  const i = await or(r, e, "verify");
-  Me(r, i);
-  const n = tr(r, i.algorithm);
+const _r = async (r, e, t, o) => {
+  const s = await vr(r, e, "verify");
+  or(r, s);
+  const n = mr(r, s.algorithm);
   try {
-    return await te.subtle.verify(n, i, t, o);
+    return await ae.subtle.verify(n, s, t, o);
   } catch {
     return !1;
   }
 };
-async function sr(r, e, t) {
-  if (!$(r))
-    throw new S("Flattened JWS must be an object");
+async function kr(r, e, t) {
+  if (!G(r))
+    throw new C("Flattened JWS must be an object");
   if (r.protected === void 0 && r.header === void 0)
-    throw new S('Flattened JWS must have either of the "protected" or "header" members');
+    throw new C('Flattened JWS must have either of the "protected" or "header" members');
   if (r.protected !== void 0 && typeof r.protected != "string")
-    throw new S("JWS Protected Header incorrect type");
+    throw new C("JWS Protected Header incorrect type");
   if (r.payload === void 0)
-    throw new S("JWS Payload missing");
+    throw new C("JWS Payload missing");
   if (typeof r.signature != "string")
-    throw new S("JWS Signature missing or incorrect type");
-  if (r.header !== void 0 && !$(r.header))
-    throw new S("JWS Unprotected Header incorrect type");
+    throw new C("JWS Signature missing or incorrect type");
+  if (r.header !== void 0 && !G(r.header))
+    throw new C("JWS Unprotected Header incorrect type");
   let o = {};
   if (r.protected)
     try {
-      const L = F(r.protected);
-      o = JSON.parse(G.decode(L));
+      const X = z(r.protected);
+      o = JSON.parse(re.decode(X));
     } catch {
-      throw new S("JWS Protected Header is invalid");
+      throw new C("JWS Protected Header is invalid");
     }
-  if (!Fe(o, r.header))
-    throw new S("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-  const i = {
+  if (!rr(o, r.header))
+    throw new C("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const s = {
     ...o,
     ...r.header
-  }, n = rr(S, /* @__PURE__ */ new Map([["b64", !0]]), void 0, o, i);
-  let s = !0;
-  if (n.has("b64") && (s = o.b64, typeof s != "boolean"))
-    throw new S('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-  const { alg: a } = i;
+  }, n = wr(C, /* @__PURE__ */ new Map([["b64", !0]]), void 0, o, s);
+  let i = !0;
+  if (n.has("b64") && (i = o.b64, typeof i != "boolean"))
+    throw new C('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+  const { alg: a } = s;
   if (typeof a != "string" || !a)
-    throw new S('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-  if (s) {
+    throw new C('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  if (i) {
     if (typeof r.payload != "string")
-      throw new S("JWS Payload must be a string");
+      throw new C("JWS Payload must be a string");
   } else if (typeof r.payload != "string" && !(r.payload instanceof Uint8Array))
-    throw new S("JWS Payload must be a string or an Uint8Array instance");
+    throw new C("JWS Payload must be a string or an Uint8Array instance");
   let c = !1;
-  typeof e == "function" && (e = await e(o, r), c = !0), er(a, e, "verify");
-  const l = je(X.encode(r.protected ?? ""), X.encode("."), typeof r.payload == "string" ? X.encode(r.payload) : r.payload);
+  typeof e == "function" ? (e = await e(o, r), c = !0, we(a, e, "verify"), Y(e) && (e = await le(e, a))) : we(a, e, "verify");
+  const h = Je(oe.encode(r.protected ?? ""), oe.encode("."), typeof r.payload == "string" ? oe.encode(r.payload) : r.payload);
   let y;
   try {
-    y = F(r.signature);
+    y = z(r.signature);
   } catch {
-    throw new S("Failed to base64url decode the signature");
+    throw new C("Failed to base64url decode the signature");
   }
-  if (!await ir(a, e, y, l))
-    throw new Ke();
-  let k;
-  if (s)
+  if (!await _r(a, e, y, h))
+    throw new Te();
+  let _;
+  if (i)
     try {
-      k = F(r.payload);
+      _ = z(r.payload);
     } catch {
-      throw new S("Failed to base64url decode the payload");
+      throw new C("Failed to base64url decode the payload");
     }
-  else typeof r.payload == "string" ? k = X.encode(r.payload) : k = r.payload;
-  const b = { payload: k };
+  else typeof r.payload == "string" ? _ = oe.encode(r.payload) : _ = r.payload;
+  const b = { payload: _ };
   return r.protected !== void 0 && (b.protectedHeader = o), r.header !== void 0 && (b.unprotectedHeader = r.header), c ? { ...b, key: e } : b;
 }
-async function nr(r, e, t) {
-  if (r instanceof Uint8Array && (r = G.decode(r)), typeof r != "string")
-    throw new S("Compact JWS must be a string or Uint8Array");
-  const { 0: o, 1: i, 2: n, length: s } = r.split(".");
-  if (s !== 3)
-    throw new S("Invalid Compact JWS");
-  const a = await sr({ payload: i, protected: o, signature: n }, e), c = { payload: a.payload, protectedHeader: a.protectedHeader };
+async function Cr(r, e, t) {
+  if (r instanceof Uint8Array && (r = re.decode(r)), typeof r != "string")
+    throw new C("Compact JWS must be a string or Uint8Array");
+  const { 0: o, 1: s, 2: n, length: i } = r.split(".");
+  if (i !== 3)
+    throw new C("Invalid Compact JWS");
+  const a = await kr({ payload: s, protected: o, signature: n }, e), c = { payload: a.payload, protectedHeader: a.protectedHeader };
   return typeof e == "function" ? { ...c, key: a.key } : c;
 }
-const Pe = F;
-function ge(r) {
+const Ne = z;
+function me(r) {
   let e;
   if (typeof r == "string") {
     const t = r.split(".");
@@ -867,41 +980,41 @@ function ge(r) {
   try {
     if (typeof e != "string" || !e)
       throw new Error();
-    const t = JSON.parse(G.decode(Pe(e)));
-    if (!$(t))
+    const t = JSON.parse(re.decode(Ne(e)));
+    if (!G(t))
       throw new Error();
     return t;
   } catch {
     throw new TypeError("Invalid Token or Protected Header formatting");
   }
 }
-function ar(r) {
+function Sr(r) {
   if (typeof r != "string")
-    throw new D("JWTs must use Compact JWS serialization, JWT must be a string");
+    throw new x("JWTs must use Compact JWS serialization, JWT must be a string");
   const { 1: e, length: t } = r.split(".");
   if (t === 5)
-    throw new D("Only JWTs using Compact JWS serialization can be decoded");
+    throw new x("Only JWTs using Compact JWS serialization can be decoded");
   if (t !== 3)
-    throw new D("Invalid JWT");
+    throw new x("Invalid JWT");
   if (!e)
-    throw new D("JWTs must contain a payload");
+    throw new x("JWTs must contain a payload");
   let o;
   try {
-    o = Pe(e);
+    o = Ne(e);
   } catch {
-    throw new D("Failed to base64url decode the payload");
+    throw new x("Failed to base64url decode the payload");
   }
-  let i;
+  let s;
   try {
-    i = JSON.parse(G.decode(o));
+    s = JSON.parse(re.decode(o));
   } catch {
-    throw new D("Failed to parse the decoded payload as JSON");
+    throw new x("Failed to parse the decoded payload as JSON");
   }
-  if (!$(i))
-    throw new D("Invalid JWT Claims Set");
-  return i;
+  if (!G(s))
+    throw new x("Invalid JWT Claims Set");
+  return s;
 }
-const C = class v {
+const k = class v {
   /**
    * Returns a user-friendly name for the given flow strings.
    * 
@@ -971,33 +1084,33 @@ const C = class v {
     }
   }
 };
-u(C, "All", "all"), /** OAuth authorization code flow (without PKCE) */
-u(C, "AuthorizationCode", "authorizationCode"), /** OAuth authorization code flow with PKCE */
-u(C, "AuthorizationCodeWithPKCE", "authorizationCodeWithPKCE"), /** Auth client credentials flow */
-u(C, "ClientCredentials", "clientCredentials"), /** OAuth refresh token flow */
-u(C, "RefreshToken", "refreshToken"), /** OAuth device code flow */
-u(C, "DeviceCode", "deviceCode"), /** OAuth password flow */
-u(C, "Password", "password"), /** The Auth0 password MFA extension to the password flow */
-u(C, "PasswordMfa", "passwordMfa"), /** The OpenID Connect authorization code flow, with or without
+u(k, "All", "all"), /** OAuth authorization code flow (without PKCE) */
+u(k, "AuthorizationCode", "authorizationCode"), /** OAuth authorization code flow with PKCE */
+u(k, "AuthorizationCodeWithPKCE", "authorizationCodeWithPKCE"), /** Auth client credentials flow */
+u(k, "ClientCredentials", "clientCredentials"), /** OAuth refresh token flow */
+u(k, "RefreshToken", "refreshToken"), /** OAuth device code flow */
+u(k, "DeviceCode", "deviceCode"), /** OAuth password flow */
+u(k, "Password", "password"), /** The Auth0 password MFA extension to the password flow */
+u(k, "PasswordMfa", "passwordMfa"), /** The OpenID Connect authorization code flow, with or without
 * PKCE.
 */
-u(C, "OidcAuthorizationCode", "oidcAuthorizationCode"), /** A user friendly name for the given flow ID
+u(k, "OidcAuthorizationCode", "oidcAuthorizationCode"), /** A user friendly name for the given flow ID
 * 
 * For example, if you pass "authorizationCode" 
 * (`OAuthFlows.AuthorizationCode`) you will get `"Authorization Code"`.
 */
-u(C, "flowName", {
-  [C.AuthorizationCode]: "Authorization Code",
-  [C.AuthorizationCodeWithPKCE]: "Authorization Code with PKCE",
-  [C.ClientCredentials]: "Client Credentials",
-  [C.RefreshToken]: "Refresh Token",
-  [C.DeviceCode]: "Device Code",
-  [C.Password]: "Password",
-  [C.PasswordMfa]: "Password MFA",
-  [C.OidcAuthorizationCode]: "OIDC Authorization Code"
+u(k, "flowName", {
+  [k.AuthorizationCode]: "Authorization Code",
+  [k.AuthorizationCodeWithPKCE]: "Authorization Code with PKCE",
+  [k.ClientCredentials]: "Client Credentials",
+  [k.RefreshToken]: "Refresh Token",
+  [k.DeviceCode]: "Device Code",
+  [k.Password]: "Password",
+  [k.PasswordMfa]: "Password MFA",
+  [k.OidcAuthorizationCode]: "OIDC Authorization Code"
 });
-var _, A;
-class cr {
+var S, A;
+class Tr {
   /**
    * Constructor.
    * 
@@ -1029,22 +1142,22 @@ class cr {
     authServerBaseUrl: e,
     client_id: t,
     client_secret: o,
-    redirect_uri: i,
+    redirect_uri: s,
     codeChallengeMethod: n,
-    stateLength: s,
+    stateLength: i,
     verifierLength: a,
     tokenConsumer: c,
-    authServerCredentials: l,
+    authServerCredentials: h,
     authServerMode: y,
-    authServerHeaders: k
+    authServerHeaders: _
   }) {
-    u(this, "authServerBaseUrl", ""), he(this, _), he(this, A), u(this, "codeChallengeMethod", "S256"), u(this, "verifierLength", 32), u(this, "redirect_uri"), u(this, "stateLength", 32), u(this, "authzCode", ""), u(this, "oidcConfig"), u(this, "tokenConsumer"), u(this, "authServerHeaders", {}), u(this, "authServerMode"), u(this, "authServerCredentials"), u(this, "oauthPostType", "json"), u(this, "oauthLogFetch", !1), u(this, "oauthUseUserInfoEndpoint", !1), u(this, "oauthAuthorizeRedirect"), this.tokenConsumer = c, this.authServerBaseUrl = e, a && (this.verifierLength = a), s && (this.stateLength = s), t && Y(this, _, t), o && Y(this, A, o), i && (this.redirect_uri = i), n && (this.codeChallengeMethod = n), this.authServerBaseUrl = e, l && (this.authServerCredentials = l), y && (this.authServerMode = y), k && (this.authServerHeaders = k);
+    u(this, "authServerBaseUrl", ""), ge(this, S), ge(this, A), u(this, "codeChallengeMethod", "S256"), u(this, "verifierLength", 32), u(this, "redirect_uri"), u(this, "stateLength", 32), u(this, "authzCode", ""), u(this, "oidcConfig"), u(this, "tokenConsumer"), u(this, "authServerHeaders", {}), u(this, "authServerMode"), u(this, "authServerCredentials"), u(this, "oauthPostType", "json"), u(this, "oauthLogFetch", !1), u(this, "oauthUseUserInfoEndpoint", !1), u(this, "oauthAuthorizeRedirect"), this.tokenConsumer = c, this.authServerBaseUrl = e, a && (this.verifierLength = a), i && (this.stateLength = i), t && te(this, S, t), o && te(this, A, o), s && (this.redirect_uri = s), n && (this.codeChallengeMethod = n), this.authServerBaseUrl = e, h && (this.authServerCredentials = h), y && (this.authServerMode = y), _ && (this.authServerHeaders = _);
   }
   set client_id(e) {
-    Y(this, _, e);
+    te(this, S, e);
   }
   set client_secret(e) {
-    Y(this, A, e);
+    te(this, A, e);
   }
   /**
    * Loads OpenID Connect configuration so that the client can determine
@@ -1054,12 +1167,12 @@ class cr {
    *        Otherwise, performs a fetch by appending
    *        `/.well-known/openid-configuration` to the 
    *        `authServerBaseUrl`.
-   * @throws {@link CrossauthError} with the following {@link ErrorCode}s
+   * @throws {@link @crossauth/common!CrossauthError} with the following {@link @crossauth/common!ErrorCode}s
    *   - `Connection` if data from the URL could not be fetched or parsed.
    */
   async loadConfig(e) {
     if (e) {
-      d.logger.debug(h({ msg: "Reading OIDC config locally" })), this.oidcConfig = e;
+      d.logger.debug(l({ msg: "Reading OIDC config locally" })), this.oidcConfig = e;
       return;
     }
     let t;
@@ -1067,22 +1180,22 @@ class cr {
       const o = new URL(
         this.authServerBaseUrl + "/.well-known/openid-configuration"
       );
-      d.logger.debug(h({ msg: `Fetching OIDC config from ${o}` }));
-      let i = { headers: this.authServerHeaders };
-      this.authServerMode && (i.mode = this.authServerMode), this.authServerCredentials && (i.credentials = this.authServerCredentials), t = await fetch(o, i);
+      d.logger.debug(l({ msg: `Fetching OIDC config from ${o}` }));
+      let s = { headers: this.authServerHeaders };
+      this.authServerMode && (s.mode = this.authServerMode), this.authServerCredentials && (s.credentials = this.authServerCredentials), t = await fetch(o, s);
     } catch (o) {
-      d.logger.error(h({ err: o }));
+      d.logger.error(l({ err: o }));
     }
     if (!t || !t.ok)
       throw new g(
         m.Connection,
         "Couldn't get OIDC configuration from URL" + this.authServerBaseUrl + "/.well-known/openid-configuration"
       );
-    this.oidcConfig = { ...me };
+    this.oidcConfig = { ...Ce };
     try {
       const o = await t.json();
-      for (const [i, n] of Object.entries(o))
-        this.oidcConfig[i] = n;
+      for (const [s, n] of Object.entries(o))
+        this.oidcConfig[s] = n;
     } catch {
       throw new g(
         m.Connection,
@@ -1112,9 +1225,9 @@ class cr {
    *          - `error_description` friendly error message or undefined
    *            if no error
    */
-  async startAuthorizationCodeFlow(e, t, o, i = !1) {
-    var n, s, a;
-    if (d.logger.debug(h({ msg: "Starting authorization code flow" })), this.oidcConfig || await this.loadConfig(), !((n = this.oidcConfig) != null && n.response_types_supported.includes("code")) || !((s = this.oidcConfig) != null && s.response_modes_supported.includes("query")))
+  async startAuthorizationCodeFlow(e, t, o, s = !1) {
+    var n, i, a;
+    if (d.logger.debug(l({ msg: "Starting authorization code flow" })), this.oidcConfig || await this.loadConfig(), !((n = this.oidcConfig) != null && n.response_types_supported.includes("code")) || !((i = this.oidcConfig) != null && i.response_modes_supported.includes("query")))
       return {
         error: "invalid_request",
         error_description: "Server does not support authorization code flow"
@@ -1124,7 +1237,7 @@ class cr {
         error: "server_error",
         error_description: "Cannot get authorize endpoint"
       };
-    if (!w(this, _)) return {
+    if (!w(this, S)) return {
       error: "invalid_request",
       error_description: "Cannot make authorization code flow without client id"
     };
@@ -1134,39 +1247,39 @@ class cr {
     };
     let c = this.oidcConfig.authorization_endpoint;
     this.oauthAuthorizeRedirect && (c = this.oauthAuthorizeRedirect);
-    let l = c + "?response_type=code&client_id=" + encodeURIComponent(w(this, _)) + "&state=" + encodeURIComponent(e) + "&redirect_uri=" + encodeURIComponent(this.redirect_uri);
-    return t && (l += "&scope=" + encodeURIComponent(t)), i && o && (l += "&code_challenge=" + o), { url: l };
+    let h = c + "?response_type=code&client_id=" + encodeURIComponent(w(this, S)) + "&state=" + encodeURIComponent(e) + "&redirect_uri=" + encodeURIComponent(this.redirect_uri);
+    return t && (h += "&scope=" + encodeURIComponent(t)), s && o && (h += "&code_challenge=" + o), { url: h };
   }
   async codeChallengeAndVerifier() {
     const e = this.randomValue(this.verifierLength);
     return { codeChallenge: this.codeChallengeMethod == "plain" ? e : await this.sha256(e), codeVerifier: e };
   }
   async getIdPayload(e, t) {
-    let o, i;
+    let o, s;
     try {
       let n;
       if (n = await this.validateIdToken(e), !n)
-        return o = "access_denied", i = "Invalid ID token received", { error: o, error_description: i };
+        return o = "access_denied", s = "Invalid ID token received", { error: o, error_description: s };
       if (t && this.oauthUseUserInfoEndpoint) {
-        const s = await this.userInfoEndpoint(t);
-        if (s.error)
-          return o = s.error, i = "Failed getting user info: " + (s.error_description ?? "unknown error"), { error: o, error_description: i };
-        n = { ...n, ...s };
+        const i = await this.userInfoEndpoint(t);
+        if (i.error)
+          return o = i.error, s = "Failed getting user info: " + (i.error_description ?? "unknown error"), { error: o, error_description: s };
+        n = { ...n, ...i };
       }
       return { payload: n };
     } catch (n) {
-      const s = g.asCrossauthError(n);
-      return d.logger.debug(h({ err: s })), d.logger.error(h({ msg: "Couldn't get user info", cerr: s })), o = s.oauthErrorCode, i = "Couldn't get user info: " + s.message, { error: o, error_description: i };
+      const i = g.asCrossauthError(n);
+      return d.logger.debug(l({ err: i })), d.logger.error(l({ msg: "Couldn't get user info", cerr: i })), o = i.oauthErrorCode, s = "Couldn't get user info: " + i.message, { error: o, error_description: s };
     }
   }
   async getAccessPayload(e, t) {
-    let o, i;
+    let o, s;
     try {
       let n;
-      return n = await this.validateAccessToken(e, t), n ? { payload: n } : (o = "access_denied", i = "Invalid access token received", { error: o, error_description: i });
+      return n = await this.validateAccessToken(e, t), n ? { payload: n } : (o = "access_denied", s = "Invalid access token received", { error: o, error_description: s });
     } catch (n) {
-      const s = g.asCrossauthError(n);
-      return d.logger.debug(h({ err: s })), d.logger.error(h({ msg: "Couldn't get user info", cerr: s })), o = s.oauthErrorCode, i = "Couldn't get user info: " + s.message, { error: o, error_description: i };
+      const i = g.asCrossauthError(n);
+      return d.logger.debug(l({ err: i })), d.logger.error(l({ msg: "Couldn't get user info", cerr: i })), o = i.oauthErrorCode, s = "Couldn't get user info: " + i.message, { error: o, error_description: s };
     }
   }
   /**
@@ -1189,11 +1302,11 @@ class cr {
    * @returns The {@link OAuthTokenResponse} from the `token` endpoint
    *          request, or `error` and `error_description`.
    */
-  async redirectEndpoint(e, t, o, i, n) {
-    var s, a;
-    if (this.oidcConfig || await this.loadConfig(), i || !e)
-      return i || (i = "server_error"), n || (n = "Unknown error"), { error: i, error_description: n };
-    if (this.authzCode = e, !((s = this.oidcConfig) != null && s.grant_types_supported.includes("authorization_code")))
+  async redirectEndpoint(e, t, o, s, n) {
+    var i, a;
+    if (this.oidcConfig || await this.loadConfig(), s || !e)
+      return s || (s = "server_error"), n || (n = "Unknown error"), { error: s, error_description: n };
+    if (this.authzCode = e, !((i = this.oidcConfig) != null && i.grant_types_supported.includes("authorization_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support authorization code grant"
@@ -1204,26 +1317,26 @@ class cr {
         error_description: "Cannot get token endpoint"
       };
     const c = this.oidcConfig.token_endpoint;
-    let l, y;
-    l = "authorization_code", y = w(this, A);
-    let k = {
-      grant_type: l,
-      client_id: w(this, _),
+    let h, y;
+    h = "authorization_code", y = w(this, A);
+    let _ = {
+      grant_type: h,
+      client_id: w(this, S),
       code: this.authzCode,
       redirect_uri: this.redirect_uri
     };
-    t && (k.scope = t), y && (k.client_secret = y), o && (k.code_verifier = o);
+    t && (_.scope = t), y && (_.client_secret = y), o && (_.code_verifier = o);
     try {
-      let b = await this.post(c, k, this.authServerHeaders);
+      let b = await this.post(c, _, this.authServerHeaders);
       if (b.id_token) {
-        const L = await this.getIdPayload(b.id_token, b.access_token);
-        if (L.error)
-          return L;
-        b.id_payload = L.payload;
+        const X = await this.getIdPayload(b.id_token, b.access_token);
+        if (X.error)
+          return X;
+        b.id_payload = X.payload;
       }
       return b;
     } catch (b) {
-      return d.logger.error(h({ err: b })), {
+      return d.logger.error(l({ err: b })), {
         error: "server_error",
         error_description: "Unable to get access token from server"
       };
@@ -1245,35 +1358,35 @@ class cr {
    */
   async clientCredentialsFlow(e) {
     var t, o;
-    if (d.logger.debug(h({ msg: "Starting client credentials flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("client_credentials")))
+    if (d.logger.debug(l({ msg: "Starting client credentials flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("client_credentials")))
       return {
         error: "invalid_request",
         error_description: "Server does not support client credentials grant"
       };
     if (!((o = this.oidcConfig) != null && o.token_endpoint))
       return { error: "server_error", error_description: "Cannot get token endpoint" };
-    if (!w(this, _)) return {
+    if (!w(this, S)) return {
       error: "invalid_request",
       error_description: "Cannot make client credentials flow without client id"
     };
-    const i = this.oidcConfig.token_endpoint;
+    const s = this.oidcConfig.token_endpoint;
     let n = {
       grant_type: "client_credentials",
-      client_id: w(this, _),
+      client_id: w(this, S),
       client_secret: w(this, A)
     };
     e && (n.scope = e);
     try {
-      let s = await this.post(i, n, this.authServerHeaders);
-      if (s.id_token) {
-        const a = await this.getIdPayload(s.id_token, s.access_token);
+      let i = await this.post(s, n, this.authServerHeaders);
+      if (i.id_token) {
+        const a = await this.getIdPayload(i.id_token, i.access_token);
         if (a.error)
           return a;
-        s.id_payload = a.payload;
+        i.id_payload = a.payload;
       }
-      return s;
-    } catch (s) {
-      return d.logger.error(h({ err: s })), {
+      return i;
+    } catch (i) {
+      return d.logger.error(l({ err: i })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1295,8 +1408,8 @@ class cr {
    * 
    */
   async passwordFlow(e, t, o) {
-    var i, n;
-    if (d.logger.debug(h({ msg: "Starting password flow" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("password")))
+    var s, n;
+    if (d.logger.debug(l({ msg: "Starting password flow" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("password")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password grant"
@@ -1306,26 +1419,26 @@ class cr {
         error: "server_error",
         error_description: "Cannot get token endpoint"
       };
-    const s = this.oidcConfig.token_endpoint;
+    const i = this.oidcConfig.token_endpoint;
     let a = {
       grant_type: "password",
-      client_id: w(this, _),
+      client_id: w(this, S),
       client_secret: w(this, A),
       username: e,
       password: t
     };
     o && (a.scope = o);
     try {
-      let c = await this.post(s, a, this.authServerHeaders);
+      let c = await this.post(i, a, this.authServerHeaders);
       if (c.id_token) {
-        const l = await this.getIdPayload(c.id_token, c.access_token);
-        if (l.error)
-          return l;
-        c.id_payload = l.payload;
+        const h = await this.getIdPayload(c.id_token, c.access_token);
+        if (h.error)
+          return h;
+        c.id_payload = h.payload;
       }
       return c;
     } catch (c) {
-      return d.logger.error(h({ err: c })), {
+      return d.logger.error(l({ err: c })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1345,34 +1458,34 @@ class cr {
    *     documentation
    */
   async mfaAuthenticators(e) {
-    var t, o, i;
-    if (d.logger.debug(h({ msg: "Getting valid MFA authenticators" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")) && (o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob"))
+    var t, o, s;
+    if (d.logger.debug(l({ msg: "Getting valid MFA authenticators" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")) && (o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob"))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((i = this.oidcConfig) != null && i.issuer))
+    if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
-    const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/authenticators", s = await this.get(n, { authorization: "Bearer " + e, ...this.authServerHeaders });
-    if (!Array.isArray(s))
+    const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/authenticators", i = await this.get(n, { authorization: "Bearer " + e, ...this.authServerHeaders });
+    if (!Array.isArray(i))
       return {
         error: "server_error",
         error_description: "Expected array of authenticators in mfa/authenticators response"
       };
     let a = [];
-    for (let c = 0; c < s.length; ++c) {
-      const l = s[c];
-      if (!l.id || !l.authenticator_type || !l.active)
+    for (let c = 0; c < i.length; ++c) {
+      const h = i[c];
+      if (!h.id || !h.authenticator_type || !h.active)
         return {
           error: "server_error",
           error_description: "Invalid mfa/authenticators response"
         };
       a.push({
-        id: l.id,
-        authenticator_type: l.authenticator_type,
-        active: l.active,
-        name: l.name,
-        oob_channel: l.oob_channel
+        id: h.id,
+        authenticator_type: h.authenticator_type,
+        active: h.active,
+        name: h.name,
+        oob_channel: h.oob_channel
       });
     }
     return { authenticators: a };
@@ -1390,25 +1503,25 @@ class cr {
    * from the `mfaAuthenticators` request.
    */
   async mfaOtpRequest(e, t) {
-    var o, i;
-    if (d.logger.debug(h({ msg: "Making MFA OTB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    var o, s;
+    if (d.logger.debug(l({ msg: "Making MFA OTB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((i = this.oidcConfig) != null && i.issuer))
+    if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
-    const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", s = await this.post(n, {
-      client_id: w(this, _),
+    const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", i = await this.post(n, {
+      client_id: w(this, S),
       client_secret: w(this, A),
       challenge_type: "otp",
       mfa_token: e,
       authenticator_id: t
     }, this.authServerHeaders);
-    return s.challenge_type != "otp" ? {
-      error: s.error ?? "server_error",
-      error_description: s.error_description ?? "Invalid OTP challenge response"
-    } : s;
+    return i.challenge_type != "otp" ? {
+      error: i.error ?? "server_error",
+      error_description: i.error_description ?? "Invalid OTP challenge response"
+    } : i;
   }
   /**
    * Completes the Password MFA OTP flow.
@@ -1428,17 +1541,17 @@ class cr {
    *   - `error_description` friendly error message
    */
   async mfaOtpComplete(e, t, o) {
-    var i, n;
-    if (d.logger.debug(h({ msg: "Completing MFA OTP request" })), this.oidcConfig || await this.loadConfig(), !((i = this.oidcConfig) != null && i.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    var s, n;
+    if (d.logger.debug(l({ msg: "Completing MFA OTP request" })), this.oidcConfig || await this.loadConfig(), !((s = this.oidcConfig) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
     if (!((n = this.oidcConfig) != null && n.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
-    const s = this.oidcConfig.token_endpoint, a = await this.post(s, {
+    const i = this.oidcConfig.token_endpoint, a = await this.post(i, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-otp",
-      client_id: w(this, _),
+      client_id: w(this, S),
       client_secret: w(this, A),
       challenge_type: "otp",
       mfa_token: e,
@@ -1481,27 +1594,27 @@ class cr {
    *   - `error_description` friendly error message
    */
   async mfaOobRequest(e, t) {
-    var o, i;
-    if (d.logger.debug(h({ msg: "Making MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
+    var o, s;
+    if (d.logger.debug(l({ msg: "Making MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-otp")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((i = this.oidcConfig) != null && i.issuer))
+    if (!((s = this.oidcConfig) != null && s.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
-    const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", s = await this.post(n, {
-      client_id: w(this, _),
+    const n = this.oidcConfig.issuer + (this.oidcConfig.issuer.endsWith("/") ? "" : "/") + "mfa/challenge", i = await this.post(n, {
+      client_id: w(this, S),
       client_secret: w(this, A),
       challenge_type: "oob",
       mfa_token: e,
       authenticator_id: t
     }, this.authServerHeaders);
-    return s.challenge_type != "oob" || !s.oob_code || !s.binding_method ? { error: s.error ?? "server_error", error_description: s.error_description ?? "Invalid OOB challenge response" } : {
-      challenge_type: s.challenge_type,
-      oob_code: s.oob_code,
-      binding_method: s.binding_method,
-      error: s.error,
-      error_description: s.error_description
+    return i.challenge_type != "oob" || !i.oob_code || !i.binding_method ? { error: i.error ?? "server_error", error_description: i.error_description ?? "Invalid OOB challenge response" } : {
+      challenge_type: i.challenge_type,
+      oob_code: i.oob_code,
+      binding_method: i.binding_method,
+      error: i.error,
+      error_description: i.error_description
     };
   }
   /**
@@ -1515,24 +1628,24 @@ class cr {
    * @returns an {@link OAuthTokenResponse} object, which may contain
    *          an error instead of the response fields.
    */
-  async mfaOobComplete(e, t, o, i) {
-    var n, s;
-    if (d.logger.debug(h({ msg: "Completing MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((n = this.oidcConfig) != null && n.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
+  async mfaOobComplete(e, t, o, s) {
+    var n, i;
+    if (d.logger.debug(l({ msg: "Completing MFA OOB request" })), this.oidcConfig || await this.loadConfig(), !((n = this.oidcConfig) != null && n.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
       return {
         error: "invalid_request",
         error_description: "Server does not support password_mfa grant"
       };
-    if (!((s = this.oidcConfig) != null && s.issuer))
+    if (!((i = this.oidcConfig) != null && i.issuer))
       return { error: "server_error", error_description: "Cannot get issuer" };
     const a = this.oidcConfig.token_endpoint, c = await this.post(a, {
       grant_type: "http://auth0.com/oauth/grant-type/mfa-oob",
-      client_id: w(this, _),
+      client_id: w(this, S),
       client_secret: w(this, A),
       challenge_type: "otp",
       mfa_token: e,
       oob_code: t,
       binding_code: o,
-      scope: i
+      scope: s
     }, this.authServerHeaders);
     if (c.error)
       return {
@@ -1540,10 +1653,10 @@ class cr {
         error_description: c.error_description
       };
     if (c.id_token) {
-      const l = await this.getIdPayload(c.id_token, c.access_token);
-      if (l.error)
-        return l;
-      c.id_payload = l.payload;
+      const h = await this.getIdPayload(c.id_token, c.access_token);
+      if (h.error)
+        return h;
+      c.id_payload = h.payload;
     }
     return {
       id_token: c.id_token,
@@ -1558,7 +1671,7 @@ class cr {
   // Refresh Token Flow
   async refreshTokenFlow(e) {
     var t, o;
-    if (d.logger.debug(h({ msg: "Starting refresh token flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("refresh_token")))
+    if (d.logger.debug(l({ msg: "Starting refresh token flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("refresh_token")))
       return {
         error: "invalid_request",
         error_description: "Server does not support refresh_token grant"
@@ -1568,17 +1681,17 @@ class cr {
         error: "server_error",
         error_description: "Cannot get token endpoint"
       };
-    const i = this.oidcConfig.token_endpoint;
+    const s = this.oidcConfig.token_endpoint;
     let n;
     n = w(this, A);
-    let s = {
+    let i = {
       grant_type: "refresh_token",
       refresh_token: e,
-      client_id: w(this, _)
+      client_id: w(this, S)
     };
-    n && (s.client_secret = n);
+    n && (i.client_secret = n);
     try {
-      let a = await this.post(i, s, this.authServerHeaders);
+      let a = await this.post(s, i, this.authServerHeaders);
       if (a.id_token) {
         const c = await this.getIdPayload(a.id_token, a.access_token);
         if (c.error)
@@ -1587,7 +1700,7 @@ class cr {
       }
       return a;
     } catch (a) {
-      return d.logger.error(h({ err: a })), {
+      return d.logger.error(l({ err: a })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1603,22 +1716,22 @@ class cr {
    */
   async startDeviceCodeFlow(e, t) {
     var o;
-    if (d.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
+    if (d.logger.debug(l({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((o = this.oidcConfig) != null && o.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support device code grant"
       };
-    let i = {
+    let s = {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: w(this, _),
+      client_id: w(this, S),
       client_secret: w(this, A)
     };
-    t && (i.scope = t);
+    t && (s.scope = t);
     try {
-      let n = await this.post(e, i, this.authServerHeaders);
+      let n = await this.post(e, s, this.authServerHeaders);
       return n.id_token && !await this.validateIdToken(n.id_token) ? { error: "access_denied", error_description: "Invalid ID token" } : n;
     } catch (n) {
-      return d.logger.error(h({ err: n })), {
+      return d.logger.error(l({ err: n })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1632,8 +1745,8 @@ class cr {
    * @returns See {@link OAuthDeviceResponse}
    */
   async pollDeviceCodeFlow(e) {
-    var t, o, i;
-    if (d.logger.debug(h({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
+    var t, o, s;
+    if (d.logger.debug(l({ msg: "Starting device code flow" })), this.oidcConfig || await this.loadConfig(), !((t = this.oidcConfig) != null && t.grant_types_supported.includes("urn:ietf:params:oauth:grant-type:device_code")))
       return {
         error: "invalid_request",
         error_description: "Server does not support device code grant"
@@ -1645,22 +1758,22 @@ class cr {
       };
     let n = {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      client_id: w(this, _),
+      client_id: w(this, S),
       client_secret: w(this, A),
       device_code: e
     };
     try {
-      const s = await this.post((i = this.oidcConfig) == null ? void 0 : i.token_endpoint, n, this.authServerHeaders);
-      if (s.error) return s;
-      if (s.id_token) {
-        const a = await this.getIdPayload(s.id_token, s.access_token);
+      const i = await this.post((s = this.oidcConfig) == null ? void 0 : s.token_endpoint, n, this.authServerHeaders);
+      if (i.error) return i;
+      if (i.id_token) {
+        const a = await this.getIdPayload(i.id_token, i.access_token);
         if (a.error)
           return a;
-        s.id_payload = a.payload;
+        i.id_payload = a.payload;
       }
-      return s;
-    } catch (s) {
-      return d.logger.error(h({ err: s })), {
+      return i;
+    } catch (i) {
+      return d.logger.error(l({ err: i })), {
         error: "server_error",
         error_description: "Error connecting to authorization server"
       };
@@ -1687,34 +1800,34 @@ class cr {
    * @throws any exception raised by `fetch()`
    */
   async post(e, t, o = {}) {
-    d.logger.debug(h({
+    d.logger.debug(l({
       msg: "Fetch POST",
       url: e,
       params: Object.keys(t)
     }));
-    let i = {};
-    this.authServerCredentials && (i.credentials = this.authServerCredentials), this.authServerMode && (i.mode = this.authServerMode);
-    let n = "", s = "";
+    let s = {};
+    this.authServerCredentials && (s.credentials = this.authServerCredentials), this.authServerMode && (s.mode = this.authServerMode);
+    let n = "", i = "";
     if (this.oauthPostType == "json")
-      n = JSON.stringify(t), s = "application/json";
+      n = JSON.stringify(t), i = "application/json";
     else {
       n = "";
       for (let c in t)
         n != "" && (n += "&"), n += encodeURIComponent(c) + "=" + encodeURIComponent(t[c]);
-      s = "application/x-www-form-urlencoded";
+      i = "application/x-www-form-urlencoded";
     }
-    this.oauthLogFetch && d.logger.debug(h({ msg: "OAuth fetch", method: "POST", url: e, body: n }));
+    this.oauthLogFetch && d.logger.debug(l({ msg: "OAuth fetch", method: "POST", url: e, body: n }));
     const a = await (await fetch(e, {
       method: "POST",
-      ...i,
+      ...s,
       headers: {
         Accept: "application/json",
-        "Content-Type": s,
+        "Content-Type": i,
         ...o
       },
       body: n
     })).json();
-    return this.oauthLogFetch && d.logger.debug(h({ msg: "OAuth fetch response", body: JSON.stringify(a) })), a;
+    return this.oauthLogFetch && d.logger.debug(l({ msg: "OAuth fetch response", body: JSON.stringify(a) })), a;
   }
   /**
    * Makes a GET request to the given URL using `fetch()`.
@@ -1725,10 +1838,10 @@ class cr {
    * @throws any exception raised by `fetch()`
    */
   async get(e, t = {}) {
-    d.logger.debug(h({ msg: "Fetch GET", url: e }));
+    d.logger.debug(l({ msg: "Fetch GET", url: e }));
     let o = {};
-    this.authServerCredentials && (o.credentials = this.authServerCredentials), this.authServerMode && (o.mode = this.authServerMode), this.oauthLogFetch && d.logger.debug(h({ msg: "OAuth fetch", method: "GET", url: e }));
-    const i = await (await fetch(e, {
+    this.authServerCredentials && (o.credentials = this.authServerCredentials), this.authServerMode && (o.mode = this.authServerMode), this.oauthLogFetch && d.logger.debug(l({ msg: "OAuth fetch", method: "GET", url: e }));
+    const s = await (await fetch(e, {
       method: "GET",
       ...o,
       headers: {
@@ -1736,7 +1849,7 @@ class cr {
         ...t
       }
     })).json();
-    return this.oauthLogFetch && d.logger.debug(h({ msg: "OAuth fetch response", body: JSON.stringify(i) })), i;
+    return this.oauthLogFetch && d.logger.debug(l({ msg: "OAuth fetch response", body: JSON.stringify(s) })), s;
   }
   /**
    * Validates an OpenID ID token, returning undefined if it is invalid.
@@ -1781,16 +1894,16 @@ class cr {
     try {
       return await this.tokenConsumer.tokenAuthorized(e, "id", t);
     } catch (o) {
-      d.logger.warn(h({ err: o }));
+      d.logger.warn(l({ err: o }));
       return;
     }
   }
   getTokenPayload(e) {
-    return ar(e);
+    return Sr(e);
   }
 }
-_ = /* @__PURE__ */ new WeakMap(), A = /* @__PURE__ */ new WeakMap();
-class dr {
+S = /* @__PURE__ */ new WeakMap(), A = /* @__PURE__ */ new WeakMap();
+class Er {
   /**
    * Constrctor
    * 
@@ -1821,14 +1934,14 @@ class dr {
             m.Configuration,
             "Must specify jwtKeyType if setting jwtSecretKey"
           );
-        this.keys._default = await Xe(this.jwtSecretKey, this.jwtKeyType);
+        this.keys._default = await gr(this.jwtSecretKey, this.jwtKeyType);
       } else if (this.jwtPublicKey) {
         if (!this.jwtKeyType)
           throw new g(
             m.Configuration,
             "Must specify jwtKeyType if setting jwtPublicKey"
           );
-        const t = await Ye(this.jwtPublicKey, this.jwtKeyType);
+        const t = await fr(this.jwtPublicKey, this.jwtKeyType);
         this.keys._default = t;
       } else {
         if (this.oidcConfig || await this.loadConfig(), !this.oidcConfig)
@@ -1839,7 +1952,7 @@ class dr {
         await this.loadJwks(void 0, e);
       }
     } catch (t) {
-      throw d.logger.debug(h({ err: t })), new g(m.Connection, "Couldn't load keys");
+      throw d.logger.debug(l({ err: t })), new g(m.Connection, "Couldn't load keys");
     }
   }
   /**
@@ -1848,7 +1961,7 @@ class dr {
    * to `authServerBaseUrl` )
    * @param oidcConfig the configuration, or undefined to load it from
    *        the authorization server
-   * @throws a {@link CrossauthError} object with {@link ErrorCode} of
+   * @throws a {@link @crossauth/common!CrossauthError} object with {@link @crossauth/common!ErrorCode} of
    *   - `Connection` if the fetch to the authorization server failed.
    */
   async loadConfig(e) {
@@ -1863,15 +1976,15 @@ class dr {
       let o = this.authServerBaseUrl;
       o.endsWith("/") || (o += "/"), t = await fetch(new URL(".well-known/openid-configuration", o));
     } catch (o) {
-      d.logger.error(h({ err: o }));
+      d.logger.error(l({ err: o }));
     }
     if (!t || !t.ok)
       throw new g(m.Connection, "Couldn't get OIDC configuration");
-    this.oidcConfig = { ...me };
+    this.oidcConfig = { ...Ce };
     try {
       const o = await t.json();
-      for (const [i, n] of Object.entries(o))
-        this.oidcConfig[i] = n;
+      for (const [s, n] of Object.entries(o))
+        this.oidcConfig[s] = n;
     } catch {
       throw new g(m.Connection, "Unrecognized response from OIDC configuration endpoint");
     }
@@ -1881,7 +1994,7 @@ class dr {
    * authorization server (using the URL in the OIDC configuration).
    * @param jwks the keys to load, or undefined to fetch them from
    *        the authorization server.
-   * @throws a {@link CrossauthError} object with {@link ErrorCode} of
+   * @throws a {@link @crossauth/common!CrossauthError} object with {@link @crossauth/common!ErrorCode} of
    *   - `Connection` if the fetch to the authorization server failed,
    *     the OIDC configuration wasn't set or the keys could not be parsed.
    */
@@ -1889,8 +2002,8 @@ class dr {
     if (e) {
       this.keys = {};
       for (let o = 0; o < e.keys.length; ++o) {
-        const i = e.keys[o];
-        this.keys[i.kid ?? "_default"] = await fe(e.keys[o]);
+        const s = e.keys[o], n = "kid" in s && s.kid ? s.kid : "_default";
+        this.keys[n] = await le(e.keys[o]);
       }
     } else {
       if (!this.oidcConfig)
@@ -1898,33 +2011,33 @@ class dr {
       let o;
       try {
         o = await fetch(new URL(this.oidcConfig.jwks_uri));
-      } catch (i) {
-        d.logger.error(h({ err: i }));
+      } catch (s) {
+        d.logger.error(l({ err: s }));
       }
       if (!o || !o.ok)
         throw new g(m.Connection, "Couldn't get OIDC configuration");
       this.keys = {};
       try {
-        const i = await o.json();
-        if (!("keys" in i) || !Array.isArray(i.keys))
+        const s = await o.json();
+        if (!("keys" in s) || !Array.isArray(s.keys))
           throw new g(m.Connection, "Couldn't fetch keys");
-        for (let n = 0; n < i.keys.length; ++n)
+        for (let n = 0; n < s.keys.length; ++n)
           try {
-            let s = "_default", a = { ...i.keys[n] };
-            if ("kid" in a && typeof a.kid == "string" && (s = String(a.kid)), a && !a.alg && !a.jwk_alg && t)
+            let i = "_default", a = { ...s.keys[n] };
+            if ("kid" in a && typeof a.kid == "string" && (i = String(a.kid)), a && !a.alg && !a.jwk_alg && t)
               if (t.startsWith("RS") && a.kty == "RSA")
                 a.alg = t;
               else {
-                d.logger.debug(h({ msg: "Skipping key with " + a.kty }));
+                d.logger.debug(l({ msg: "Skipping key with " + a.kty }));
                 continue;
               }
-            const c = await fe(a);
-            this.keys[s] = c;
-          } catch (s) {
-            throw d.logger.error(h({ err: s })), new g(m.Connection, "Couldn't load keys");
+            const c = await le(a);
+            this.keys[i] = c;
+          } catch (i) {
+            throw d.logger.error(l({ err: i })), new g(m.Connection, "Couldn't load keys");
           }
-      } catch (i) {
-        throw d.logger.error(h({ err: i })), new g(m.Connection, "Unrecognized response from OIDC jwks endpoint");
+      } catch (s) {
+        throw d.logger.error(l({ err: s })), new g(m.Connection, "Unrecognized response from OIDC jwks endpoint");
       }
     }
   }
@@ -1941,61 +2054,61 @@ class dr {
    */
   async tokenAuthorized(e, t, o) {
     if (!this.keys || Object.keys(this.keys).length == 0) {
-      const n = ge(e);
+      const n = me(e);
       await this.loadKeys(n.alg);
     }
-    const i = await this.validateToken(e);
-    if (i) {
-      if (i.iss != this.authServerBaseUrl) {
-        const n = i.jti ? i.jti : i.sid ? i.sid : "";
-        d.logger.error(h({ msg: `Invalid issuer ${i.iss} ${t} token`, hashedAccessToken: await this.hash(n) }));
+    const s = await this.validateToken(e);
+    if (s) {
+      if (s.iss != this.authServerBaseUrl) {
+        const n = s.jti ? s.jti : s.sid ? s.sid : "";
+        d.logger.error(l({ msg: `Invalid issuer ${s.iss} ${t} token`, hashedAccessToken: await this.hash(n) }));
         return;
       }
-      if (o != !1 && i.aud) {
-        const n = i.jti ? i.jti : i.sid ? i.sid : "";
-        if (Array.isArray(i.aud) && !i.aud.includes(this.audience) || !Array.isArray(i.aud) && i.aud != this.audience) {
-          d.logger.error(h({ msg: `Invalid audience ${i.aud} in ${t} token`, hashedAccessToken: await this.hash(n) }));
+      if (o != !1 && s.aud) {
+        const n = s.jti ? s.jti : s.sid ? s.sid : "";
+        if (Array.isArray(s.aud) && !s.aud.includes(this.audience) || !Array.isArray(s.aud) && s.aud != this.audience) {
+          d.logger.error(l({ msg: `Invalid audience ${s.aud} in ${t} token`, hashedAccessToken: await this.hash(n) }));
           return;
         }
       }
-      return i;
+      return s;
     }
   }
   async validateToken(e) {
     (!this.keys || Object.keys(this.keys).length == 0) && d.logger.warn("No keys loaded so cannot validate tokens");
     let t;
     try {
-      t = ge(e).kid;
+      t = me(e).kid;
     } catch {
-      d.logger.warn(h({ msg: "Invalid access token format" }));
+      d.logger.warn(l({ msg: "Invalid access token format" }));
       return;
     }
     let o;
-    for (let i in this.keys)
-      if (t == i) {
-        o = this.keys[i];
+    for (let s in this.keys)
+      if (t == s) {
+        o = this.keys[s];
         break;
       }
     if (!o && "_default" in this.keys && (o = this.keys._default), !o) {
-      d.logger.warn(h({ msg: "No matching keys found for access token" }));
+      d.logger.warn(l({ msg: "No matching keys found for access token" }));
       return;
     }
     try {
-      const { payload: i } = await nr(e, o), n = JSON.parse(new TextDecoder().decode(i));
+      const { payload: s } = await Cr(e, o), n = JSON.parse(new TextDecoder().decode(s));
       if (n.exp * 1e3 < Date.now() + this.clockTolerance) {
-        d.logger.warn(h({ msg: "Access token has expired" }));
+        d.logger.warn(l({ msg: "Access token has expired" }));
         return;
       }
       return n;
-    } catch (i) {
-      const n = g.asCrossauthError(i);
-      d.logger.debug(h({ err: n })), d.logger.warn(h({ msg: "Access token did not validate", cerr: n }));
+    } catch (s) {
+      const n = g.asCrossauthError(s);
+      d.logger.debug(l({ err: n })), d.logger.warn(l({ msg: "Access token did not validate", cerr: n }));
       return;
     }
   }
 }
-const pe = 30, Q = 2, ae = 30;
-class Re {
+const ve = 30, se = 2, de = 30;
+class Ke {
   /**
    * Constructor
    * 
@@ -2020,50 +2133,50 @@ class Re {
   }
   async startAutoRefresh(e = ["access", "id"], t) {
     if (!this.autoRefreshActive) {
-      this.autoRefreshActive = !0, d.logger.debug(h({ msg: "Starting auto refresh" }));
+      this.autoRefreshActive = !0, d.logger.debug(l({ msg: "Starting auto refresh" }));
       try {
         await this.scheduleAutoRefresh(e, t);
       } catch (o) {
-        const i = g.asCrossauthError(o);
-        d.logger.error(h({ cerr: i })), d.logger.debug(h({ err: i }));
+        const s = g.asCrossauthError(o);
+        d.logger.error(l({ cerr: s })), d.logger.debug(l({ err: s }));
       }
     }
   }
   stopAutoRefresh() {
-    this.autoRefreshActive = !1, d.logger.debug(h({ msg: "Stopping auto refresh" }));
+    this.autoRefreshActive = !1, d.logger.debug(l({ msg: "Stopping auto refresh" }));
   }
   async scheduleAutoRefresh(e, t) {
     let o;
-    const i = this.tokenProvider.getCsrfToken(), n = i ? await i : void 0, s = await this.tokenProvider.getTokenExpiries([...e, "refresh"], n);
-    if (s.refresh == null) {
-      d.logger.debug(h({ msg: "No refresh token found" }));
+    const s = this.tokenProvider.getCsrfToken(), n = s ? await s : void 0, i = await this.tokenProvider.getTokenExpiries([...e, "refresh"], n);
+    if (i.refresh == null) {
+      d.logger.debug(l({ msg: "No refresh token found" }));
       return;
     }
     const a = Date.now();
-    let c = s.id;
-    if ((!c || s.access && s.access < c) && (c = s.access), !c) {
-      d.logger.debug(h({ msg: "No tokens expire" }));
+    let c = i.id;
+    if ((!c || i.access && i.access < c) && (c = i.access), !c) {
+      d.logger.debug(l({ msg: "No tokens expire" }));
       return;
     }
-    let l = c * 1e3 - a - pe;
-    if (l < 0 && o != null && o <= 0) {
-      d.logger.debug(h({ msg: "Expiry time has passed" }));
+    let h = c * 1e3 - a - ve;
+    if (h < 0 && o != null && o <= 0) {
+      d.logger.debug(l({ msg: "Expiry time has passed" }));
       return;
     }
-    if (l < 0 && (l = 0), s.refresh && s.refresh - pe < l) {
-      d.logger.debug(h({ msg: "Refresh token has expired" }));
+    if (h < 0 && (h = 0), i.refresh && i.refresh - ve < h) {
+      d.logger.debug(l({ msg: "Refresh token has expired" }));
       return;
     }
-    let y = (k) => new Promise((b) => setTimeout(b, k));
-    d.logger.debug(h({ msg: `Waiting ${l} before refreshing tokens` })), o = l, await y(l), await this.autoRefresh(e, n, t);
+    let y = (_) => new Promise((b) => setTimeout(b, _));
+    d.logger.debug(l({ msg: `Waiting ${h} before refreshing tokens` })), o = h, await y(h), await this.autoRefresh(e, n, t);
   }
   async autoRefresh(e, t, o) {
     if (this.autoRefreshActive) {
-      let i, n = !1, s = 0;
-      for (; !n && s <= Q; )
+      let s, n = !1, i = 0;
+      for (; !n && i <= se; )
         try {
           let a = { ...this.headers };
-          t && (a[this.csrfHeader] = t), d.logger.debug(h({ msg: "Initiating auto refresh" }));
+          t && (a[this.csrfHeader] = t), d.logger.debug(l({ msg: "Initiating auto refresh" }));
           const c = await this.tokenProvider.jsonFetchWithToken(
             this.autoRefreshUrl,
             {
@@ -2081,35 +2194,35 @@ class Re {
             },
             "refresh"
           );
-          c.ok || d.logger.error(h({ msg: "Failed auto refreshing tokens", status: c.status }));
+          c.ok || d.logger.error(l({ msg: "Failed auto refreshing tokens", status: c.status }));
           try {
-            i = await c.json();
+            s = await c.json();
           } catch {
             try {
-              d.logger.error(h({ msg: "/refresh returned a non-JSON response " + (i ? await i.text() : void 0) }));
+              d.logger.error(l({ msg: "/refresh returned a non-JSON response " + (s ? await s.text() : void 0) }));
             } catch {
-              d.logger.error(h({ msg: "/refresh returned a  with no body " }));
+              d.logger.error(l({ msg: "/refresh returned a  with no body " }));
             }
-            i = { ok: !1, error: "Unknown" };
+            s = { ok: !1, error: "Unknown" };
           }
-          if (i != null && i.ok) {
+          if (s != null && s.ok) {
             await this.scheduleAutoRefresh(e, o), n = !0;
             try {
-              await this.tokenProvider.receiveTokens(i);
-            } catch (l) {
-              const y = g.asCrossauthError(l);
-              o ? o("Couldn't receive tokens", y) : (d.logger.debug(h({ err: l })), d.logger.error(h({ msg: "Error receiving tokens", cerr: y })));
+              await this.tokenProvider.receiveTokens(s);
+            } catch (h) {
+              const y = g.asCrossauthError(h);
+              o ? o("Couldn't receive tokens", y) : (d.logger.debug(l({ err: h })), d.logger.error(l({ msg: "Error receiving tokens", cerr: y })));
             }
           } else
-            s < Q ? (d.logger.error(h({ msg: `Failed auto refreshing tokens.  Retrying in ${ae} seconds` })), await ((y) => new Promise((k) => setTimeout(k, y)))(ae * 1e3)) : (d.logger.error(h({ msg: "Failed auto refreshing tokens.  Number of retries exceeded" })), o && o("Failed auto refreshing tokens")), s++;
+            i < se ? (d.logger.error(l({ msg: `Failed auto refreshing tokens.  Retrying in ${de} seconds` })), await ((y) => new Promise((_) => setTimeout(_, y)))(de * 1e3)) : (d.logger.error(l({ msg: "Failed auto refreshing tokens.  Number of retries exceeded" })), o && o("Failed auto refreshing tokens")), i++;
         } catch (a) {
           const c = g.asCrossauthError(a);
-          d.logger.debug(h({ err: c })), s < Q ? (d.logger.error(h({ msg: `Failed auto refreshing tokens.  Retrying in ${Q} seconds` })), await ((y) => new Promise((k) => setTimeout(k, y)))(ae * 1e3)) : (d.logger.error(h({ msg: "Failed auto refreshing tokens.  Number of retries exceeded" })), o && o(c.message, c)), s++;
+          d.logger.debug(l({ err: c })), i < se ? (d.logger.error(l({ msg: `Failed auto refreshing tokens.  Retrying in ${se} seconds` })), await ((y) => new Promise((_) => setTimeout(_, y)))(de * 1e3)) : (d.logger.error(l({ msg: "Failed auto refreshing tokens.  Number of retries exceeded" })), o && o(c.message, c)), i++;
         }
     }
   }
 }
-class Ie {
+class We {
   /**
    * Constructor
    * 
@@ -2130,29 +2243,29 @@ class Ie {
     this.oauthClient = e.oauthClient, e.deviceCodePollUrl != null && (this.deviceCodePollUrl = e.deviceCodePollUrl), e.headers && (this.headers = e.headers), e.mode && (this.mode = e.mode), e.credentials && (this.credentials = e.credentials);
   }
   async startPolling(e, t, o = 5) {
-    this.pollingActive || (this.pollingActive = !0, d.logger.debug(h({ msg: "Starting auto refresh" })), await this.poll(e, o, t));
+    this.pollingActive || (this.pollingActive = !0, d.logger.debug(l({ msg: "Starting auto refresh" })), await this.poll(e, o, t));
   }
   stopPolling() {
-    this.pollingActive = !1, d.logger.debug(h({ msg: "Stopping auto refresh" }));
+    this.pollingActive = !1, d.logger.debug(l({ msg: "Stopping auto refresh" }));
   }
   async poll(e, t, o) {
-    var i;
+    var s;
     if (!e)
-      d.logger.debug(h({ msg: "device code poll: no device code provided" })), o("error", "Error waiting for authorization");
+      d.logger.debug(l({ msg: "device code poll: no device code provided" })), o("error", "Error waiting for authorization");
     else
       try {
-        if (d.logger.debug(h({ msg: "device code poll: poll" })), !this.deviceCodePollUrl && this.oauthClient) {
-          if (this.oauthClient.getOidcConfig() || await this.oauthClient.loadConfig(), !((i = this.oauthClient.getOidcConfig()) != null && i.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
+        if (d.logger.debug(l({ msg: "device code poll: poll" })), !this.deviceCodePollUrl && this.oauthClient) {
+          if (this.oauthClient.getOidcConfig() || await this.oauthClient.loadConfig(), !((s = this.oauthClient.getOidcConfig()) != null && s.grant_types_supported.includes("http://auth0.com/oauth/grant-type/mfa-oob")))
             return {
               error: "invalid_request",
               error_description: "Server does not support password_mfa grant"
             };
-          let s = this.oauthClient.getOidcConfig();
-          if (!(s != null && s.token_endpoint)) return {
+          let i = this.oauthClient.getOidcConfig();
+          if (!(i != null && i.token_endpoint)) return {
             error: "server_error",
             error_description: "Couldn't get OIDC configuration"
           };
-          this.deviceCodePollUrl = s.token_endpoint;
+          this.deviceCodePollUrl = i.token_endpoint;
         }
         if (!this.deviceCodePollUrl)
           return {
@@ -2169,23 +2282,23 @@ class Ie {
         else if (!n.ok)
           this.pollingActive = !1, o("error", "Received an error from the authorization server");
         else {
-          const s = await n.json();
-          if (d.logger.debug(h({ msg: "device code poll: received" + JSON.stringify(s) })), s.error == "expired_token")
+          const i = await n.json();
+          if (d.logger.debug(l({ msg: "device code poll: received" + JSON.stringify(i) })), i.error == "expired_token")
             this.pollingActive = !1, o("expired_token", "Timeout waiting for authorization");
-          else if (s.error == "authorization_pending" || s.error == "slow_down") {
-            s.error == "slow_down" && (t += 5);
-            let a = s.interval ?? t, c = (l) => new Promise((y) => setTimeout(y, l));
-            d.logger.debug(h({ msg: "device code poll: waiting " + String(a) + " seconds" })), await c(a * 1e3), this.pollingActive && this.poll(e, t, o);
-          } else s.error ? (this.pollingActive = !1, o("error", s.error_description ?? s.error)) : (this.pollingActive = !1, o("complete"));
+          else if (i.error == "authorization_pending" || i.error == "slow_down") {
+            i.error == "slow_down" && (t += 5);
+            let a = i.interval ?? t, c = (h) => new Promise((y) => setTimeout(y, h));
+            d.logger.debug(l({ msg: "device code poll: waiting " + String(a) + " seconds" })), await c(a * 1e3), this.pollingActive && this.poll(e, t, o);
+          } else i.error ? (this.pollingActive = !1, o("error", i.error_description ?? i.error)) : (this.pollingActive = !1, o("complete"));
         }
       } catch (n) {
         this.pollingActive = !1;
-        const s = g.asCrossauthError(n);
-        d.logger.debug(h({ err: s })), d.logger.error(h({ msg: "Polling failed", cerr: s })), o("error", s.message);
+        const i = g.asCrossauthError(n);
+        d.logger.debug(l({ err: i })), d.logger.error(l({ msg: "Polling failed", cerr: i })), o("error", i.message);
       }
   }
 }
-class ur {
+class Rr {
   /**
    * Constructor
    * 
@@ -2218,11 +2331,11 @@ class ur {
     f(this, "getCsrfTokenUrl", "/api/getcsrftoken");
     f(this, "autoRefreshUrl", "/api/refreshtokens");
     f(this, "tokensUrl", "/tokens");
-    e.bffPrefix && (this.bffPrefix = e.bffPrefix), e.csrfHeader && (this.csrfHeader = e.csrfHeader), e.enableCsrfProtection != null && (this.enableCsrfProtection = e.enableCsrfProtection), e.getCsrfTokenUrl && (this.getCsrfTokenUrl = e.getCsrfTokenUrl), e.tokensUrl && (this.tokensUrl = e.tokensUrl), e.autoRefreshUrl && (this.autoRefreshUrl = e.autoRefreshUrl), this.bffPrefix.endsWith("/") || (this.bffPrefix += "/"), e.headers && (this.headers = e.headers), e.mode && (this.mode = e.mode), e.credentials && (this.credentials = e.credentials), this.autoRefresher = new Re({
+    e.bffPrefix && (this.bffPrefix = e.bffPrefix), e.csrfHeader && (this.csrfHeader = e.csrfHeader), e.enableCsrfProtection != null && (this.enableCsrfProtection = e.enableCsrfProtection), e.getCsrfTokenUrl && (this.getCsrfTokenUrl = e.getCsrfTokenUrl), e.tokensUrl && (this.tokensUrl = e.tokensUrl), e.autoRefreshUrl && (this.autoRefreshUrl = e.autoRefreshUrl), this.bffPrefix.endsWith("/") || (this.bffPrefix += "/"), e.headers && (this.headers = e.headers), e.mode && (this.mode = e.mode), e.credentials && (this.credentials = e.credentials), this.autoRefresher = new Ke({
       ...e,
       autoRefreshUrl: this.autoRefreshUrl,
       tokenProvider: this
-    }), this.deviceCodePoller = new Ie({ ...e, oauthClient: void 0 });
+    }), this.deviceCodePoller = new We({ ...e, oauthClient: void 0 });
   }
   /**
    * Gets a CSRF token from the server
@@ -2329,11 +2442,11 @@ class ur {
    * @param csrfToken : the CSRF token
    * @returns the HTTP status code and the body or null
    */
-  async api(e, t, o, i) {
+  async api(e, t, o, s) {
     let n = { ...this.headers };
-    !i && !["GET", "HEAD", "OPTIONS"].includes(e) && (i = await this.getCsrfToken(), i && (n[this.csrfHeader] = i)), t.startsWith("/") && (t = t.substring(1));
-    let s = {};
-    o && (s.body = JSON.stringify(o));
+    !s && !["GET", "HEAD", "OPTIONS"].includes(e) && (s = await this.getCsrfToken(), s && (n[this.csrfHeader] = s)), t.startsWith("/") && (t = t.substring(1));
+    let i = {};
+    o && (i.body = JSON.stringify(o));
     const a = await fetch(
       this.bffPrefix + t,
       {
@@ -2341,7 +2454,7 @@ class ur {
         method: e,
         mode: this.mode,
         credentials: this.credentials,
-        ...s
+        ...i
       }
     );
     let c = null;
@@ -2416,15 +2529,15 @@ class ur {
   async getTokenExpiries(e, t) {
     const o = await this.getTokens(t);
     try {
-      const i = e.includes("id") ? (o == null ? void 0 : o.id_token) ?? null : null, n = e.includes("access") ? (o == null ? void 0 : o.access_token) ?? null : null, s = e.includes("refresh") ? (o == null ? void 0 : o.refresh_token) ?? null : null;
-      let a, c, l;
-      return i && (a = i.exp ? i.exp : null), n && (c = n.exp ? n.exp : null), s && (l = s.exp ? s.exp : null), {
+      const s = e.includes("id") ? (o == null ? void 0 : o.id_token) ?? null : null, n = e.includes("access") ? (o == null ? void 0 : o.access_token) ?? null : null, i = e.includes("refresh") ? (o == null ? void 0 : o.refresh_token) ?? null : null;
+      let a, c, h;
+      return s && (a = s.exp ? s.exp : null), n && (c = n.exp ? n.exp : null), i && (h = i.exp ? i.exp : null), {
         id: a,
         access: c,
-        refresh: l
+        refresh: h
       };
     } catch {
-      return d.logger.error(h({ msg: "getTokenExpiries received non JSON response " + o })), {
+      return d.logger.error(l({ msg: "getTokenExpiries received non JSON response " + o })), {
         id: 0,
         access: 0,
         refresh: 0
@@ -2446,7 +2559,7 @@ class ur {
     });
   }
 }
-class fr {
+class Pr {
   /**
    * Gets a CSRF token from the server
    * @returns the CSRF token that can be included in
@@ -2457,19 +2570,19 @@ class fr {
     });
   }
 }
-class hr extends dr {
+class br extends Er {
   /**
    * SHA256 and Base64-url-encodes the given test
    * @param plaintext the text to encode
    * @returns the SHA256 hash, Base64-url-encode
    */
   async hash(e) {
-    const o = new TextEncoder().encode(e), i = await crypto.subtle.digest("SHA-256", o), n = Array.from(new Uint8Array(i));
-    return btoa(n.reduce((s, a) => s + String.fromCharCode(a), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
+    const o = new TextEncoder().encode(e), s = await crypto.subtle.digest("SHA-256", o), n = Array.from(new Uint8Array(s));
+    return btoa(n.reduce((i, a) => i + String.fromCharCode(a), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
   }
 }
-var x, N, I, K, z, J, M, q, V, B;
-class gr extends cr {
+var j, W, N, D, J, B, q, Z, ee, V;
+class Ir extends Tr {
   /**
    * Constructor
    * 
@@ -2511,7 +2624,7 @@ class gr extends cr {
    *  For other options see {@link OAuthClientBase}.
    */
   constructor(t) {
-    t.tokenConsumer || (t.tokenConsumer = new hr(
+    t.tokenConsumer || (t.tokenConsumer = new br(
       t.client_id,
       {
         authServerBaseUrl: t.authServerBaseUrl
@@ -2528,58 +2641,58 @@ class gr extends cr {
     f(this, "accessTokenName", "CROSSAUTH_AT");
     f(this, "refreshTokenName", "CROSSAUTH_RT");
     f(this, "idTokenName", "CROSSAUTH_IT");
-    E(this, x);
-    E(this, N);
-    E(this, I);
-    E(this, K);
-    E(this, z);
-    E(this, J);
-    E(this, M);
+    R(this, j);
+    R(this, W);
+    R(this, N);
+    R(this, D);
+    R(this, J);
+    R(this, B);
+    R(this, q);
     f(this, "autoRefresher");
     f(this, "deviceCodePoller");
     f(this, "deviceAuthorizationUrl", "device_authorization");
-    E(this, q);
-    E(this, V);
-    E(this, B);
+    R(this, Z);
+    R(this, ee);
+    R(this, V);
     f(this, "scope");
     f(this, "logFetch", !1);
-    this.resServerBaseUrl != null && (this.resServerBaseUrl = t.resServerBaseUrl ?? "", this.resServerBaseUrl.length > 0 && !this.resServerBaseUrl.endsWith("/") && (this.resServerBaseUrl += "/")), t.accessTokenResponseType && (this.accessTokenResponseType = t.accessTokenResponseType), t.idTokenResponseType && (this.idTokenResponseType = t.idTokenResponseType), t.refreshTokenResponseType && (this.refreshTokenResponseType = t.refreshTokenResponseType), t.accessTokenName && (this.accessTokenName = t.accessTokenName), t.idTokenName && (this.idTokenName = t.idTokenName), t.refreshTokenName && (this.refreshTokenName = t.refreshTokenName), t.resServerHeaders && (this.resServerHeaders = t.resServerHeaders), t.resServerMode && (this.resServerMode = t.resServerMode), t.resServerCredentials && (this.resServerCredentials = t.resServerCredentials), t.client_id && T(this, J, t.client_id), t.client_secret && T(this, M, t.client_secret), t.deviceAuthorizationUrl && (this.deviceAuthorizationUrl = t.deviceAuthorizationUrl), this.autoRefresher = new Re({
+    this.resServerBaseUrl != null && (this.resServerBaseUrl = t.resServerBaseUrl ?? "", this.resServerBaseUrl.length > 0 && !this.resServerBaseUrl.endsWith("/") && (this.resServerBaseUrl += "/")), t.accessTokenResponseType && (this.accessTokenResponseType = t.accessTokenResponseType), t.idTokenResponseType && (this.idTokenResponseType = t.idTokenResponseType), t.refreshTokenResponseType && (this.refreshTokenResponseType = t.refreshTokenResponseType), t.accessTokenName && (this.accessTokenName = t.accessTokenName), t.idTokenName && (this.idTokenName = t.idTokenName), t.refreshTokenName && (this.refreshTokenName = t.refreshTokenName), t.resServerHeaders && (this.resServerHeaders = t.resServerHeaders), t.resServerMode && (this.resServerMode = t.resServerMode), t.resServerCredentials && (this.resServerCredentials = t.resServerCredentials), t.client_id && T(this, B, t.client_id), t.client_secret && T(this, q, t.client_secret), t.deviceAuthorizationUrl && (this.deviceAuthorizationUrl = t.deviceAuthorizationUrl), this.autoRefresher = new Ke({
       ...t,
       autoRefreshUrl: this.authServerBaseUrl + "/token",
       tokenProvider: this
-    }), this.deviceCodePoller = new Ie({ ...t, oauthClient: this, deviceCodePollUrl: null });
-    let o, i, n;
-    if (this.idTokenResponseType == "sessionStorage" ? o = sessionStorage.getItem(this.idTokenName) : this.idTokenResponseType == "localStorage" && (o = localStorage.getItem(this.idTokenName)), this.accessTokenResponseType == "sessionStorage" ? i = sessionStorage.getItem(this.accessTokenName) : this.accessTokenResponseType == "localStorage" && (i = localStorage.getItem(this.accessTokenName)), this.refreshTokenResponseType == "sessionStorage" ? n = sessionStorage.getItem(this.refreshTokenName) : this.refreshTokenResponseType == "localStorage" && (n = localStorage.getItem(this.refreshTokenName)), this.receiveTokens({
-      access_token: i,
+    }), this.deviceCodePoller = new We({ ...t, oauthClient: this, deviceCodePollUrl: null });
+    let o, s, n;
+    if (this.idTokenResponseType == "sessionStorage" ? o = sessionStorage.getItem(this.idTokenName) : this.idTokenResponseType == "localStorage" && (o = localStorage.getItem(this.idTokenName)), this.accessTokenResponseType == "sessionStorage" ? s = sessionStorage.getItem(this.accessTokenName) : this.accessTokenResponseType == "localStorage" && (s = localStorage.getItem(this.accessTokenName)), this.refreshTokenResponseType == "sessionStorage" ? n = sessionStorage.getItem(this.refreshTokenName) : this.refreshTokenResponseType == "localStorage" && (n = localStorage.getItem(this.refreshTokenName)), this.receiveTokens({
+      access_token: s,
       id_token: o,
       refresh_token: n
-    }), i) {
-      const s = this.getTokenPayload(i);
-      s && (T(this, x, i), T(this, K, s));
+    }), s) {
+      const i = this.getTokenPayload(s);
+      i && (T(this, j, s), T(this, D, i));
     }
     if (n) {
-      const s = this.getTokenPayload(n);
-      s && (T(this, N, n), T(this, z, s));
+      const i = this.getTokenPayload(n);
+      i && (T(this, W, n), T(this, J, i));
     }
-    o ? this.validateIdToken(o).then((s) => {
-      T(this, I, s), t.autoRefresh && this.startAutoRefresh(t.autoRefresh).then().catch((a) => {
-        d.logger.debug(h({ err: a, msg: "Couldn't start auto refresh" }));
+    o ? this.validateIdToken(o).then((i) => {
+      T(this, N, i), t.autoRefresh && this.startAutoRefresh(t.autoRefresh).then().catch((a) => {
+        d.logger.debug(l({ err: a, msg: "Couldn't start auto refresh" }));
       });
-    }).catch((s) => {
-      d.logger.debug(h({ err: s, msg: "Couldn't validate ID token" }));
-    }) : p(this, x) && t.autoRefresh && n ? this.startAutoRefresh(t.autoRefresh).then().catch((s) => {
-      d.logger.debug(h({ err: s, msg: "Couldn't start auto refresh" }));
-    }) : n && !i && this.refreshTokenFlow(n).then((s) => {
-      d.logger.debug(h({ msg: "Refreshed tokens" })), t.autoRefresh && this.startAutoRefresh(t.autoRefresh).then().catch((a) => {
-        d.logger.debug(h({ err: a, msg: "Couldn't start auto refresh" }));
+    }).catch((i) => {
+      d.logger.debug(l({ err: i, msg: "Couldn't validate ID token" }));
+    }) : p(this, j) && t.autoRefresh && n ? this.startAutoRefresh(t.autoRefresh).then().catch((i) => {
+      d.logger.debug(l({ err: i, msg: "Couldn't start auto refresh" }));
+    }) : n && !s && this.refreshTokenFlow(n).then((i) => {
+      d.logger.debug(l({ msg: "Refreshed tokens" })), t.autoRefresh && this.startAutoRefresh(t.autoRefresh).then().catch((a) => {
+        d.logger.debug(l({ err: a, msg: "Couldn't start auto refresh" }));
       });
-    }).catch((s) => {
-      const a = g.asCrossauthError(s);
-      d.logger.debug(h({ err: a })), d.logger.error(h({ msg: "failed refreshing tokens", cerr: a }));
+    }).catch((i) => {
+      const a = g.asCrossauthError(i);
+      d.logger.debug(l({ err: a })), d.logger.error(l({ msg: "failed refreshing tokens", cerr: a }));
     });
   }
   get idTokenPayload() {
-    return p(this, I);
+    return p(this, N);
   }
   /**
    * Processes the query parameters for a Redirect URI request if they
@@ -2607,23 +2720,23 @@ class gr extends cr {
     const t = new URL(window.location.href);
     if (t.origin + t.pathname != this.redirect_uri) return;
     const o = new URLSearchParams(window.location.search);
-    let i, n, s, a;
-    for (const [l, y] of o)
-      l == "code" && (i = y), l == "state" && (n = y), l == "error" && (s = y), l == "error_description" && (a = y);
-    if (!s && !i) return;
-    if (s) {
-      const l = g.fromOAuthError(s, a);
-      throw d.logger.debug(h({ err: l })), d.logger.error(h({ cerr: l, msg: "Error from authorize endpoint: " + s })), l;
+    let s, n, i, a;
+    for (const [h, y] of o)
+      h == "code" && (s = y), h == "state" && (n = y), h == "error" && (i = y), h == "error_description" && (a = y);
+    if (!i && !s) return;
+    if (i) {
+      const h = g.fromOAuthError(i, a);
+      throw d.logger.debug(l({ err: h })), d.logger.error(l({ cerr: h, msg: "Error from authorize endpoint: " + i })), h;
     }
-    if (p(this, B) && n != p(this, B))
+    if (p(this, V) && n != p(this, V))
       return {
         error: "access_denied",
         error_description: "Invalid state"
       };
-    const c = await this.redirectEndpoint(i, this.scope, p(this, V), s, a);
+    const c = await this.redirectEndpoint(s, this.scope, p(this, ee), i, a);
     if (c.error) {
-      const l = g.fromOAuthError(c.error, a);
-      throw d.logger.debug(h({ err: l })), d.logger.error(h({ cerr: l, msg: "Error from redirect endpoint: " + c.error })), l;
+      const h = g.fromOAuthError(c.error, a);
+      throw d.logger.debug(l({ err: h })), d.logger.error(l({ cerr: h, msg: "Error from redirect endpoint: " + c.error })), h;
     }
     return await this.receiveTokens(c), c;
   }
@@ -2646,8 +2759,8 @@ class gr extends cr {
    * @param deviceCode the device code to poll for (this was returned when the device code flow was started)
    * @param pollResultFn called with the result of each poll
    */
-  async startDeviceCodePolling(t, o, i = 5) {
-    return this.deviceCodePoller.startPolling(t, o, i);
+  async startDeviceCodePolling(t, o, s = 5) {
+    return this.deviceCodePoller.startPolling(t, o, s);
   }
   /**
    * Turns off polling for a device code
@@ -2664,7 +2777,7 @@ class gr extends cr {
    * @returns the payload as an object
    */
   getIdToken() {
-    return p(this, I);
+    return p(this, N);
   }
   ///////
   // Implementation of abstract methods
@@ -2676,7 +2789,7 @@ class gr extends cr {
    */
   randomValue(t) {
     const o = new Uint8Array(t);
-    return self.crypto.getRandomValues(o), btoa(o.reduce((i, n) => i + String.fromCharCode(n), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
+    return self.crypto.getRandomValues(o), btoa(o.reduce((s, n) => s + String.fromCharCode(n), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
   }
   /**
    * SHA256 and Base64-url-encodes the given test
@@ -2684,8 +2797,8 @@ class gr extends cr {
    * @returns the SHA256 hash, Base64-url-encode
    */
   async sha256(t) {
-    const i = new TextEncoder().encode(t), n = await crypto.subtle.digest("SHA-256", i), s = Array.from(new Uint8Array(n));
-    return btoa(s.reduce((a, c) => a + String.fromCharCode(c), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
+    const s = new TextEncoder().encode(t), n = await crypto.subtle.digest("SHA-256", s), i = Array.from(new Uint8Array(n));
+    return btoa(i.reduce((a, c) => a + String.fromCharCode(c), "")).replace(/\//g, "_").replace(/\+/g, "-").replace(/=+$/, "");
   }
   /**
    * Calls an API endpoint on the resource server
@@ -2694,11 +2807,11 @@ class gr extends cr {
    * @param body : the body to pass to the call
    * @returns the HTTP status code and the body or null
    */
-  async api(t, o, i) {
+  async api(t, o, s) {
     let n = { ...this.resServerHeaders };
     o.startsWith("/") && (o = o.substring(1));
-    let s = {};
-    i && (s.body = JSON.stringify(i));
+    let i = {};
+    s && (i.body = JSON.stringify(s));
     let a;
     this.accessTokenResponseType == "sessionStorage" ? a = sessionStorage.getItem(this.accessTokenName) : this.accessTokenResponseType == "localStorage" && (a = localStorage.getItem(this.accessTokenName)), n.authorization = "Bearer " + a;
     const c = await fetch(
@@ -2708,11 +2821,11 @@ class gr extends cr {
         method: t,
         mode: this.resServerMode,
         credentials: this.resServerCredentials,
-        ...s
+        ...i
       }
     );
-    let l = null;
-    return c.body && (l = await c.json()), { status: c.status, body: l };
+    let h = null;
+    return c.body && (h = await c.json()), { status: c.status, body: h };
   }
   ///////////////////////////////////////////////////////////
   // OAuthTokenProvider interface
@@ -2724,11 +2837,11 @@ class gr extends cr {
    *          expire, or `undefined` if the token does not exist
    */
   async getTokenExpiries(t, o) {
-    let i, n, s;
-    return p(this, I) && (i = p(this, I).exp ? p(this, I).exp : null), p(this, K) && (n = p(this, K).exp ? p(this, K).exp : null), p(this, z) && (s = p(this, z).exp ? p(this, z).exp : null), {
-      id: i,
+    let s, n, i;
+    return p(this, N) && (s = p(this, N).exp ? p(this, N).exp : null), p(this, D) && (n = p(this, D).exp ? p(this, D).exp : null), p(this, J) && (i = p(this, J).exp ? p(this, J).exp : null), {
+      id: s,
       access: n,
-      refresh: s
+      refresh: i
     };
   }
   /**
@@ -2741,17 +2854,17 @@ class gr extends cr {
    * @param token which token to add
    * @returns parsed JSON response
    */
-  async jsonFetchWithToken(t, o, i) {
-    if (i == "access") {
-      if (!p(this, x))
+  async jsonFetchWithToken(t, o, s) {
+    if (s == "access") {
+      if (!p(this, j))
         throw new g(m.InvalidToken, "Cannot make fetch with access token - no access token defined");
-      o.headers || (o.headers = {}), o.headers.authorization = "Bearer " + p(this, x);
+      o.headers || (o.headers = {}), o.headers.authorization = "Bearer " + p(this, j);
     } else {
-      if (o.body || (o.body = {}), !p(this, N))
+      if (o.body || (o.body = {}), !p(this, W))
         throw new g(m.InvalidToken, "Cannot make fetch with refresh token - no refresh token defined");
-      o.body.refresh_token = p(this, N), o.body.grant_type = "refresh_token";
+      o.body.refresh_token = p(this, W), o.body.grant_type = "refresh_token";
     }
-    return p(this, J) && (o.body || (o.body = {}), o.body.client_id = p(this, J), p(this, M) && (o.body.client_secret = p(this, M))), typeof o.body != "string" && (o.body = JSON.stringify(o.body)), await fetch(t, o);
+    return p(this, B) && (o.body || (o.body = {}), o.body.client_id = p(this, B), p(this, q) && (o.body.client_secret = p(this, q))), typeof o.body != "string" && (o.body = JSON.stringify(o.body)), await fetch(t, o);
   }
   /**
    * Does nothing as CSRF tokens are not needed for this class
@@ -2762,15 +2875,15 @@ class gr extends cr {
   async receiveTokens(t) {
     if (t.access_token) {
       const o = this.getTokenPayload(t.access_token);
-      o && (T(this, x, t.access_token), T(this, K, o)), this.accessTokenResponseType == "localStorage" ? localStorage.setItem(this.accessTokenName, t.access_token) : this.accessTokenResponseType == "sessionStorage" && sessionStorage.setItem(this.accessTokenName, t.access_token);
+      o && (T(this, j, t.access_token), T(this, D, o)), this.accessTokenResponseType == "localStorage" ? localStorage.setItem(this.accessTokenName, t.access_token) : this.accessTokenResponseType == "sessionStorage" && sessionStorage.setItem(this.accessTokenName, t.access_token);
     }
     if (t.refresh_token) {
       const o = this.getTokenPayload(t.refresh_token);
-      o && (T(this, N, t.refresh_token), T(this, z, o)), this.refreshTokenResponseType == "localStorage" ? localStorage.setItem(this.refreshTokenName, t.refresh_token) : this.accessTokenResponseType == "sessionStorage" && sessionStorage.setItem(this.refreshTokenName, t.refresh_token);
+      o && (T(this, W, t.refresh_token), T(this, J, o)), this.refreshTokenResponseType == "localStorage" ? localStorage.setItem(this.refreshTokenName, t.refresh_token) : this.accessTokenResponseType == "sessionStorage" && sessionStorage.setItem(this.refreshTokenName, t.refresh_token);
     }
     if (t.id_token) {
       const o = await this.validateIdToken(t.id_token);
-      T(this, I, o), this.idTokenResponseType == "localStorage" ? localStorage.setItem(this.idTokenName, t.id_token) : this.idTokenResponseType == "sessionStorage" && sessionStorage.setItem(this.idTokenName, t.id_token);
+      T(this, N, o), this.idTokenResponseType == "localStorage" ? localStorage.setItem(this.idTokenName, t.id_token) : this.idTokenResponseType == "sessionStorage" && sessionStorage.setItem(this.idTokenName, t.id_token);
     }
   }
   /////////
@@ -2789,8 +2902,8 @@ class gr extends cr {
    * then saves the tokens, as per the requested method
    * @param scope 
    */
-  async passwordFlow(t, o, i) {
-    const n = await super.passwordFlow(t, o, i);
+  async passwordFlow(t, o, s) {
+    const n = await super.passwordFlow(t, o, s);
     return await this.receiveTokens(n), n;
   }
   /**
@@ -2810,8 +2923,8 @@ class gr extends cr {
    * @return the response from the MFA OTP OAuth call
    */
   async mfaOtpComplete(t, o) {
-    const i = await super.mfaOtpComplete(t, o);
-    return await this.receiveTokens(i), i;
+    const s = await super.mfaOtpComplete(t, o);
+    return await this.receiveTokens(s), s;
   }
   /**
    * See {@link OAuthClientBase}.  Calls the base function
@@ -2820,8 +2933,8 @@ class gr extends cr {
    * @param oobCode the code entered by the user
    * @return the response from the MFA OOB OAuth call
    */
-  async mfaOobComplete(t, o, i) {
-    const n = await super.mfaOobComplete(t, o, i);
+  async mfaOobComplete(t, o, s) {
+    const n = await super.mfaOobComplete(t, o, s);
     return await this.receiveTokens(n), n;
   }
   /**
@@ -2832,8 +2945,8 @@ class gr extends cr {
    */
   async refreshTokenFlow(t) {
     if (!t)
-      if (p(this, N))
-        t = p(this, N);
+      if (p(this, W))
+        t = p(this, W);
       else
         throw new g(m.InvalidToken, "Cannot refresh tokens: no refresh token present");
     const o = await super.refreshTokenFlow(t);
@@ -2845,31 +2958,31 @@ class gr extends cr {
    * @param pkce whether or not to use PKCE.
    */
   async authorizationCodeFlow(t, o = !1) {
-    const i = this.randomValue(this.stateLength);
+    const s = this.randomValue(this.stateLength);
     if (this.scope = t, o) {
-      const s = await this.codeChallengeAndVerifier();
-      T(this, q, s.codeChallenge), T(this, V, s.codeVerifier), T(this, B, i);
+      const i = await this.codeChallengeAndVerifier();
+      T(this, Z, i.codeChallenge), T(this, ee, i.codeVerifier), T(this, V, s);
     }
-    const n = await super.startAuthorizationCodeFlow(i, t, p(this, q), o);
+    const n = await super.startAuthorizationCodeFlow(s, t, p(this, Z), o);
     if (n.error || !n.url) {
-      const s = g.fromOAuthError(
+      const i = g.fromOAuthError(
         n.error ?? "Couldn't create URL for authorization code flow",
         n.error_description
       );
-      throw d.logger.debug(h({ err: s })), s;
+      throw d.logger.debug(l({ err: i })), i;
     }
     location.href = n.url;
   }
 }
-x = new WeakMap(), N = new WeakMap(), I = new WeakMap(), K = new WeakMap(), z = new WeakMap(), J = new WeakMap(), M = new WeakMap(), q = new WeakMap(), V = new WeakMap(), B = new WeakMap();
+j = new WeakMap(), W = new WeakMap(), N = new WeakMap(), D = new WeakMap(), J = new WeakMap(), B = new WeakMap(), q = new WeakMap(), Z = new WeakMap(), ee = new WeakMap(), V = new WeakMap();
 export {
   g as CrossauthError,
   d as CrossauthLogger,
-  Re as OAuthAutoRefresher,
-  ur as OAuthBffClient,
-  gr as OAuthClient,
-  Ie as OAuthDeviceCodePoller,
-  hr as OAuthTokenConsumer,
-  fr as OAuthTokenProvider,
-  h as j
+  Ke as OAuthAutoRefresher,
+  Rr as OAuthBffClient,
+  Ir as OAuthClient,
+  We as OAuthDeviceCodePoller,
+  br as OAuthTokenConsumer,
+  Pr as OAuthTokenProvider,
+  l as j
 };