@crossauth/sveltekit 0.0.20 → 0.0.22

package/dist/index.js

@@ -1,9 +1,9 @@
-import { minimatch as P } from "minimatch";
-import { ApiKeyManager as M, KeyStorage as X, toCookieSerializeOptions as R, Crypto as A, OAuthAuthorizationServer as Z, setParameter as y, ParamType as _, DoubleSubmitCsrfToken as ee, OAuthClientManager as x, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
-import { CrossauthError as c, ErrorCode as h, CrossauthLogger as d, j as u, OAuthFlows as E, UserState as I, httpStatus as q } from "@crossauth/common";
+import { minimatch as I } from "minimatch";
+import { ApiKeyManager as K, KeyStorage as $, toCookieSerializeOptions as P, Crypto as F, OAuthAuthorizationServer as Z, setParameter as y, ParamType as E, DoubleSubmitCsrfToken as ee, OAuthClientManager as B, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
+import { CrossauthError as c, ErrorCode as h, CrossauthLogger as d, j as u, OAuthFlows as _, UserState as N, httpStatus as q } from "@crossauth/common";
 import { json as v, redirect as Q, error as Y } from "@sveltejs/kit";
 import "cookie";
-import { jwtDecode as K } from "jwt-decode";
+import { jwtDecode as M } from "jwt-decode";
 import ae from "qrcode";
 class V {
   constructor(r) {
@@ -26,11 +26,11 @@ class b {
     this.clone = r;
   }
   async loadData(r) {
-    var t, e, s, a;
+    var t, e, s, i;
     if (!((t = r.request) != null && t.body))
       return;
     const o = r.request.headers.get("content-type");
-    o == "application/json" ? this.jsonData = this.clone ? await ((s = (e = r.request) == null ? void 0 : e.clone()) == null ? void 0 : s.json()) : await ((a = r.request) == null ? void 0 : a.json()) : (o == "application/x-www-form-urlencoded" || o != null && o.startsWith("multipart/form-data")) && (this.formData = this.clone ? await r.request.clone().formData() : await r.request.formData());
+    o == "application/json" ? this.jsonData = this.clone ? await ((s = (e = r.request) == null ? void 0 : e.clone()) == null ? void 0 : s.json()) : await ((i = r.request) == null ? void 0 : i.json()) : (o == "application/x-www-form-urlencoded" || o != null && o.startsWith("multipart/form-data")) && (this.formData = this.clone ? await r.request.clone().formData() : await r.request.formData());
   }
   get(r) {
     if (this.jsonData) return this.jsonData[r];
@@ -84,7 +84,7 @@ class ne {
    * @param options See {@link SvelteKitApiKeyServerOptions}
    */
   constructor(r, o, t = {}) {
-    this.userStorage = r, this.apiKeyManager = new M(o, t), this.hook = async ({ event: e }) => {
+    this.userStorage = r, this.apiKeyManager = new K(o, t), this.hook = async ({ event: e }) => {
       d.logger.debug("APIKey hook");
       const s = e.request.headers.get("authorization");
       if (s)
@@ -92,29 +92,29 @@ class ne {
           d.logger.debug(u({
             msg: "Received authorization header"
           }));
-          const a = await this.apiKeyManager.validateToken(
+          const i = await this.apiKeyManager.validateToken(
             s
           );
           d.logger.debug(u({
             msg: "Valid API key",
-            hahedApiKey: M.hashSignedApiKeyValue(a.value)
+            hahedApiKey: K.hashSignedApiKeyValue(i.value)
           }));
-          const i = X.decodeData(a.data);
-          if (e.locals.apiKey = { ...a, ...i }, "scope" in i && Array.isArray(i.scope)) {
+          const a = $.decodeData(i.data);
+          if (e.locals.apiKey = { ...i, ...a }, "scope" in a && Array.isArray(a.scope)) {
             let n = [];
-            for (let l of i.scope)
+            for (let l of a.scope)
               typeof l == "string" && n.push(l);
             e.locals.scope = n;
           }
-          if (a.userid)
+          if (i.userid)
             try {
-              const { user: n } = await this.userStorage.getUserById(a.userid);
-              e.locals.user = n, e.locals.authType = "apiKey", d.logger.debug(u({ msg: "API key is for user", userid: n.id, user: n.username, hahedApiKey: M.hashSignedApiKeyValue(a.value) }));
+              const { user: n } = await this.userStorage.getUserById(i.userid);
+              e.locals.user = n, e.locals.authType = "apiKey", d.logger.debug(u({ msg: "API key is for user", userid: n.id, user: n.username, hahedApiKey: K.hashSignedApiKeyValue(i.value) }));
             } catch (n) {
-              d.logger.error(u({ msg: "API key has invalid user", userid: a.userid, hashedApiKey: M.hashSignedApiKeyValue(a.value) })), d.logger.debug(u({ err: n }));
+              d.logger.error(u({ msg: "API key has invalid user", userid: i.userid, hashedApiKey: K.hashSignedApiKeyValue(i.value) })), d.logger.debug(u({ err: n }));
             }
-        } catch (a) {
-          d.logger.error(u({ msg: "Invalid authorization header received", header: s })), d.logger.debug(u({ err: a }));
+        } catch (i) {
+          d.logger.error(u({ msg: "Invalid authorization header received", header: s })), d.logger.debug(u({ err: i }));
         }
     };
   }
@@ -130,9 +130,9 @@ class ce {
    * @param options see {@link SvelteKitAuthorizationServerOptions}
    */
   constructor(r, o, t, e, s = {}) {
-    var a;
+    var i;
     this.loginUrl = "/login", this.refreshTokenType = "json", this.refreshTokenCookieName = "CROSSAUTH_REFRESH_TOKEN", this.refreshTokenCookieDomain = void 0, this.refreshTokenCookieHttpOnly = !1, this.refreshTokenCookiePath = "/", this.refreshTokenCookieSecure = !0, this.refreshTokenCookieSameSite = "strict", this.authorizeEndpointUrl = "/oauth/authorize", this.tokenEndpointUrl = "/oauth/token", this.jwksEndpointUrl = "/oauth/jwks", this.oidcConfigurationEndpoint = {
-      get: async (i) => v(this.authServer.oidcConfiguration(
+      get: async (a) => v(this.authServer.oidcConfiguration(
         {
           authorizeEndpoint: this.authorizeEndpointUrl,
           tokenEndpoint: this.tokenEndpointUrl,
@@ -141,7 +141,7 @@ class ce {
         }
       ))
     }, this.jwksGetEndpoint = {
-      get: async (i) => {
+      get: async (a) => {
         try {
           return v(this.authServer.jwks());
         } catch (n) {
@@ -153,7 +153,7 @@ class ce {
         }
       }
     }, this.getCsrfTokenEndpoint = {
-      get: async (i) => {
+      get: async (a) => {
         var l;
         if (!this.csrfTokens) return v({
           ok: !1,
@@ -166,17 +166,17 @@ class ce {
             csrfCookie: f,
             csrfFormOrHeaderValue: g
           } = await this.createCsrfToken();
-          return n = f.value, i.cookies.set(
+          return n = f.value, a.cookies.set(
             f.name,
             f.value,
-            R(f.options)
+            P(f.options)
           ), v({ ok: !0, csrfToken: g });
         } catch (f) {
           const g = c.asCrossauthError(f);
           return d.logger.error(u({
             msg: "getcsrftoken failure",
-            user: (l = i.locals.user) == null ? void 0 : l.username,
-            hashedCsrfCookie: A.hash(n.split(".")[0]),
+            user: (l = a.locals.user) == null ? void 0 : l.username,
+            hashedCsrfCookie: F.hash(n.split(".")[0]),
             error: g.code,
             errorCodeName: g.codeName
           })), d.logger.debug(u({ err: f })), d.logger.error({ cerr: f }), v({
@@ -187,15 +187,15 @@ class ce {
         }
       }
     }, this.authorizeEndpoint = {
-      load: async (i) => {
-        var w, S;
-        if (!(this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode)))
+      load: async (a) => {
+        var m, S;
+        if (!(this.authServer.validFlows.includes(_.AuthorizationCode) || this.authServer.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(_.OidcAuthorizationCode)))
           throw this.error(401, "authorize cannot be called because the authorization code flows are not supported");
-        if (!i.locals.user) return this.redirect(
+        if (!a.locals.user) return this.redirect(
           302,
-          this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
+          this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
         );
-        let n = this.getAuthorizeQuery(i);
+        let n = this.getAuthorizeQuery(a);
         if (!n.query) return n.error;
         let l = n.query;
         d.logger.debug(u({ msg: "validating authorize parameters" }));
@@ -203,34 +203,34 @@ class ce {
         if (f ? (g = new c(h.BadRequest, f), d.logger.error(u({
           msg: "authorize parameter invalid",
           cerr: g,
-          user: (w = i.locals.user) == null ? void 0 : w.username
+          user: (m = a.locals.user) == null ? void 0 : m.username
         }))) : d.logger.error(u({
           msg: "authorize parameter valid",
-          user: (S = i.locals.user) == null ? void 0 : S.username
+          user: (S = a.locals.user) == null ? void 0 : S.username
         })), g)
           return {
             ok: !1,
             error: g.oauthErrorCode,
             error_description: g.message
           };
-        let m = !1;
+        let w = !1;
         if (d.logger.debug(u({
           msg: "Checking scopes have been authorized",
           scope: l.scope
-        })), l.scope ? m = await this.authServer.hasAllScopes(
+        })), l.scope ? w = await this.authServer.hasAllScopes(
           l.client_id,
-          i.locals.user,
+          a.locals.user,
           l.scope.split(" ")
-        ) : m = await this.authServer.hasAllScopes(
+        ) : w = await this.authServer.hasAllScopes(
           l.client_id,
-          i.locals.user,
+          a.locals.user,
           [null]
-        ), m) {
+        ), w) {
           d.logger.debug(u({
             msg: "All scopes authorized",
             scope: l.scope
           }));
-          const C = await this.authorize(i, !0, {
+          const C = await this.authorize(a, !0, {
             responseType: l.response_type,
             client_id: l.client_id,
             redirect_uri: l.redirect_uri,
@@ -254,7 +254,7 @@ class ce {
             return {
               ok: !0,
               authorizationNeeded: {
-                user: i.locals.user,
+                user: a.locals.user,
                 response_type: l.response_type,
                 client_id: l.client_id,
                 client_name: C.client_name,
@@ -264,7 +264,7 @@ class ce {
                 state: l.state,
                 code_challenge: l.code_challenge,
                 code_challenge_method: l.code_challenge_method,
-                csrfToken: i.locals.csrfToken
+                csrfToken: a.locals.csrfToken
               },
               ...this.baseEndpoint
             };
@@ -280,33 +280,33 @@ class ce {
       },
       // load
       actions: {
-        default: async (i) => {
+        default: async (a) => {
           var f;
           let n;
           try {
             var l = new b();
-            await l.loadData(i), n = l.toObject();
-            const g = l.getAsBoolean("authorized"), m = n.response_type, w = n.client_id, S = n.redirect_uri, C = n.scope, T = n.state, N = n.code_challenge, F = n.code_challenge_method;
+            await l.loadData(a), n = l.toObject();
+            const g = l.getAsBoolean("authorized"), w = n.response_type, m = n.client_id, S = n.redirect_uri, C = n.scope, T = n.state, R = n.code_challenge, A = n.code_challenge_method;
             let U;
-            if (g == null && (U = "authorized"), m ? w ? S ? T || (U = "state") : U = "redirect_uri" : U = "client_id" : U = "response_type", U)
+            if (g == null && (U = "authorized"), w ? m ? S ? T || (U = "state") : U = "redirect_uri" : U = "client_id" : U = "response_type", U)
               return {
                 ok: !1,
                 error: "invalid_request",
                 error_description: "Invalid form: does not contain " + U + " parameter"
               };
-            if (!i.locals.user) return this.redirect(
+            if (!a.locals.user) return this.redirect(
               302,
-              this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
+              this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
             );
-            if ((f = this.svelteKitServer.sessionServer) != null && f.enableCsrfProtection && !i.locals.csrfToken) throw new c(h.InvalidCsrf);
-            const z = await this.authorize(i, g ?? !1, {
-              responseType: m,
-              client_id: w,
+            if ((f = this.svelteKitServer.sessionServer) != null && f.enableCsrfProtection && !a.locals.csrfToken) throw new c(h.InvalidCsrf);
+            const z = await this.authorize(a, g ?? !1, {
+              responseType: w,
+              client_id: m,
               redirect_uri: S,
               scope: C,
               state: T,
-              codeChallenge: N,
-              codeChallengeMethod: F
+              codeChallenge: R,
+              codeChallengeMethod: A
             });
             return {
               ok: !1,
@@ -315,10 +315,10 @@ class ce {
             };
           } catch (g) {
             if (p.isSvelteKitError(g) || p.isSvelteKitRedirect(g)) throw g;
-            let m = c.asCrossauthError(g, "Couldn't process authorization code");
+            let w = c.asCrossauthError(g, "Couldn't process authorization code");
             return {
-              error: m.oauthErrorCode,
-              error_description: m.message,
+              error: w.oauthErrorCode,
+              error_description: w.message,
               ok: !1,
               formData: n
             };
@@ -326,22 +326,22 @@ class ce {
         }
       }
     }, this.tokenEndpoint = {
-      post: async (i) => {
+      post: async (a) => {
         let n;
         try {
-          if (!(this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode) || this.authServer.validFlows.includes(E.ClientCredentials) || this.authServer.validFlows.includes(E.RefreshToken) || this.authServer.validFlows.includes(E.Password) || this.authServer.validFlows.includes(E.PasswordMfa || this.authServer.validFlows.includes(E.DeviceCode))))
+          if (!(this.authServer.validFlows.includes(_.AuthorizationCode) || this.authServer.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(_.OidcAuthorizationCode) || this.authServer.validFlows.includes(_.ClientCredentials) || this.authServer.validFlows.includes(_.RefreshToken) || this.authServer.validFlows.includes(_.Password) || this.authServer.validFlows.includes(_.PasswordMfa || this.authServer.validFlows.includes(_.DeviceCode))))
             return v({
               ok: !1,
               error: "invalid_request",
               error_description: "Token endpoint cannot be called as the supported OAuth flow types don't require it"
             }, { status: 500 });
           var l = new b();
-          await l.loadData(i), n = l.toObject();
-          const { client_id: f, client_secret: g } = this.getClientIdAndSecret(n, i);
-          let m = n.refresh_token, w = i.cookies.get(this.refreshTokenCookieName);
-          if ((this.refreshTokenType == "cookie" && w || this.refreshTokenType == "both" && w && m == null) && this.csrfTokens) {
-            const C = i.cookies.get(this.csrfTokens.cookieName);
-            let T = i.request.headers.get(this.csrfTokens.headerName.toLowerCase());
+          await l.loadData(a), n = l.toObject();
+          const { client_id: f, client_secret: g } = this.getClientIdAndSecret(n, a);
+          let w = n.refresh_token, m = a.cookies.get(this.refreshTokenCookieName);
+          if ((this.refreshTokenType == "cookie" && m || this.refreshTokenType == "both" && m && w == null) && this.csrfTokens) {
+            const C = a.cookies.get(this.csrfTokens.cookieName);
+            let T = a.request.headers.get(this.csrfTokens.headerName.toLowerCase());
             if (Array.isArray(T) && (T = T[0]), !C || !T)
               return v({
                 ok: !1,
@@ -350,14 +350,14 @@ class ce {
               }, { status: 401 });
             try {
               this.csrfTokens.validateDoubleSubmitCsrfToken(C, T);
-            } catch (N) {
-              return d.logger.debug(u({ err: N })), d.logger.warn(u({ cerr: N, msg: "Invalid csrf token", client_id: n.client_id })), v({
+            } catch (R) {
+              return d.logger.debug(u({ err: R })), d.logger.warn(u({ cerr: R, msg: "Invalid csrf token", client_id: n.client_id })), v({
                 ok: !1,
                 error: "access_denied",
                 error_description: "Invalid csrf token"
               }, { status: 401 });
             }
-            m = w;
+            w = m;
           }
           const S = await this.authServer.tokenEndpoint({
             grantType: n.grant_type,
@@ -372,16 +372,16 @@ class ce {
             oobCode: n.oob_code,
             bindingCode: n.binding_code,
             otp: n.otp,
-            refreshToken: m,
+            refreshToken: w,
             deviceCode: n.device_code
           });
-          if (S.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(i, S.refresh_token, S.expires_in), S.error == "authorization_pending")
+          if (S.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(a, S.refresh_token, S.expires_in), S.error == "authorization_pending")
             return v(S);
           if (S.error || !S.access_token) {
             let C = "server_error", T = "Neither code nor error received when requestoing authorization";
             S.error && (C = S.error), S.error_description && (T = S.error_description);
-            const N = c.fromOAuthError(C, T);
-            return d.logger.error(u({ cerr: N })), v(S, { status: N.httpStatus });
+            const R = c.fromOAuthError(C, T);
+            return d.logger.error(u({ cerr: R })), v(S, { status: R.httpStatus });
           }
           return v(S);
         } catch (f) {
@@ -393,10 +393,10 @@ class ce {
         }
       }
     }, this.mfaAuthenticatorsEndpoint = {
-      get: async (i) => {
+      get: async (a) => {
         try {
           var n = new b();
-          return await n.loadData(i), v(await this.mfaAuthenticators(i));
+          return await n.loadData(a), v(await this.mfaAuthenticators(a));
         } catch (l) {
           const f = c.asCrossauthError(l);
           return d.logger.debug({ err: l }), d.logger.error({ cerr: l }), v({
@@ -405,11 +405,11 @@ class ce {
           });
         }
       },
-      post: async (i) => {
+      post: async (a) => {
         try {
           var n = new b();
-          await n.loadData(i);
-          let l = await this.mfaAuthenticators(i), f = 200;
+          await n.loadData(a);
+          let l = await this.mfaAuthenticators(a), f = 200;
           return !Array.isArray(l) && l.error == "access_denied" ? f = 401 : !Array.isArray(l) && l.error && (f = 500), v(l, { status: f });
         } catch (l) {
           const f = c.asCrossauthError(l);
@@ -420,11 +420,11 @@ class ce {
         }
       }
     }, this.mfaChallengeEndpoint = {
-      post: async (i) => {
+      post: async (a) => {
         try {
           var n = new b();
-          await n.loadData(i);
-          const l = await this.mfaChallenge(i);
+          await n.loadData(a);
+          const l = await this.mfaChallenge(a);
           let f = 200;
           return l.error == "access_denied" ? f = 401 : l.error && (f = 500), v(l, { status: f });
         } catch (l) {
@@ -436,35 +436,35 @@ class ce {
         }
       }
     }, this.deviceAuthorizationEndpoint = {
-      post: async (i) => {
+      post: async (a) => {
         let n;
         try {
-          if (!this.authServer.validFlows.includes(E.DeviceCode))
+          if (!this.authServer.validFlows.includes(_.DeviceCode))
             return v({
               ok: !1,
               error: "invalid_request",
               error_description: "Device authorization endpoint cannot be called as the supported OAuth flow types don't require it"
             });
           var l = new b();
-          await l.loadData(i), n = l.toObject();
-          const { client_id: f, client_secret: g } = this.getClientIdAndSecret(n, i), m = await this.authServer.deviceAuthorizationEndpoint({
+          await l.loadData(a), n = l.toObject();
+          const { client_id: f, client_secret: g } = this.getClientIdAndSecret(n, a), w = await this.authServer.deviceAuthorizationEndpoint({
             client_id: f,
             client_secret: g,
             scope: n.scope
           });
-          if (m.error) {
-            const w = c.fromOAuthError(m.error, m.error_description);
-            return d.logger.error(u({ cerr: w })), v(m, { status: 500 });
+          if (w.error) {
+            const m = c.fromOAuthError(w.error, w.error_description);
+            return d.logger.error(u({ cerr: m })), v(w, { status: 500 });
           }
-          if (!m.device_code || !m.user_code || !m.verification_uri || !m.verification_uri_complete || !m.expires_in) {
-            let w = "server_error", S = "Device authorization result has missing data";
+          if (!w.device_code || !w.user_code || !w.verification_uri || !w.verification_uri_complete || !w.expires_in) {
+            let m = "server_error", S = "Device authorization result has missing data";
             const C = new c(h.UnknownError, S);
             return d.logger.error(u({ cerr: C })), v({
-              error: w,
+              error: m,
               error_description: S
             }, { status: 500 });
           }
-          return v(m);
+          return v(w);
         } catch (f) {
           const g = c.asCrossauthError(f);
           return d.logger.debug({ err: f }), d.logger.error({ cerr: f }), v({
@@ -474,31 +474,31 @@ class ce {
         }
       }
     }, this.deviceEndpoint = {
-      load: async (i) => {
-        if (!this.authServer.validFlows.includes(E.DeviceCode))
+      load: async (a) => {
+        if (!this.authServer.validFlows.includes(_.DeviceCode))
           throw this.error(401, "device cannot be called because the device code flow is not supported");
-        if (!i.locals.user) return this.redirect(
+        if (!a.locals.user) return this.redirect(
           302,
-          this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
+          this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
         );
-        let n = i.url.searchParams.get("user_code");
-        return n ? await this.applyUserCode(n, i, i.locals.user) : {
+        let n = a.url.searchParams.get("user_code");
+        return n ? await this.applyUserCode(n, a, a.locals.user) : {
           ok: !0,
           completed: !1,
           retryAllowed: !0,
-          user: i.locals.user,
-          csrfToken: i.locals.csrfToken
+          user: a.locals.user,
+          csrfToken: a.locals.csrfToken
         };
       },
       // load
       actions: {
-        userCode: async (i) => {
-          if (!i.locals.user) throw this.error(401, "Access Denied");
+        userCode: async (a) => {
+          if (!a.locals.user) throw this.error(401, "Access Denied");
           try {
             var n = new b();
-            await n.loadData(i);
+            await n.loadData(a);
             const l = n.get("user_code");
-            return l ? await this.applyUserCode(l, i, i.locals.user) : {
+            return l ? await this.applyUserCode(l, a, a.locals.user) : {
               ok: !1,
               completed: !1,
               retryAllowed: !0,
@@ -517,15 +517,15 @@ class ce {
             };
           }
         },
-        authorize: async (i) => {
+        authorize: async (a) => {
           var f;
           let n;
           try {
             var l = new b();
-            await l.loadData(i), n = l.toObject();
-            const g = l.getAsBoolean("authorized"), m = n.scope, w = n.client_id, S = n.user_code;
+            await l.loadData(a), n = l.toObject();
+            const g = l.getAsBoolean("authorized"), w = n.scope, m = n.client_id, S = n.user_code;
             let C;
-            if (g == null && (C = "authorized"), w == null && (C = "client_id"), S == null && (C = "user_code"), C)
+            if (g == null && (C = "authorized"), m == null && (C = "client_id"), S == null && (C = "user_code"), C)
               return {
                 ok: !1,
                 completed: !1,
@@ -533,24 +533,24 @@ class ce {
                 error: "invalid_request",
                 error_description: "Invalid form: does not contain " + C + " parameter"
               };
-            if (!i.locals.user) return this.redirect(
+            if (!a.locals.user) return this.redirect(
               302,
-              this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
+              this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
             );
-            if ((f = this.svelteKitServer.sessionServer) != null && f.enableCsrfProtection && !i.locals.csrfToken) throw new c(h.InvalidCsrf);
-            return (await this.authServer.validateAndPersistScope(w, m, i.locals.user)).error ? {
+            if ((f = this.svelteKitServer.sessionServer) != null && f.enableCsrfProtection && !a.locals.csrfToken) throw new c(h.InvalidCsrf);
+            return (await this.authServer.validateAndPersistScope(m, w, a.locals.user)).error ? {
               ok: !1,
               completed: !1,
               retryAllowed: !1,
               error: "unauthorized_client",
               error_description: "You did not authorize access to your account"
-            } : await this.applyUserCode(S, i, i.locals.user);
+            } : await this.applyUserCode(S, a, a.locals.user);
           } catch (g) {
             if (p.isSvelteKitError(g) || p.isSvelteKitRedirect(g)) throw g;
-            let m = c.asCrossauthError(g, "Couldn't process authorization code");
+            let w = c.asCrossauthError(g, "Couldn't process authorization code");
             return {
-              error: m.oauthErrorCode,
-              error_description: m.message,
+              error: w.oauthErrorCode,
+              error_description: w.message,
               ok: !1,
               completed: !1,
               retryAllowed: !1
@@ -563,7 +563,7 @@ class ce {
       t,
       e,
       s
-    ), y("loginUrl", _.String, this, s, "LOGIN_URL"), y("refreshTokenType", _.String, this, s, "OAUTH_REFRESH_TOKEN_TYPE"), y("refreshTokenCookieName", _.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), y("refreshTokenCookieDomain", _.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), y("refreshTokenCookieHttpOnly", _.Boolean, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), y("refreshTokenCookiePath", _.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), y("refreshTokenCookieSecure", _.Boolean, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), y("refreshTokenCookieSameSite", _.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), y("authorizeEndpointUrl", _.String, this, s, "OAUTH_AUTHORIZE_ENDPOINT"), y("tokenEndpointUrl", _.String, this, s, "OAUTH_TOKEN_ENDPOINT"), y("jwksEndpointUrl", _.String, this, s, "OAUTH_JWKS_ENDPOINT"), this.refreshTokenType != "json" && (((a = this.svelteKitServer.sessionServer) == null ? void 0 : a.enableCsrfProtection) == !0 ? this.csrfTokens = this.svelteKitServer.sessionServer.sessionManager.csrfTokens : this.csrfTokens = new ee(s.doubleSubmitCookieOptions));
+    ), y("loginUrl", E.String, this, s, "LOGIN_URL"), y("refreshTokenType", E.String, this, s, "OAUTH_REFRESH_TOKEN_TYPE"), y("refreshTokenCookieName", E.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), y("refreshTokenCookieDomain", E.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), y("refreshTokenCookieHttpOnly", E.Boolean, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), y("refreshTokenCookiePath", E.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), y("refreshTokenCookieSecure", E.Boolean, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), y("refreshTokenCookieSameSite", E.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), y("authorizeEndpointUrl", E.String, this, s, "OAUTH_AUTHORIZE_ENDPOINT"), y("tokenEndpointUrl", E.String, this, s, "OAUTH_TOKEN_ENDPOINT"), y("jwksEndpointUrl", E.String, this, s, "OAUTH_JWKS_ENDPOINT"), this.refreshTokenType != "json" && (((i = this.svelteKitServer.sessionServer) == null ? void 0 : i.enableCsrfProtection) == !0 ? this.csrfTokens = this.svelteKitServer.sessionServer.sessionManager.csrfTokens : this.csrfTokens = new ee(s.doubleSubmitCookieOptions));
   }
   /**
    * Returns this server's OIDC configuration.  Just wraps
@@ -585,24 +585,24 @@ class ce {
     responseType: t,
     client_id: e,
     redirect_uri: s,
-    scope: a,
-    state: i,
+    scope: i,
+    state: a,
     codeChallenge: n,
     codeChallengeMethod: l
   }) {
-    let f, g, m;
+    let f, g, w;
     if (o) {
-      const w = await this.authServer.authorizeGetEndpoint({
+      const m = await this.authServer.authorizeGetEndpoint({
         responseType: t,
         client_id: e,
         redirect_uri: s,
-        scope: a,
-        state: i,
+        scope: i,
+        state: a,
         codeChallenge: n,
         codeChallengeMethod: l,
         user: r.locals.user
       });
-      if (m = w.code, f = w.error, g = w.error_description, f || !m) {
+      if (w = m.code, f = m.error, g = m.error_description, f || !w) {
         const S = c.fromOAuthError(
           f ?? "server_error",
           g ?? "Neither code nor error received"
@@ -615,25 +615,25 @@ class ce {
       }
       throw this.redirect(302, this.authServer.redirect_uri(
         s,
-        m,
-        i
+        w,
+        a
       ));
     } else {
-      const w = new c(
+      const m = new c(
         h.Unauthorized,
         "You have not granted access"
       );
-      d.logger.debug(u({ err: w })), d.logger.error(u({ cerr: w })), d.logger.error(u({
+      d.logger.debug(u({ err: m })), d.logger.error(u({ cerr: m })), d.logger.error(u({
         msg: g,
-        errorCode: w.code,
-        errorCodeName: w.codeName
+        errorCode: m.code,
+        errorCodeName: m.codeName
       }));
       try {
-        throw x.validateUri(s), this.redirect(302, s + "?error=access_denied&error_description=" + encodeURIComponent("Access was not granted"));
+        throw B.validateUri(s), this.redirect(302, s + "?error=access_denied&error_description=" + encodeURIComponent("Access was not granted"));
       } catch (S) {
         if (p.isSvelteKitError(S) || p.isSvelteKitRedirect(S)) throw S;
         return d.logger.error(u({
-          msg: `Couldn't send error message ${w.codeName} to ${s}}`
+          msg: `Couldn't send error message ${m.codeName} to ${s}}`
         })), {
           ok: !1,
           error: "server_error",
@@ -690,13 +690,13 @@ class ce {
     if (o = this.requireGetParam(r, "client_id"), o) return { error: o };
     if (o = this.requireGetParam(r, "redirect_uri"), o) return { error: o };
     if (o = this.requireGetParam(r, "state"), o) return { error: o };
-    const t = r.url.searchParams.get("response_type") ?? "", e = r.url.searchParams.get("client_id") ?? "", s = r.url.searchParams.get("redirect_uri") ?? "", a = r.url.searchParams.get("scope") ?? void 0, i = r.url.searchParams.get("state") ?? "", n = r.url.searchParams.get("code_challenge") ?? void 0, l = r.url.searchParams.get("code_challenge_method") ?? void 0;
+    const t = r.url.searchParams.get("response_type") ?? "", e = r.url.searchParams.get("client_id") ?? "", s = r.url.searchParams.get("redirect_uri") ?? "", i = r.url.searchParams.get("scope") ?? void 0, a = r.url.searchParams.get("state") ?? "", n = r.url.searchParams.get("code_challenge") ?? void 0, l = r.url.searchParams.get("code_challenge_method") ?? void 0;
     return { query: {
       response_type: t,
       client_id: e,
       redirect_uri: s,
-      scope: a,
-      state: i,
+      scope: i,
+      state: a,
       code_challenge: n,
       code_challenge_method: l
     }, error: { error: "Unknown error", error_description: "Unknown error", ok: !0 } };
@@ -710,18 +710,18 @@ class ce {
     if (e = this.requireBodyParam(t, "challenge_type"), e) return { error: e };
     if (e = this.requireBodyParam(t, "mfa_token"), e) return { error: e };
     if (e = this.requireBodyParam(t, "authenticator_id"), e) return { error: e };
-    const s = t.client_id ?? "", a = t.challenge_type ?? "", i = t.mfa_token ?? "", n = t.authenticator_id ?? "", l = t.client_secret ?? void 0;
+    const s = t.client_id ?? "", i = t.challenge_type ?? "", a = t.mfa_token ?? "", n = t.authenticator_id ?? "", l = t.client_secret ?? void 0;
     return { query: {
       client_id: s,
       client_secret: l,
-      challenge_type: a,
-      mfa_token: i,
+      challenge_type: i,
+      mfa_token: a,
       authenticator_id: n
     }, error: { error: "Unknown error", error_description: "Unknown error", ok: !0 } };
   }
   async mfaAuthenticators(r) {
-    var a;
-    const o = (a = r.request.headers.get("authorization")) == null ? void 0 : a.split(" ");
+    var i;
+    const o = (i = r.request.headers.get("authorization")) == null ? void 0 : i.split(" ");
     if (!o || o.length != 2)
       return {
         error: "access_denied",
@@ -752,65 +752,65 @@ class ce {
     let t = r.client_id, e = r.client_secret;
     const s = o.request.headers.get("authorization");
     if (s) {
-      let a, i;
+      let i, a;
       const n = s.split(" ");
       if (n.length == 2 && n[0].toLocaleLowerCase() == "basic") {
-        const f = A.base64Decode(n[1]).split(":", 2);
-        f.length == 2 && (a = f[0], i = f[1]);
+        const f = F.base64Decode(n[1]).split(":", 2);
+        f.length == 2 && (i = f[0], a = f[1]);
       }
-      a == null || i == null ? d.logger.warn(u({
+      i == null || a == null ? d.logger.warn(u({
         msg: "Ignoring malform authenization header " + s
-      })) : (t = a, e = i);
+      })) : (t = i, e = a);
     }
     return { client_id: t, client_secret: e };
   }
   async applyUserCode(r, o, t) {
-    var e, s, a;
+    var e, s, i;
     try {
-      const i = await this.authServer.deviceEndpoint({ userCode: r, user: t });
-      if (i.error)
+      const a = await this.authServer.deviceEndpoint({ userCode: r, user: t });
+      if (a.error)
         return {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
-          error: i.error,
-          error_description: i.error_description
+          error: a.error,
+          error_description: a.error_description
         };
-      if (!i.client_id)
-        return d.logger.error(u({ msg: "No client id found for user code", userCodeHash: A.hash(r), ip: o.request.referrer, username: (e = o.locals.user) == null ? void 0 : e.username })), {
+      if (!a.client_id)
+        return d.logger.error(u({ msg: "No client id found for user code", userCodeHash: F.hash(r), ip: o.request.referrer, username: (e = o.locals.user) == null ? void 0 : e.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
           error: "server_error",
           error_description: "No client id found for user code"
         };
-      if (i.error == "access_denied")
-        return d.logger.error(u({ msg: "Incorrect user code given", userCodeHash: A.hash(r), ip: o.request.referrer, username: (s = o.locals.user) == null ? void 0 : s.username })), this.authServer.userCodeThrottle > 0 && await ((f) => new Promise((g) => setTimeout(g, f)))(this.authServer.userCodeThrottle), {
+      if (a.error == "access_denied")
+        return d.logger.error(u({ msg: "Incorrect user code given", userCodeHash: F.hash(r), ip: o.request.referrer, username: (s = o.locals.user) == null ? void 0 : s.username })), this.authServer.userCodeThrottle > 0 && await ((f) => new Promise((g) => setTimeout(g, f)))(this.authServer.userCodeThrottle), {
           ok: !1,
           completed: !1,
           retryAllowed: !0,
-          error: i.error,
-          error_description: i.error_description
+          error: a.error,
+          error_description: a.error_description
         };
-      if (i.error == "expired_token")
-        return d.logger.error(u({ msg: "Expired user code", userCodeHash: A.hash(r), ip: o.request.referrer, username: (a = o.locals.user) == null ? void 0 : a.username })), {
+      if (a.error == "expired_token")
+        return d.logger.error(u({ msg: "Expired user code", userCodeHash: F.hash(r), ip: o.request.referrer, username: (i = o.locals.user) == null ? void 0 : i.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
-          error: i.error,
-          error_description: i.error_description
+          error: a.error,
+          error_description: a.error_description
         };
-      const n = await this.clientStorage.getClientById(i.client_id);
-      return i.scopeAuthorizationNeeded ? {
+      const n = await this.clientStorage.getClientById(a.client_id);
+      return a.scopeAuthorizationNeeded ? {
         ok: !0,
         completed: !1,
         retryAllowed: !0,
         authorizationNeeded: {
           user: t,
-          client_id: i.client_id,
+          client_id: a.client_id,
           client_name: n.client_name,
-          scope: i.scope,
-          scopes: i.scope ? i.scope.split(" ") : [],
+          scope: a.scope,
+          scopes: a.scope ? a.scope.split(" ") : [],
           csrfToken: o.locals.csrfToken
         },
         user: o.locals.user,
@@ -823,8 +823,8 @@ class ce {
         user: o.locals.user,
         csrfToken: o.locals.csrfToken
       };
-    } catch (i) {
-      const n = c.asCrossauthError(i);
+    } catch (a) {
+      const n = c.asCrossauthError(a);
       return d.logger.debug(u({ err: n })), d.logger.error(u({ msg: n.message, cerr: n })), {
         ok: !1,
         completed: !1,
@@ -870,7 +870,7 @@ function O(k) {
   let r;
   if (k)
     try {
-      r = JSON.parse(A.base64Decode(k.split(".")[1]));
+      r = JSON.parse(F.base64Decode(k.split(".")[1]));
     } catch {
       d.logger.error(u({ msg: "Couldn't decode id token" }));
     }
@@ -885,10 +885,10 @@ function L(k, r) {
   if (k.access_token)
     try {
       if (k.access_token && r.includes("access")) {
-        const s = (o = K(k.access_token)) == null ? void 0 : o.jti, a = s ? A.hash(s) : void 0;
+        const s = (o = M(k.access_token)) == null ? void 0 : o.jti, i = s ? F.hash(s) : void 0;
         d.logger.debug(u({
           msg: "Got access token",
-          accessTokenHash: a
+          accessTokenHash: i
         }));
       }
     } catch (s) {
@@ -897,10 +897,10 @@ function L(k, r) {
   if (k.id_token)
     try {
       if (k.id_token && r.includes("id")) {
-        const s = (t = K(k.id_token)) == null ? void 0 : t.jti, a = s ? A.hash(s) : void 0;
+        const s = (t = M(k.id_token)) == null ? void 0 : t.jti, i = s ? F.hash(s) : void 0;
         d.logger.debug(u({
           msg: "Got id token",
-          idTokenHash: a
+          idTokenHash: i
         }));
       }
     } catch (s) {
@@ -909,10 +909,10 @@ function L(k, r) {
   if (k.refresh_token && r.includes("refresh"))
     try {
       if (k.refresh_token) {
-        const s = (e = K(k.refresh_token)) == null ? void 0 : e.jti, a = s ? A.hash(s) : void 0;
+        const s = (e = M(k.refresh_token)) == null ? void 0 : e.jti, i = s ? F.hash(s) : void 0;
         d.logger.debug(u({
           msg: "Got refresh token",
-          refreshTokenHash: a
+          refreshTokenHash: i
         }));
       }
     } catch (s) {
@@ -920,7 +920,7 @@ function L(k, r) {
     }
 }
 async function j(k, r, o) {
-  var a, i, n, l;
+  var i, a, n, l;
   if (!r.server.sessionAdapter)
     throw new c(
       h.Configuration,
@@ -928,7 +928,7 @@ async function j(k, r, o) {
     );
   let t = k.expires_in;
   if (!t && k.access_token && r.jwtTokens.includes("access")) {
-    const f = K(k.access_token);
+    const f = M(k.access_token);
     f.exp && (t = f.exp);
   }
   if (!t)
@@ -943,12 +943,12 @@ async function j(k, r, o) {
     f && (s.id_token = f);
   }
   if (r.server.sessionServer) {
-    let f = (a = r.server.sessionServer) == null ? void 0 : a.getSessionCookieValue(o);
+    let f = (i = r.server.sessionServer) == null ? void 0 : i.getSessionCookieValue(o);
     f ? await ((n = r.server.sessionAdapter) == null ? void 0 : n.updateSessionData(
       o,
       r.sessionDataName,
       s
-    )) : f = await ((i = r.server.sessionServer) == null ? void 0 : i.createAnonymousSession(
+    )) : f = await ((a = r.server.sessionServer) == null ? void 0 : a.createAnonymousSession(
       o,
       { [r.sessionDataName]: s }
     ));
@@ -977,8 +977,8 @@ async function de(k, r, o, t, e) {
     if (!t) return r.redirect(302, r.authorizedUrl);
   } catch (s) {
     if (p.isSvelteKitError(s) || p.isSvelteKitRedirect(s)) throw s;
-    const a = c.asCrossauthError(s);
-    return d.logger.debug(u({ err: a })), d.logger.debug(u({ cerr: a, msg: "Error receiving tokens" })), r.errorFn(r.server, o, a);
+    const i = c.asCrossauthError(s);
+    return d.logger.debug(u({ err: i })), d.logger.debug(u({ cerr: i, msg: "Error receiving tokens" })), r.errorFn(r.server, o, i);
   }
 }
 async function he(k, r, o, t, e) {
@@ -999,8 +999,8 @@ async function he(k, r, o, t, e) {
     return v({ ok: !0, ...k });
   } catch (s) {
     if (p.isSvelteKitError(s) || p.isSvelteKitRedirect(s)) throw s;
-    const a = c.asCrossauthError(s);
-    return d.logger.debug(u({ err: a })), d.logger.debug(u({ cerr: a, msg: "Error receiving tokens" })), r.errorFn(r.server, o, a);
+    const i = c.asCrossauthError(s);
+    return d.logger.debug(u({ err: i })), d.logger.debug(u({ cerr: i, msg: "Error receiving tokens" })), r.errorFn(r.server, o, i);
   }
 }
 async function ue(k, r, o, t, e) {
@@ -1020,11 +1020,11 @@ async function ue(k, r, o, t, e) {
     return r.jwtTokens.includes("id") && (s.id_payload = O(k.id_token)), s.id_payload && await e(o, s.id_payload), s;
   } catch (s) {
     if (p.isSvelteKitError(s) || p.isSvelteKitRedirect(s)) throw s;
-    const a = c.asCrossauthError(s);
-    return d.logger.debug(u({ err: a })), d.logger.debug(u({ cerr: a, msg: "Error receiving tokens" })), {
+    const i = c.asCrossauthError(s);
+    return d.logger.debug(u({ err: i })), d.logger.debug(u({ cerr: i, msg: "Error receiving tokens" })), {
       ok: !1,
-      error: a.oauthErrorCode,
-      error_description: a.message
+      error: i.oauthErrorCode,
+      error_description: i.message
     };
   }
 }
@@ -1060,35 +1060,35 @@ class G extends re {
    * @param options See {@link SvelteKitOAuthClientOptions}
    */
   constructor(r, o, t) {
-    if (super(o, t), this.sessionDataName = "oauth", this.receiveTokenFn = J, this.errorFn = W, this.loginUrl = "/login", this.validFlows = [E.All], this.authorizedUrl = "", this.autoRefreshActive = {}, this.loginProtectedFlows = [], this.tokenResponseType = "sendJson", this.errorResponseType = "sendJson", this.bffEndpoints = [], this.bffEndpointName = "bff", this.tokenEndpoints = [], this.bffMaxTries = 1, this.bffSleepMilliseconds = 500, this.jwtTokens = ["access", "id", "refresh"], this.testMiddleware = !1, this.testEvent = void 0, this.authorizationCodeFlowEndpoint = {
+    if (super(o, t), this.sessionDataName = "oauth", this.receiveTokenFn = J, this.errorFn = W, this.loginUrl = "/login", this.validFlows = [_.All], this.authorizedUrl = "", this.autoRefreshActive = {}, this.loginProtectedFlows = [], this.tokenResponseType = "sendJson", this.errorResponseType = "sendJson", this.bffEndpoints = [], this.bffEndpointName = "bff", this.tokenEndpoints = [], this.bffMaxTries = 1, this.bffSleepMilliseconds = 500, this.jwtTokens = ["access", "id", "refresh"], this.testMiddleware = !1, this.testEvent = void 0, this.authorizationCodeFlowEndpoint = {
       get: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
           const s = new c(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
           return this.errorFn(this.server, e, s);
         }
         try {
-          if (!this.validFlows.includes(E.AuthorizationCode)) {
+          if (!this.validFlows.includes(_.AuthorizationCode)) {
             const l = new c(h.Unauthorized, "Authorization flow is not supported");
             return this.errorFn(this.server, e, l);
           }
           let s = e.url.searchParams.get("scope") ?? void 0;
           s == "" && (s = void 0);
-          const { url: a, error: i, error_description: n } = await this.startAuthorizationCodeFlow(s);
-          if (i || !a) {
+          const { url: i, error: a, error_description: n } = await this.startAuthorizationCodeFlow(s);
+          if (a || !i) {
             const l = c.fromOAuthError(
-              i ?? "server_error",
+              a ?? "server_error",
               n
             );
             return await this.errorFn(this.server, e, l);
           }
           throw d.logger.debug(u({
             msg: "Authorization code flow: redirecting",
-            url: a
-          })), this.redirect(302, a);
+            url: i
+          })), this.redirect(302, i);
         } catch (s) {
           if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-          const a = c.asCrossauthError(s);
-          return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), this.errorFn(this.server, e, a);
+          const i = c.asCrossauthError(s);
+          return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), this.errorFn(this.server, e, i);
         }
       },
       load: async (e) => {
@@ -1104,7 +1104,7 @@ class G extends re {
           };
         }
         try {
-          if (!this.validFlows.includes(E.AuthorizationCode)) {
+          if (!this.validFlows.includes(_.AuthorizationCode)) {
             const l = new c(h.Unauthorized, "Authorization flow is not supported");
             return {
               ok: !1,
@@ -1114,10 +1114,10 @@ class G extends re {
           }
           let s = e.url.searchParams.get("scope") ?? void 0;
           s == "" && (s = void 0);
-          const { url: a, error: i, error_description: n } = await this.startAuthorizationCodeFlow(s);
-          if (i || !a) {
+          const { url: i, error: a, error_description: n } = await this.startAuthorizationCodeFlow(s);
+          if (a || !i) {
             const l = c.fromOAuthError(
-              i ?? "server_error",
+              a ?? "server_error",
               n
             );
             return {
@@ -1128,15 +1128,15 @@ class G extends re {
           }
           throw d.logger.debug(u({
             msg: "Authorization code flow: redirecting",
-            url: a
-          })), this.redirect(302, a);
+            url: i
+          })), this.redirect(302, i);
         } catch (s) {
           if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-          const a = c.asCrossauthError(s);
+          const i = c.asCrossauthError(s);
           return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), {
             ok: !1,
-            error: a.oauthErrorCode,
-            error_description: a.message
+            error: i.oauthErrorCode,
+            error_description: i.message
           };
         }
       }
@@ -1147,31 +1147,31 @@ class G extends re {
           return this.errorFn(this.server, e, s);
         }
         try {
-          if (!this.validFlows.includes(E.AuthorizationCodeWithPKCE)) {
+          if (!this.validFlows.includes(_.AuthorizationCodeWithPKCE)) {
             const l = new c(h.Unauthorized, "Authorization flow is not supported");
             return this.errorFn(this.server, e, l);
           }
           let s = e.url.searchParams.get("scope") ?? void 0;
           s == "" && (s = void 0);
-          const { url: a, error: i, error_description: n } = await this.startAuthorizationCodeFlow(s, !0);
-          if (i || !a) {
+          const { url: i, error: a, error_description: n } = await this.startAuthorizationCodeFlow(s, !0);
+          if (a || !i) {
             const l = c.fromOAuthError(
-              i ?? "server_error",
+              a ?? "server_error",
               n
             );
             return await this.errorFn(this.server, e, l);
           }
           throw d.logger.debug(u({
             msg: "Authorization code flow: redirecting",
-            url: a
-          })), this.redirect(302, a);
+            url: i
+          })), this.redirect(302, i);
         } catch (s) {
           if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-          const a = c.asCrossauthError(s);
+          const i = c.asCrossauthError(s);
           return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), v({
-            error: a.oauthErrorCode,
-            error_description: a.message
-          }, { status: a.httpStatus });
+            error: i.oauthErrorCode,
+            error_description: i.message
+          }, { status: i.httpStatus });
         }
       },
       load: async (e) => {
@@ -1187,7 +1187,7 @@ class G extends re {
           };
         }
         try {
-          if (!this.validFlows.includes(E.AuthorizationCodeWithPKCE)) {
+          if (!this.validFlows.includes(_.AuthorizationCodeWithPKCE)) {
             const l = new c(h.Unauthorized, "Authorization flow is not supported");
             return {
               ok: !1,
@@ -1197,10 +1197,10 @@ class G extends re {
           }
           let s = e.url.searchParams.get("scope") ?? void 0;
           s == "" && (s = void 0);
-          const { url: a, error: i, error_description: n } = await this.startAuthorizationCodeFlow(s, !0);
-          if (i || !a) {
+          const { url: i, error: a, error_description: n } = await this.startAuthorizationCodeFlow(s, !0);
+          if (a || !i) {
             const l = c.fromOAuthError(
-              i ?? "server_error",
+              a ?? "server_error",
               n
             );
             return {
@@ -1211,15 +1211,15 @@ class G extends re {
           }
           throw d.logger.debug(u({
             msg: "Authorization code flow: redirecting",
-            url: a
-          })), this.redirect(302, a);
+            url: i
+          })), this.redirect(302, i);
         } catch (s) {
           if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-          const a = c.asCrossauthError(s);
+          const i = c.asCrossauthError(s);
           return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), {
             ok: !1,
-            error: a.oauthErrorCode,
-            error_description: a.message
+            error: i.oauthErrorCode,
+            error_description: i.message
           };
         }
       }
@@ -1230,14 +1230,14 @@ class G extends re {
           return this.errorFn(this.server, e, s);
         }
         try {
-          if (!(this.validFlows.includes(E.AuthorizationCode) || this.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.validFlows.includes(E.OidcAuthorizationCode))) {
+          if (!(this.validFlows.includes(_.AuthorizationCode) || this.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.validFlows.includes(_.OidcAuthorizationCode))) {
             const f = new c(h.Unauthorized, "Authorization flows are not supported");
             return this.errorFn(this.server, e, f);
           }
-          const s = e.url.searchParams.get("code") ?? "", a = e.url.searchParams.get("state") ?? void 0, i = e.url.searchParams.get("error") ?? void 0, n = e.url.searchParams.get("error") ?? void 0, l = this.errorIfIdTokenInvalid(await this.redirectEndpoint(
+          const s = e.url.searchParams.get("code") ?? "", i = e.url.searchParams.get("state") ?? void 0, a = e.url.searchParams.get("error") ?? void 0, n = e.url.searchParams.get("error") ?? void 0, l = this.errorIfIdTokenInvalid(await this.redirectEndpoint(
             s,
-            a,
             i,
+            a,
             n
           ));
           if (l.error) return this.errorFn(this.server, e, c.fromOAuthError(l.error, l.error_description));
@@ -1261,8 +1261,8 @@ class G extends re {
           );
         } catch (s) {
           if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-          const a = c.asCrossauthError(s);
-          return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), this.errorFn(this.server, e, a);
+          const i = c.asCrossauthError(s);
+          return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), this.errorFn(this.server, e, i);
         }
       },
       load: async (e) => {
@@ -1278,7 +1278,7 @@ class G extends re {
           };
         }
         try {
-          if (!(this.validFlows.includes(E.AuthorizationCode) || this.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.validFlows.includes(E.OidcAuthorizationCode))) {
+          if (!(this.validFlows.includes(_.AuthorizationCode) || this.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.validFlows.includes(_.OidcAuthorizationCode))) {
             const g = new c(h.Unauthorized, "Authorization flows are not supported");
             return {
               ok: !1,
@@ -1286,10 +1286,10 @@ class G extends re {
               error_description: g.message
             };
           }
-          const s = e.url.searchParams.get("code") ?? "", a = e.url.searchParams.get("state") ?? void 0, i = e.url.searchParams.get("error") ?? void 0, n = e.url.searchParams.get("error") ?? void 0, l = this.errorIfIdTokenInvalid(await this.redirectEndpoint(
+          const s = e.url.searchParams.get("code") ?? "", i = e.url.searchParams.get("state") ?? void 0, a = e.url.searchParams.get("error") ?? void 0, n = e.url.searchParams.get("error") ?? void 0, l = this.errorIfIdTokenInvalid(await this.redirectEndpoint(
             s,
-            a,
             i,
+            a,
             n
           ));
           if (l.error) return {
@@ -1332,33 +1332,33 @@ class G extends re {
           };
         } catch (s) {
           if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-          const a = c.asCrossauthError(s);
+          const i = c.asCrossauthError(s);
           return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), {
             ok: !1,
-            error: a.oauthErrorCode,
-            error_description: a.message
+            error: i.oauthErrorCode,
+            error_description: i.message
           };
         }
       }
     }, this.clientCredentialsFlowEndpoint = {
       post: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const i = new c(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
-          return this.errorFn(this.server, e, i);
+          const a = new c(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
+          return this.errorFn(this.server, e, a);
         }
         let s;
         try {
-          if (!this.validFlows.includes(E.ClientCredentials)) {
+          if (!this.validFlows.includes(_.ClientCredentials)) {
             const l = new c(h.Unauthorized, "Client credentials flow is not supported");
             return this.errorFn(this.server, e, l);
           }
-          var a = new b();
-          await a.loadData(e), s = a.toObject();
-          const i = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(s == null ? void 0 : s.scope));
-          if (i.error) {
+          var i = new b();
+          await i.loadData(e), s = i.toObject();
+          const a = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(s == null ? void 0 : s.scope));
+          if (a.error) {
             const l = c.fromOAuthError(
-              i.error,
-              i.error_description
+              a.error,
+              a.error_description
             );
             return await this.errorFn(
               this.server,
@@ -1367,17 +1367,17 @@ class G extends re {
             );
           }
           const n = await this.receiveTokenFn(
-            i,
+            a,
             this,
             e,
             !1,
             this.setEventLocalsUser
           );
           return n instanceof Response ? n : this.pack(n);
-        } catch (i) {
-          if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
-          const n = c.asCrossauthError(i);
-          return d.logger.debug({ err: i }), d.logger.error({ cerr: i }), this.errorFn(this.server, e, n);
+        } catch (a) {
+          if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
+          const n = c.asCrossauthError(a);
+          return d.logger.debug({ err: a }), d.logger.error({ cerr: a }), this.errorFn(this.server, e, n);
         }
       },
       actions: {
@@ -1389,27 +1389,27 @@ class G extends re {
             throw new c(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
           let s;
           try {
-            if (!this.validFlows.includes(E.ClientCredentials))
+            if (!this.validFlows.includes(_.ClientCredentials))
               throw new c(h.Unauthorized, "Client credentials flow is not supported");
-            var a = new b();
-            await a.loadData(e), s = a.toObject();
-            const i = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(s == null ? void 0 : s.scope));
-            if (i.error)
+            var i = new b();
+            await i.loadData(e), s = i.toObject();
+            const a = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(s == null ? void 0 : s.scope));
+            if (a.error)
               throw c.fromOAuthError(
-                i.error,
-                i.error_description
+                a.error,
+                a.error_description
               );
             return await this.receiveTokenFn(
-              i,
+              a,
               this,
               e,
               !1,
               this.setEventLocalsUser
             ) ?? {};
-          } catch (i) {
-            if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
-            const n = c.asCrossauthError(i);
-            return d.logger.debug({ err: i }), d.logger.error({ cerr: i }), {
+          } catch (a) {
+            if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
+            const n = c.asCrossauthError(a);
+            return d.logger.debug({ err: a }), d.logger.error({ cerr: a }), {
               ok: !1,
               error: n.oauthErrorCode,
               error_description: n.message
@@ -1420,17 +1420,17 @@ class G extends re {
     }, this.refreshTokenFlowEndpoint = {
       post: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const i = new c(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
-          return this.errorFn(this.server, e, i);
+          const a = new c(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
+          return this.errorFn(this.server, e, a);
         }
         let s;
         try {
-          if (!this.validFlows.includes(E.RefreshToken)) {
+          if (!this.validFlows.includes(_.RefreshToken)) {
             const f = new c(h.Unauthorized, "Refresh token flow is not supported");
             return this.errorFn(this.server, e, f);
           }
-          var a = new b();
-          if (await a.loadData(e), s = a.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
+          var i = new b();
+          if (await i.loadData(e), s = i.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
             try {
               if (!this.server.sessionAdapter.getCsrfToken(e))
                 throw new c(h.InvalidCsrf);
@@ -1439,8 +1439,8 @@ class G extends re {
               const g = new c(h.Unauthorized, "CSRF token not present");
               return this.errorFn(this.server, e, g);
             }
-          let i = s.refresh_token;
-          if (!i && this.server.sessionAdapter) {
+          let a = s.refresh_token;
+          if (!a && this.server.sessionAdapter) {
             const f = await this.server.sessionAdapter.getSessionData(e, this.sessionDataName);
             if (!(f != null && f.refresh_token)) {
               const g = new c(
@@ -1449,16 +1449,16 @@ class G extends re {
               );
               return this.errorFn(this.server, e, g);
             }
-            i = f.refresh_token;
+            a = f.refresh_token;
           }
-          if (!i) {
+          if (!a) {
             const f = new c(
               h.BadRequest,
               "No refresh token supplied"
             );
             return this.errorFn(this.server, e, f);
           }
-          const n = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(i)), l = await this.receiveTokenFn(
+          const n = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(a)), l = await this.receiveTokenFn(
             n,
             this,
             e,
@@ -1467,10 +1467,10 @@ class G extends re {
           );
           if (n && l instanceof Response) return l;
           throw new c(h.UnknownError, "Receive token function did not return a Response");
-        } catch (i) {
-          if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
-          const n = c.asCrossauthError(i);
-          return d.logger.debug({ err: i }), d.logger.error({ cerr: i }), this.errorFn(this.server, e, n);
+        } catch (a) {
+          if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
+          const n = c.asCrossauthError(a);
+          return d.logger.debug({ err: a }), d.logger.error({ cerr: a }), this.errorFn(this.server, e, n);
         }
       },
       actions: {
@@ -1482,34 +1482,34 @@ class G extends re {
             throw new c(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
           let s;
           try {
-            if (!this.validFlows.includes(E.RefreshToken)) {
+            if (!this.validFlows.includes(_.RefreshToken)) {
               const f = new c(h.Unauthorized, "Refresh token flow is not supported");
               return this.errorFn(this.server, e, f);
             }
-            var a = new b();
-            if (await a.loadData(e), s = a.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
+            var i = new b();
+            if (await i.loadData(e), s = i.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
               try {
                 if (!this.server.sessionAdapter.getCsrfToken(e))
                   throw new c(h.InvalidCsrf);
               } catch (f) {
                 throw p.isSvelteKitError(f) || p.isSvelteKitRedirect(f) ? f : new c(h.Unauthorized, "CSRF token not present");
               }
-            let i = s.refresh_token;
-            if (!i && this.server.sessionAdapter) {
+            let a = s.refresh_token;
+            if (!a && this.server.sessionAdapter) {
               const f = await this.server.sessionAdapter.getSessionData(e, this.sessionDataName);
               if (!(f != null && f.refresh_token))
                 throw new c(
                   h.BadRequest,
                   "No refresh token in session or in parameters"
                 );
-              i = f.refresh_token;
+              a = f.refresh_token;
             }
-            if (!i)
+            if (!a)
               throw new c(
                 h.BadRequest,
                 "No refresh token supplied"
               );
-            const n = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(i)), l = await this.receiveTokenFn(
+            const n = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(a)), l = await this.receiveTokenFn(
               n,
               this,
               e,
@@ -1518,10 +1518,10 @@ class G extends re {
             ) ?? {};
             if (l instanceof Response) throw new c(h.Configuration, "Refresh token flow should return an object not Response");
             return l;
-          } catch (i) {
-            if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
-            const n = c.asCrossauthError(i);
-            return d.logger.debug({ err: i }), d.logger.error({ cerr: i }), {
+          } catch (a) {
+            if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
+            const n = c.asCrossauthError(a);
+            return d.logger.debug({ err: a }), d.logger.error({ cerr: a }), {
               ok: !1,
               error: n.oauthErrorCode,
               error_description: n.message
@@ -1570,8 +1570,8 @@ class G extends re {
       post: async (e) => {
         const s = await this.startDeviceCodeFlow_internal(e);
         if (s.error) {
-          const a = c.fromOAuthError(s.error, s.error_description);
-          return v(s, { status: a.httpStatus });
+          const i = c.fromOAuthError(s.error, s.error_description);
+          return v(s, { status: i.httpStatus });
         }
         return v(s);
       }
@@ -1587,40 +1587,40 @@ class G extends re {
         if (s instanceof Response) return s;
         if (s == null) return new Response(null, { status: 204 });
         if (s.error) {
-          const a = c.fromOAuthError(s.error, s.error_description);
-          return v(s, { status: a.httpStatus });
+          const i = c.fromOAuthError(s.error, s.error_description);
+          return v(s, { status: i.httpStatus });
         }
         return v(s);
       }
     }, this.passwordFlowEndpoint = {
-      post: async (e) => await this.passwordFlow_post(e, (s, a) => this.passwordPost(s, a)),
+      post: async (e) => await this.passwordFlow_post(e, (s, i) => this.passwordPost(s, i)),
       actions: {
-        password: async (e) => await this.passwordFlow_action(e, (s, a) => this.passwordPost(s, a)),
-        passwordOtp: async (e) => await this.passwordFlow_action(e, (s, a) => this.passwordOtp(s, a)),
-        passwordOob: async (e) => await this.passwordFlow_action(e, (s, a) => this.passwordOob(s, a))
+        password: async (e) => await this.passwordFlow_action(e, (s, i) => this.passwordPost(s, i)),
+        passwordOtp: async (e) => await this.passwordFlow_action(e, (s, i) => this.passwordOtp(s, i)),
+        passwordOob: async (e) => await this.passwordFlow_action(e, (s, i) => this.passwordOob(s, i))
       }
     }, this.passwordOtpEndpoint = {
-      post: async (e) => await this.passwordFlow_post(e, (s, a) => this.passwordOtp(s, a)),
+      post: async (e) => await this.passwordFlow_post(e, (s, i) => this.passwordOtp(s, i)),
       actions: {
-        default: async (e) => await this.passwordFlow_action(e, (s, a) => this.passwordOtp(s, a))
+        default: async (e) => await this.passwordFlow_action(e, (s, i) => this.passwordOtp(s, i))
       }
     }, this.passwordOobEndpoint = {
-      post: async (e) => await this.passwordFlow_post(e, (s, a) => this.passwordOob(s, a)),
+      post: async (e) => await this.passwordFlow_post(e, (s, i) => this.passwordOob(s, i)),
       actions: {
-        default: async (e) => await this.passwordFlow_action(e, (s, a) => this.passwordOob(s, a))
+        default: async (e) => await this.passwordFlow_action(e, (s, i) => this.passwordOob(s, i))
       }
     }, this.deleteTokensEndpoint = {
       post: async (e) => {
-        var s, a;
+        var s, i;
         try {
           return await this.deleteSessionData(e), v({ ok: !0 });
-        } catch (i) {
-          if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
-          const n = c.asCrossauthError(i);
+        } catch (a) {
+          if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
+          const n = c.asCrossauthError(a);
           return d.logger.debug({ err: n }), d.logger.error({ cerr: n }), v({
             ok: !1,
             user: (s = this.server.sessionAdapter) == null ? void 0 : s.getUser(e),
-            csrfToken: (a = this.server.sessionAdapter) == null ? void 0 : a.getCsrfToken(e),
+            csrfToken: (i = this.server.sessionAdapter) == null ? void 0 : i.getCsrfToken(e),
             errorCode: n.code,
             errorCodeName: n.codeName,
             errorMessage: n.message
@@ -1629,16 +1629,16 @@ class G extends re {
       },
       actions: {
         default: async (e) => {
-          var s, a;
+          var s, i;
           try {
             return await this.deleteSessionData(e), { ok: !0 };
-          } catch (i) {
-            if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
-            const n = c.asCrossauthError(i);
+          } catch (a) {
+            if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
+            const n = c.asCrossauthError(a);
             return d.logger.debug({ err: n }), d.logger.error({ cerr: n }), {
               ok: !1,
               user: (s = this.server.sessionAdapter) == null ? void 0 : s.getUser(e),
-              csrfToken: (a = this.server.sessionAdapter) == null ? void 0 : a.getCsrfToken(e),
+              csrfToken: (i = this.server.sessionAdapter) == null ? void 0 : i.getCsrfToken(e),
               errorCode: n.code,
               errorCodeName: n.codeName,
               errorMessage: n.message
@@ -1709,9 +1709,9 @@ class G extends re {
       actions: {
         default: async (e) => await this.tokens(e, this.tokenEndpoints)
       }
-    }, this.server = r, y("sessionDataName", _.String, this, t, "OAUTH_SESSION_DATA_NAME"), y("tokenResponseType", _.String, this, t, "OAUTH_TOKEN_RESPONSE_TYPE"), y("errorResponseType", _.String, this, t, "OAUTH_ERROR_RESPONSE_TYPE"), y("loginUrl", _.String, this, t, "LOGIN_URL"), y("bffEndpointName", _.String, this, t, "OAUTH_BFF_ENDPOINT_NAME"), y("bffBaseUrl", _.String, this, t, "OAUTH_BFF_BASEURL"), y("redirect_uri", _.String, this, t, "OAUTH_REDIRECTURI", !0), y("authorizedUrl", _.String, this, t, "AUTHORIZED_URL", !1), y("validFlows", _.JsonArray, this, t, "OAUTH_validFlows"), y("bffMaxTries", _.Number, this, t, "OAUTH_BFF_MAX_RETRIES"), y("bffSleepMilliseconds", _.Number, this, t, "OAUTH_BFF_SLEEP_MILLISECONDS"), y("jwtTokens", _.JsonArray, this, t, "OAUTH_JWT_TOKENS"), this.bffEndpointName && !this.bffEndpointName.startsWith("/") && (this.bffEndpointName = "/" + this.bffEndpointName), this.bffEndpointName && this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), this.bffBaseUrl && this.bffBaseUrl.endsWith("/") && (this.bffBaseUrl = this.bffBaseUrl.substring(0, this.bffBaseUrl.length - 1)), t.redirect && (this.redirect = t.redirect), t.error && (this.error = t.error), this.validFlows.length == 1 && this.validFlows[0] == E.All)
-      this.validFlows = E.allFlows();
-    else if (!E.areAllValidFlows(this.validFlows))
+    }, this.server = r, y("sessionDataName", E.String, this, t, "OAUTH_SESSION_DATA_NAME"), y("tokenResponseType", E.String, this, t, "OAUTH_TOKEN_RESPONSE_TYPE"), y("errorResponseType", E.String, this, t, "OAUTH_ERROR_RESPONSE_TYPE"), y("loginUrl", E.String, this, t, "LOGIN_URL"), y("bffEndpointName", E.String, this, t, "OAUTH_BFF_ENDPOINT_NAME"), y("bffBaseUrl", E.String, this, t, "OAUTH_BFF_BASEURL"), y("redirect_uri", E.String, this, t, "OAUTH_REDIRECTURI", !0), y("authorizedUrl", E.String, this, t, "AUTHORIZED_URL", !1), y("validFlows", E.JsonArray, this, t, "OAUTH_validFlows"), y("bffMaxTries", E.Number, this, t, "OAUTH_BFF_MAX_RETRIES"), y("bffSleepMilliseconds", E.Number, this, t, "OAUTH_BFF_SLEEP_MILLISECONDS"), y("jwtTokens", E.JsonArray, this, t, "OAUTH_JWT_TOKENS"), this.bffEndpointName && !this.bffEndpointName.startsWith("/") && (this.bffEndpointName = "/" + this.bffEndpointName), this.bffEndpointName && this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), this.bffBaseUrl && this.bffBaseUrl.endsWith("/") && (this.bffBaseUrl = this.bffBaseUrl.substring(0, this.bffBaseUrl.length - 1)), t.redirect && (this.redirect = t.redirect), t.error && (this.error = t.error), this.validFlows.length == 1 && this.validFlows[0] == _.All)
+      this.validFlows = _.allFlows();
+    else if (!_.areAllValidFlows(this.validFlows))
       throw new c(h.Configuration, "Invalid flows specificied in " + this.validFlows.join(","));
     try {
       new URL(this.redirect_uri ?? "");
@@ -1721,9 +1721,9 @@ class G extends re {
     if (t.tokenEndpoints && (this.tokenEndpoints = t.tokenEndpoints), this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), t.bffEndpoints && (this.bffEndpoints = t.bffEndpoints.map((e) => ({ ...e, methodsString: e.methods.map((s) => s) }))), this.bffEndpoints)
       for (let e of this.bffEndpoints)
         e.url.startsWith("/") || (e.url = "/" + e.url);
-    if (this.loginProtectedFlows.length == 1 && this.loginProtectedFlows[0] == E.All)
+    if (this.loginProtectedFlows.length == 1 && this.loginProtectedFlows[0] == _.All)
       this.loginProtectedFlows = this.validFlows;
-    else if (!E.areAllValidFlows(this.loginProtectedFlows))
+    else if (!_.areAllValidFlows(this.loginProtectedFlows))
       throw new c(
         h.Configuration,
         "Invalid flows specificied in " + this.loginProtectedFlows.join(",")
@@ -1753,8 +1753,8 @@ class G extends re {
       if (e.locals.user || !r.sessionAdapter) return;
       let s = await r.sessionAdapter.getSessionData(e, this.sessionDataName);
       if (s && s.id_payload) {
-        let a = s.expires_at;
-        a && a > Date.now() && s.id_payload.sub && await this.setEventLocalsUser(e, s.id_payload);
+        let i = s.expires_at;
+        i && i > Date.now() && s.id_payload.sub && await this.setEventLocalsUser(e, s.id_payload);
       }
       this.testMiddleware && (this.testEvent = e);
     };
@@ -1787,12 +1787,12 @@ class G extends re {
         o.password,
         o.scope
       );
-      if (e.error == "mfa_required" && e.mfa_token && this.validFlows.includes(E.PasswordMfa)) {
+      if (e.error == "mfa_required" && e.mfa_token && this.validFlows.includes(_.PasswordMfa)) {
         const s = e.mfa_token;
-        let a = o.scope;
-        if (a == "" && (a = void 0), e = this.errorIfIdTokenInvalid(await this.passwordMfa(
+        let i = o.scope;
+        if (i == "" && (i = void 0), e = this.errorIfIdTokenInvalid(await this.passwordMfa(
           s,
-          a,
+          i,
           r
         )), e.error)
           throw c.fromOAuthError(
@@ -1828,11 +1828,11 @@ class G extends re {
       };
     const s = e.authenticators[0];
     if (s.authenticator_type == "otp") {
-      const i = await this.mfaOtpRequest(r, s.id);
-      if (i.error || i.challenge_type != "otp") {
+      const a = await this.mfaOtpRequest(r, s.id);
+      if (a.error || a.challenge_type != "otp") {
         const n = c.fromOAuthError(
-          i.error ?? "server_error",
-          i.error_description ?? "Invalid response from MFA OTP challenge"
+          a.error ?? "server_error",
+          a.error_description ?? "Invalid response from MFA OTP challenge"
         );
         return d.logger.debug({ err: n }), d.logger.error({ cerr: n }), {
           error: n.oauthErrorCode,
@@ -1842,14 +1842,14 @@ class G extends re {
       return {
         scope: o,
         mfa_token: r,
-        challenge_type: i.challenge_type
+        challenge_type: a.challenge_type
       };
     } else if (s.authenticator_type == "oob") {
-      const i = await this.mfaOobRequest(r, s.id);
-      if (i.error || i.challenge_type != "oob" || !i.oob_code || i.binding_method != "prompt") {
+      const a = await this.mfaOobRequest(r, s.id);
+      if (a.error || a.challenge_type != "oob" || !a.oob_code || a.binding_method != "prompt") {
         const n = c.fromOAuthError(
-          i.error ?? "server_error",
-          i.error_description ?? "Invalid response from MFA OOB challenge"
+          a.error ?? "server_error",
+          a.error_description ?? "Invalid response from MFA OOB challenge"
         );
         return d.logger.debug({ err: n }), d.logger.error({ cerr: n }), {
           error: n.oauthErrorCode,
@@ -1860,19 +1860,19 @@ class G extends re {
         scope: o,
         mfa_token: r,
         oob_channel: s.oob_channel,
-        challenge_type: i.challenge_type,
-        binding_method: i.binding_method,
-        oob_code: i.oob_code,
+        challenge_type: a.challenge_type,
+        binding_method: a.binding_method,
+        oob_code: a.oob_code,
         name: s.name
       };
     }
-    const a = new c(
+    const i = new c(
       h.UnknownError,
       "Unsupported MFA type " + s.authenticator_type + " returned"
     );
     return {
-      error: a.oauthErrorCode,
-      error_description: a.message
+      error: i.oauthErrorCode,
+      error_description: i.message
     };
   }
   async passwordOtp(r, o) {
@@ -1908,7 +1908,7 @@ class G extends re {
     return e.error ? (d.logger.warn(u({
       msg: "Error completing MFA",
       user: (s = this.server.sessionAdapter) == null ? void 0 : s.getUser(r),
-      hashedMfaToken: o.mfa_token ? A.hash(o.mfa_token) : void 0
+      hashedMfaToken: o.mfa_token ? F.hash(o.mfa_token) : void 0
     })), {
       error: e.error,
       error_description: e.error_description
@@ -1927,10 +1927,10 @@ class G extends re {
       if (o.locals.sessionId && this.autoRefreshActive[o.locals.sessionId]) return;
       try {
         o.locals.sessionId && (this.autoRefreshActive[o.locals.sessionId] = !0);
-        const a = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(e));
-        if (!a.error && !a.access_token && (a.error = "server_error", a.error_description = "Unexpectedly did not receive error or access token"), !a.error) {
+        const i = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(e));
+        if (!i.error && !i.access_token && (i.error = "server_error", i.error_description = "Unexpectedly did not receive error or access token"), !i.error) {
           const l = await this.receiveTokenFn(
-            a,
+            i,
             this,
             o,
             r == "silent",
@@ -1940,43 +1940,43 @@ class G extends re {
         }
         if (r != "silent") {
           const l = c.fromOAuthError(
-            a.error ?? "server_error",
-            a.error_description
+            i.error ?? "server_error",
+            i.error_description
           );
           return r == "page" ? this.errorFn(this.server, o, l) : {
             error: l.oauthErrorCode,
             error_description: l.message
           };
         }
-        let i = a.expires_in;
-        if (!i && a.access_token) {
-          const l = K(a.access_token);
-          l.exp && (i = l.exp);
+        let a = i.expires_in;
+        if (!a && i.access_token) {
+          const l = M(i.access_token);
+          l.exp && (a = l.exp);
         }
-        if (!i)
+        if (!a)
           throw new c(
             h.BadRequest,
             "OAuth server did not return an expiry for the access token"
           );
-        const n = (/* @__PURE__ */ new Date()).getTime() + i * 1e3;
+        const n = (/* @__PURE__ */ new Date()).getTime() + a * 1e3;
         return {
-          access_token: a.access_token,
-          refresh_token: a.refresh_token,
-          expires_in: a.expires_in,
+          access_token: i.access_token,
+          refresh_token: i.refresh_token,
+          expires_in: i.expires_in,
           expires_at: n,
-          error: a.error,
-          error_description: a.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      } catch (a) {
-        if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
-        if (d.logger.debug(u({ err: a })), d.logger.error(u({
-          cerr: a,
+      } catch (i) {
+        if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
+        if (d.logger.debug(u({ err: i })), d.logger.error(u({
+          cerr: i,
           msg: "Failed refreshing access token"
         })), r != "silent") {
-          const i = c.asCrossauthError(a);
-          return r == "page" ? this.errorFn(this.server, o, i) : {
-            error: i.oauthErrorCode,
-            error_description: i.message
+          const a = c.asCrossauthError(i);
+          return r == "page" ? this.errorFn(this.server, o, a) : {
+            error: a.oauthErrorCode,
+            error_description: a.message
           };
         }
         return {
@@ -2052,17 +2052,17 @@ class G extends re {
     }
     let t;
     try {
-      if (!(this.validFlows.includes(E.Password) || this.validFlows.includes(E.PasswordMfa))) {
-        const i = new c(h.Unauthorized, "Password flow is not supported");
-        return this.errorFn(this.server, r, i);
+      if (!(this.validFlows.includes(_.Password) || this.validFlows.includes(_.PasswordMfa))) {
+        const a = new c(h.Unauthorized, "Password flow is not supported");
+        return this.errorFn(this.server, r, a);
       }
       var e = new b();
       if (await e.loadData(r), t = e.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
             throw new c(h.InvalidCsrf);
-        } catch (i) {
-          if (p.isSvelteKitError(i) || p.isSvelteKitRedirect(i)) throw i;
+        } catch (a) {
+          if (p.isSvelteKitError(a) || p.isSvelteKitRedirect(a)) throw a;
           const n = new c(h.Unauthorized, "CSRF token not present");
           return this.errorFn(this.server, r, n);
         }
@@ -2072,19 +2072,19 @@ class G extends re {
         ok: !1,
         ...s
       };
-      const a = await this.receiveTokenFn(
+      const i = await this.receiveTokenFn(
         s,
         this,
         r,
         !1,
         this.setEventLocalsUser
       );
-      if (s && a instanceof Response) return a;
+      if (s && i instanceof Response) return i;
       throw new c(h.UnknownError, "Receive token function did not return a Response");
     } catch (s) {
       if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-      const a = c.asCrossauthError(s);
-      return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), this.errorFn(this.server, r, a);
+      const i = c.asCrossauthError(s);
+      return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), this.errorFn(this.server, r, i);
     }
   }
   async passwordFlow_action(r, o) {
@@ -2095,17 +2095,17 @@ class G extends re {
       throw new c(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
     let t;
     try {
-      if (!(this.validFlows.includes(E.Password) || this.validFlows.includes(E.PasswordMfa))) {
-        const i = new c(h.Unauthorized, "Password and Password MFA flows are not supported");
-        return this.errorFn(this.server, r, i);
+      if (!(this.validFlows.includes(_.Password) || this.validFlows.includes(_.PasswordMfa))) {
+        const a = new c(h.Unauthorized, "Password and Password MFA flows are not supported");
+        return this.errorFn(this.server, r, a);
       }
       var e = new b();
       if (await e.loadData(r), t = e.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
             throw new c(h.InvalidCsrf);
-        } catch (i) {
-          throw p.isSvelteKitError(i) || p.isSvelteKitRedirect(i) ? i : new c(h.Unauthorized, "CSRF token not present");
+        } catch (a) {
+          throw p.isSvelteKitError(a) || p.isSvelteKitRedirect(a) ? a : new c(h.Unauthorized, "CSRF token not present");
         }
       const s = await o(r, t);
       if (!s) throw new c(h.UnknownError, "Password flow returned no data");
@@ -2115,28 +2115,28 @@ class G extends re {
           ...s
         };
       if (s.challenge_type) {
-        if (!this.validFlows.includes(E.PasswordMfa)) {
-          const i = new c(h.Unauthorized, "Password MFA flow is not supported");
-          return this.errorFn(this.server, r, i);
+        if (!this.validFlows.includes(_.PasswordMfa)) {
+          const a = new c(h.Unauthorized, "Password MFA flow is not supported");
+          return this.errorFn(this.server, r, a);
         }
         return s;
       }
-      const a = await this.receiveTokenFn(
+      const i = await this.receiveTokenFn(
         s,
         this,
         r,
         !1,
         this.setEventLocalsUser
       ) ?? {};
-      if (a instanceof Response) throw new c(h.Configuration, "Refresh token flow should return an object not Response");
-      return a;
+      if (i instanceof Response) throw new c(h.Configuration, "Refresh token flow should return an object not Response");
+      return i;
     } catch (s) {
       if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-      const a = c.asCrossauthError(s);
+      const i = c.asCrossauthError(s);
       return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), {
         ok: !1,
-        error: a.oauthErrorCode,
-        error_description: a.message
+        error: i.oauthErrorCode,
+        error_description: i.message
       };
     }
   }
@@ -2162,30 +2162,30 @@ class G extends re {
       let s = o.url;
       if (!s) {
         if (!r.url.pathname.startsWith(this.bffEndpointName)) throw new c(h.Unauthorized, "Attempt to call BFF url with the wrong prefix");
-        const a = r.url.pathname.substring(this.bffEndpointName.length);
-        let i = ((e = r.url.searchParams) == null ? void 0 : e.toString()) ?? void 0;
-        i && i != "" && (i = "?" + i), s = new URL(this.bffBaseUrl + a + i);
+        const i = r.url.pathname.substring(this.bffEndpointName.length);
+        let a = ((e = r.url.searchParams) == null ? void 0 : e.toString()) ?? void 0;
+        a && a != "" && (a = "?" + a), s = new URL(this.bffBaseUrl + i + a);
       }
       o.headers || (o.headers = new Headers());
-      for (let a = 0; a < this.bffMaxTries; ++a) {
-        a > 0 && await new Promise((g) => setTimeout(g, this.bffSleepMilliseconds));
-        const i = await this.server.sessionAdapter.getSessionData(
+      for (let i = 0; i < this.bffMaxTries; ++i) {
+        i > 0 && await new Promise((g) => setTimeout(g, this.bffSleepMilliseconds));
+        const a = await this.server.sessionAdapter.getSessionData(
           r,
           this.sessionDataName
         );
-        if (!i) {
-          if (a == this.bffMaxTries)
+        if (!a) {
+          if (i == this.bffMaxTries)
             throw new c(h.Unauthorized, "No access token found");
           continue;
         }
-        let n = i.access_token;
-        if (i && i.access_token) {
+        let n = a.access_token;
+        if (a && a.access_token) {
           const g = await this.refresh(
             "silent",
             r,
             !0,
-            i.refresh_token,
-            i.expires_at
+            a.refresh_token,
+            a.expires_at
           );
           if (g instanceof Response) throw new c(h.Configuration, "Expected object when refreshing tokens, not Response");
           if (g != null && g.access_token)
@@ -2207,7 +2207,7 @@ class G extends re {
           headers: o.headers,
           method: o.method ?? r.request.method
         }), l.status == 401) {
-          if (a < this.bffMaxTries - 1)
+          if (i < this.bffMaxTries - 1)
             continue;
           return l;
         } else
@@ -2216,11 +2216,11 @@ class G extends re {
       return new Response(null, { status: 401 });
     } catch (s) {
       if (p.isSvelteKitError(s) || p.isSvelteKitRedirect(s)) throw s;
-      const a = c.asCrossauthError(s);
-      return d.logger.debug({ err: a }), d.logger.error({ cerr: a }), v({
-        error: a.oauthErrorCode,
-        error_description: a.message
-      }, { status: a.httpStatus });
+      const i = c.asCrossauthError(s);
+      return d.logger.debug({ err: i }), d.logger.error({ cerr: i }), v({
+        error: i.oauthErrorCode,
+        error_description: i.message
+      }, { status: i.httpStatus });
     }
   }
   async unpack(r) {
@@ -2258,16 +2258,16 @@ class G extends re {
       const t = r.url.pathname.substring(this.bffEndpointName.length);
       let e;
       for (let s = 0; s < this.bffEndpoints.length; ++s) {
-        let a = this.bffEndpoints[s];
-        if (a.matchSubUrls) {
-          let i = a.url, n = a.url;
-          if (n.endsWith("/") || (n += "/"), a.methodsString.includes(r.request.method) && (t.startsWith(n) || t == i)) {
+        let i = this.bffEndpoints[s];
+        if (i.matchSubUrls) {
+          let a = i.url, n = i.url;
+          if (n.endsWith("/") || (n += "/"), i.methodsString.includes(r.request.method) && (t.startsWith(n) || t == a)) {
             e = s;
             break;
           }
         } else {
-          let i = a.url;
-          if (a.methodsString.includes(r.request.method) && t == i) {
+          let a = i.url;
+          if (i.methodsString.includes(r.request.method) && t == a) {
             e = s;
             break;
           }
@@ -2297,23 +2297,23 @@ class G extends re {
       if (!this.tokenEndpoints || this.tokenEndpoints.length == 0)
         throw new c(h.Unauthorized, "No tokens have been made available");
       let s = Array.isArray(o) ? o : [o];
-      const a = await this.server.sessionAdapter.getSessionData(
+      const i = await this.server.sessionAdapter.getSessionData(
         r,
         this.sessionDataName
       );
-      if (!a)
+      if (!i)
         throw new c(h.Unauthorized, "No access token found");
-      let i = {}, n, l = !1;
+      let a = {}, n, l = !1;
       for (let f of s) {
         if (!this.tokenEndpoints.includes(f)) throw new c(h.Unauthorized, "Token type " + f + " may not be returned");
         l = !1;
         let g = f;
         f.startsWith("have_") && (g = f.replace("have_", ""), l = !0);
-        const m = g.replace("_token", ""), w = e && this.jwtTokens.includes(m);
-        let S = this.tokenPayload(g, a, l, w);
-        l ? i[f] = S.ok : S && (i[f] = S), n = i[f];
+        const w = g.replace("_token", ""), m = e && this.jwtTokens.includes(w);
+        let S = this.tokenPayload(g, i, l, m);
+        l ? a[f] = S.ok : S && (a[f] = S), n = a[f];
       }
-      return Array.isArray(o) ? { status: 200, body: i } : n ? l ? { status: 200, body: typeof n == "boolean" ? { ok: n } : n } : { status: 200, body: n } : o.startsWith("have_") ? { status: 200, body: { ok: !1 } } : { status: 204 };
+      return Array.isArray(o) ? { status: 200, body: a } : n ? l ? { status: 200, body: typeof n == "boolean" ? { ok: n } : n } : { status: 200, body: n } : o.startsWith("have_") ? { status: 200, body: { ok: !1 } } : { status: 204 };
     } catch (t) {
       if (p.isSvelteKitError(t) || p.isSvelteKitRedirect(t)) throw t;
       const e = c.asCrossauthError(t);
@@ -2330,7 +2330,7 @@ class G extends re {
   async startDeviceCodeFlow_internal(r) {
     let o;
     try {
-      if (!this.validFlows.includes(E.DeviceCode))
+      if (!this.validFlows.includes(_.DeviceCode))
         throw new c(h.Unauthorized, "Device code flow is not supported");
       var t = new b();
       if (await t.loadData(r), o = t.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
@@ -2344,13 +2344,13 @@ class G extends re {
       e == "" && (e = void 0);
       let s = this.authServerBaseUrl;
       s.endsWith("/") || (s += "/"), s += this.deviceAuthorizationUrl;
-      const a = await this.startDeviceCodeFlow(s, e);
-      let i;
-      return a.verification_uri_complete && await ae.toDataURL(a.verification_uri_complete).then((n) => {
-        i = n;
+      const i = await this.startDeviceCodeFlow(s, e);
+      let a;
+      return i.verification_uri_complete && await ae.toDataURL(i.verification_uri_complete).then((n) => {
+        a = n;
       }).catch((n) => {
         d.logger.debug(u({ err: n })), d.logger.warn(u({ msg: "Couldn't generate verification URL QR Code" }));
-      }), i ? { verification_uri_qrdata: i, ...a } : a;
+      }), a ? { verification_uri_qrdata: a, ...i } : i;
     } catch (e) {
       if (p.isSvelteKitRedirect(e) || p.isSvelteKitError(e)) throw e;
       const s = c.asCrossauthError(e);
@@ -2363,15 +2363,15 @@ class G extends re {
   async pollDeviceCodeFlow_internal(r) {
     let o;
     try {
-      if (!this.validFlows.includes(E.DeviceCode))
+      if (!this.validFlows.includes(_.DeviceCode))
         throw new c(h.Unauthorized, "Device code flow is not supported");
       var t = new b();
       if (await t.loadData(r), o = t.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
             throw new c(h.InvalidCsrf);
-        } catch (a) {
-          throw p.isSvelteKitError(a) || p.isSvelteKitRedirect(a) ? a : new c(h.Unauthorized, "CSRF token not present");
+        } catch (i) {
+          throw p.isSvelteKitError(i) || p.isSvelteKitRedirect(i) ? i : new c(h.Unauthorized, "CSRF token not present");
         }
       let e = o.device_code;
       if (!e) throw new c(h.BadRequest, "No device code given when polling for user authorization");
@@ -2386,8 +2386,8 @@ class G extends re {
         );
       {
         if (s.error == "authorization_pending") return { ok: !0, ...s };
-        let a = s.error ?? "server_error", i = s.error_description ?? "Didn't receive an access token";
-        const n = c.fromOAuthError(a, i);
+        let i = s.error ?? "server_error", a = s.error_description ?? "Didn't receive an access token";
+        const n = c.fromOAuthError(i, a);
         return this.errorFn(this.server, r, n);
       }
     } catch (e) {
@@ -2428,19 +2428,19 @@ class ge extends se {
    * @param options See {@link SvelteKitOAuthResourceServerOptions}
    */
   constructor(r, o = {}) {
-    if (super(r, o), this.errorBody = {}, this.protectedEndpoints = {}, this.sessionDataName = "oauth", this.tokenLocations = ["header"], y("errorBody", _.Json, this, o, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), y("tokenLocations", _.JsonArray, this, o, "OAUTH_TOKEN_LOCATIONS"), y("sessionDataName", _.String, this, o, "OAUTH_SESSION_DATA_NAME"), this.userStorage = o.userStorage, this.sessionAdapter = o.sessionAdapter, o.protectedEndpoints) {
+    if (super(r, o), this.errorBody = {}, this.protectedEndpoints = {}, this.sessionDataName = "oauth", this.tokenLocations = ["header"], y("errorBody", E.Json, this, o, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), y("tokenLocations", E.JsonArray, this, o, "OAUTH_TOKEN_LOCATIONS"), y("sessionDataName", E.String, this, o, "OAUTH_SESSION_DATA_NAME"), this.userStorage = o.userStorage, this.sessionAdapter = o.sessionAdapter, o.protectedEndpoints) {
       const t = /^[!#\$%&'\(\)\*\+,\.\/a-zA-Z\[\]\^_`-]+/;
       for (const [e, s] of Object.entries(o.protectedEndpoints)) {
         if (!e.startsWith("/"))
           throw new c(h.Configuration, "protected endpoints must be absolute paths without the protocol and hostname");
-        s.scope && s.scope.forEach((a) => {
-          if (!t.test(a)) throw new c(h.Configuration, "Illegal characters in scope " + a);
+        s.scope && s.scope.forEach((i) => {
+          if (!t.test(i)) throw new c(h.Configuration, "Illegal characters in scope " + i);
         });
       }
       this.protectedEndpoints = o.protectedEndpoints;
     }
     o.protectedEndpoints && (this.hook = async ({ event: t }) => {
-      var a, i;
+      var i, a;
       const e = t.url.pathname;
       if (!(e in this.protectedEndpoints)) return;
       const s = await this.authorized(t);
@@ -2468,7 +2468,7 @@ class ge extends se {
         }
       }
       if (s) {
-        if (t.locals.accessTokenPayload = s.tokenPayload, t.locals.user = s.user, (a = s.tokenPayload) != null && a.scope)
+        if (t.locals.accessTokenPayload = s.tokenPayload, t.locals.user = s.user, (i = s.tokenPayload) != null && i.scope)
           if (Array.isArray(s.tokenPayload.scope)) {
             let n = [];
             for (let l of s.tokenPayload.scope)
@@ -2480,7 +2480,7 @@ class ge extends se {
             if (!t.locals.scope || !t.locals.scope.includes(n) && this.protectedEndpoints[e].acceptSessionAuthorization != !0) {
               d.logger.warn(u({
                 msg: "Access token does not have sufficient scope",
-                username: (i = t.locals.user) == null ? void 0 : i.username,
+                username: (a = t.locals.user) == null ? void 0 : a.username,
                 url: t.request.url
               })), t.locals.scope = void 0, t.locals.accessTokenPayload = void 0, t.locals.user = void 0, t.locals.authError = "access_denied", t.locals.authErrorDescription = "Access token does not have sufficient scope";
               const l = this.authenticateHeader(t);
@@ -2635,11 +2635,11 @@ const D = class D {
     apiKey: t,
     oAuthAuthServer: e,
     oAuthClient: s,
-    oAuthClients: a,
-    oAuthResServer: i,
+    oAuthClients: i,
+    oAuthResServer: a,
     options: n
   }) {
-    this.loginUrl = "/login", this.audience = "", this.dummyLoad = async (f) => ({}), this.dummyActions = {}, this.dummyBff = async (f) => ({ status: 500, body: { error: "Unimplemented" } }), n || (n = {}), y("loginUrl", _.String, this, n, "LOGIN_URL", !1), n.isAdminFn && (D.isAdminFn = n.isAdminFn);
+    this.loginUrl = "/login", this.audience = "", this.dummyLoad = async (f) => ({}), this.dummyActions = {}, this.dummyBff = async (f) => ({ status: 500, body: { error: "Unimplemented" } }), n || (n = {}), y("loginUrl", E.String, this, n, "LOGIN_URL", !1), n.isAdminFn && (D.isAdminFn = n.isAdminFn);
     let l = {};
     if (n.authenticators && (l = n.authenticators), this.userStorage = n.userStorage, r) {
       if (!l)
@@ -2667,15 +2667,15 @@ const D = class D {
         { ...f, ...n, ...e.options }
       );
     }
-    if (s && a)
+    if (s && i)
       throw new c(h.Configuration, "Cannot specify both oAuthClient and oAuthClients");
     if (s && (this.oAuthClient = new G(
       this,
       s.authServerBaseUrl,
       { ...n, ...s.options }
-    )), a) {
+    )), i) {
       this.oAuthClients = [];
-      for (let f of a)
+      for (let f of i)
         this.oAuthClients.push(
           new G(
             this,
@@ -2684,12 +2684,12 @@ const D = class D {
           )
         );
     }
-    i && (y("audience", _.String, this, n, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new ge(
+    a && (y("audience", E.String, this, n, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new ge(
       [new te(this.audience, n)],
-      { sessionAdapter: this.sessionAdapter, ...i.options, ...n }
+      { sessionAdapter: this.sessionAdapter, ...a.options, ...n }
     )), this.hooks = async ({ event: f, resolve: g }) => {
-      const m = await this.unresolvedHooks(f);
-      return await g(m);
+      const w = await this.unresolvedHooks(f);
+      return w instanceof Response ? w : await g(w);
     };
   }
   async unresolvedHooks(r) {
@@ -2797,12 +2797,12 @@ class we {
           const g = await this.sessionServer.getSessionData(t, "factor2change");
           g != null && g.username || this.isSessionUser(t) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), e = g == null ? void 0 : g.username;
         }
-        let s = this.sessionServer.allowedFactor2 ?? [{ name: "none", friendlyName: "None", configurable: !1 }], a = {}, i = t.url.searchParams.get("required"), n;
-        i && (i = i.toLowerCase(), n = i == "true" || i == "1", n == !0 && (a.required = !0));
+        let s = this.sessionServer.allowedFactor2 ?? [{ name: "none", friendlyName: "None", configurable: !1 }], i = {}, a = t.url.searchParams.get("required"), n;
+        a && (a = a.toLowerCase(), n = a == "true" || a == "1", n == !0 && (i.required = !0));
         let l = t.url.searchParams.get("next");
-        return l && (a.next = l), {
+        return l && (i.next = l), {
           allowedFactor2: s,
-          ...a,
+          ...i,
           username: e,
           ...this.baseEndpoint(t)
         };
@@ -2812,12 +2812,12 @@ class we {
         default: async (t) => await this.changePassword(t)
       },
       load: async (t) => {
-        let e = {}, s = t.url.searchParams.get("required"), a, i = t.locals.user != null;
-        if (!i) {
+        let e = {}, s = t.url.searchParams.get("required"), i, a = t.locals.user != null;
+        if (!a) {
           const l = await this.sessionServer.getSessionData(t, "passwordchange");
-          l != null && l.username && (i = !0);
+          l != null && l.username && (a = !0);
         }
-        i || this.sessionServer.redirect(302, this.loginUrl), s && (s = s.toLowerCase(), a = s == "true" || s == "1", a == !0 && (e.required = !0));
+        a || this.sessionServer.redirect(302, this.loginUrl), s && (s = s.toLowerCase(), i = s == "true" || s == "1", i == !0 && (e.required = !0));
         let n = t.url.searchParams.get("next");
         return n && (e.next = n), {
           ...e,
@@ -2843,8 +2843,8 @@ class we {
         default: async (t) => await this.requestPasswordReset(t)
       },
       load: async (t) => {
-        let e = {}, s = t.url.searchParams.get("required"), a;
-        return s && (s = s.toLowerCase(), a = s == "true" || s == "1", a == !0 && (e.required = !0)), {
+        let e = {}, s = t.url.searchParams.get("required"), i;
+        return s && (s = s.toLowerCase(), i = s == "true" || s == "1", i == !0 && (e.required = !0)), {
           ...e,
           ...this.baseEndpoint(t)
         };
@@ -2864,14 +2864,14 @@ class we {
           try {
             return e = await this.resetPassword(t), e;
           } catch (s) {
-            const a = c.asCrossauthError(s);
+            const i = c.asCrossauthError(s);
             if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-            return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
+            return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
               ok: !1,
               tokenValidated: !1,
               error: e == null ? void 0 : e.error,
-              errorCode: a.code,
-              errorCodeName: a.codeName,
+              errorCode: i.code,
+              errorCodeName: i.codeName,
               ...this.baseEndpoint(t)
             };
           }
@@ -2919,7 +2919,7 @@ class we {
           ...e
         };
       }
-    }, this.sessionServer = r, y("changePasswordUrl", _.String, this, o, "CHANGE_PASSWORD_URL"), y("requestPasswordResetUrl", _.String, this, o, "REQUEST_PASSWORD_RESET_URL"), y("changeFactor2Url", _.String, this, o, "CHANGE_FACTOR2_URL"), y("loginRedirectUrl", _.JsonArray, this, o, "LOGIN_REDIRECT_URL"), y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.addToSession && (this.addToSession = o.addToSession);
+    }, this.sessionServer = r, y("changePasswordUrl", E.String, this, o, "CHANGE_PASSWORD_URL"), y("requestPasswordResetUrl", E.String, this, o, "REQUEST_PASSWORD_RESET_URL"), y("changeFactor2Url", E.String, this, o, "CHANGE_FACTOR2_URL"), y("loginRedirectUrl", E.JsonArray, this, o, "LOGIN_REDIRECT_URL"), y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.addToSession && (this.addToSession = o.addToSession);
   }
   /** Returns whether there is a user logged in with a cookie-based session
    */
@@ -2971,43 +2971,43 @@ class we {
     try {
       var t = new b();
       await t.loadData(r), o = t.toObject();
-      const e = t.get("username") ?? "", s = t.getAsBoolean("persist") ?? !1, a = o.next ?? this.loginRedirectUrl;
+      const e = t.get("username") ?? "", s = t.getAsBoolean("persist") ?? !1, i = o.next ?? this.loginRedirectUrl;
       if (e == "") throw new c(h.InvalidUsername, "Username field may not be empty");
-      let i = this.addToSession ? this.addToSession(r, o) : {};
+      let a = this.addToSession ? this.addToSession(r, o) : {};
       if (this.sessionServer.enableCsrfProtection && !r.locals.csrfToken) throw new c(h.InvalidCsrf);
       const n = this.sessionServer.getSessionCookieValue(r);
-      let { sessionCookie: l, csrfCookie: f, user: g } = await this.sessionServer.sessionManager.login(e, t.toObject(), i, s);
+      let { sessionCookie: l, csrfCookie: f, user: g } = await this.sessionServer.sessionManager.login(e, t.toObject(), a, s);
       if (d.logger.debug(u({
         msg: "Login: set session cookie " + l.name + " opts " + JSON.stringify(l.options),
         user: e
       })), r.cookies.set(
         l.name,
         l.value,
-        R(l.options)
+        P(l.options)
       ), d.logger.debug(u({
         msg: "Login: set csrf cookie " + f.name + " opts " + JSON.stringify(l.options),
         user: e
       })), this.sessionServer.enableCsrfProtection && (r.cookies.set(
         f.name,
         f.value,
-        R(f.options)
+        P(f.options)
       ), r.locals.csrfToken = await this.sessionServer.sessionManager.createCsrfFormOrHeaderValue(f.value)), n)
         try {
           await this.sessionServer.sessionManager.deleteSession(n);
-        } catch (m) {
+        } catch (w) {
           d.logger.warn(u({
             msg: "Couldn't delete session ID from database",
             hashOfSessionId: this.sessionServer.getHashOfSessionId(r)
-          })), d.logger.debug(u({ err: m }));
+          })), d.logger.debug(u({ err: w }));
         }
-      if (g.state == I.passwordChangeNeeded)
-        this.sessionServer.redirect(302, this.changePasswordUrl + "?required=true&next=" + encodeURIComponent("login?next=" + a));
+      if (g.state == N.passwordChangeNeeded)
+        this.sessionServer.redirect(302, this.changePasswordUrl + "?required=true&next=" + encodeURIComponent("login?next=" + i));
       else {
-        if (g.state == I.passwordResetNeeded)
+        if (g.state == N.passwordResetNeeded)
           throw new c(h.PasswordResetNeeded, "Please click on the link we sent you to reset your password");
-        if (g.state == I.passwordAndFactor2ResetNeeded)
+        if (g.state == N.passwordAndFactor2ResetNeeded)
           throw new c(h.PasswordResetNeeded, "Please click on the link we sent you to reset your password");
-        this.sessionServer.allowedFactor2.length > 0 && g.state == I.factor2ResetNeeded || !this.sessionServer.allowedFactor2Names.includes(g.factor2 ? g.factor2 : "none") ? this.sessionServer.redirect(302, this.changeFactor2Url + "?required=true&next=" + encodeURIComponent("login?next=" + a)) : (!g.factor2 || g.factor2 == "") && (r.locals.user = g);
+        this.sessionServer.allowedFactor2.length > 0 && g.state == N.factor2ResetNeeded || !this.sessionServer.allowedFactor2Names.includes(g.factor2 ? g.factor2 : "none") ? this.sessionServer.redirect(302, this.changeFactor2Url + "?required=true&next=" + encodeURIComponent("login?next=" + i)) : (!g.factor2 || g.factor2 == "") && (r.locals.user = g);
       }
       return {
         user: g,
@@ -3033,22 +3033,22 @@ class we {
   async loginWithUser(r, o, t) {
     const e = t.locals.sessionId, s = new b();
     await s.loadData(t);
-    let a = this.addToSession ? this.addToSession(t, s.toObject()) : {}, { sessionCookie: i, csrfCookie: n, csrfFormOrHeaderValue: l } = await this.sessionServer.sessionManager.login("", {}, a, void 0, r, o);
+    let i = this.addToSession ? this.addToSession(t, s.toObject()) : {}, { sessionCookie: a, csrfCookie: n, csrfFormOrHeaderValue: l } = await this.sessionServer.sessionManager.login("", {}, i, void 0, r, o);
     if (d.logger.debug(u({
-      msg: "Login: set session cookie " + i.name + " opts " + JSON.stringify(i.options),
+      msg: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
       user: r.username
     })), t.cookies.set(
-      i.name,
-      i.value,
-      R(i.options)
+      a.name,
+      a.value,
+      P(a.options)
     ), d.logger.debug(u({
-      msg: "Login: set csrf cookie " + n.name + " opts " + JSON.stringify(i.options),
+      msg: "Login: set csrf cookie " + n.name + " opts " + JSON.stringify(a.options),
       user: r.username
     })), this.sessionServer.enableCsrfProtection && t.cookies.set(
       n.name,
       n.value,
-      R(n.options)
-    ), t.locals.user = r, t.locals.csrfToken = l, t.locals.sessionId = this.sessionServer.sessionManager.getSessionId(i.value), e)
+      P(n.options)
+    ), t.locals.user = r, t.locals.csrfToken = l, t.locals.sessionId = this.sessionServer.sessionManager.getSessionId(a.value), e)
       try {
         await this.sessionServer.sessionManager.deleteSession(e);
       } catch (f) {
@@ -3166,24 +3166,24 @@ class we {
           "Illegal second factor " + o.factor2 + " requested"
         );
       (o.factor2 == "none" || o.factor2 == "") && (o.factor2 = void 0), s = this.sessionServer.createUserFn(r, o, this.sessionServer.userStorage.userEditableFields);
-      let a = this.sessionServer.authenticators[s.factor1].validateSecrets(o);
-      const i = this.sessionServer.authenticators[s.factor1].secretNames();
+      let i = this.sessionServer.authenticators[s.factor1].validateSecrets(o);
+      const a = this.sessionServer.authenticators[s.factor1].secretNames();
       let n = {};
-      for (let m in o)
-        if (m.startsWith("repeat_")) {
-          const w = m.replace(/^repeat_/, "");
-          i.includes(w) && (n[w] = o[m]);
+      for (let w in o)
+        if (w.startsWith("repeat_")) {
+          const m = w.replace(/^repeat_/, "");
+          a.includes(m) && (n[m] = o[w]);
         }
       Object.keys(n).length === 0 && (n = void 0), s.state = "active", o.factor2 && o.factor2 != "none" ? s.state = "awaitingtwofactor" : this.sessionServer.enableEmailVerification && (s.state = "awaitingemailverification");
-      let f = [...this.sessionServer.validateUserFn(s), ...a];
+      let f = [...this.sessionServer.validateUserFn(s), ...i];
       if (f.length > 0)
         throw new c(h.FormEntry, f);
       let g = !1;
       try {
-        const { user: m, secrets: w } = await this.sessionServer.userStorage.getUserByUsername(e);
-        await this.sessionServer.sessionManager.authenticators[s.factor1].authenticateUser(m, w, o);
-      } catch (m) {
-        c.asCrossauthError(m).code == h.TwoFactorIncomplete && (g = !0);
+        const { user: w, secrets: m } = await this.sessionServer.userStorage.getUserByUsername(e);
+        await this.sessionServer.sessionManager.authenticators[s.factor1].authenticateUser(w, m, o);
+      } catch (w) {
+        c.asCrossauthError(w).code == h.TwoFactorIncomplete && (g = !0);
       }
       if (!o.factor2 && !g)
         return await this.sessionServer.sessionManager.createUser(
@@ -3192,13 +3192,13 @@ class we {
           n
         ), this.sessionServer.enableEmailVerification ? { emailVerificationRequired: !0, user: s, ok: !0, formData: o } : { ...await this.login(r), formData: o };
       {
-        let m;
+        let w;
         if (g) {
           if (!r.locals.sessionId) throw new c(h.Unauthorized);
-          m = (await this.sessionServer.sessionManager.repeatTwoFactorSignup(r.locals.sessionId)).userData;
+          w = (await this.sessionServer.sessionManager.repeatTwoFactorSignup(r.locals.sessionId)).userData;
         } else {
-          const w = await this.sessionServer.createAnonymousSession(r), S = this.sessionServer.sessionManager.getSessionId(w);
-          m = (await this.sessionServer.sessionManager.initiateTwoFactorSignup(
+          const m = await this.sessionServer.createAnonymousSession(r), S = this.sessionServer.sessionManager.getSessionId(m);
+          w = (await this.sessionServer.sessionManager.initiateTwoFactorSignup(
             s,
             o,
             S,
@@ -3206,14 +3206,14 @@ class we {
           )).userData;
         }
         try {
-          let w = {
-            userData: m,
+          let m = {
+            userData: w,
             username: e,
             factor2: o.factor2 ?? "none"
           };
-          return this.sessionServer.enableCsrfProtection && (w.csrfToken = r.locals.csrfToken), { factor2Data: w, ok: !0, factor2Required: !0, formData: o };
-        } catch (w) {
-          d.logger.error(u({ err: w }));
+          return this.sessionServer.enableCsrfProtection && (m.csrfToken = r.locals.csrfToken), { factor2Data: m, ok: !0, factor2Required: !0, formData: o };
+        } catch (m) {
+          d.logger.error(u({ err: m }));
           try {
             this.sessionServer.sessionManager.deleteUserByUsername(e);
           } catch (S) {
@@ -3309,8 +3309,8 @@ class we {
     try {
       var s = new b();
       await s.loadData(r), o = s.toObject();
-      const a = await this.sessionServer.getSessionData(r, "2fa");
-      if (a != null && a.factor2) e = a == null ? void 0 : a.factor2;
+      const i = await this.sessionServer.getSessionData(r, "2fa");
+      if (i != null && i.factor2) e = i == null ? void 0 : i.factor2;
       else throw new c(h.BadRequest, "Two factor authentication was not started");
       if (this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
         throw new c(h.InvalidCsrf);
@@ -3318,17 +3318,17 @@ class we {
         h.Unauthorized,
         "No session active while enabling 2FA.  Please enable cookies"
       );
-      let i = await this.sessionServer.sessionManager.completeTwoFactorSetup(
+      let a = await this.sessionServer.sessionManager.completeTwoFactorSetup(
         o,
         r.locals.sessionId
       );
-      return this.sessionServer.enableEmailVerification || await this.loginWithUser(i, !0, r), r.locals.user ? {
+      return this.sessionServer.enableEmailVerification || await this.loginWithUser(a, !0, r), r.locals.user ? {
         ok: !0,
-        user: i,
+        user: a,
         emailVerificationRequired: this.sessionServer.enableEmailVerification
-      } : await this.loginWithUser(i, !0, r);
-    } catch (a) {
-      const i = c.asCrossauthError(a);
+      } : await this.loginWithUser(a, !0, r);
+    } catch (i) {
+      const a = c.asCrossauthError(i);
       let n;
       try {
         n = (await this.sessionServer.sessionManager.repeatTwoFactorSignup(r.locals.sessionId ?? "")).userData;
@@ -3339,11 +3339,11 @@ class we {
         csrfToken: r.locals.csrfToken,
         username: n.username ?? "",
         factor2: e
-      }), d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
+      }), d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
         ok: !1,
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         formData: o,
         factor2Data: t,
         emailVerificationRequired: this.sessionServer.enableEmailVerification
@@ -3379,27 +3379,27 @@ class we {
       if (!s) throw new c(h.Unauthorized);
       if (this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
         throw new c(h.InvalidCsrf);
-      let a = this.addToSession ? this.addToSession(r, o) : {};
-      const { sessionCookie: i, csrfCookie: n, user: l } = await this.sessionServer.sessionManager.completeTwoFactorLogin(
+      let i = this.addToSession ? this.addToSession(r, o) : {};
+      const { sessionCookie: a, csrfCookie: n, user: l } = await this.sessionServer.sessionManager.completeTwoFactorLogin(
         o,
         s,
-        a,
+        i,
         e
       );
       return d.logger.debug(u({
-        msg: "Login: set session cookie " + i.name + " opts " + JSON.stringify(i.options),
+        msg: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
         user: l == null ? void 0 : l.username
       })), r.cookies.set(
-        i.name,
-        i.value,
-        R(i.options)
+        a.name,
+        a.value,
+        P(a.options)
       ), d.logger.debug(u({
-        msg: "Login: set csrf cookie " + n.name + " opts " + JSON.stringify(i.options),
+        msg: "Login: set csrf cookie " + n.name + " opts " + JSON.stringify(a.options),
         user: l == null ? void 0 : l.username
       })), r.cookies.set(
         n.name,
         n.value,
-        R(n.options)
+        P(n.options)
       ), this.sessionServer.enableCsrfProtection && (r.locals.csrfToken = await this.sessionServer.sessionManager.createCsrfFormOrHeaderValue(n.value)), r.locals.user = l, {
         user: l,
         ok: !0
@@ -3512,24 +3512,24 @@ class we {
         );
       const e = r.params.token ?? "";
       if (e == "") throw new c(h.InvalidUsername, "No token provided");
-      const s = await this.sessionServer.sessionManager.userForPasswordResetToken(e), a = this.sessionServer.authenticators[s.factor1], i = a.secretNames();
+      const s = await this.sessionServer.sessionManager.userForPasswordResetToken(e), i = this.sessionServer.authenticators[s.factor1], a = i.secretNames();
       let n = {}, l = {};
-      for (let m in o)
-        if (m.startsWith("new_")) {
-          const w = m.replace(/^new_/, "");
-          i.includes(w) && (n[w] = o[m]);
-        } else if (m.startsWith("repeat_")) {
-          const w = m.replace(/^repeat_/, "");
-          i.includes(w) && (l[w] = o[m]);
+      for (let w in o)
+        if (w.startsWith("new_")) {
+          const m = w.replace(/^new_/, "");
+          a.includes(m) && (n[m] = o[w]);
+        } else if (w.startsWith("repeat_")) {
+          const m = w.replace(/^repeat_/, "");
+          a.includes(m) && (l[m] = o[w]);
         }
-      if (Object.keys(l).length === 0 && (l = void 0), a.validateSecrets(n).length > 0)
+      if (Object.keys(l).length === 0 && (l = void 0), i.validateSecrets(n).length > 0)
         throw new c(h.PasswordFormat);
       const g = await this.sessionServer.sessionManager.resetSecret(e, 1, n, l);
-      if (g.state == I.active)
+      if (g.state == N.active)
         return await this.loginWithUser(g, !0, r);
       {
-        const m = this.sessionServer.getSessionCookieValue(r), w = this.sessionServer.sessionManager.getSessionId(m ?? "");
-        throw await this.sessionServer.sessionManager.updateSessionData(w, "factor2change", { username: s.username }), this.sessionServer.redirect(302, this.changeFactor2Url + "?required=true");
+        const w = this.sessionServer.getSessionCookieValue(r), m = this.sessionServer.sessionManager.getSessionId(w ?? "");
+        throw await this.sessionServer.sessionManager.updateSessionData(m, "factor2change", { username: s.username }), this.sessionServer.redirect(302, this.changeFactor2Url + "?required=true");
       }
     } catch (e) {
       if (p.isSvelteKitRedirect(e)) throw e;
@@ -3619,10 +3619,10 @@ class we {
       await t.loadData(r), o = t.toObject();
       let e, s = !1;
       if (!this.isSessionUser(r) || !r.locals.user) {
-        const w = await this.sessionServer.getSessionData(r, "passwordchange");
-        if (w != null && w.username) {
+        const m = await this.sessionServer.getSessionData(r, "passwordchange");
+        if (m != null && m.username) {
           if (e = (await this.sessionServer.userStorage.getUserByUsername(
-            w == null ? void 0 : w.username,
+            m == null ? void 0 : m.username,
             {
               skipActiveCheck: !0,
               skipEmailVerifiedCheck: !0
@@ -3637,22 +3637,22 @@ class we {
         e = r.locals.user;
       } else
         throw new c(h.InsufficientPriviledges);
-      const a = this.sessionServer.authenticators[e.factor1], i = a.secretNames();
+      const i = this.sessionServer.authenticators[e.factor1], a = i.secretNames();
       let n = {}, l = {}, f = {};
-      for (let w in o)
-        if (w.startsWith("new_")) {
-          const S = w.replace(/^new_/, "");
-          i.includes(S) && (l[S] = o[w]);
-        } else if (w.startsWith("old_")) {
-          const S = w.replace(/^old_/, "");
-          i.includes(S) && (n[S] = o[w]);
-        } else if (w.startsWith("repeat_")) {
-          const S = w.replace(/^repeat_/, "");
-          i.includes(S) && (f[S] = o[w]);
+      for (let m in o)
+        if (m.startsWith("new_")) {
+          const S = m.replace(/^new_/, "");
+          a.includes(S) && (l[S] = o[m]);
+        } else if (m.startsWith("old_")) {
+          const S = m.replace(/^old_/, "");
+          a.includes(S) && (n[S] = o[m]);
+        } else if (m.startsWith("repeat_")) {
+          const S = m.replace(/^repeat_/, "");
+          a.includes(S) && (f[S] = o[m]);
         }
-      if (Object.keys(f).length === 0 && (f = void 0), a.validateSecrets(l).length > 0)
+      if (Object.keys(f).length === 0 && (f = void 0), i.validateSecrets(l).length > 0)
         throw new c(h.PasswordFormat);
-      const m = e.state;
+      const w = e.state;
       try {
         s && (e.state = "active", await this.sessionServer.userStorage.updateUser({ id: e.id, state: e.state })), await this.sessionServer.sessionManager.changeSecrets(
           e.username,
@@ -3661,11 +3661,11 @@ class we {
           f,
           n
         );
-      } catch (w) {
-        const S = c.asCrossauthError(w);
-        if (d.logger.debug(u({ err: w })), s)
+      } catch (m) {
+        const S = c.asCrossauthError(m);
+        if (d.logger.debug(u({ err: m })), s)
           try {
-            await this.sessionServer.userStorage.updateUser({ id: e.id, state: m });
+            await this.sessionServer.userStorage.updateUser({ id: e.id, state: w });
           } catch (C) {
             d.logger.debug(u({ err: C }));
           }
@@ -3768,15 +3768,15 @@ class we {
       let s = this.sessionServer.validateUserFn(e);
       if (s.length > 0)
         throw new c(h.FormEntry, s);
-      let { emailVerificationTokenSent: a } = await this.sessionServer.sessionManager.updateUser(r.locals.user, e);
-      if (!a) {
-        const i = await this.sessionServer.userStorage.getUserById(r.locals.user.id);
-        r.locals.user = i.user;
+      let { emailVerificationTokenSent: i } = await this.sessionServer.sessionManager.updateUser(r.locals.user, e);
+      if (!i) {
+        const a = await this.sessionServer.userStorage.getUserById(r.locals.user.id);
+        r.locals.user = a.user;
       }
       return {
         ok: !0,
         formData: o,
-        emailVerificationNeeded: a
+        emailVerificationNeeded: i
       };
     } catch (e) {
       let s = c.asCrossauthError(e, "Couldn't update account");
@@ -3824,32 +3824,32 @@ class we {
         const l = await this.sessionServer.getSessionData(r, "factor2change");
         l != null && l.username || this.isSessionUser(r) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), s = l == null ? void 0 : l.username;
       }
-      let a = r.locals.user;
-      if (!a && s && (a = (await this.sessionServer.userStorage.getUserByUsername(
+      let i = r.locals.user;
+      if (!i && s && (i = (await this.sessionServer.userStorage.getUserByUsername(
         s,
         {
           skipActiveCheck: !0,
           skipEmailVerifiedCheck: !0
         }
-      )).user), !a)
+      )).user), !i)
         throw new c(h.InsufficientPriviledges);
       if (!r.locals.sessionId)
         throw new c(h.Unauthorized);
-      let i = o.factor2;
+      let a = o.factor2;
       if (o.factor2 && !this.sessionServer.allowedFactor2Names.includes(o.factor2))
         throw new c(
           h.Forbidden,
           "Illegal second factor " + o.factor2 + " requested"
         );
-      if ((o.factor2 == "none" || o.factor2 == "") && (i = void 0, !r.locals.user))
-        return await this.loginWithUser(a, !0, r);
-      const n = await this.sessionServer.sessionManager.initiateTwoFactorSetup(a, i, r.locals.sessionId);
-      return i ? {
+      if ((o.factor2 == "none" || o.factor2 == "") && (a = void 0, !r.locals.user))
+        return await this.loginWithUser(i, !0, r);
+      const n = await this.sessionServer.sessionManager.initiateTwoFactorSetup(i, a, r.locals.sessionId);
+      return a ? {
         ok: !0,
         formData: o,
         factor2Data: {
-          username: a.username,
-          factor2: i ?? "",
+          username: i.username,
+          factor2: a ?? "",
           userData: n,
           csrfToken: r.locals.csrfToken
         }
@@ -3858,11 +3858,11 @@ class we {
         formData: o
       };
     } catch (s) {
-      let a = c.asCrossauthError(s, "Couldn't update account");
-      return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+      let i = c.asCrossauthError(s, "Couldn't update account");
+      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1,
         formData: o
       };
@@ -3900,47 +3900,47 @@ class we {
         const f = await this.sessionServer.getSessionData(r, "factor2change");
         f != null && f.username || this.isSessionUser(r) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), s = f == null ? void 0 : f.username;
       }
-      let a = r.locals.user;
-      if (!a && s && (a = (await this.sessionServer.userStorage.getUserByUsername(
+      let i = r.locals.user;
+      if (!i && s && (i = (await this.sessionServer.userStorage.getUserByUsername(
         s,
         {
           skipActiveCheck: !0,
           skipEmailVerifiedCheck: !0
         }
-      )).user), !a)
+      )).user), !i)
         throw new c(h.InsufficientPriviledges);
       if (!r.locals.sessionId)
         throw new c(h.Unauthorized);
       if (!r.locals.sessionId)
         throw new c(h.Unauthorized);
-      let i = a.factor2;
-      const n = this.sessionServer.authenticators[i];
+      let a = i.factor2;
+      const n = this.sessionServer.authenticators[a];
       if (!n || n.secretNames().length == 0)
         throw new c(
           h.BadRequest,
           "Selected second factor does not have configuration"
         );
       const l = await this.sessionServer.sessionManager.initiateTwoFactorSetup(
-        a,
         i,
+        a,
         r.locals.sessionId
       );
       return {
         ok: !0,
         formData: o,
         factor2Data: {
-          username: a.username,
-          factor2: a.factor2 ?? "",
+          username: i.username,
+          factor2: i.factor2 ?? "",
           userData: l,
           csrfToken: r.locals.csrfToken
         }
       };
     } catch (s) {
-      let a = c.asCrossauthError(s, "Couldn't update account");
-      return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+      let i = c.asCrossauthError(s, "Couldn't update account");
+      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1,
         formData: o
       };
@@ -3962,16 +3962,16 @@ async function me(k, r, o = 0, t = 10) {
     const { user: s } = await r.getUserByUsername(k);
     e.push(s);
   } catch (s) {
-    const a = c.asCrossauthError(s);
-    if (a.code != h.UserNotExist)
-      throw d.logger.debug(u({ err: a })), a;
+    const i = c.asCrossauthError(s);
+    if (i.code != h.UserNotExist)
+      throw d.logger.debug(u({ err: i })), i;
     try {
-      const { user: i } = await r.getUserByEmail(k);
-      e.push(i);
-    } catch (i) {
-      const n = c.asCrossauthError(i);
+      const { user: a } = await r.getUserByEmail(k);
+      e.push(a);
+    } catch (a) {
+      const n = c.asCrossauthError(a);
       if (n.code != h.UserNotExist)
-        throw d.logger.debug(u({ err: n })), a;
+        throw d.logger.debug(u({ err: n })), i;
     }
   }
   return e;
@@ -3990,12 +3990,12 @@ class ke {
     }, this.updateUserEndpoint = {
       actions: {
         default: async (t) => {
-          var a, i, n;
+          var i, a, n;
           const e = await this.getUserFromParam(t);
           return e.exception || !e.user ? {
             ok: !1,
-            error: ((a = e.exception) == null ? void 0 : a.message) ?? "Couldn't get user",
-            errorCode: (i = e.exception) == null ? void 0 : i.code,
+            error: ((i = e.exception) == null ? void 0 : i.message) ?? "Couldn't get user",
+            errorCode: (a = e.exception) == null ? void 0 : a.code,
             errorCodeName: (n = e.exception) == null ? void 0 : n.codeName
           } : await this.updateUser(e.user, t);
         }
@@ -4017,12 +4017,12 @@ class ke {
     }, this.changePasswordEndpoint = {
       actions: {
         default: async (t) => {
-          var a, i, n;
+          var i, a, n;
           const e = await this.getUserFromParam(t);
           return e.exception || !e.user ? {
             ok: !1,
-            error: ((a = e.exception) == null ? void 0 : a.message) ?? "Couldn't get user",
-            errorCode: (i = e.exception) == null ? void 0 : i.code,
+            error: ((i = e.exception) == null ? void 0 : i.message) ?? "Couldn't get user",
+            errorCode: (a = e.exception) == null ? void 0 : a.code,
             errorCodeName: (n = e.exception) == null ? void 0 : n.codeName
           } : await this.changePassword(e.user, t);
         }
@@ -4035,8 +4035,8 @@ class ke {
             editUser: e.user,
             ...this.baseEndpoint(t)
           };
-        let s = {}, a = t.url.searchParams.get("next");
-        return a && (s.next = a), {
+        let s = {}, i = t.url.searchParams.get("next");
+        return i && (s.next = i), {
           ...s,
           editUser: e.user,
           ...this.baseEndpoint(t)
@@ -4058,15 +4058,15 @@ class ke {
         default: async (t) => await this.deleteUser(t)
       },
       load: async (t) => {
-        var s, a, i;
+        var s, i, a;
         const e = await this.getUserFromParam(t);
         return e.exception || !e.user ? {
           error: "User doesn't exist",
           errorCode: (s = e.exception) == null ? void 0 : s.code,
-          errorCodeName: (a = e.exception) == null ? void 0 : a.codeName,
+          errorCodeName: (i = e.exception) == null ? void 0 : i.codeName,
           ...this.baseEndpoint(t)
         } : {
-          username: (i = e.user) == null ? void 0 : i.username,
+          username: (a = e.user) == null ? void 0 : a.username,
           ...this.baseEndpoint(t)
         };
       }
@@ -4117,7 +4117,7 @@ class ke {
     try {
       if (!this.sessionServer.userStorage) throw new c(h.Configuration, "Must provide user storage to use this function");
       (!r.locals.user || !p.isAdminFn(r.locals.user)) && this.sessionServer.error(401);
-      let s = [], a = [], i = [];
+      let s = [], i = [], a = [];
       if (!t)
         try {
           const l = r.url.searchParams.get("skip");
@@ -4139,7 +4139,7 @@ class ke {
         this.sessionServer.userStorage,
         t,
         e
-      ), t > 0 && (a = await this.userSearchFn(
+      ), t > 0 && (i = await this.userSearchFn(
         o,
         this.sessionServer.userStorage,
         t - 1,
@@ -4147,7 +4147,7 @@ class ke {
       ))) : (s = await this.sessionServer.userStorage.getUsers(
         t,
         e
-      ), s.length == e && (i = await this.sessionServer.userStorage.getUsers(
+      ), s.length == e && (a = await this.sessionServer.userStorage.getUsers(
         t + e,
         1
       ))), {
@@ -4155,17 +4155,17 @@ class ke {
         users: s,
         skip: t,
         take: e,
-        hasPrevious: a.length > 0,
-        hasNext: i.length > 0,
+        hasPrevious: i.length > 0,
+        hasNext: a.length > 0,
         search: o
       };
     } catch (s) {
-      const a = c.asCrossauthError(s);
-      return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
+      const i = c.asCrossauthError(s);
+      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
         ok: !1,
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         hasPrevious: !1,
         hasNext: !1,
         skip: t ?? 0,
@@ -4211,7 +4211,7 @@ class ke {
       if (!this.sessionServer.userStorage) throw new c(h.Configuration, "Must provide user storage to use this function");
       var e = new b();
       if (await e.loadData(o), t = e.toObject(), (!o.locals.user || !p.isAdminFn(o.locals.user)) && this.sessionServer.error(401), this.isSessionUser(o) && this.sessionServer.enableCsrfProtection && !o.locals.csrfToken) throw new c(h.InvalidCsrf);
-      const s = r.factor2, a = r.state;
+      const s = r.factor2, i = r.state;
       r.state = t.state ?? "active", r = this.sessionServer.updateUserFn(
         r,
         o,
@@ -4221,11 +4221,11 @@ class ke {
           ...this.sessionServer.userStorage.adminEditableFields
         }
       );
-      const i = r.factor2 && r.factor2 != "none" && r.factor2 != s;
-      if (i && !(r.state == a || r.state == "factor2ResetNeeded"))
+      const a = r.factor2 && r.factor2 != "none" && r.factor2 != s;
+      if (a && !(r.state == i || r.state == "factor2ResetNeeded"))
         throw new c(h.BadRequest, "Cannot change both factor2 and state at the same time");
-      i && (r.state = I.factor2ResetNeeded, d.logger.warn(u({
-        msg: `Setting state for user to ${I.factor2ResetNeeded}`,
+      a && (r.state = N.factor2ResetNeeded, d.logger.warn(u({
+        msg: `Setting state for user to ${N.factor2ResetNeeded}`,
         username: r.username
       })));
       let n = this.sessionServer.validateUserFn(r);
@@ -4240,11 +4240,11 @@ class ke {
       };
     } catch (s) {
       if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s, 401)) throw s;
-      let a = c.asCrossauthError(s, "Couldn't log in");
-      return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+      let i = c.asCrossauthError(s, "Couldn't log in");
+      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1,
         formData: t
       };
@@ -4276,18 +4276,18 @@ class ke {
       var e = new b();
       if (await e.loadData(o), t = e.toObject(), (!o.locals.user || !p.isAdminFn(o.locals.user)) && this.sessionServer.error(401), this.isSessionUser(o) && this.sessionServer.enableCsrfProtection && !o.locals.csrfToken)
         throw new c(h.InvalidCsrf);
-      const s = this.sessionServer.authenticators[r.factor1], a = s.secretNames();
-      let i = {}, n = {}, l = {};
+      const s = this.sessionServer.authenticators[r.factor1], i = s.secretNames();
+      let a = {}, n = {}, l = {};
       for (let g in t)
         if (g.startsWith("new_")) {
-          const m = g.replace(/^new_/, "");
-          a.includes(m) && (n[m] = t[g]);
+          const w = g.replace(/^new_/, "");
+          i.includes(w) && (n[w] = t[g]);
         } else if (g.startsWith("old_")) {
-          const m = g.replace(/^old_/, "");
-          a.includes(m) && (i[m] = t[g]);
+          const w = g.replace(/^old_/, "");
+          i.includes(w) && (a[w] = t[g]);
         } else if (g.startsWith("repeat_")) {
-          const m = g.replace(/^repeat_/, "");
-          a.includes(m) && (l[m] = t[g]);
+          const w = g.replace(/^repeat_/, "");
+          i.includes(w) && (l[w] = t[g]);
         }
       if (Object.keys(l).length === 0 && (l = void 0), s.validateSecrets(n).length > 0)
         throw new c(h.PasswordFormat);
@@ -4297,11 +4297,11 @@ class ke {
           1,
           n,
           l,
-          i
+          a
         );
       } catch (g) {
-        const m = c.asCrossauthError(g);
-        throw d.logger.debug(u({ err: g })), m;
+        const w = c.asCrossauthError(g);
+        throw d.logger.debug(u({ err: g })), w;
       }
       return {
         ok: !0,
@@ -4309,11 +4309,11 @@ class ke {
       };
     } catch (s) {
       if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s, 401)) throw s;
-      let a = c.asCrossauthError(s, "Couldn't change password");
-      return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+      let i = c.asCrossauthError(s, "Couldn't change password");
+      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1,
         formData: t
       };
@@ -4388,37 +4388,37 @@ class ke {
           ...this.sessionServer.userStorage.adminEditableFields
         }
       );
-      const a = this.sessionServer.authenticators[s.factor1].secretNames();
-      let i = !0;
-      for (let w of a)
-        !o[w] && !o["repeat_" + w] && (i = !1);
+      const i = this.sessionServer.authenticators[s.factor1].secretNames();
+      let a = !0;
+      for (let m of i)
+        !o[m] && !o["repeat_" + m] && (a = !1);
       let n = [], l = {};
-      if (i) {
+      if (a) {
         n = this.sessionServer.authenticators[s.factor1].validateSecrets(o);
-        for (let w in o)
-          if (w.startsWith("repeat_")) {
-            const S = w.replace(/^repeat_/, "");
-            a.includes(S) && (l[S] = o[w]);
+        for (let m in o)
+          if (m.startsWith("repeat_")) {
+            const S = m.replace(/^repeat_/, "");
+            i.includes(S) && (l[S] = o[m]);
           }
         Object.keys(l).length === 0 && (l = void 0);
       }
-      i ? o.factor2 != null && (s.state = I.factor2ResetNeeded) : o.factor2 == null ? s.state = I.passwordResetNeeded : s.state = I.passwordAndFactor2ResetNeeded;
+      a ? o.factor2 != null && (s.state = N.factor2ResetNeeded) : o.factor2 == null ? s.state = N.passwordResetNeeded : s.state = N.passwordAndFactor2ResetNeeded;
       let g = [...this.sessionServer.validateUserFn(s), ...n];
       if (g.length > 0)
         throw new c(h.FormEntry, g);
-      const m = await this.sessionServer.sessionManager.createUser(
+      const w = await this.sessionServer.sessionManager.createUser(
         s,
         o,
         l,
         !0,
-        !i
+        !a
       );
-      if (!i) {
-        let w = o.username;
-        if ("user_email" in o && (w = o.user_email), oe.validateEmail(w), !w) throw new c(h.FormEntry, "No password given but no email address found either");
-        await this.sessionServer.sessionManager.requestPasswordReset(w);
+      if (!a) {
+        let m = o.username;
+        if ("user_email" in o && (m = o.user_email), oe.validateEmail(m), !m) throw new c(h.FormEntry, "No password given but no email address found either");
+        await this.sessionServer.sessionManager.requestPasswordReset(m);
       }
-      return { ok: !0, user: m, formData: o };
+      return { ok: !0, user: w, formData: o };
     } catch (e) {
       let s = c.asCrossauthError(e, "Couldn't create user");
       return d.logger.debug(u({ err: s })), d.logger.error(u({ cerr: s })), {
@@ -4487,23 +4487,23 @@ async function Se(k, r, o, t, e) {
   let s = [];
   if (o > 0) return [];
   try {
-    const a = await r.getClientById(k);
-    s.push(a);
-  } catch (a) {
-    const i = c.asCrossauthError(a);
-    if (i.code != h.UserNotExist)
-      throw d.logger.debug(u({ err: i })), i;
+    const i = await r.getClientById(k);
+    s.push(i);
+  } catch (i) {
+    const a = c.asCrossauthError(i);
+    if (a.code != h.UserNotExist)
+      throw d.logger.debug(u({ err: a })), a;
     try {
       s = await r.getClientByName(k, e);
     } catch (n) {
       const l = c.asCrossauthError(n);
       if (l.code != h.UserNotExist)
-        throw d.logger.debug(u({ err: l })), i;
+        throw d.logger.debug(u({ err: l })), a;
     }
   }
   return s;
 }
-class $ {
+class X {
   /**
    * Constructor
    * 
@@ -4511,7 +4511,7 @@ class $ {
    * @param options See {@link SvelteKitSessionServerOptions}
    */
   constructor(r, o) {
-    this.loginUrl = "/login", this.clientSearchFn = Se, this.validFlows = ["all"], this.sessionServer = r, y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect ?? Q, this.error = o.error ?? Y, y("validFlows", _.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == E.All && (this.validFlows = E.allFlows()), this.valid_flowNames = E.flowNames(this.validFlows), o.clientStorage && (this.clientManager = new x(o)), this.clientStorage = o.clientStorage;
+    this.loginUrl = "/login", this.clientSearchFn = Se, this.validFlows = ["all"], this.sessionServer = r, y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect ?? Q, this.error = o.error ?? Y, y("validFlows", E.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == _.All && (this.validFlows = _.allFlows()), this.valid_flowNames = _.flowNames(this.validFlows), o.clientStorage && (this.clientManager = new B(o)), this.clientStorage = o.clientStorage;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -4557,7 +4557,7 @@ class $ {
       if (!this.sessionServer.clientStorage) throw new c(h.Configuration, "Must provide client storage to use this function");
       if (!r.locals.user)
         throw this.redirect(302, this.loginUrl + "?next=" + encodeURIComponent(r.request.url));
-      let a = [], i = [], n = [];
+      let i = [], a = [], n = [];
       if (!t)
         try {
           const f = r.url.searchParams.get("skip");
@@ -4574,44 +4574,44 @@ class $ {
         }
       e || (e = 10);
       const l = r.url.searchParams.get("search");
-      return !o && l != null && l != "" && (o = l), o || (o = ""), o.length == 0 && (o = void 0), o ? (a = await this.clientSearchFn(
+      return !o && l != null && l != "" && (o = l), o || (o = ""), o.length == 0 && (o = void 0), o ? (i = await this.clientSearchFn(
         o,
         this.sessionServer.clientStorage,
         t,
         e
-      ), t > 0 && (i = await this.clientSearchFn(
+      ), t > 0 && (a = await this.clientSearchFn(
         o,
         this.sessionServer.clientStorage,
         t - 1,
         1,
         s
-      ))) : (a = await this.sessionServer.clientStorage.getClients(
+      ))) : (i = await this.sessionServer.clientStorage.getClients(
         t,
         e,
         s
-      ), a.length == e && (n = await this.sessionServer.clientStorage.getClients(
+      ), i.length == e && (n = await this.sessionServer.clientStorage.getClients(
         t + e,
         1,
         s
       ))), {
         ok: !0,
-        clients: a,
+        clients: i,
         skip: t,
         take: e,
-        hasPrevious: i.length > 0,
+        hasPrevious: a.length > 0,
         hasNext: n.length > 0,
         search: o,
         clientUserId: s
       };
-    } catch (a) {
-      if (p.isSvelteKitRedirect(a) || p.isSvelteKitRedirect(a))
-        throw a;
-      const i = c.asCrossauthError(a);
-      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
+    } catch (i) {
+      if (p.isSvelteKitRedirect(i) || p.isSvelteKitRedirect(i))
+        throw i;
+      const a = c.asCrossauthError(i);
+      return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
         ok: !1,
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         hasPrevious: !1,
         hasNext: !1,
         skip: t ?? 0,
@@ -4634,21 +4634,21 @@ class $ {
     try {
       if (!o) throw new c(h.BadRequest, "No client ID specified");
       if (!this.clientStorage) throw new c(h.Configuration, "No client storage specified");
-      const a = await this.clientStorage.getClientById(o), i = a.userid == null ? void 0 : await ((e = (t = this.sessionServer) == null ? void 0 : t.userStorage) == null ? void 0 : e.getUserById(a.userid)), n = (s = i == null ? void 0 : i.user) == null ? void 0 : s.username;
+      const i = await this.clientStorage.getClientById(o), a = i.userid == null ? void 0 : await ((e = (t = this.sessionServer) == null ? void 0 : t.userStorage) == null ? void 0 : e.getUserById(i.userid)), n = (s = a == null ? void 0 : a.user) == null ? void 0 : s.username;
       return {
         ok: !0,
-        client: a,
+        client: i,
         validFlows: this.validFlows,
         valid_flowNames: this.valid_flowNames,
         client_id: o,
         clientUsername: n
       };
-    } catch (a) {
-      let i = c.asCrossauthError(a, "Couldn't load client");
-      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+    } catch (i) {
+      let a = c.asCrossauthError(i, "Couldn't load client");
+      return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1,
         validFlows: this.validFlows,
         valid_flowNames: this.valid_flowNames,
@@ -4669,11 +4669,11 @@ class $ {
    * @returns {@link UpdateClientFormData}.  If a new secret was created, it will be placed as plaintext in the client that is returned.
    */
   async updateClient_internal(r, o) {
-    var s, a;
+    var s, i;
     let t;
     try {
-      const i = r.params.client_id;
-      if (!i) throw new c(h.BadRequest, "No client ID given");
+      const a = r.params.client_id;
+      if (!a) throw new c(h.BadRequest, "No client ID given");
       var e = new b();
       if (await e.loadData(r), t = e.toObject(), this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
         throw new c(h.InvalidCsrf);
@@ -4681,7 +4681,7 @@ class $ {
       let l = [];
       for (let C of n)
         try {
-          x.validateUri(C);
+          B.validateUri(C);
         } catch (T) {
           d.logger.error(u({ err: T })), l.push("[" + C + "]");
         }
@@ -4697,28 +4697,28 @@ class $ {
       if (g.client_name = t.client_name, g.confidential = e.getAsBoolean("confidential") ?? !1, g.valid_flow = f, g.redirect_uri = n, o) {
         let C = t.userid ?? void 0;
         if (C && ((s = this.sessionServer) != null && s.userStorage)) {
-          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
+          const { user: T } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
           C = T.id;
         }
         g.userid = t.userid ? Number(t.userid) : null;
       }
-      const m = e.getAsBoolean("resetSecret");
+      const w = e.getAsBoolean("resetSecret");
       if (!this.clientManager) throw new c(h.Configuration, "Cannot call this endpoint as you did not provide a clientStorage");
-      const { client: w, newSecret: S } = await this.clientManager.updateClient(
-        i,
+      const { client: m, newSecret: S } = await this.clientManager.updateClient(
+        a,
         g,
-        m
+        w
       );
       return {
         ok: !0,
-        client: w,
+        client: m,
         formData: t,
         //plaintextSecret: resetSecret ? formData.client_secret : undefined,
-        plaintextSecret: S && w.client_secret ? w.client_secret : void 0
+        plaintextSecret: S && m.client_secret ? m.client_secret : void 0
       };
-    } catch (i) {
-      if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
-      let n = c.asCrossauthError(i, "Couldn't update client");
+    } catch (a) {
+      if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
+      let n = c.asCrossauthError(a, "Couldn't update client");
       return d.logger.debug(u({ err: n })), d.logger.error(u({ cerr: n })), {
         error: n.message,
         errorCode: n.code,
@@ -4737,7 +4737,7 @@ class $ {
    * @returns {@link CreateClientPageData}.  
    */
   async emptyClient_internal(r, o) {
-    var e, s, a, i, n, l, f;
+    var e, s, i, a, n, l, f;
     try {
       var t = new b();
       await t.loadData(r);
@@ -4749,8 +4749,8 @@ class $ {
           g = T.id;
         }
         const C = t.get("userid");
-        if (C && ((a = this.sessionServer) != null && a.userStorage)) {
-          const { user: T } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
+        if (C && ((i = this.sessionServer) != null && i.userStorage)) {
+          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
           g = T.id;
         }
       } else {
@@ -4758,20 +4758,20 @@ class $ {
         g = r.locals.user.id;
       }
       if (!this.clientStorage) throw new c(h.Configuration, "No client storage specified");
-      const m = g == null ? void 0 : await ((l = (n = this.sessionServer) == null ? void 0 : n.userStorage) == null ? void 0 : l.getUserById(g)), w = (f = m == null ? void 0 : m.user) == null ? void 0 : f.username;
+      const w = g == null ? void 0 : await ((l = (n = this.sessionServer) == null ? void 0 : n.userStorage) == null ? void 0 : l.getUserById(g)), m = (f = w == null ? void 0 : w.user) == null ? void 0 : f.username;
       return {
         ok: !0,
         validFlows: this.validFlows,
         valid_flowNames: this.valid_flowNames,
         clientUserId: g,
-        clientUsername: w
+        clientUsername: m
       };
     } catch (g) {
-      let m = c.asCrossauthError(g, "Couldn't initialize new client");
-      return d.logger.debug(u({ err: m })), d.logger.error(u({ cerr: m })), {
-        error: m.message,
-        errorCode: m.code,
-        errorCodeName: m.codeName,
+      let w = c.asCrossauthError(g, "Couldn't initialize new client");
+      return d.logger.debug(u({ err: w })), d.logger.error(u({ cerr: w })), {
+        error: w.message,
+        errorCode: w.code,
+        errorCodeName: w.codeName,
         ok: !1,
         validFlows: this.validFlows,
         valid_flowNames: this.valid_flowNames
@@ -4790,7 +4790,7 @@ class $ {
    * @returns {@link UpdateClientFormData}.  If a secret was created, it will be placed as plaintext in the client that is returned.  A random `client_id` is created.
    */
   async createClient_internal(r, o) {
-    var s, a, i, n;
+    var s, i, a, n;
     let t;
     try {
       var e = new b();
@@ -4799,7 +4799,7 @@ class $ {
       if (o) {
         const C = e.get("userid");
         if (C && ((s = this.sessionServer) != null && s.userStorage)) {
-          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
+          const { user: T } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
           l = T.id;
         }
       } else {
@@ -4807,13 +4807,13 @@ class $ {
         l = r.locals.user.id;
       }
       if (!this.clientStorage) throw new c(h.Configuration, "No client storage specified");
-      if (l && await ((n = (i = this.sessionServer) == null ? void 0 : i.userStorage) == null ? void 0 : n.getUserById(l)), this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
+      if (l && await ((n = (a = this.sessionServer) == null ? void 0 : a.userStorage) == null ? void 0 : n.getUserById(l)), this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
         throw new c(h.InvalidCsrf);
       const f = !t.redirect_uri || t.redirect_uri.trim().length == 0 ? [] : t.redirect_uri.trim().split(/[, ][ \t\n]*/);
       let g = [];
       for (let C of f)
         try {
-          x.validateUri(C);
+          B.validateUri(C);
         } catch (T) {
           d.logger.error(u({ err: T })), g.push("[" + C + "]");
         }
@@ -4822,17 +4822,17 @@ class $ {
           h.BadRequest,
           "The following redirect URIs are invalid: " + g.join(" ")
         );
-      let m = [];
+      let w = [];
       for (let C of this.validFlows)
-        C in t && m.push(C);
-      const w = {};
-      if (w.client_name = t.client_name, w.confidential = e.getAsBoolean("confidential"), w.valid_flow = m, w.redirect_uri = f, o && (w.userid = t.userid ? Number(t.userid) : null), !this.clientManager) throw new c(h.Configuration, "Cannot call this endpoint as you did not provide a clientStorage");
+        C in t && w.push(C);
+      const m = {};
+      if (m.client_name = t.client_name, m.confidential = e.getAsBoolean("confidential"), m.valid_flow = w, m.redirect_uri = f, o && (m.userid = t.userid ? Number(t.userid) : null), !this.clientManager) throw new c(h.Configuration, "Cannot call this endpoint as you did not provide a clientStorage");
       return {
         ok: !0,
         client: await this.clientManager.createClient(
           t.client_name,
           f,
-          m,
+          w,
           e.getAsBoolean("confidential") ?? !1,
           l
         ),
@@ -4863,19 +4863,19 @@ class $ {
     try {
       if (!o) throw new c(h.BadRequest, "No client ID specified");
       if (!this.clientStorage) throw new c(h.Configuration, "No client storage specified");
-      const a = await this.clientStorage.getClientById(o), i = a.userid == null ? void 0 : await ((e = (t = this.sessionServer) == null ? void 0 : t.userStorage) == null ? void 0 : e.getUserById(a.userid)), n = (s = i == null ? void 0 : i.user) == null ? void 0 : s.username;
+      const i = await this.clientStorage.getClientById(o), a = i.userid == null ? void 0 : await ((e = (t = this.sessionServer) == null ? void 0 : t.userStorage) == null ? void 0 : e.getUserById(i.userid)), n = (s = a == null ? void 0 : a.user) == null ? void 0 : s.username;
       return {
         ok: !0,
-        client: a,
+        client: i,
         client_id: o,
         clientUsername: n
       };
-    } catch (a) {
-      let i = c.asCrossauthError(a, "Couldn't load client");
-      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+    } catch (i) {
+      let a = c.asCrossauthError(i, "Couldn't load client");
+      return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1,
         client_id: o
       };
@@ -4896,19 +4896,19 @@ class $ {
       const s = r.params.client_id;
       if (!s) throw new c(h.BadRequest, "No client ID given");
       if (!this.clientStorage) throw new c(h.Configuration, "No client storage specified");
-      const a = await ((t = this.clientStorage) == null ? void 0 : t.getClientById(s));
-      if (!o && a.userid != ((e = r.locals.user) == null ? void 0 : e.id))
+      const i = await ((t = this.clientStorage) == null ? void 0 : t.getClientById(s));
+      if (!o && i.userid != ((e = r.locals.user) == null ? void 0 : e.id))
         throw this.error(401, "Unauthorized");
       return await this.clientStorage.deleteClient(s), {
         ok: !0
       };
     } catch (s) {
       if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-      let a = c.asCrossauthError(s, "Couldn't delete client");
-      return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+      let i = c.asCrossauthError(s, "Couldn't delete client");
+      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1
       };
     }
@@ -4929,7 +4929,7 @@ class $ {
     };
   }
 }
-class Ce extends $ {
+class Ce extends X {
   /**
    * Constructor
    * @param sessionServer the session server which will have these endpoints
@@ -4977,7 +4977,7 @@ class Ce extends $ {
       actions: {
         default: async (t) => await this.deleteClient(t)
       }
-    }, this.sessionServer = r, y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
+    }, this.sessionServer = r, y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -5105,7 +5105,7 @@ class Ce extends $ {
     return this.createClient_internal(r, !1);
   }
 }
-class ye extends $ {
+class ye extends X {
   /**
    * Constructor
    * @param sessionServer the session server which will have these endpoints
@@ -5159,7 +5159,7 @@ class ye extends $ {
       actions: {
         default: async (t) => await this.deleteClient(t)
       }
-    }, this.sessionServer = r, y("loginUrl", _.String, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
+    }, this.sessionServer = r, y("loginUrl", E.String, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -5220,52 +5220,52 @@ class ye extends $ {
     return this.deleteClient_internal(r, !0);
   }
 }
-const B = "X-CROSSAUTH-CSRF";
-function _e(k) {
+const x = "X-CROSSAUTH-CSRF";
+function Ee(k) {
   let r = [];
   return k.username == null ? r.push("Username must be given") : k.username.length < 2 ? r.push("Username must be at least 2 characters") : k.username.length > 254 && r.push("Username must be no longer than 254 characters"), r;
 }
-function Ee(k, r, o) {
-  var a;
+function _e(k, r, o) {
+  var i;
   let e = {
     username: r.username ?? "",
     state: "active"
   };
   const s = k.locals.user && p.isAdminFn(k.locals.user);
-  for (let i in r) {
-    let n = i.replace(/^user_/, "");
-    if (i.startsWith("user_") && (s || o.includes(n)))
+  for (let a in r) {
+    let n = a.replace(/^user_/, "");
+    if (a.startsWith("user_") && (s || o.includes(n)))
       if ("type_" + n in r) {
         if (r["type_" + n] == "string")
-          e[n] = r[i];
+          e[n] = r[a];
         else if (r["type_" + n] == "number" || r["type_" + n] == "integer" || r["type_" + n] == "float")
-          e[n] = Number(r[i]);
+          e[n] = Number(r[a]);
         else if (r["type_" + n] == "boolean") {
-          const l = (a = r[i]) == null ? void 0 : a.toLocaleLowerCase();
+          const l = (i = r[a]) == null ? void 0 : i.toLocaleLowerCase();
           e[n] = l == "1" || l == "y" || l == "t" || l == "yes" || l == "true";
         }
       } else
-        e[n] = r[i];
+        e[n] = r[a];
   }
   return e.factor1 = "localpassword", e.factor2 = r.factor2, e;
 }
 function ve(k, r, o, t) {
   var s;
   const e = r.locals.user && p.isAdminFn(r.locals.user);
-  for (let a in o) {
-    let i = a.replace(/^user_/, "");
-    if (a.startsWith("user_") && (e || t.includes(i)))
-      if ("type_" + i in o) {
-        if (o["type_" + i] == "string")
-          k[i] = o[a];
-        else if (o["type_" + i] == "number" || o["type_" + i] == "integer" || o["type_" + i] == "float")
-          k[i] = Number(o[a]);
-        else if (o["type_" + i] == "boolean") {
-          const n = (s = o[a]) == null ? void 0 : s.toLocaleLowerCase();
-          k[i] = n == "1" || n == "y" || n == "t" || n == "yes" || n == "true";
+  for (let i in o) {
+    let a = i.replace(/^user_/, "");
+    if (i.startsWith("user_") && (e || t.includes(a)))
+      if ("type_" + a in o) {
+        if (o["type_" + a] == "string")
+          k[a] = o[i];
+        else if (o["type_" + a] == "number" || o["type_" + a] == "integer" || o["type_" + a] == "float")
+          k[a] = Number(o[i]);
+        else if (o["type_" + a] == "boolean") {
+          const n = (s = o[i]) == null ? void 0 : s.toLocaleLowerCase();
+          k[a] = n == "1" || n == "y" || n == "t" || n == "yes" || n == "true";
         }
       } else
-        k[i] = o[a];
+        k[a] = o[i];
   }
   return k;
 }
@@ -5278,9 +5278,9 @@ class H {
    * @param options See {@link SvelteKitSessionServerOptions}.
    */
   constructor(r, o, t = {}) {
-    this.validateUserFn = _e, this.createUserFn = Ee, this.updateUserFn = ve, this.allowedFactor2 = [], this.allowedFactor2Names = [], this.factor2ProtectedPageEndpoints = [], this.factor2ProtectedApiEndpoints = [], this.loginProtectedPageEndpoints = [], this.loginProtectedApiEndpoints = [], this.loginProtectedExceptionPageEndpoints = [], this.loginProtectedExceptionApiEndpoints = [], this.adminPageEndpoints = [], this.adminApiEndpoints = [], this.unauthorizedUrl = void 0, this.enableCsrfProtection = !0, this.enableEmailVerification = !1, this.enablePasswordReset = !1, this.factor2Url = "/factor2", this.loginUrl = "/login", this.keyStorage = r, this.userStorage = t.userStorage, this.clientStorage = t.clientStorage, this.authenticators = o, this.sessionManager = new ie(r, o, t), this.redirect = t.redirect ?? Q, this.error = t.error ?? Y, y("factor2Url", _.String, this, t, "FACTOR2_URL"), this.factor2Url.endsWith("/") || (this.factor2Url += "/"), y("factor2ProtectedPageEndpoints", _.JsonArray, this, t, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), y("factor2ProtectedApiEndpoints", _.JsonArray, this, t, "FACTOR2_PROTECTED_API_ENDPOINTS"), y("loginProtectedPageEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_PAGE_ENDPOINTS"), y("loginProtectedApiEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_API_ENDPOINTS"), y("loginProtectedExceptionPageEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("loginProtectedExceptionApiEndpoints", _.JsonArray, this, t, "LOGIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("adminPageEndpoints", _.JsonArray, this, t, "ADMIN_PAGE_ENDPOINTS"), y("adminApiEndpoints", _.JsonArray, this, t, "ADMIN_API_ENDPOINTS"), y("loginUrl", _.JsonArray, this, t, "LOGIN_URL"), y("unauthorizedUrl", _.JsonArray, this, t, "UNAUTHORIZED_PAGE");
+    this.validateUserFn = Ee, this.createUserFn = _e, this.updateUserFn = ve, this.allowedFactor2 = [], this.allowedFactor2Names = [], this.factor2ProtectedPageEndpoints = [], this.factor2ProtectedApiEndpoints = [], this.loginProtectedPageEndpoints = [], this.loginProtectedApiEndpoints = [], this.loginProtectedExceptionPageEndpoints = [], this.loginProtectedExceptionApiEndpoints = [], this.adminPageEndpoints = [], this.adminApiEndpoints = [], this.adminProtectedExceptionPageEndpoints = [], this.adminProtectedExceptionApiEndpoints = [], this.unauthorizedUrl = void 0, this.enableCsrfProtection = !0, this.enableEmailVerification = !1, this.enablePasswordReset = !1, this.factor2Url = "/factor2", this.loginUrl = "/login", this.keyStorage = r, this.userStorage = t.userStorage, this.clientStorage = t.clientStorage, this.authenticators = o, this.sessionManager = new ie(r, o, t), this.redirect = t.redirect ?? Q, this.error = t.error ?? Y, y("factor2Url", E.String, this, t, "FACTOR2_URL"), this.factor2Url.endsWith("/") || (this.factor2Url += "/"), y("factor2ProtectedPageEndpoints", E.JsonArray, this, t, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), y("factor2ProtectedApiEndpoints", E.JsonArray, this, t, "FACTOR2_PROTECTED_API_ENDPOINTS"), y("loginProtectedPageEndpoints", E.JsonArray, this, t, "LOGIN_PROTECTED_PAGE_ENDPOINTS"), y("loginProtectedApiEndpoints", E.JsonArray, this, t, "LOGIN_PROTECTED_API_ENDPOINTS"), y("loginProtectedExceptionPageEndpoints", E.JsonArray, this, t, "LOGIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("loginProtectedExceptionApiEndpoints", E.JsonArray, this, t, "LOGIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("adminPageEndpoints", E.JsonArray, this, t, "ADMIN_PAGE_ENDPOINTS"), y("adminApiEndpoints", E.JsonArray, this, t, "ADMIN_API_ENDPOINTS"), y("adminProtectedExceptionPageEndpoints", E.JsonArray, this, t, "ADMIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("adminProtectedExceptionApiEndpoints", E.JsonArray, this, t, "ADMIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("loginUrl", E.JsonArray, this, t, "LOGIN_URL"), y("unauthorizedUrl", E.JsonArray, this, t, "UNAUTHORIZED_PAGE");
     let e = {};
-    if (y("allowedFactor2", _.JsonArray, e, t, "ALLOWED_FACTOR2"), this.allowedFactor2Names = t.allowedFactor2 ?? ["none"], e.allowedFactor2)
+    if (y("allowedFactor2", E.JsonArray, e, t, "ALLOWED_FACTOR2"), this.allowedFactor2Names = t.allowedFactor2 ?? ["none"], e.allowedFactor2)
       for (let s of e.allowedFactor2)
         s in this.authenticators ? this.allowedFactor2.push({
           name: s,
@@ -5291,79 +5291,79 @@ class H {
           friendlyName: "None",
           configurable: !1
         });
-    y("enableEmailVerification", _.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), y("enablePasswordReset", _.Boolean, this, t, "ENABLE_PASSWORD_RESET"), y("enableCsrfProtection", _.Boolean, this, t, "ENABLE_CSRF_PROTECTION"), y("editUserScope", _.String, this, t, "EDIT_USER_SCOPE"), t.validateUserFn && (this.validateUserFn = t.validateUserFn), t.createUserFn && (this.createUserFn = t.createUserFn), t.updateUserFn && (this.updateUserFn = t.updateUserFn), t.addToSession && (this.addToSession = t.addToSession), t.validateSession && (this.validateSession = t.validateSession), this.userEndpoints = new we(this, t), this.adminEndpoints = new ke(this, t), this.userClientEndpoints = new Ce(this, t), this.adminClientEndpoints = new ye(this, t), this.sessionHook = async ({ event: s }) => {
+    y("enableEmailVerification", E.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), y("enablePasswordReset", E.Boolean, this, t, "ENABLE_PASSWORD_RESET"), y("enableCsrfProtection", E.Boolean, this, t, "ENABLE_CSRF_PROTECTION"), y("editUserScope", E.String, this, t, "EDIT_USER_SCOPE"), t.validateUserFn && (this.validateUserFn = t.validateUserFn), t.createUserFn && (this.createUserFn = t.createUserFn), t.updateUserFn && (this.updateUserFn = t.updateUserFn), t.addToSession && (this.addToSession = t.addToSession), t.validateSession && (this.validateSession = t.validateSession), this.userEndpoints = new we(this, t), this.adminEndpoints = new ke(this, t), this.userClientEndpoints = new Ce(this, t), this.adminClientEndpoints = new ye(this, t), this.sessionHook = async ({ event: s }) => {
       var f, g;
       d.logger.debug("Session hook");
-      let a = [];
-      const i = this.sessionManager.csrfCookieName, n = this.sessionManager.sessionCookieName;
+      let i = [];
+      const a = this.sessionManager.csrfCookieName, n = this.sessionManager.sessionCookieName;
       if (this.enableCsrfProtection) {
         d.logger.debug(u({ msg: "Getting csrf cookie" }));
-        let m;
+        let w;
         try {
-          m = this.getCsrfCookieValue(s), m && this.sessionManager.validateCsrfCookie(m);
-        } catch (w) {
-          d.logger.warn(u({ msg: "Invalid csrf cookie received", cerr: w, hashedCsrfCookie: this.getHashOfCsrfCookie(s) }));
+          w = this.getCsrfCookieValue(s), w && this.sessionManager.validateCsrfCookie(w);
+        } catch (m) {
+          d.logger.warn(u({ msg: "Invalid csrf cookie received", cerr: m, hashedCsrfCookie: this.getHashOfCsrfCookie(s) }));
           try {
-            this.clearCookie(i, this.sessionManager.csrfCookiePath, s);
+            this.clearCookie(a, this.sessionManager.csrfCookiePath, s);
           } catch (S) {
             d.logger.debug(u({ err: S })), d.logger.error(u({ cerr: S, msg: "Couldn't delete CSRF cookie", ip: s.request.referrer, hashedCsrfCookie: this.getHashOfCsrfCookie(s) }));
           }
-          m = void 0, s.locals.csrfToken = void 0;
+          w = void 0, s.locals.csrfToken = void 0;
         }
         if (["GET", "OPTIONS", "HEAD"].includes(s.request.method))
           try {
-            if (m) {
+            if (w) {
               d.logger.debug(u({ msg: "Valid CSRF cookie - creating token" }));
-              const w = await this.sessionManager.createCsrfFormOrHeaderValue(m);
-              s.locals.csrfToken = w;
+              const m = await this.sessionManager.createCsrfFormOrHeaderValue(w);
+              s.locals.csrfToken = m;
             } else {
               d.logger.debug(u({ msg: "Invalid CSRF cookie - recreating" }));
-              const { csrfCookie: w, csrfFormOrHeaderValue: S } = await this.sessionManager.createCsrfToken();
-              this.setCsrfCookie(w, s), s.locals.csrfToken = S;
+              const { csrfCookie: m, csrfFormOrHeaderValue: S } = await this.sessionManager.createCsrfToken();
+              this.setCsrfCookie(m, s), s.locals.csrfToken = S;
             }
-            this.setHeader(B, s.locals.csrfToken, a);
-          } catch (w) {
-            d.logger.error(u({ msg: "Couldn't create CSRF token", cerr: w, user: (f = s.locals.user) == null ? void 0 : f.username, hashedSessionCookie: this.getHashOfSessionCookie(s) })), d.logger.debug(u({ err: w })), this.clearCookie(i, this.sessionManager.csrfCookiePath, s), s.locals.csrfToken = void 0;
+            this.setHeader(x, s.locals.csrfToken, i);
+          } catch (m) {
+            d.logger.error(u({ msg: "Couldn't create CSRF token", cerr: m, user: (f = s.locals.user) == null ? void 0 : f.username, hashedSessionCookie: this.getHashOfSessionCookie(s) })), d.logger.debug(u({ err: m })), this.clearCookie(a, this.sessionManager.csrfCookiePath, s), s.locals.csrfToken = void 0;
           }
-        else if (m)
+        else if (w)
           try {
-            await this.csrfToken(s, a);
-          } catch (w) {
-            d.logger.error(u({ msg: "Couldn't create CSRF token", cerr: w, user: (g = s.locals.user) == null ? void 0 : g.username, hashedSessionCookie: this.getHashOfSessionCookie(s) })), d.logger.debug(u({ err: w }));
+            await this.csrfToken(s, i);
+          } catch (m) {
+            d.logger.error(u({ msg: "Couldn't create CSRF token", cerr: m, user: (g = s.locals.user) == null ? void 0 : g.username, hashedSessionCookie: this.getHashOfSessionCookie(s) })), d.logger.debug(u({ err: m }));
           }
       }
       s.locals.user = void 0, s.locals.authType = void 0;
       const l = this.getSessionCookieValue(s);
       if (d.logger.debug(u({ msg: "Getting session cookie" })), l)
         try {
-          const m = this.sessionManager.getSessionId(l);
-          let { key: w, user: S } = await this.sessionManager.userForSessionId(m);
-          this.validateSession && this.validateSession(w, S, s), s.locals.sessionId = m, s.locals.user = S, s.locals.authType = "cookie", d.logger.debug(u({ msg: "Valid session id", user: S == null ? void 0 : S.username }));
+          const w = this.sessionManager.getSessionId(l);
+          let { key: m, user: S } = await this.sessionManager.userForSessionId(w);
+          this.validateSession && this.validateSession(m, S, s), s.locals.sessionId = w, s.locals.user = S, s.locals.authType = "cookie", d.logger.debug(u({ msg: "Valid session id", user: S == null ? void 0 : S.username }));
         } catch {
           d.logger.warn(u({ msg: "Invalid session cookie received", hashedSessionCookie: this.getHashOfSessionCookie(s) })), this.clearCookie(n, this.sessionManager.sessionCookiePath, s);
         }
-      return { headers: a };
+      return { headers: i };
     }, this.twoFAHook = async ({ event: s }) => {
       var f;
       if (d.logger.debug(u({ msg: "twoFAHook", username: (f = s.locals.user) == null ? void 0 : f.username })), !this.userStorage) throw this.error(500, "No user storage defined");
-      const a = this.getSessionCookieValue(s), i = this.isFactor2PageProtected(s), n = this.isFactor2ApiProtected(s);
+      const i = this.getSessionCookieValue(s), a = this.isFactor2PageProtected(s), n = this.isFactor2ApiProtected(s);
       let l;
-      if (a)
+      if (i)
         if (s.locals.user) l = s.locals.user;
         else {
           const g = await this.getSessionData(s, "user");
           if (g) {
-            const m = await this.userStorage.getUserByUsername(g.username, { skipActiveCheck: !0 });
-            (m.user.status == I.active || m.user.state == I.factor2ResetNeeded) && (l = m.user);
+            const w = await this.userStorage.getUserByUsername(g.username, { skipActiveCheck: !0 });
+            (w.user.status == N.active || w.user.state == N.factor2ResetNeeded) && (l = w.user);
           }
         }
-      if (l && a && l.factor2 != "" && (i || n))
+      if (l && i && l.factor2 != "" && (a || n))
         if (d.logger.debug(u({ msg: "Factor2-protected endpoint visited" })), ["GET", "OPTIONS", "HEAD"].includes(s.request.method)) {
           d.logger.debug(u({ msg: "Factor2-protected GET endpoint - cancelling 2FA" }));
           const g = this.getSessionCookieValue(s);
           if (g) {
-            const m = this.sessionManager.getSessionId(g);
-            if ("pre2fa" in await this.sessionManager.dataForSessionId(m)) {
+            const w = this.sessionManager.getSessionId(g);
+            if ("pre2fa" in await this.sessionManager.dataForSessionId(w)) {
               d.logger.debug(u({ msg: "Cancelling 2FA" }));
               try {
                 await this.sessionManager.cancelTwoFactorPageVisit(g);
@@ -5373,59 +5373,59 @@ class H {
             }
           }
         } else {
-          const g = this.sessionManager.getSessionId(a), m = await this.sessionManager.dataForSessionId(g);
-          if ("pre2fa" in m) {
+          const g = this.sessionManager.getSessionId(i), w = await this.sessionManager.dataForSessionId(g);
+          if ("pre2fa" in w) {
             d.logger.debug(u({ msg: "Completing 2FA" }));
-            const w = this.authenticators[m.pre2fa.factor2], S = [...w.secretNames(), ...w.transientSecretNames()];
+            const m = this.authenticators[w.pre2fa.factor2], S = [...m.secretNames(), ...m.transientSecretNames()];
             let C = {};
             const T = new b();
             await T.loadData(s);
             for (let U of T.keys())
               S.includes(U) && (C[U] = T.get(U) ?? "");
-            const N = this.getSessionCookieValue(s);
-            if (!N) throw new c(h.Unauthorized, "No session cookie found");
-            let F;
+            const R = this.getSessionCookieValue(s);
+            if (!R) throw new c(h.Unauthorized, "No session cookie found");
+            let A;
             try {
               await this.sessionManager.completeTwoFactorPageVisit(C, s.locals.sessionId ?? "");
             } catch (U) {
-              F = c.asCrossauthError(U), d.logger.debug(u({ err: U }));
+              A = c.asCrossauthError(U), d.logger.debug(u({ err: U }));
               const z = c.asCrossauthError(U);
-              d.logger.error(u({ msg: F.message, cerr: U, user: T.get("username"), errorCode: z.code, errorCodeName: z.codeName }));
+              d.logger.error(u({ msg: A.message, cerr: U, user: T.get("username"), errorCode: z.code, errorCodeName: z.codeName }));
             }
-            if (F)
-              if (F.code == h.Expired) {
+            if (A)
+              if (A.code == h.Expired) {
                 d.logger.debug(u({ msg: "Error - cancelling 2FA" }));
                 try {
-                  await this.sessionManager.cancelTwoFactorPageVisit(N);
+                  await this.sessionManager.cancelTwoFactorPageVisit(R);
                 } catch (U) {
                   d.logger.error(u({ msg: "Failed cancelling 2FA", cerr: U, user: l.username, hashedSessionCookie: this.getHashOfSessionCookie(s) })), d.logger.debug(u({ err: U }));
                 }
                 return this.error(401, { message: "Sorry, your code has expired" }), { ok: !1, twofa: !0 };
               } else
-                return i ? {
+                return a ? {
                   twofa: !0,
                   ok: !1,
                   response: new Response("", {
                     status: 302,
                     statusText: q(302),
-                    headers: { Location: this.factor2Url + "?error=" + h[F.code] }
+                    headers: { Location: this.factor2Url + "?error=" + h[A.code] }
                   })
                 } : {
                   twofa: !0,
                   ok: !1,
                   response: new Response(JSON.stringify({
                     ok: !1,
-                    errorMessage: F.message,
-                    errorMessages: F.messages,
-                    errorCode: F.code,
-                    errorCodeName: h[F.code]
+                    errorMessage: A.message,
+                    errorMessages: A.messages,
+                    errorCode: A.code,
+                    errorCodeName: h[A.code]
                   }), {
-                    status: F.httpStatus,
-                    statusText: q(F.httpStatus),
+                    status: A.httpStatus,
+                    statusText: q(A.httpStatus),
                     headers: { "content-tyoe": "application/json" }
                   })
                 };
-            return H.updateRequest(s, m.pre2fa.body, m.pre2fa["content-type"]), { twofa: !0, ok: !0 };
+            return H.updateRequest(s, w.pre2fa.body, w.pre2fa["content-type"]), { twofa: !0, ok: !0 };
           } else {
             if (d.logger.debug(u({ msg: "Starting 2FA", username: l.username })), this.enableCsrfProtection && !s.locals.csrfToken) {
               const C = new c(h.Forbidden, "CSRF token missing");
@@ -5447,10 +5447,10 @@ class H {
                 })
               };
             }
-            const w = new b();
-            await w.loadData(s);
+            const m = new b();
+            await m.loadData(s);
             let S = s.request.headers.get("content-type");
-            return await this.sessionManager.initiateTwoFactorPageVisit(l, s.locals.sessionId ?? "", w.toObject(), s.request.url.replace(/\?.*$/, ""), S || void 0), i ? {
+            return await this.sessionManager.initiateTwoFactorPageVisit(l, s.locals.sessionId ?? "", m.toObject(), s.request.url.replace(/\?.*$/, ""), S || void 0), a ? {
               twofa: !0,
               ok: !0,
               response: new Response("", {
@@ -5519,7 +5519,7 @@ class H {
    * @param event the request event
    */
   setCsrfCookie(r, o) {
-    o.cookies.set(r.name, r.value, R(r.options));
+    o.cookies.set(r.name, r.value, P(r.options));
   }
   setHeader(r, o, t) {
     t.push({
@@ -5539,7 +5539,7 @@ class H {
     const o = this.getSessionCookieValue(r);
     if (!o) return "";
     try {
-      return A.hash(o);
+      return F.hash(o);
     } catch {
     }
     return "";
@@ -5556,7 +5556,7 @@ class H {
     const o = this.getCsrfCookieValue(r);
     if (!o) return "";
     try {
-      return A.hash(o);
+      return F.hash(o);
     } catch {
     }
     return "";
@@ -5573,28 +5573,28 @@ class H {
    * @returns the string CSRF token for inclusion in forms
    */
   async csrfToken(r, o) {
-    var e, s, a;
+    var e, s, i;
     let t;
-    if (r.request.headers && r.request.headers.has(B.toLowerCase())) {
-      const i = r.request.headers.get(B.toLowerCase());
-      Array.isArray(i) ? t = i[0] : i && (t = i);
+    if (r.request.headers && r.request.headers.has(x.toLowerCase())) {
+      const a = r.request.headers.get(x.toLowerCase());
+      Array.isArray(a) ? t = a[0] : a && (t = a);
     }
     if (!t) {
       if (!((e = r.request) != null && e.body)) {
         d.logger.warn(u({ msg: "Received CSRF header but not token", ip: r.request.referrerPolicy, hashedCsrfCookie: this.getHashOfCsrfCookie(r) }));
         return;
       }
-      const i = r.request.headers.get("content-type");
-      if (i == "application/json")
-        t = (await ((a = (s = r.request) == null ? void 0 : s.clone()) == null ? void 0 : a.json())).csrfToken;
-      else if (i == "application/x-www-form-urlencoded" || i == "multipart/form-data") {
+      const a = r.request.headers.get("content-type");
+      if (a == "application/json")
+        t = (await ((i = (s = r.request) == null ? void 0 : s.clone()) == null ? void 0 : i.json())).csrfToken;
+      else if (a == "application/x-www-form-urlencoded" || a == "multipart/form-data") {
         const l = (await r.request.clone().formData()).get("csrfToken");
         l && typeof l == "string" && (t = l);
       }
     }
     if (t)
       try {
-        this.sessionManager.validateDoubleSubmitCsrfToken(this.getCsrfCookieValue(r), t), r.locals.csrfToken = t, this.setHeader(B, t, o);
+        this.sessionManager.validateDoubleSubmitCsrfToken(this.getCsrfCookieValue(r), t), r.locals.csrfToken = t, this.setHeader(x, t, o);
       } catch {
         d.logger.warn(u({ msg: "Invalid CSRF token", hashedCsrfCookie: this.getHashOfCsrfCookie(r) })), this.clearCookie(this.sessionManager.csrfCookieName, this.sessionManager.csrfCookiePath, r), r.locals.csrfToken = void 0;
       }
@@ -5620,8 +5620,8 @@ class H {
     else {
       e = "";
       for (let s in o) {
-        const a = o[s];
-        e.length > 0 && (e += "&"), e += encodeURIComponent(s) + "=" + encodeURIComponent(a);
+        const i = o[s];
+        e.length > 0 && (e += "&"), e += encodeURIComponent(s) + "=" + encodeURIComponent(i);
       }
     }
     return r.request = new Request(r.request.url, {
@@ -5639,7 +5639,7 @@ class H {
   getHashOfSessionId(r) {
     if (!r.locals.sessionId) return "";
     try {
-      return A.hash(r.locals.sessionId);
+      return F.hash(r.locals.sessionId);
     } catch {
     }
     return "";
@@ -5675,10 +5675,10 @@ class H {
     if (o.pathname == this.loginUrl) return !1;
     let t = !1;
     return t = this.loginProtectedExceptionPageEndpoints.reduce(
-      (s, a) => s || P(o.pathname, a),
+      (s, i) => s || I(o.pathname, i),
       t
     ), t ? !1 : this.loginProtectedPageEndpoints.reduce(
-      (s, a) => s || P(o.pathname, a),
+      (s, i) => s || I(o.pathname, i),
       !1
     );
   }
@@ -5696,10 +5696,10 @@ class H {
     if (o.pathname == this.loginUrl) return !1;
     let t = !1;
     return t = this.loginProtectedExceptionApiEndpoints.reduce(
-      (s, a) => s || P(o.pathname, a),
+      (s, i) => s || I(o.pathname, i),
       t
     ), t ? !1 : this.loginProtectedApiEndpoints.reduce(
-      (s, a) => s || P(o.pathname, a),
+      (s, i) => s || I(o.pathname, i),
       !1
     );
   }
@@ -5715,7 +5715,7 @@ class H {
   isFactor2PageProtected(r) {
     const o = new URL(typeof r == "string" ? r : r.request.url);
     return this.factor2ProtectedPageEndpoints.reduce(
-      (e, s) => e || P(o.pathname, s),
+      (e, s) => e || I(o.pathname, s),
       !1
     );
   }
@@ -5731,7 +5731,7 @@ class H {
   isFactor2ApiProtected(r) {
     const o = new URL(typeof r == "string" ? r : r.request.url);
     return this.factor2ProtectedApiEndpoints.reduce(
-      (e, s) => e || P(o.pathname, s),
+      (e, s) => e || I(o.pathname, s),
       !1
     );
   }
@@ -5746,8 +5746,15 @@ class H {
    */
   isAdminPageEndpoint(r) {
     const o = new URL(typeof r == "string" ? r : r.request.url);
-    return this.adminPageEndpoints.reduce(
-      (e, s) => e || P(o.pathname, s),
+    let t = !1;
+    return t = this.adminProtectedExceptionPageEndpoints.reduce(
+      (s, i) => s || I(o.pathname, i),
+      t
+    ), t || (t = this.loginProtectedExceptionPageEndpoints.reduce(
+      (s, i) => s || I(o.pathname, i),
+      t
+    ), t) ? !1 : this.adminPageEndpoints.reduce(
+      (s, i) => s || I(o.pathname, i),
       !1
     );
   }
@@ -5762,8 +5769,15 @@ class H {
    */
   isAdminApiEndpoint(r) {
     const o = new URL(typeof r == "string" ? r : r.request.url);
-    return this.adminApiEndpoints.reduce(
-      (e, s) => e || P(o.pathname, s),
+    let t = !1;
+    return t = this.adminProtectedExceptionApiEndpoints.reduce(
+      (s, i) => s || I(o.pathname, i),
+      t
+    ), t || (t = this.loginProtectedExceptionApiEndpoints.reduce(
+      (s, i) => s || I(o.pathname, i),
+      t
+    ), t) ? !1 : this.adminApiEndpoints.reduce(
+      (s, i) => s || I(o.pathname, i),
       !1
     );
   }
@@ -5785,15 +5799,15 @@ class H {
     await t.loadData(r);
     let e = this.addToSession ? this.addToSession(r, t.toObject()) : {};
     o && (e.data = JSON.stringify(o));
-    let { sessionCookie: s, csrfCookie: a, csrfFormOrHeaderValue: i } = await this.sessionManager.createAnonymousSession(e);
+    let { sessionCookie: s, csrfCookie: i, csrfFormOrHeaderValue: a } = await this.sessionManager.createAnonymousSession(e);
     r.cookies.set(
       s.name,
       s.value,
-      R(s.options)
-    ), this.enableCsrfProtection && (r.locals.csrfToken = i, r.cookies.set(
-      a.name,
-      a.value,
-      R(a.options)
+      P(s.options)
+    ), this.enableCsrfProtection && (r.locals.csrfToken = a, r.cookies.set(
+      i.name,
+      i.value,
+      P(i.options)
     )), r.locals.user = void 0;
     const n = this.sessionManager.getSessionId(s.value);
     return r.locals.sessionId = n, s.value;
@@ -5896,7 +5910,7 @@ export {
   p as SvelteKitServer,
   Re as SvelteKitSessionAdapter,
   H as SvelteKitSessionServer,
-  $ as SvelteKitSharedClientEndpoints,
+  X as SvelteKitSharedClientEndpoints,
   Ce as SvelteKitUserClientEndpoints,
   we as SvelteKitUserEndpoints,
   Se as defaultClientSearchFn