@crossauth/sveltekit 0.0.28 → 0.0.30

package/dist/index.js

@@ -1,6 +1,6 @@
 import { minimatch as I } from "minimatch";
 import { ApiKeyManager as K, KeyStorage as $, toCookieSerializeOptions as P, Crypto as F, OAuthAuthorizationServer as Z, setParameter as y, ParamType as E, DoubleSubmitCsrfToken as ee, OAuthClientManager as B, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
-import { CrossauthError as c, ErrorCode as h, CrossauthLogger as d, j as u, OAuthFlows as _, UserState as N, httpStatus as q } from "@crossauth/common";
+import { CrossauthError as c, ErrorCode as h, CrossauthLogger as d, j as f, OAuthFlows as _, UserState as N, httpStatus as q } from "@crossauth/common";
 import { json as v, redirect as Q, error as Y } from "@sveltejs/kit";
 import "cookie";
 import { jwtDecode as M } from "jwt-decode";
@@ -26,11 +26,11 @@ class b {
     this.clone = r;
   }
   async loadData(r) {
-    var t, e, s, i;
+    var t, e, s, a;
     if (!((t = r.request) != null && t.body))
       return;
     const o = r.request.headers.get("content-type");
-    o == "application/json" ? this.jsonData = this.clone ? await ((s = (e = r.request) == null ? void 0 : e.clone()) == null ? void 0 : s.json()) : await ((i = r.request) == null ? void 0 : i.json()) : (o == "application/x-www-form-urlencoded" || o != null && o.startsWith("multipart/form-data")) && (this.formData = this.clone ? await r.request.clone().formData() : await r.request.formData());
+    o == "application/json" ? this.jsonData = this.clone ? await ((s = (e = r.request) == null ? void 0 : e.clone()) == null ? void 0 : s.json()) : await ((a = r.request) == null ? void 0 : a.json()) : (o == "application/x-www-form-urlencoded" || o != null && o.startsWith("multipart/form-data")) && (this.formData = this.clone ? await r.request.clone().formData() : await r.request.formData());
   }
   get(r) {
     if (this.jsonData) return this.jsonData[r];
@@ -89,32 +89,32 @@ class ne {
       const s = e.request.headers.get("authorization");
       if (s)
         try {
-          d.logger.debug(u({
+          d.logger.debug(f({
             msg: "Received authorization header"
           }));
-          const i = await this.apiKeyManager.validateToken(
+          const a = await this.apiKeyManager.validateToken(
             s
           );
-          d.logger.debug(u({
+          d.logger.debug(f({
             msg: "Valid API key",
-            hahedApiKey: K.hashSignedApiKeyValue(i.value)
+            hahedApiKey: K.hashSignedApiKeyValue(a.value)
           }));
-          const a = $.decodeData(i.data);
-          if (e.locals.apiKey = { ...i, ...a }, "scope" in a && Array.isArray(a.scope)) {
+          const i = $.decodeData(a.data);
+          if (e.locals.apiKey = { ...a, ...i }, "scope" in i && Array.isArray(i.scope)) {
             let n = [];
-            for (let l of a.scope)
+            for (let l of i.scope)
               typeof l == "string" && n.push(l);
             e.locals.scope = n;
           }
-          if (i.userid)
+          if (a.userid)
             try {
-              const { user: n } = await this.userStorage.getUserById(i.userid);
-              e.locals.user = n, e.locals.authType = "apiKey", d.logger.debug(u({ msg: "API key is for user", userid: n.id, user: n.username, hahedApiKey: K.hashSignedApiKeyValue(i.value) }));
+              const { user: n } = await this.userStorage.getUserById(a.userid);
+              e.locals.user = n, e.locals.authType = "apiKey", d.logger.debug(f({ msg: "API key is for user", userid: n.id, user: n.username, hahedApiKey: K.hashSignedApiKeyValue(a.value) }));
             } catch (n) {
-              d.logger.error(u({ msg: "API key has invalid user", userid: i.userid, hashedApiKey: K.hashSignedApiKeyValue(i.value) })), d.logger.debug(u({ err: n }));
+              d.logger.error(f({ msg: "API key has invalid user", userid: a.userid, hashedApiKey: K.hashSignedApiKeyValue(a.value) })), d.logger.debug(f({ err: n }));
             }
-        } catch (i) {
-          d.logger.error(u({ msg: "Invalid authorization header received", header: s })), d.logger.debug(u({ err: i }));
+        } catch (a) {
+          d.logger.error(f({ msg: "Invalid authorization header received", header: s })), d.logger.debug(f({ err: a }));
         }
     };
   }
@@ -130,9 +130,9 @@ class ce {
    * @param options see {@link SvelteKitAuthorizationServerOptions}
    */
   constructor(r, o, t, e, s = {}) {
-    var i;
+    var a;
     this.loginUrl = "/login", this.refreshTokenType = "json", this.refreshTokenCookieName = "CROSSAUTH_REFRESH_TOKEN", this.refreshTokenCookieDomain = void 0, this.refreshTokenCookieHttpOnly = !1, this.refreshTokenCookiePath = "/", this.refreshTokenCookieSecure = !0, this.refreshTokenCookieSameSite = "strict", this.authorizeEndpointUrl = "/oauth/authorize", this.tokenEndpointUrl = "/oauth/token", this.jwksEndpointUrl = "/oauth/jwks", this.oidcConfigurationEndpoint = {
-      get: async (a) => v(this.authServer.oidcConfiguration(
+      get: async (i) => v(this.authServer.oidcConfiguration(
         {
           authorizeEndpoint: this.authorizeEndpointUrl,
           tokenEndpoint: this.tokenEndpointUrl,
@@ -141,7 +141,7 @@ class ce {
         }
       ))
     }, this.jwksGetEndpoint = {
-      get: async (a) => {
+      get: async (i) => {
         try {
           return v(this.authServer.jwks());
         } catch (n) {
@@ -153,7 +153,7 @@ class ce {
         }
       }
     }, this.getCsrfTokenEndpoint = {
-      get: async (a) => {
+      get: async (i) => {
         var l;
         if (!this.csrfTokens) return v({
           ok: !1,
@@ -163,23 +163,23 @@ class ce {
         let n = "";
         try {
           const {
-            csrfCookie: f,
+            csrfCookie: u,
             csrfFormOrHeaderValue: g
           } = await this.createCsrfToken();
-          return n = f.value, a.cookies.set(
-            f.name,
-            f.value,
-            P(f.options)
+          return n = u.value, i.cookies.set(
+            u.name,
+            u.value,
+            P(u.options)
           ), v({ ok: !0, csrfToken: g });
-        } catch (f) {
-          const g = c.asCrossauthError(f);
-          return d.logger.error(u({
+        } catch (u) {
+          const g = c.asCrossauthError(u);
+          return d.logger.error(f({
             msg: "getcsrftoken failure",
-            user: (l = a.locals.user) == null ? void 0 : l.username,
+            user: (l = i.locals.user) == null ? void 0 : l.username,
             hashedCsrfCookie: F.hash(n.split(".")[0]),
             error: g.code,
             errorCodeName: g.codeName
-          })), d.logger.debug(u({ err: f })), d.logger.error({ cerr: f }), v({
+          })), d.logger.debug(f({ err: u })), d.logger.error({ cerr: u }), v({
             ok: !1,
             error: g.oauthErrorCode,
             error_description: g.message
@@ -187,26 +187,26 @@ class ce {
         }
       }
     }, this.authorizeEndpoint = {
-      load: async (a) => {
+      load: async (i) => {
         var m, S;
         if (!(this.authServer.validFlows.includes(_.AuthorizationCode) || this.authServer.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(_.OidcAuthorizationCode)))
           throw this.error(401, "authorize cannot be called because the authorization code flows are not supported");
-        if (!a.locals.user) return this.redirect(
+        if (!i.locals.user) return this.redirect(
           302,
-          this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
+          this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
         );
-        let n = this.getAuthorizeQuery(a);
+        let n = this.getAuthorizeQuery(i);
         if (!n.query) return n.error;
         let l = n.query;
-        d.logger.debug(u({ msg: "validating authorize parameters" }));
-        let { error_description: f } = this.authServer.validateAuthorizeParameters(l), g;
-        if (f ? (g = new c(h.BadRequest, f), d.logger.error(u({
+        d.logger.debug(f({ msg: "validating authorize parameters" }));
+        let { error_description: u } = this.authServer.validateAuthorizeParameters(l), g;
+        if (u ? (g = new c(h.BadRequest, u), d.logger.error(f({
           msg: "authorize parameter invalid",
           cerr: g,
-          user: (m = a.locals.user) == null ? void 0 : m.username
-        }))) : d.logger.error(u({
+          user: (m = i.locals.user) == null ? void 0 : m.username
+        }))) : d.logger.error(f({
           msg: "authorize parameter valid",
-          user: (S = a.locals.user) == null ? void 0 : S.username
+          user: (S = i.locals.user) == null ? void 0 : S.username
         })), g)
           return {
             ok: !1,
@@ -214,23 +214,23 @@ class ce {
             error_description: g.message
           };
         let w = !1;
-        if (d.logger.debug(u({
+        if (d.logger.debug(f({
           msg: "Checking scopes have been authorized",
           scope: l.scope
         })), l.scope ? w = await this.authServer.hasAllScopes(
           l.client_id,
-          a.locals.user,
+          i.locals.user,
           l.scope.split(" ")
         ) : w = await this.authServer.hasAllScopes(
           l.client_id,
-          a.locals.user,
+          i.locals.user,
           [null]
         ), w) {
-          d.logger.debug(u({
+          d.logger.debug(f({
             msg: "All scopes authorized",
             scope: l.scope
           }));
-          const C = await this.authorize(a, !0, {
+          const C = await this.authorize(i, !0, {
             responseType: l.response_type,
             client_id: l.client_id,
             redirect_uri: l.redirect_uri,
@@ -245,7 +245,7 @@ class ce {
             error_description: C.error_description ?? "An unexpected error occurred"
           };
         } else {
-          d.logger.debug(u({
+          d.logger.debug(f({
             msg: "Not all scopes authorized",
             scope: l.scope
           }));
@@ -254,7 +254,7 @@ class ce {
             return {
               ok: !0,
               authorizationNeeded: {
-                user: a.locals.user,
+                user: i.locals.user,
                 response_type: l.response_type,
                 client_id: l.client_id,
                 client_name: C.client_name,
@@ -264,13 +264,13 @@ class ce {
                 state: l.state,
                 code_challenge: l.code_challenge,
                 code_challenge_method: l.code_challenge_method,
-                csrfToken: a.locals.csrfToken
+                csrfToken: i.locals.csrfToken
               },
               ...this.baseEndpoint
             };
           } catch (C) {
             const T = C;
-            return d.logger.debug(u({ err: T })), {
+            return d.logger.debug(f({ err: T })), {
               ok: !1,
               error: "unauthorized_client",
               error_description: "Not a valid client"
@@ -280,12 +280,12 @@ class ce {
       },
       // load
       actions: {
-        default: async (a) => {
-          var f;
+        default: async (i) => {
+          var u;
           let n;
           try {
             var l = new b();
-            await l.loadData(a), n = l.toObject();
+            await l.loadData(i), n = l.toObject();
             const g = l.getAsBoolean("authorized"), w = n.response_type, m = n.client_id, S = n.redirect_uri, C = n.scope, T = n.state, R = n.code_challenge, A = n.code_challenge_method;
             let U;
             if (g == null && (U = "authorized"), w ? m ? S ? T || (U = "state") : U = "redirect_uri" : U = "client_id" : U = "response_type", U)
@@ -294,12 +294,12 @@ class ce {
                 error: "invalid_request",
                 error_description: "Invalid form: does not contain " + U + " parameter"
               };
-            if (!a.locals.user) return this.redirect(
+            if (!i.locals.user) return this.redirect(
               302,
-              this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
+              this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
             );
-            if ((f = this.svelteKitServer.sessionServer) != null && f.enableCsrfProtection && !a.locals.csrfToken) throw new c(h.InvalidCsrf);
-            const z = await this.authorize(a, g ?? !1, {
+            if ((u = this.svelteKitServer.sessionServer) != null && u.enableCsrfProtection && !i.locals.csrfToken) throw new c(h.InvalidCsrf);
+            const z = await this.authorize(i, g ?? !1, {
               responseType: w,
               client_id: m,
               redirect_uri: S,
@@ -326,7 +326,7 @@ class ce {
         }
       }
     }, this.tokenEndpoint = {
-      post: async (a) => {
+      post: async (i) => {
         let n;
         try {
           if (!(this.authServer.validFlows.includes(_.AuthorizationCode) || this.authServer.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(_.OidcAuthorizationCode) || this.authServer.validFlows.includes(_.ClientCredentials) || this.authServer.validFlows.includes(_.RefreshToken) || this.authServer.validFlows.includes(_.Password) || this.authServer.validFlows.includes(_.PasswordMfa || this.authServer.validFlows.includes(_.DeviceCode))))
@@ -336,12 +336,12 @@ class ce {
               error_description: "Token endpoint cannot be called as the supported OAuth flow types don't require it"
             }, { status: 500 });
           var l = new b();
-          await l.loadData(a), n = l.toObject();
-          const { client_id: f, client_secret: g } = this.getClientIdAndSecret(n, a);
-          let w = n.refresh_token, m = a.cookies.get(this.refreshTokenCookieName);
+          await l.loadData(i), n = l.toObject();
+          const { client_id: u, client_secret: g } = this.getClientIdAndSecret(n, i);
+          let w = n.refresh_token, m = i.cookies.get(this.refreshTokenCookieName);
           if ((this.refreshTokenType == "cookie" && m || this.refreshTokenType == "both" && m && w == null) && this.csrfTokens) {
-            const C = a.cookies.get(this.csrfTokens.cookieName);
-            let T = a.request.headers.get(this.csrfTokens.headerName.toLowerCase());
+            const C = i.cookies.get(this.csrfTokens.cookieName);
+            let T = i.request.headers.get(this.csrfTokens.headerName.toLowerCase());
             if (Array.isArray(T) && (T = T[0]), !C || !T)
               return v({
                 ok: !1,
@@ -351,7 +351,7 @@ class ce {
             try {
               this.csrfTokens.validateDoubleSubmitCsrfToken(C, T);
             } catch (R) {
-              return d.logger.debug(u({ err: R })), d.logger.warn(u({ cerr: R, msg: "Invalid csrf token", client_id: n.client_id })), v({
+              return d.logger.debug(f({ err: R })), d.logger.warn(f({ cerr: R, msg: "Invalid csrf token", client_id: n.client_id })), v({
                 ok: !1,
                 error: "access_denied",
                 error_description: "Invalid csrf token"
@@ -361,7 +361,7 @@ class ce {
           }
           const S = await this.authServer.tokenEndpoint({
             grantType: n.grant_type,
-            client_id: f,
+            client_id: u,
             client_secret: g,
             scope: n.scope,
             codeVerifier: n.code_verifier,
@@ -375,68 +375,68 @@ class ce {
             refreshToken: w,
             deviceCode: n.device_code
           });
-          if (S.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(a, S.refresh_token, S.expires_in), S.error == "authorization_pending")
+          if (S.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(i, S.refresh_token, S.expires_in), S.error == "authorization_pending")
             return v(S);
           if (S.error || !S.access_token) {
             let C = "server_error", T = "Neither code nor error received when requestoing authorization";
             S.error && (C = S.error), S.error_description && (T = S.error_description);
             const R = c.fromOAuthError(C, T);
-            return d.logger.error(u({ cerr: R })), v(S, { status: R.httpStatus });
+            return d.logger.error(f({ cerr: R })), v(S, { status: R.httpStatus });
           }
           return v(S);
-        } catch (f) {
-          const g = c.asCrossauthError(f);
-          return d.logger.debug({ err: f }), d.logger.error({ cerr: f }), v({
+        } catch (u) {
+          const g = c.asCrossauthError(u);
+          return d.logger.debug({ err: u }), d.logger.error({ cerr: u }), v({
             error: g.oauthErrorCode,
             error_description: g.message
           }, { status: g.httpStatus });
         }
       }
     }, this.mfaAuthenticatorsEndpoint = {
-      get: async (a) => {
+      get: async (i) => {
         try {
           var n = new b();
-          return await n.loadData(a), v(await this.mfaAuthenticators(a));
+          return await n.loadData(i), v(await this.mfaAuthenticators(i));
         } catch (l) {
-          const f = c.asCrossauthError(l);
+          const u = c.asCrossauthError(l);
           return d.logger.debug({ err: l }), d.logger.error({ cerr: l }), v({
-            error: f.oauthErrorCode,
-            error_description: f.message
+            error: u.oauthErrorCode,
+            error_description: u.message
           });
         }
       },
-      post: async (a) => {
+      post: async (i) => {
         try {
           var n = new b();
-          await n.loadData(a);
-          let l = await this.mfaAuthenticators(a), f = 200;
-          return !Array.isArray(l) && l.error == "access_denied" ? f = 401 : !Array.isArray(l) && l.error && (f = 500), v(l, { status: f });
+          await n.loadData(i);
+          let l = await this.mfaAuthenticators(i), u = 200;
+          return !Array.isArray(l) && l.error == "access_denied" ? u = 401 : !Array.isArray(l) && l.error && (u = 500), v(l, { status: u });
         } catch (l) {
-          const f = c.asCrossauthError(l);
+          const u = c.asCrossauthError(l);
           return d.logger.debug({ err: l }), d.logger.error({ cerr: l }), v({
-            error: f.oauthErrorCode,
-            error_description: f.message
-          }, { status: f.httpStatus });
+            error: u.oauthErrorCode,
+            error_description: u.message
+          }, { status: u.httpStatus });
         }
       }
     }, this.mfaChallengeEndpoint = {
-      post: async (a) => {
+      post: async (i) => {
         try {
           var n = new b();
-          await n.loadData(a);
-          const l = await this.mfaChallenge(a);
-          let f = 200;
-          return l.error == "access_denied" ? f = 401 : l.error && (f = 500), v(l, { status: f });
+          await n.loadData(i);
+          const l = await this.mfaChallenge(i);
+          let u = 200;
+          return l.error == "access_denied" ? u = 401 : l.error && (u = 500), v(l, { status: u });
         } catch (l) {
-          const f = c.asCrossauthError(l);
+          const u = c.asCrossauthError(l);
           return d.logger.debug({ err: l }), d.logger.error({ cerr: l }), v({
-            error: f.oauthErrorCode,
-            error_description: f.message
+            error: u.oauthErrorCode,
+            error_description: u.message
           }, { status: 500 });
         }
       }
     }, this.deviceAuthorizationEndpoint = {
-      post: async (a) => {
+      post: async (i) => {
         let n;
         try {
           if (!this.authServer.validFlows.includes(_.DeviceCode))
@@ -446,59 +446,59 @@ class ce {
               error_description: "Device authorization endpoint cannot be called as the supported OAuth flow types don't require it"
             });
           var l = new b();
-          await l.loadData(a), n = l.toObject();
-          const { client_id: f, client_secret: g } = this.getClientIdAndSecret(n, a), w = await this.authServer.deviceAuthorizationEndpoint({
-            client_id: f,
+          await l.loadData(i), n = l.toObject();
+          const { client_id: u, client_secret: g } = this.getClientIdAndSecret(n, i), w = await this.authServer.deviceAuthorizationEndpoint({
+            client_id: u,
             client_secret: g,
             scope: n.scope
           });
           if (w.error) {
             const m = c.fromOAuthError(w.error, w.error_description);
-            return d.logger.error(u({ cerr: m })), v(w, { status: 500 });
+            return d.logger.error(f({ cerr: m })), v(w, { status: 500 });
           }
           if (!w.device_code || !w.user_code || !w.verification_uri || !w.verification_uri_complete || !w.expires_in) {
             let m = "server_error", S = "Device authorization result has missing data";
             const C = new c(h.UnknownError, S);
-            return d.logger.error(u({ cerr: C })), v({
+            return d.logger.error(f({ cerr: C })), v({
               error: m,
               error_description: S
             }, { status: 500 });
           }
           return v(w);
-        } catch (f) {
-          const g = c.asCrossauthError(f);
-          return d.logger.debug({ err: f }), d.logger.error({ cerr: f }), v({
+        } catch (u) {
+          const g = c.asCrossauthError(u);
+          return d.logger.debug({ err: u }), d.logger.error({ cerr: u }), v({
             error: g.oauthErrorCode,
             error_description: g.message
           }, { status: 500 });
         }
       }
     }, this.deviceEndpoint = {
-      load: async (a) => {
+      load: async (i) => {
         if (!this.authServer.validFlows.includes(_.DeviceCode))
           throw this.error(401, "device cannot be called because the device code flow is not supported");
-        if (!a.locals.user) return this.redirect(
+        if (!i.locals.user) return this.redirect(
           302,
-          this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
+          this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
         );
-        let n = a.url.searchParams.get("user_code");
-        return n ? await this.applyUserCode(n, a, a.locals.user) : {
+        let n = i.url.searchParams.get("user_code");
+        return n ? await this.applyUserCode(n, i, i.locals.user) : {
           ok: !0,
           completed: !1,
           retryAllowed: !0,
-          user: a.locals.user,
-          csrfToken: a.locals.csrfToken
+          user: i.locals.user,
+          csrfToken: i.locals.csrfToken
         };
       },
       // load
       actions: {
-        userCode: async (a) => {
-          if (!a.locals.user) throw this.error(401, "Access Denied");
+        userCode: async (i) => {
+          if (!i.locals.user) throw this.error(401, "Access Denied");
           try {
             var n = new b();
-            await n.loadData(a);
+            await n.loadData(i);
             const l = n.get("user_code");
-            return l ? await this.applyUserCode(l, a, a.locals.user) : {
+            return l ? await this.applyUserCode(l, i, i.locals.user) : {
               ok: !1,
               completed: !1,
               retryAllowed: !0,
@@ -507,22 +507,22 @@ class ce {
             };
           } catch (l) {
             if (p.isSvelteKitError(l) || p.isSvelteKitRedirect(l)) throw l;
-            let f = c.asCrossauthError(l, "Couldn't validate user code");
+            let u = c.asCrossauthError(l, "Couldn't validate user code");
             return {
               ok: !1,
               completed: !1,
               retryAllowed: !0,
-              error: f.oauthErrorCode,
-              error_description: f.message
+              error: u.oauthErrorCode,
+              error_description: u.message
             };
           }
         },
-        authorize: async (a) => {
-          var f;
+        authorize: async (i) => {
+          var u;
           let n;
           try {
             var l = new b();
-            await l.loadData(a), n = l.toObject();
+            await l.loadData(i), n = l.toObject();
             const g = l.getAsBoolean("authorized"), w = n.scope, m = n.client_id, S = n.user_code;
             let C;
             if (g == null && (C = "authorized"), m == null && (C = "client_id"), S == null && (C = "user_code"), C)
@@ -533,18 +533,18 @@ class ce {
                 error: "invalid_request",
                 error_description: "Invalid form: does not contain " + C + " parameter"
               };
-            if (!a.locals.user) return this.redirect(
+            if (!i.locals.user) return this.redirect(
               302,
-              this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
+              this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
             );
-            if ((f = this.svelteKitServer.sessionServer) != null && f.enableCsrfProtection && !a.locals.csrfToken) throw new c(h.InvalidCsrf);
-            return (await this.authServer.validateAndPersistScope(m, w, a.locals.user)).error ? {
+            if ((u = this.svelteKitServer.sessionServer) != null && u.enableCsrfProtection && !i.locals.csrfToken) throw new c(h.InvalidCsrf);
+            return (await this.authServer.validateAndPersistScope(m, w, i.locals.user)).error ? {
               ok: !1,
               completed: !1,
               retryAllowed: !1,
               error: "unauthorized_client",
               error_description: "You did not authorize access to your account"
-            } : await this.applyUserCode(S, a, a.locals.user);
+            } : await this.applyUserCode(S, i, i.locals.user);
           } catch (g) {
             if (p.isSvelteKitError(g) || p.isSvelteKitRedirect(g)) throw g;
             let w = c.asCrossauthError(g, "Couldn't process authorization code");
@@ -563,7 +563,7 @@ class ce {
       t,
       e,
       s
-    ), y("loginUrl", E.String, this, s, "LOGIN_URL"), y("refreshTokenType", E.String, this, s, "OAUTH_REFRESH_TOKEN_TYPE"), y("refreshTokenCookieName", E.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), y("refreshTokenCookieDomain", E.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), y("refreshTokenCookieHttpOnly", E.Boolean, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), y("refreshTokenCookiePath", E.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), y("refreshTokenCookieSecure", E.Boolean, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), y("refreshTokenCookieSameSite", E.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), y("authorizeEndpointUrl", E.String, this, s, "OAUTH_AUTHORIZE_ENDPOINT"), y("tokenEndpointUrl", E.String, this, s, "OAUTH_TOKEN_ENDPOINT"), y("jwksEndpointUrl", E.String, this, s, "OAUTH_JWKS_ENDPOINT"), this.refreshTokenType != "json" && (((i = this.svelteKitServer.sessionServer) == null ? void 0 : i.enableCsrfProtection) == !0 ? this.csrfTokens = this.svelteKitServer.sessionServer.sessionManager.csrfTokens : this.csrfTokens = new ee(s.doubleSubmitCookieOptions));
+    ), y("loginUrl", E.String, this, s, "LOGIN_URL"), y("refreshTokenType", E.String, this, s, "OAUTH_REFRESH_TOKEN_TYPE"), y("refreshTokenCookieName", E.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), y("refreshTokenCookieDomain", E.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), y("refreshTokenCookieHttpOnly", E.Boolean, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), y("refreshTokenCookiePath", E.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), y("refreshTokenCookieSecure", E.Boolean, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), y("refreshTokenCookieSameSite", E.String, this, s, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), y("authorizeEndpointUrl", E.String, this, s, "OAUTH_AUTHORIZE_ENDPOINT"), y("tokenEndpointUrl", E.String, this, s, "OAUTH_TOKEN_ENDPOINT"), y("jwksEndpointUrl", E.String, this, s, "OAUTH_JWKS_ENDPOINT"), this.refreshTokenType != "json" && (((a = this.svelteKitServer.sessionServer) == null ? void 0 : a.enableCsrfProtection) == !0 ? this.csrfTokens = this.svelteKitServer.sessionServer.sessionManager.csrfTokens : this.csrfTokens = new ee(s.doubleSubmitCookieOptions));
   }
   /**
    * Returns this server's OIDC configuration.  Just wraps
@@ -585,45 +585,45 @@ class ce {
     responseType: t,
     client_id: e,
     redirect_uri: s,
-    scope: i,
-    state: a,
+    scope: a,
+    state: i,
     codeChallenge: n,
     codeChallengeMethod: l
   }) {
-    let f, g, w;
+    let u, g, w;
     if (o) {
       const m = await this.authServer.authorizeGetEndpoint({
         responseType: t,
         client_id: e,
         redirect_uri: s,
-        scope: i,
-        state: a,
+        scope: a,
+        state: i,
         codeChallenge: n,
         codeChallengeMethod: l,
         user: r.locals.user
       });
-      if (w = m.code, f = m.error, g = m.error_description, f || !w) {
+      if (w = m.code, u = m.error, g = m.error_description, u || !w) {
         const S = c.fromOAuthError(
-          f ?? "server_error",
+          u ?? "server_error",
           g ?? "Neither code nor error received"
         );
-        return d.logger.error(u({ cerr: S })), {
+        return d.logger.error(f({ cerr: S })), {
           ok: !1,
-          error: f,
+          error: u,
           error_description: g
         };
       }
       throw this.redirect(302, this.authServer.redirect_uri(
         s,
         w,
-        a
+        i
       ));
     } else {
       const m = new c(
         h.Unauthorized,
         "You have not granted access"
       );
-      d.logger.debug(u({ err: m })), d.logger.error(u({ cerr: m })), d.logger.error(u({
+      d.logger.debug(f({ err: m })), d.logger.error(f({ cerr: m })), d.logger.error(f({
         msg: g,
         errorCode: m.code,
         errorCodeName: m.codeName
@@ -632,7 +632,7 @@ class ce {
         throw B.validateUri(s), this.redirect(302, s + "?error=access_denied&error_description=" + encodeURIComponent("Access was not granted"));
       } catch (S) {
         if (p.isSvelteKitError(S) || p.isSvelteKitRedirect(S)) throw S;
-        return d.logger.error(u({
+        return d.logger.error(f({
           msg: `Couldn't send error message ${m.codeName} to ${s}}`
         })), {
           ok: !1,
@@ -690,13 +690,13 @@ class ce {
     if (o = this.requireGetParam(r, "client_id"), o) return { error: o };
     if (o = this.requireGetParam(r, "redirect_uri"), o) return { error: o };
     if (o = this.requireGetParam(r, "state"), o) return { error: o };
-    const t = r.url.searchParams.get("response_type") ?? "", e = r.url.searchParams.get("client_id") ?? "", s = r.url.searchParams.get("redirect_uri") ?? "", i = r.url.searchParams.get("scope") ?? void 0, a = r.url.searchParams.get("state") ?? "", n = r.url.searchParams.get("code_challenge") ?? void 0, l = r.url.searchParams.get("code_challenge_method") ?? void 0;
+    const t = r.url.searchParams.get("response_type") ?? "", e = r.url.searchParams.get("client_id") ?? "", s = r.url.searchParams.get("redirect_uri") ?? "", a = r.url.searchParams.get("scope") ?? void 0, i = r.url.searchParams.get("state") ?? "", n = r.url.searchParams.get("code_challenge") ?? void 0, l = r.url.searchParams.get("code_challenge_method") ?? void 0;
     return { query: {
       response_type: t,
       client_id: e,
       redirect_uri: s,
-      scope: i,
-      state: a,
+      scope: a,
+      state: i,
       code_challenge: n,
       code_challenge_method: l
     }, error: { error: "Unknown error", error_description: "Unknown error", ok: !0 } };
@@ -710,18 +710,18 @@ class ce {
     if (e = this.requireBodyParam(t, "challenge_type"), e) return { error: e };
     if (e = this.requireBodyParam(t, "mfa_token"), e) return { error: e };
     if (e = this.requireBodyParam(t, "authenticator_id"), e) return { error: e };
-    const s = t.client_id ?? "", i = t.challenge_type ?? "", a = t.mfa_token ?? "", n = t.authenticator_id ?? "", l = t.client_secret ?? void 0;
+    const s = t.client_id ?? "", a = t.challenge_type ?? "", i = t.mfa_token ?? "", n = t.authenticator_id ?? "", l = t.client_secret ?? void 0;
     return { query: {
       client_id: s,
       client_secret: l,
-      challenge_type: i,
-      mfa_token: a,
+      challenge_type: a,
+      mfa_token: i,
       authenticator_id: n
     }, error: { error: "Unknown error", error_description: "Unknown error", ok: !0 } };
   }
   async mfaAuthenticators(r) {
-    var i;
-    const o = (i = r.request.headers.get("authorization")) == null ? void 0 : i.split(" ");
+    var a;
+    const o = (a = r.request.headers.get("authorization")) == null ? void 0 : a.split(" ");
     if (!o || o.length != 2)
       return {
         error: "access_denied",
@@ -752,65 +752,65 @@ class ce {
     let t = r.client_id, e = r.client_secret;
     const s = o.request.headers.get("authorization");
     if (s) {
-      let i, a;
+      let a, i;
       const n = s.split(" ");
       if (n.length == 2 && n[0].toLocaleLowerCase() == "basic") {
-        const f = F.base64Decode(n[1]).split(":", 2);
-        f.length == 2 && (i = f[0], a = f[1]);
+        const u = F.base64Decode(n[1]).split(":", 2);
+        u.length == 2 && (a = u[0], i = u[1]);
       }
-      i == null || a == null ? d.logger.warn(u({
+      a == null || i == null ? d.logger.warn(f({
         msg: "Ignoring malform authenization header " + s
-      })) : (t = i, e = a);
+      })) : (t = a, e = i);
     }
     return { client_id: t, client_secret: e };
   }
   async applyUserCode(r, o, t) {
-    var e, s, i;
+    var e, s, a;
     try {
-      const a = await this.authServer.deviceEndpoint({ userCode: r, user: t });
-      if (a.error)
+      const i = await this.authServer.deviceEndpoint({ userCode: r, user: t });
+      if (i.error)
         return {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
-          error: a.error,
-          error_description: a.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      if (!a.client_id)
-        return d.logger.error(u({ msg: "No client id found for user code", userCodeHash: F.hash(r), ip: o.request.referrer, username: (e = o.locals.user) == null ? void 0 : e.username })), {
+      if (!i.client_id)
+        return d.logger.error(f({ msg: "No client id found for user code", userCodeHash: F.hash(r), ip: o.request.referrer, username: (e = o.locals.user) == null ? void 0 : e.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
           error: "server_error",
           error_description: "No client id found for user code"
         };
-      if (a.error == "access_denied")
-        return d.logger.error(u({ msg: "Incorrect user code given", userCodeHash: F.hash(r), ip: o.request.referrer, username: (s = o.locals.user) == null ? void 0 : s.username })), this.authServer.userCodeThrottle > 0 && await ((f) => new Promise((g) => setTimeout(g, f)))(this.authServer.userCodeThrottle), {
+      if (i.error == "access_denied")
+        return d.logger.error(f({ msg: "Incorrect user code given", userCodeHash: F.hash(r), ip: o.request.referrer, username: (s = o.locals.user) == null ? void 0 : s.username })), this.authServer.userCodeThrottle > 0 && await ((u) => new Promise((g) => setTimeout(g, u)))(this.authServer.userCodeThrottle), {
           ok: !1,
           completed: !1,
           retryAllowed: !0,
-          error: a.error,
-          error_description: a.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      if (a.error == "expired_token")
-        return d.logger.error(u({ msg: "Expired user code", userCodeHash: F.hash(r), ip: o.request.referrer, username: (i = o.locals.user) == null ? void 0 : i.username })), {
+      if (i.error == "expired_token")
+        return d.logger.error(f({ msg: "Expired user code", userCodeHash: F.hash(r), ip: o.request.referrer, username: (a = o.locals.user) == null ? void 0 : a.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
-          error: a.error,
-          error_description: a.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      const n = await this.clientStorage.getClientById(a.client_id);
-      return a.scopeAuthorizationNeeded ? {
+      const n = await this.clientStorage.getClientById(i.client_id);
+      return i.scopeAuthorizationNeeded ? {
         ok: !0,
         completed: !1,
         retryAllowed: !0,
         authorizationNeeded: {
           user: t,
-          client_id: a.client_id,
+          client_id: i.client_id,
           client_name: n.client_name,
-          scope: a.scope,
-          scopes: a.scope ? a.scope.split(" ") : [],
+          scope: i.scope,
+          scopes: i.scope ? i.scope.split(" ") : [],
           csrfToken: o.locals.csrfToken
         },
         user: o.locals.user,
@@ -823,9 +823,9 @@ class ce {
         user: o.locals.user,
         csrfToken: o.locals.csrfToken
       };
-    } catch (a) {
-      const n = c.asCrossauthError(a);
-      return d.logger.debug(u({ err: n })), d.logger.error(u({ msg: n.message, cerr: n })), {
+    } catch (i) {
+      const n = c.asCrossauthError(i);
+      return d.logger.debug(f({ err: n })), d.logger.error(f({ msg: n.message, cerr: n })), {
         ok: !1,
         completed: !1,
         retryAllowed: !0,
@@ -853,7 +853,7 @@ class ce {
   }
 }
 async function W(k, r, o) {
-  return d.logger.debug(u({ err: o })), d.logger.error(u({ cerr: o })), v({
+  return d.logger.debug(f({ err: o })), d.logger.error(f({ cerr: o })), v({
     ok: !1,
     status: o.httpStatus,
     errorMessage: o.message,
@@ -872,7 +872,7 @@ function O(k) {
     try {
       r = JSON.parse(F.base64Decode(k.split(".")[1]));
     } catch {
-      d.logger.error(u({ msg: "Couldn't decode id token" }));
+      d.logger.error(f({ msg: "Couldn't decode id token" }));
     }
   return r;
 }
@@ -885,42 +885,42 @@ function L(k, r) {
   if (k.access_token)
     try {
       if (k.access_token && r.includes("access")) {
-        const s = (o = M(k.access_token)) == null ? void 0 : o.jti, i = s ? F.hash(s) : void 0;
-        d.logger.debug(u({
+        const s = (o = M(k.access_token)) == null ? void 0 : o.jti, a = s ? F.hash(s) : void 0;
+        d.logger.debug(f({
           msg: "Got access token",
-          accessTokenHash: i
+          accessTokenHash: a
         }));
       }
     } catch (s) {
-      d.logger.debug(u({ err: s }));
+      d.logger.debug(f({ err: s }));
     }
   if (k.id_token)
     try {
       if (k.id_token && r.includes("id")) {
-        const s = (t = M(k.id_token)) == null ? void 0 : t.jti, i = s ? F.hash(s) : void 0;
-        d.logger.debug(u({
+        const s = (t = M(k.id_token)) == null ? void 0 : t.jti, a = s ? F.hash(s) : void 0;
+        d.logger.debug(f({
           msg: "Got id token",
-          idTokenHash: i
+          idTokenHash: a
         }));
       }
     } catch (s) {
-      d.logger.debug(u({ err: s }));
+      d.logger.debug(f({ err: s }));
     }
   if (k.refresh_token && r.includes("refresh"))
     try {
       if (k.refresh_token) {
-        const s = (e = M(k.refresh_token)) == null ? void 0 : e.jti, i = s ? F.hash(s) : void 0;
-        d.logger.debug(u({
+        const s = (e = M(k.refresh_token)) == null ? void 0 : e.jti, a = s ? F.hash(s) : void 0;
+        d.logger.debug(f({
           msg: "Got refresh token",
-          refreshTokenHash: i
+          refreshTokenHash: a
         }));
       }
     } catch (s) {
-      d.logger.debug(u({ err: s }));
+      d.logger.debug(f({ err: s }));
     }
 }
 async function j(k, r, o) {
-  var i, a, n, l;
+  var a, i, n, l;
   if (!r.server.sessionAdapter)
     throw new c(
       h.Configuration,
@@ -928,8 +928,8 @@ async function j(k, r, o) {
     );
   let t = k.expires_in;
   if (!t && k.access_token && r.jwtTokens.includes("access")) {
-    const f = M(k.access_token);
-    f.exp && (t = f.exp);
+    const u = M(k.access_token);
+    u.exp && (t = u.exp);
   }
   if (!t)
     throw new c(
@@ -939,16 +939,16 @@ async function j(k, r, o) {
   const e = Date.now() + t * 1e3;
   let s = { ...k, expires_at: e };
   if ("id_token" in k) {
-    let f = O(k.id_token);
-    f && (s.id_token = f);
+    let u = O(k.id_token);
+    u && (s.id_token = u);
   }
   if (r.server.sessionServer) {
-    let f = (i = r.server.sessionServer) == null ? void 0 : i.getSessionCookieValue(o);
-    f ? await ((n = r.server.sessionAdapter) == null ? void 0 : n.updateSessionData(
+    let u = (a = r.server.sessionServer) == null ? void 0 : a.getSessionCookieValue(o);
+    u ? await ((n = r.server.sessionAdapter) == null ? void 0 : n.updateSessionData(
       o,
       r.sessionDataName,
       s
-    )) : f = await ((a = r.server.sessionServer) == null ? void 0 : a.createAnonymousSession(
+    )) : u = await ((i = r.server.sessionServer) == null ? void 0 : i.createAnonymousSession(
       o,
       { [r.sessionDataName]: s }
     ));
@@ -977,8 +977,8 @@ async function de(k, r, o, t, e) {
     if (!t) return r.redirect(302, r.authorizedUrl);
   } catch (s) {
     if (p.isSvelteKitError(s) || p.isSvelteKitRedirect(s)) throw s;
-    const i = c.asCrossauthError(s);
-    return d.logger.debug(u({ err: i })), d.logger.debug(u({ cerr: i, msg: "Error receiving tokens" })), r.errorFn(r.server, o, i);
+    const a = c.asCrossauthError(s);
+    return d.logger.debug(f({ err: a })), d.logger.debug(f({ cerr: a, msg: "Error receiving tokens" })), r.errorFn(r.server, o, a);
   }
 }
 async function he(k, r, o, t, e) {
@@ -999,8 +999,8 @@ async function he(k, r, o, t, e) {
     return v({ ok: !0, ...k });
   } catch (s) {
     if (p.isSvelteKitError(s) || p.isSvelteKitRedirect(s)) throw s;
-    const i = c.asCrossauthError(s);
-    return d.logger.debug(u({ err: i })), d.logger.debug(u({ cerr: i, msg: "Error receiving tokens" })), r.errorFn(r.server, o, i);
+    const a = c.asCrossauthError(s);
+    return d.logger.debug(f({ err: a })), d.logger.debug(f({ cerr: a, msg: "Error receiving tokens" })), r.errorFn(r.server, o, a);
   }
 }
 async function ue(k, r, o, t, e) {
@@ -1020,11 +1020,11 @@ async function ue(k, r, o, t, e) {
     return r.jwtTokens.includes("id") && (s.id_payload = O(k.id_token)), s.id_payload && await e(o, s.id_payload), s;
   } catch (s) {
     if (p.isSvelteKitError(s) || p.isSvelteKitRedirect(s)) throw s;
-    const i = c.asCrossauthError(s);
-    return d.logger.debug(u({ err: i })), d.logger.debug(u({ cerr: i, msg: "Error receiving tokens" })), {
+    const a = c.asCrossauthError(s);
+    return d.logger.debug(f({ err: a })), d.logger.debug(f({ cerr: a, msg: "Error receiving tokens" })), {
       ok: !1,
-      error: i.oauthErrorCode,
-      error_description: i.message
+      error: a.oauthErrorCode,
+      error_description: a.message
     };
   }
 }
@@ -1045,7 +1045,7 @@ async function fe(k, r, o, t) {
   } catch (e) {
     if (p.isSvelteKitError(e) || p.isSvelteKitRedirect(e)) throw e;
     const s = c.asCrossauthError(e);
-    return d.logger.debug(u({ err: s })), d.logger.debug(u({ cerr: s, msg: "Error receiving tokens" })), {
+    return d.logger.debug(f({ err: s })), d.logger.debug(f({ cerr: s, msg: "Error receiving tokens" })), {
       ok: !1,
       error: s.oauthErrorCode,
       error_description: s.message
@@ -1073,22 +1073,22 @@ class G extends re {
           }
           let s = e.url.searchParams.get("scope") ?? void 0;
           s == "" && (s = void 0);
-          const { url: i, error: a, error_description: n } = await this.startAuthorizationCodeFlow(s);
-          if (a || !i) {
+          const { url: a, error: i, error_description: n } = await this.startAuthorizationCodeFlow(s);
+          if (i || !a) {
             const l = c.fromOAuthError(
-              a ?? "server_error",
+              i ?? "server_error",
               n
             );
             return await this.errorFn(this.server, e, l);
           }
-          throw d.logger.debug(u({
+          throw d.logger.debug(f({
             msg: "Authorization code flow: redirecting",
-            url: i
-          })), this.redirect(302, i);
+            url: a
+          })), this.redirect(302, a);
         } catch (s) {
           if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-          const i = c.asCrossauthError(s);
-          return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), this.errorFn(this.server, e, i);
+          const a = c.asCrossauthError(s);
+          return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), this.errorFn(this.server, e, a);
         }
       },
       load: async (e) => {
@@ -1114,10 +1114,10 @@ class G extends re {
           }
           let s = e.url.searchParams.get("scope") ?? void 0;
           s == "" && (s = void 0);
-          const { url: i, error: a, error_description: n } = await this.startAuthorizationCodeFlow(s);
-          if (a || !i) {
+          const { url: a, error: i, error_description: n } = await this.startAuthorizationCodeFlow(s);
+          if (i || !a) {
             const l = c.fromOAuthError(
-              a ?? "server_error",
+              i ?? "server_error",
               n
             );
             return {
@@ -1126,17 +1126,17 @@ class G extends re {
               error_description: l.message
             };
           }
-          throw d.logger.debug(u({
+          throw d.logger.debug(f({
             msg: "Authorization code flow: redirecting",
-            url: i
-          })), this.redirect(302, i);
+            url: a
+          })), this.redirect(302, a);
         } catch (s) {
           if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-          const i = c.asCrossauthError(s);
+          const a = c.asCrossauthError(s);
           return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), {
             ok: !1,
-            error: i.oauthErrorCode,
-            error_description: i.message
+            error: a.oauthErrorCode,
+            error_description: a.message
           };
         }
       }
@@ -1153,25 +1153,25 @@ class G extends re {
           }
           let s = e.url.searchParams.get("scope") ?? void 0;
           s == "" && (s = void 0);
-          const { url: i, error: a, error_description: n } = await this.startAuthorizationCodeFlow(s, !0);
-          if (a || !i) {
+          const { url: a, error: i, error_description: n } = await this.startAuthorizationCodeFlow(s, !0);
+          if (i || !a) {
             const l = c.fromOAuthError(
-              a ?? "server_error",
+              i ?? "server_error",
               n
             );
             return await this.errorFn(this.server, e, l);
           }
-          throw d.logger.debug(u({
+          throw d.logger.debug(f({
             msg: "Authorization code flow: redirecting",
-            url: i
-          })), this.redirect(302, i);
+            url: a
+          })), this.redirect(302, a);
         } catch (s) {
           if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-          const i = c.asCrossauthError(s);
+          const a = c.asCrossauthError(s);
           return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), v({
-            error: i.oauthErrorCode,
-            error_description: i.message
-          }, { status: i.httpStatus });
+            error: a.oauthErrorCode,
+            error_description: a.message
+          }, { status: a.httpStatus });
         }
       },
       load: async (e) => {
@@ -1197,10 +1197,10 @@ class G extends re {
           }
           let s = e.url.searchParams.get("scope") ?? void 0;
           s == "" && (s = void 0);
-          const { url: i, error: a, error_description: n } = await this.startAuthorizationCodeFlow(s, !0);
-          if (a || !i) {
+          const { url: a, error: i, error_description: n } = await this.startAuthorizationCodeFlow(s, !0);
+          if (i || !a) {
             const l = c.fromOAuthError(
-              a ?? "server_error",
+              i ?? "server_error",
               n
             );
             return {
@@ -1209,17 +1209,17 @@ class G extends re {
               error_description: l.message
             };
           }
-          throw d.logger.debug(u({
+          throw d.logger.debug(f({
             msg: "Authorization code flow: redirecting",
-            url: i
-          })), this.redirect(302, i);
+            url: a
+          })), this.redirect(302, a);
         } catch (s) {
           if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-          const i = c.asCrossauthError(s);
+          const a = c.asCrossauthError(s);
           return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), {
             ok: !1,
-            error: i.oauthErrorCode,
-            error_description: i.message
+            error: a.oauthErrorCode,
+            error_description: a.message
           };
         }
       }
@@ -1231,25 +1231,25 @@ class G extends re {
         }
         try {
           if (!(this.validFlows.includes(_.AuthorizationCode) || this.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.validFlows.includes(_.OidcAuthorizationCode))) {
-            const f = new c(h.Unauthorized, "Authorization flows are not supported");
-            return this.errorFn(this.server, e, f);
+            const u = new c(h.Unauthorized, "Authorization flows are not supported");
+            return this.errorFn(this.server, e, u);
           }
-          const s = e.url.searchParams.get("code") ?? "", i = e.url.searchParams.get("state") ?? void 0, a = e.url.searchParams.get("error") ?? void 0, n = e.url.searchParams.get("error") ?? void 0, l = this.errorIfIdTokenInvalid(await this.redirectEndpoint(
+          const s = e.url.searchParams.get("code") ?? "", a = e.url.searchParams.get("state") ?? void 0, i = e.url.searchParams.get("error") ?? void 0, n = e.url.searchParams.get("error") ?? void 0, l = this.errorIfIdTokenInvalid(await this.redirectEndpoint(
             s,
-            i,
             a,
+            i,
             n
           ));
           if (l.error) return this.errorFn(this.server, e, c.fromOAuthError(l.error, l.error_description));
           if (l.error) {
-            const f = c.fromOAuthError(
+            const u = c.fromOAuthError(
               l.error,
               l.error_description
             );
             return await this.errorFn(
               this.server,
               e,
-              f
+              u
             );
           }
           return await this.receiveTokenFn(
@@ -1261,8 +1261,8 @@ class G extends re {
           );
         } catch (s) {
           if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-          const i = c.asCrossauthError(s);
-          return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), this.errorFn(this.server, e, i);
+          const a = c.asCrossauthError(s);
+          return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), this.errorFn(this.server, e, a);
         }
       },
       load: async (e) => {
@@ -1286,10 +1286,10 @@ class G extends re {
               error_description: g.message
             };
           }
-          const s = e.url.searchParams.get("code") ?? "", i = e.url.searchParams.get("state") ?? void 0, a = e.url.searchParams.get("error") ?? void 0, n = e.url.searchParams.get("error") ?? void 0, l = this.errorIfIdTokenInvalid(await this.redirectEndpoint(
+          const s = e.url.searchParams.get("code") ?? "", a = e.url.searchParams.get("state") ?? void 0, i = e.url.searchParams.get("error") ?? void 0, n = e.url.searchParams.get("error") ?? void 0, l = this.errorIfIdTokenInvalid(await this.redirectEndpoint(
             s,
-            i,
             a,
+            i,
             n
           ));
           if (l.error) return {
@@ -1308,43 +1308,43 @@ class G extends re {
               error_description: g.message
             };
           }
-          const f = await this.receiveTokenFn(
+          const u = await this.receiveTokenFn(
             l,
             this,
             e,
             !1,
             this.setEventLocalsUser
           );
-          return f instanceof Response ? {
+          return u instanceof Response ? {
             ok: !1,
             error: "server_error",
             error_description: "When using load, receiveTokenFn should return an object not a Response"
-          } : f == null ? {
+          } : u == null ? {
             ok: !1,
             error: "server_error",
             error_description: "No response received from receiveTokenFn"
-          } : f.error ? {
+          } : u.error ? {
             ok: !1,
-            error: f.error,
-            error_description: f.error_description
+            error: u.error,
+            error_description: u.error_description
           } : {
-            ...f
+            ...u
           };
         } catch (s) {
           if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-          const i = c.asCrossauthError(s);
+          const a = c.asCrossauthError(s);
           return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), {
             ok: !1,
-            error: i.oauthErrorCode,
-            error_description: i.message
+            error: a.oauthErrorCode,
+            error_description: a.message
           };
         }
       }
     }, this.clientCredentialsFlowEndpoint = {
       post: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const a = new c(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
-          return this.errorFn(this.server, e, a);
+          const i = new c(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
+          return this.errorFn(this.server, e, i);
         }
         let s;
         try {
@@ -1352,13 +1352,13 @@ class G extends re {
             const l = new c(h.Unauthorized, "Client credentials flow is not supported");
             return this.errorFn(this.server, e, l);
           }
-          var i = new b();
-          await i.loadData(e), s = i.toObject();
-          const a = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(s == null ? void 0 : s.scope));
-          if (a.error) {
+          var a = new b();
+          await a.loadData(e), s = a.toObject();
+          const i = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(s == null ? void 0 : s.scope));
+          if (i.error) {
             const l = c.fromOAuthError(
-              a.error,
-              a.error_description
+              i.error,
+              i.error_description
             );
             return await this.errorFn(
               this.server,
@@ -1367,17 +1367,17 @@ class G extends re {
             );
           }
           const n = await this.receiveTokenFn(
-            a,
+            i,
             this,
             e,
             !1,
             this.setEventLocalsUser
           );
           return n instanceof Response ? n : this.pack(n);
-        } catch (a) {
-          if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
-          const n = c.asCrossauthError(a);
-          return d.logger.debug({ err: a }), d.logger.error({ cerr: a }), this.errorFn(this.server, e, n);
+        } catch (i) {
+          if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
+          const n = c.asCrossauthError(i);
+          return d.logger.debug({ err: i }), d.logger.error({ cerr: i }), this.errorFn(this.server, e, n);
         }
       },
       actions: {
@@ -1391,25 +1391,25 @@ class G extends re {
           try {
             if (!this.validFlows.includes(_.ClientCredentials))
               throw new c(h.Unauthorized, "Client credentials flow is not supported");
-            var i = new b();
-            await i.loadData(e), s = i.toObject();
-            const a = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(s == null ? void 0 : s.scope));
-            if (a.error)
+            var a = new b();
+            await a.loadData(e), s = a.toObject();
+            const i = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(s == null ? void 0 : s.scope));
+            if (i.error)
               throw c.fromOAuthError(
-                a.error,
-                a.error_description
+                i.error,
+                i.error_description
               );
             return await this.receiveTokenFn(
-              a,
+              i,
               this,
               e,
               !1,
               this.setEventLocalsUser
             ) ?? {};
-          } catch (a) {
-            if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
-            const n = c.asCrossauthError(a);
-            return d.logger.debug({ err: a }), d.logger.error({ cerr: a }), {
+          } catch (i) {
+            if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
+            const n = c.asCrossauthError(i);
+            return d.logger.debug({ err: i }), d.logger.error({ cerr: i }), {
               ok: !1,
               error: n.oauthErrorCode,
               error_description: n.message
@@ -1420,45 +1420,45 @@ class G extends re {
     }, this.refreshTokenFlowEndpoint = {
       post: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const a = new c(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
-          return this.errorFn(this.server, e, a);
+          const i = new c(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
+          return this.errorFn(this.server, e, i);
         }
         let s;
         try {
           if (!this.validFlows.includes(_.RefreshToken)) {
-            const f = new c(h.Unauthorized, "Refresh token flow is not supported");
-            return this.errorFn(this.server, e, f);
+            const u = new c(h.Unauthorized, "Refresh token flow is not supported");
+            return this.errorFn(this.server, e, u);
           }
-          var i = new b();
-          if (await i.loadData(e), s = i.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
+          var a = new b();
+          if (await a.loadData(e), s = a.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
             try {
               if (!this.server.sessionAdapter.getCsrfToken(e))
                 throw new c(h.InvalidCsrf);
-            } catch (f) {
-              if (p.isSvelteKitError(f) || p.isSvelteKitRedirect(f)) throw f;
+            } catch (u) {
+              if (p.isSvelteKitError(u) || p.isSvelteKitRedirect(u)) throw u;
               const g = new c(h.Unauthorized, "CSRF token not present");
               return this.errorFn(this.server, e, g);
             }
-          let a = s.refresh_token;
-          if (!a && this.server.sessionAdapter) {
-            const f = await this.server.sessionAdapter.getSessionData(e, this.sessionDataName);
-            if (!(f != null && f.refresh_token)) {
+          let i = s.refresh_token;
+          if (!i && this.server.sessionAdapter) {
+            const u = await this.server.sessionAdapter.getSessionData(e, this.sessionDataName);
+            if (!(u != null && u.refresh_token)) {
               const g = new c(
                 h.BadRequest,
                 "No refresh token in session or in parameters"
               );
               return this.errorFn(this.server, e, g);
             }
-            a = f.refresh_token;
+            i = u.refresh_token;
           }
-          if (!a) {
-            const f = new c(
+          if (!i) {
+            const u = new c(
               h.BadRequest,
               "No refresh token supplied"
             );
-            return this.errorFn(this.server, e, f);
+            return this.errorFn(this.server, e, u);
           }
-          const n = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(a)), l = await this.receiveTokenFn(
+          const n = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(i)), l = await this.receiveTokenFn(
             n,
             this,
             e,
@@ -1467,10 +1467,10 @@ class G extends re {
           );
           if (n && l instanceof Response) return l;
           throw new c(h.UnknownError, "Receive token function did not return a Response");
-        } catch (a) {
-          if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
-          const n = c.asCrossauthError(a);
-          return d.logger.debug({ err: a }), d.logger.error({ cerr: a }), this.errorFn(this.server, e, n);
+        } catch (i) {
+          if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
+          const n = c.asCrossauthError(i);
+          return d.logger.debug({ err: i }), d.logger.error({ cerr: i }), this.errorFn(this.server, e, n);
         }
       },
       actions: {
@@ -1483,33 +1483,33 @@ class G extends re {
           let s;
           try {
             if (!this.validFlows.includes(_.RefreshToken)) {
-              const f = new c(h.Unauthorized, "Refresh token flow is not supported");
-              return this.errorFn(this.server, e, f);
+              const u = new c(h.Unauthorized, "Refresh token flow is not supported");
+              return this.errorFn(this.server, e, u);
             }
-            var i = new b();
-            if (await i.loadData(e), s = i.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
+            var a = new b();
+            if (await a.loadData(e), s = a.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
               try {
                 if (!this.server.sessionAdapter.getCsrfToken(e))
                   throw new c(h.InvalidCsrf);
-              } catch (f) {
-                throw p.isSvelteKitError(f) || p.isSvelteKitRedirect(f) ? f : new c(h.Unauthorized, "CSRF token not present");
+              } catch (u) {
+                throw p.isSvelteKitError(u) || p.isSvelteKitRedirect(u) ? u : new c(h.Unauthorized, "CSRF token not present");
               }
-            let a = s.refresh_token;
-            if (!a && this.server.sessionAdapter) {
-              const f = await this.server.sessionAdapter.getSessionData(e, this.sessionDataName);
-              if (!(f != null && f.refresh_token))
+            let i = s.refresh_token;
+            if (!i && this.server.sessionAdapter) {
+              const u = await this.server.sessionAdapter.getSessionData(e, this.sessionDataName);
+              if (!(u != null && u.refresh_token))
                 throw new c(
                   h.BadRequest,
                   "No refresh token in session or in parameters"
                 );
-              a = f.refresh_token;
+              i = u.refresh_token;
             }
-            if (!a)
+            if (!i)
               throw new c(
                 h.BadRequest,
                 "No refresh token supplied"
               );
-            const n = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(a)), l = await this.receiveTokenFn(
+            const n = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(i)), l = await this.receiveTokenFn(
               n,
               this,
               e,
@@ -1518,10 +1518,10 @@ class G extends re {
             ) ?? {};
             if (l instanceof Response) throw new c(h.Configuration, "Refresh token flow should return an object not Response");
             return l;
-          } catch (a) {
-            if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
-            const n = c.asCrossauthError(a);
-            return d.logger.debug({ err: a }), d.logger.error({ cerr: a }), {
+          } catch (i) {
+            if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
+            const n = c.asCrossauthError(i);
+            return d.logger.debug({ err: i }), d.logger.error({ cerr: i }), {
               ok: !1,
               error: n.oauthErrorCode,
               error_description: n.message
@@ -1570,8 +1570,8 @@ class G extends re {
       post: async (e) => {
         const s = await this.startDeviceCodeFlow_internal(e);
         if (s.error) {
-          const i = c.fromOAuthError(s.error, s.error_description);
-          return v(s, { status: i.httpStatus });
+          const a = c.fromOAuthError(s.error, s.error_description);
+          return v(s, { status: a.httpStatus });
         }
         return v(s);
       }
@@ -1587,40 +1587,40 @@ class G extends re {
         if (s instanceof Response) return s;
         if (s == null) return new Response(null, { status: 204 });
         if (s.error) {
-          const i = c.fromOAuthError(s.error, s.error_description);
-          return v(s, { status: i.httpStatus });
+          const a = c.fromOAuthError(s.error, s.error_description);
+          return v(s, { status: a.httpStatus });
         }
         return v(s);
       }
     }, this.passwordFlowEndpoint = {
-      post: async (e) => await this.passwordFlow_post(e, (s, i) => this.passwordPost(s, i)),
+      post: async (e) => await this.passwordFlow_post(e, (s, a) => this.passwordPost(s, a)),
       actions: {
-        password: async (e) => await this.passwordFlow_action(e, (s, i) => this.passwordPost(s, i)),
-        passwordOtp: async (e) => await this.passwordFlow_action(e, (s, i) => this.passwordOtp(s, i)),
-        passwordOob: async (e) => await this.passwordFlow_action(e, (s, i) => this.passwordOob(s, i))
+        password: async (e) => await this.passwordFlow_action(e, (s, a) => this.passwordPost(s, a)),
+        passwordOtp: async (e) => await this.passwordFlow_action(e, (s, a) => this.passwordOtp(s, a)),
+        passwordOob: async (e) => await this.passwordFlow_action(e, (s, a) => this.passwordOob(s, a))
       }
     }, this.passwordOtpEndpoint = {
-      post: async (e) => await this.passwordFlow_post(e, (s, i) => this.passwordOtp(s, i)),
+      post: async (e) => await this.passwordFlow_post(e, (s, a) => this.passwordOtp(s, a)),
       actions: {
-        default: async (e) => await this.passwordFlow_action(e, (s, i) => this.passwordOtp(s, i))
+        default: async (e) => await this.passwordFlow_action(e, (s, a) => this.passwordOtp(s, a))
       }
     }, this.passwordOobEndpoint = {
-      post: async (e) => await this.passwordFlow_post(e, (s, i) => this.passwordOob(s, i)),
+      post: async (e) => await this.passwordFlow_post(e, (s, a) => this.passwordOob(s, a)),
       actions: {
-        default: async (e) => await this.passwordFlow_action(e, (s, i) => this.passwordOob(s, i))
+        default: async (e) => await this.passwordFlow_action(e, (s, a) => this.passwordOob(s, a))
       }
     }, this.deleteTokensEndpoint = {
       post: async (e) => {
-        var s, i;
+        var s, a;
         try {
           return await this.deleteSessionData(e), v({ ok: !0 });
-        } catch (a) {
-          if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
-          const n = c.asCrossauthError(a);
+        } catch (i) {
+          if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
+          const n = c.asCrossauthError(i);
           return d.logger.debug({ err: n }), d.logger.error({ cerr: n }), v({
             ok: !1,
             user: (s = this.server.sessionAdapter) == null ? void 0 : s.getUser(e),
-            csrfToken: (i = this.server.sessionAdapter) == null ? void 0 : i.getCsrfToken(e),
+            csrfToken: (a = this.server.sessionAdapter) == null ? void 0 : a.getCsrfToken(e),
             errorCode: n.code,
             errorCodeName: n.codeName,
             errorMessage: n.message
@@ -1629,16 +1629,16 @@ class G extends re {
       },
       actions: {
         default: async (e) => {
-          var s, i;
+          var s, a;
           try {
             return await this.deleteSessionData(e), { ok: !0 };
-          } catch (a) {
-            if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
-            const n = c.asCrossauthError(a);
+          } catch (i) {
+            if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
+            const n = c.asCrossauthError(i);
             return d.logger.debug({ err: n }), d.logger.error({ cerr: n }), {
               ok: !1,
               user: (s = this.server.sessionAdapter) == null ? void 0 : s.getUser(e),
-              csrfToken: (i = this.server.sessionAdapter) == null ? void 0 : i.getCsrfToken(e),
+              csrfToken: (a = this.server.sessionAdapter) == null ? void 0 : a.getCsrfToken(e),
               errorCode: n.code,
               errorCodeName: n.codeName,
               errorMessage: n.message
@@ -1753,8 +1753,8 @@ class G extends re {
       if (e.locals.user || !r.sessionAdapter) return;
       let s = await r.sessionAdapter.getSessionData(e, this.sessionDataName);
       if (s && s.id_payload) {
-        let i = s.expires_at;
-        i && i > Date.now() && s.id_payload.sub && await this.setEventLocalsUser(e, s.id_payload);
+        let a = s.expires_at;
+        a && a > Date.now() && s.id_payload.sub && await this.setEventLocalsUser(e, s.id_payload);
       }
       this.testMiddleware && (this.testEvent = e);
     };
@@ -1776,7 +1776,7 @@ class G extends re {
         this.idTokenMatchField
       ), r.locals.user = t, r.locals.authType = t ? "oidc" : void 0;
     } catch (e) {
-      d.logger.error(u({ cerr: e })), r.locals.user = void 0, r.locals.authType = void 0;
+      d.logger.error(f({ cerr: e })), r.locals.user = void 0, r.locals.authType = void 0;
     }
   }
   async passwordPost(r, o) {
@@ -1789,10 +1789,10 @@ class G extends re {
       );
       if (e.error == "mfa_required" && e.mfa_token && this.validFlows.includes(_.PasswordMfa)) {
         const s = e.mfa_token;
-        let i = o.scope;
-        if (i == "" && (i = void 0), e = this.errorIfIdTokenInvalid(await this.passwordMfa(
+        let a = o.scope;
+        if (a == "" && (a = void 0), e = this.errorIfIdTokenInvalid(await this.passwordMfa(
           s,
-          i,
+          a,
           r
         )), e.error)
           throw c.fromOAuthError(
@@ -1809,11 +1809,11 @@ class G extends re {
     } catch (e) {
       if (p.isSvelteKitError(e) || p.isSvelteKitRedirect(e)) throw e;
       const s = c.asCrossauthError(e);
-      return d.logger.error(u({
+      return d.logger.error(f({
         msg: "Error receiving token",
         cerr: s,
         user: (t = this.server.sessionAdapter) == null ? void 0 : t.getUser(r)
-      })), d.logger.debug(u({ err: e })), {
+      })), d.logger.debug(f({ err: e })), {
         error: s.oauthErrorCode,
         error_description: s.message
       };
@@ -1828,11 +1828,11 @@ class G extends re {
       };
     const s = e.authenticators[0];
     if (s.authenticator_type == "otp") {
-      const a = await this.mfaOtpRequest(r, s.id);
-      if (a.error || a.challenge_type != "otp") {
+      const i = await this.mfaOtpRequest(r, s.id);
+      if (i.error || i.challenge_type != "otp") {
         const n = c.fromOAuthError(
-          a.error ?? "server_error",
-          a.error_description ?? "Invalid response from MFA OTP challenge"
+          i.error ?? "server_error",
+          i.error_description ?? "Invalid response from MFA OTP challenge"
         );
         return d.logger.debug({ err: n }), d.logger.error({ cerr: n }), {
           error: n.oauthErrorCode,
@@ -1842,14 +1842,14 @@ class G extends re {
       return {
         scope: o,
         mfa_token: r,
-        challenge_type: a.challenge_type
+        challenge_type: i.challenge_type
       };
     } else if (s.authenticator_type == "oob") {
-      const a = await this.mfaOobRequest(r, s.id);
-      if (a.error || a.challenge_type != "oob" || !a.oob_code || a.binding_method != "prompt") {
+      const i = await this.mfaOobRequest(r, s.id);
+      if (i.error || i.challenge_type != "oob" || !i.oob_code || i.binding_method != "prompt") {
         const n = c.fromOAuthError(
-          a.error ?? "server_error",
-          a.error_description ?? "Invalid response from MFA OOB challenge"
+          i.error ?? "server_error",
+          i.error_description ?? "Invalid response from MFA OOB challenge"
         );
         return d.logger.debug({ err: n }), d.logger.error({ cerr: n }), {
           error: n.oauthErrorCode,
@@ -1860,19 +1860,19 @@ class G extends re {
         scope: o,
         mfa_token: r,
         oob_channel: s.oob_channel,
-        challenge_type: a.challenge_type,
-        binding_method: a.binding_method,
-        oob_code: a.oob_code,
+        challenge_type: i.challenge_type,
+        binding_method: i.binding_method,
+        oob_code: i.oob_code,
         name: s.name
       };
     }
-    const i = new c(
+    const a = new c(
       h.UnknownError,
       "Unsupported MFA type " + s.authenticator_type + " returned"
     );
     return {
-      error: i.oauthErrorCode,
-      error_description: i.message
+      error: a.oauthErrorCode,
+      error_description: a.message
     };
   }
   async passwordOtp(r, o) {
@@ -1905,7 +1905,7 @@ class G extends re {
       o.binding_code,
       t
     ));
-    return e.error ? (d.logger.warn(u({
+    return e.error ? (d.logger.warn(f({
       msg: "Error completing MFA",
       user: (s = this.server.sessionAdapter) == null ? void 0 : s.getUser(r),
       hashedMfaToken: o.mfa_token ? F.hash(o.mfa_token) : void 0
@@ -1927,10 +1927,10 @@ class G extends re {
       if (o.locals.sessionId && this.autoRefreshActive[o.locals.sessionId]) return;
       try {
         o.locals.sessionId && (this.autoRefreshActive[o.locals.sessionId] = !0);
-        const i = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(e));
-        if (!i.error && !i.access_token && (i.error = "server_error", i.error_description = "Unexpectedly did not receive error or access token"), !i.error) {
+        const a = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(e));
+        if (!a.error && !a.access_token && (a.error = "server_error", a.error_description = "Unexpectedly did not receive error or access token"), !a.error) {
           const l = await this.receiveTokenFn(
-            i,
+            a,
             this,
             o,
             r == "silent",
@@ -1940,43 +1940,43 @@ class G extends re {
         }
         if (r != "silent") {
           const l = c.fromOAuthError(
-            i.error ?? "server_error",
-            i.error_description
+            a.error ?? "server_error",
+            a.error_description
           );
           return r == "page" ? this.errorFn(this.server, o, l) : {
             error: l.oauthErrorCode,
             error_description: l.message
           };
         }
-        let a = i.expires_in;
-        if (!a && i.access_token) {
-          const l = M(i.access_token);
-          l.exp && (a = l.exp);
+        let i = a.expires_in;
+        if (!i && a.access_token) {
+          const l = M(a.access_token);
+          l.exp && (i = l.exp);
         }
-        if (!a)
+        if (!i)
           throw new c(
             h.BadRequest,
             "OAuth server did not return an expiry for the access token"
           );
-        const n = (/* @__PURE__ */ new Date()).getTime() + a * 1e3;
+        const n = (/* @__PURE__ */ new Date()).getTime() + i * 1e3;
         return {
-          access_token: i.access_token,
-          refresh_token: i.refresh_token,
-          expires_in: i.expires_in,
+          access_token: a.access_token,
+          refresh_token: a.refresh_token,
+          expires_in: a.expires_in,
           expires_at: n,
-          error: i.error,
-          error_description: i.error_description
+          error: a.error,
+          error_description: a.error_description
         };
-      } catch (i) {
-        if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
-        if (d.logger.debug(u({ err: i })), d.logger.error(u({
-          cerr: i,
+      } catch (a) {
+        if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
+        if (d.logger.debug(f({ err: a })), d.logger.error(f({
+          cerr: a,
           msg: "Failed refreshing access token"
         })), r != "silent") {
-          const a = c.asCrossauthError(i);
-          return r == "page" ? this.errorFn(this.server, o, a) : {
-            error: a.oauthErrorCode,
-            error_description: a.message
+          const i = c.asCrossauthError(a);
+          return r == "page" ? this.errorFn(this.server, o, i) : {
+            error: i.oauthErrorCode,
+            error_description: i.message
           };
         }
         return {
@@ -2053,16 +2053,16 @@ class G extends re {
     let t;
     try {
       if (!(this.validFlows.includes(_.Password) || this.validFlows.includes(_.PasswordMfa))) {
-        const a = new c(h.Unauthorized, "Password flow is not supported");
-        return this.errorFn(this.server, r, a);
+        const i = new c(h.Unauthorized, "Password flow is not supported");
+        return this.errorFn(this.server, r, i);
       }
       var e = new b();
       if (await e.loadData(r), t = e.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
             throw new c(h.InvalidCsrf);
-        } catch (a) {
-          if (p.isSvelteKitError(a) || p.isSvelteKitRedirect(a)) throw a;
+        } catch (i) {
+          if (p.isSvelteKitError(i) || p.isSvelteKitRedirect(i)) throw i;
           const n = new c(h.Unauthorized, "CSRF token not present");
           return this.errorFn(this.server, r, n);
         }
@@ -2072,19 +2072,19 @@ class G extends re {
         ok: !1,
         ...s
       };
-      const i = await this.receiveTokenFn(
+      const a = await this.receiveTokenFn(
         s,
         this,
         r,
         !1,
         this.setEventLocalsUser
       );
-      if (s && i instanceof Response) return i;
+      if (s && a instanceof Response) return a;
       throw new c(h.UnknownError, "Receive token function did not return a Response");
     } catch (s) {
       if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-      const i = c.asCrossauthError(s);
-      return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), this.errorFn(this.server, r, i);
+      const a = c.asCrossauthError(s);
+      return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), this.errorFn(this.server, r, a);
     }
   }
   async passwordFlow_action(r, o) {
@@ -2096,16 +2096,16 @@ class G extends re {
     let t;
     try {
       if (!(this.validFlows.includes(_.Password) || this.validFlows.includes(_.PasswordMfa))) {
-        const a = new c(h.Unauthorized, "Password and Password MFA flows are not supported");
-        return this.errorFn(this.server, r, a);
+        const i = new c(h.Unauthorized, "Password and Password MFA flows are not supported");
+        return this.errorFn(this.server, r, i);
       }
       var e = new b();
       if (await e.loadData(r), t = e.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
             throw new c(h.InvalidCsrf);
-        } catch (a) {
-          throw p.isSvelteKitError(a) || p.isSvelteKitRedirect(a) ? a : new c(h.Unauthorized, "CSRF token not present");
+        } catch (i) {
+          throw p.isSvelteKitError(i) || p.isSvelteKitRedirect(i) ? i : new c(h.Unauthorized, "CSRF token not present");
         }
       const s = await o(r, t);
       if (!s) throw new c(h.UnknownError, "Password flow returned no data");
@@ -2116,27 +2116,27 @@ class G extends re {
         };
       if (s.challenge_type) {
         if (!this.validFlows.includes(_.PasswordMfa)) {
-          const a = new c(h.Unauthorized, "Password MFA flow is not supported");
-          return this.errorFn(this.server, r, a);
+          const i = new c(h.Unauthorized, "Password MFA flow is not supported");
+          return this.errorFn(this.server, r, i);
         }
         return s;
       }
-      const i = await this.receiveTokenFn(
+      const a = await this.receiveTokenFn(
         s,
         this,
         r,
         !1,
         this.setEventLocalsUser
       ) ?? {};
-      if (i instanceof Response) throw new c(h.Configuration, "Refresh token flow should return an object not Response");
-      return i;
+      if (a instanceof Response) throw new c(h.Configuration, "Refresh token flow should return an object not Response");
+      return a;
     } catch (s) {
       if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-      const i = c.asCrossauthError(s);
+      const a = c.asCrossauthError(s);
       return d.logger.debug({ err: s }), d.logger.error({ cerr: s }), {
         ok: !1,
-        error: i.oauthErrorCode,
-        error_description: i.message
+        error: a.oauthErrorCode,
+        error_description: a.message
       };
     }
   }
@@ -2162,30 +2162,30 @@ class G extends re {
       let s = o.url;
       if (!s) {
         if (!r.url.pathname.startsWith(this.bffEndpointName)) throw new c(h.Unauthorized, "Attempt to call BFF url with the wrong prefix");
-        const i = r.url.pathname.substring(this.bffEndpointName.length);
-        let a = ((e = r.url.searchParams) == null ? void 0 : e.toString()) ?? void 0;
-        a && a != "" && (a = "?" + a), s = new URL(this.bffBaseUrl + i + a);
+        const a = r.url.pathname.substring(this.bffEndpointName.length);
+        let i = ((e = r.url.searchParams) == null ? void 0 : e.toString()) ?? void 0;
+        i && i != "" && (i = "?" + i), s = new URL(this.bffBaseUrl + a + i);
       }
       o.headers || (o.headers = new Headers());
-      for (let i = 0; i < this.bffMaxTries; ++i) {
-        i > 0 && await new Promise((g) => setTimeout(g, this.bffSleepMilliseconds));
-        const a = await this.server.sessionAdapter.getSessionData(
+      for (let a = 0; a < this.bffMaxTries; ++a) {
+        a > 0 && await new Promise((g) => setTimeout(g, this.bffSleepMilliseconds));
+        const i = await this.server.sessionAdapter.getSessionData(
           r,
           this.sessionDataName
         );
-        if (!a) {
-          if (i == this.bffMaxTries)
+        if (!i) {
+          if (a == this.bffMaxTries)
             throw new c(h.Unauthorized, "No access token found");
           continue;
         }
-        let n = a.access_token;
-        if (a && a.access_token) {
+        let n = i.access_token;
+        if (i && i.access_token) {
           const g = await this.refresh(
             "silent",
             r,
             !0,
-            a.refresh_token,
-            a.expires_at
+            i.refresh_token,
+            i.expires_at
           );
           if (g instanceof Response) throw new c(h.Configuration, "Expected object when refreshing tokens, not Response");
           if (g != null && g.access_token)
@@ -2194,20 +2194,20 @@ class G extends re {
             continue;
         }
         o.headers.set("accept", "application/json"), o.headers.set("content-type", "application/json"), n && o.headers.set("authorization", "Bearer " + n);
-        let l, f;
+        let l, u;
         if (r.request.body) {
           var t = new b();
-          await t.loadData(r), f = t.toObject();
+          await t.loadData(r), u = t.toObject();
         }
-        if (d.logger.debug(u({ msg: "Calling BFF URL", url: s, method: r.request.method })), f ? l = await fetch(s, {
+        if (d.logger.debug(f({ msg: "Calling BFF URL", url: s, method: r.request.method })), u ? l = await fetch(s, {
           headers: o.headers,
           method: o.method ?? r.request.method,
-          body: JSON.stringify(f ?? "{}")
+          body: JSON.stringify(u ?? "{}")
         }) : l = await fetch(s, {
           headers: o.headers,
           method: o.method ?? r.request.method
         }), l.status == 401) {
-          if (i < this.bffMaxTries - 1)
+          if (a < this.bffMaxTries - 1)
             continue;
           return l;
         } else
@@ -2216,11 +2216,11 @@ class G extends re {
       return new Response(null, { status: 401 });
     } catch (s) {
       if (p.isSvelteKitError(s) || p.isSvelteKitRedirect(s)) throw s;
-      const i = c.asCrossauthError(s);
-      return d.logger.debug({ err: i }), d.logger.error({ cerr: i }), v({
-        error: i.oauthErrorCode,
-        error_description: i.message
-      }, { status: i.httpStatus });
+      const a = c.asCrossauthError(s);
+      return d.logger.debug({ err: a }), d.logger.error({ cerr: a }), v({
+        error: a.oauthErrorCode,
+        error_description: a.message
+      }, { status: a.httpStatus });
     }
   }
   async unpack(r) {
@@ -2249,7 +2249,7 @@ class G extends re {
    */
   async allBff(r, o = {}) {
     try {
-      if (d.logger.debug(u({ msg: "Called allBff", url: r.url.toString() })), !this.server.sessionAdapter) throw new c(h.Configuration, "Session server must be instantiated to use bff()");
+      if (d.logger.debug(f({ msg: "Called allBff", url: r.url.toString() })), !this.server.sessionAdapter) throw new c(h.Configuration, "Session server must be instantiated to use bff()");
       if (!this.server.oAuthClient) throw new c(h.Configuration, "OAuth Client not found");
       if (!this.bffBaseUrl) throw new c(h.Configuration, "Must set bffBaseUrl to use bff()");
       if (!this.bffEndpointName) throw new c(h.Configuration, "Must set bffEndpointName to use bff()");
@@ -2258,16 +2258,16 @@ class G extends re {
       const t = r.url.pathname.substring(this.bffEndpointName.length);
       let e;
       for (let s = 0; s < this.bffEndpoints.length; ++s) {
-        let i = this.bffEndpoints[s];
-        if (i.matchSubUrls) {
-          let a = i.url, n = i.url;
-          if (n.endsWith("/") || (n += "/"), i.methodsString.includes(r.request.method) && (t.startsWith(n) || t == a)) {
+        let a = this.bffEndpoints[s];
+        if (a.matchSubUrls) {
+          let i = a.url, n = a.url;
+          if (n.endsWith("/") || (n += "/"), a.methodsString.includes(r.request.method) && (t.startsWith(n) || t == i)) {
             e = s;
             break;
           }
         } else {
-          let a = i.url;
-          if (i.methodsString.includes(r.request.method) && t == a) {
+          let i = a.url;
+          if (a.methodsString.includes(r.request.method) && t == i) {
             e = s;
             break;
           }
@@ -2297,23 +2297,23 @@ class G extends re {
       if (!this.tokenEndpoints || this.tokenEndpoints.length == 0)
         throw new c(h.Unauthorized, "No tokens have been made available");
       let s = Array.isArray(o) ? o : [o];
-      const i = await this.server.sessionAdapter.getSessionData(
+      const a = await this.server.sessionAdapter.getSessionData(
         r,
         this.sessionDataName
       );
-      if (!i)
+      if (!a)
         throw new c(h.Unauthorized, "No access token found");
-      let a = {}, n, l = !1;
-      for (let f of s) {
-        if (!this.tokenEndpoints.includes(f)) throw new c(h.Unauthorized, "Token type " + f + " may not be returned");
+      let i = {}, n, l = !1;
+      for (let u of s) {
+        if (!this.tokenEndpoints.includes(u)) throw new c(h.Unauthorized, "Token type " + u + " may not be returned");
         l = !1;
-        let g = f;
-        f.startsWith("have_") && (g = f.replace("have_", ""), l = !0);
+        let g = u;
+        u.startsWith("have_") && (g = u.replace("have_", ""), l = !0);
         const w = g.replace("_token", ""), m = e && this.jwtTokens.includes(w);
-        let S = this.tokenPayload(g, i, l, m);
-        l ? a[f] = S.ok : S && (a[f] = S), n = a[f];
+        let S = this.tokenPayload(g, a, l, m);
+        l ? i[u] = S.ok : S && (i[u] = S), n = i[u];
       }
-      return Array.isArray(o) ? { status: 200, body: a } : n ? l ? { status: 200, body: typeof n == "boolean" ? { ok: n } : n } : { status: 200, body: n } : o.startsWith("have_") ? { status: 200, body: { ok: !1 } } : { status: 204 };
+      return Array.isArray(o) ? { status: 200, body: i } : n ? l ? { status: 200, body: typeof n == "boolean" ? { ok: n } : n } : { status: 200, body: n } : o.startsWith("have_") ? { status: 200, body: { ok: !1 } } : { status: 204 };
     } catch (t) {
       if (p.isSvelteKitError(t) || p.isSvelteKitRedirect(t)) throw t;
       const e = c.asCrossauthError(t);
@@ -2344,13 +2344,13 @@ class G extends re {
       e == "" && (e = void 0);
       let s = this.authServerBaseUrl;
       s.endsWith("/") || (s += "/"), s += this.deviceAuthorizationUrl;
-      const i = await this.startDeviceCodeFlow(s, e);
-      let a;
-      return i.verification_uri_complete && await ae.toDataURL(i.verification_uri_complete).then((n) => {
-        a = n;
+      const a = await this.startDeviceCodeFlow(s, e);
+      let i;
+      return a.verification_uri_complete && await ae.toDataURL(a.verification_uri_complete).then((n) => {
+        i = n;
       }).catch((n) => {
-        d.logger.debug(u({ err: n })), d.logger.warn(u({ msg: "Couldn't generate verification URL QR Code" }));
-      }), a ? { verification_uri_qrdata: a, ...i } : i;
+        d.logger.debug(f({ err: n })), d.logger.warn(f({ msg: "Couldn't generate verification URL QR Code" }));
+      }), i ? { verification_uri_qrdata: i, ...a } : a;
     } catch (e) {
       if (p.isSvelteKitRedirect(e) || p.isSvelteKitError(e)) throw e;
       const s = c.asCrossauthError(e);
@@ -2370,8 +2370,8 @@ class G extends re {
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
             throw new c(h.InvalidCsrf);
-        } catch (i) {
-          throw p.isSvelteKitError(i) || p.isSvelteKitRedirect(i) ? i : new c(h.Unauthorized, "CSRF token not present");
+        } catch (a) {
+          throw p.isSvelteKitError(a) || p.isSvelteKitRedirect(a) ? a : new c(h.Unauthorized, "CSRF token not present");
         }
       let e = o.device_code;
       if (!e) throw new c(h.BadRequest, "No device code given when polling for user authorization");
@@ -2386,8 +2386,8 @@ class G extends re {
         );
       {
         if (s.error == "authorization_pending") return { ok: !0, ...s };
-        let i = s.error ?? "server_error", a = s.error_description ?? "Didn't receive an access token";
-        const n = c.fromOAuthError(i, a);
+        let a = s.error ?? "server_error", i = s.error_description ?? "Didn't receive an access token";
+        const n = c.fromOAuthError(a, i);
         return this.errorFn(this.server, r, n);
       }
     } catch (e) {
@@ -2428,88 +2428,98 @@ class ge extends se {
    * @param options See {@link SvelteKitOAuthResourceServerOptions}
    */
   constructor(r, o = {}) {
-    if (super(r, o), this.errorBody = {}, this.protectedEndpoints = {}, this.sessionDataName = "oauth", this.tokenLocations = ["header"], y("errorBody", E.Json, this, o, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), y("tokenLocations", E.JsonArray, this, o, "OAUTH_TOKEN_LOCATIONS"), y("sessionDataName", E.String, this, o, "OAUTH_SESSION_DATA_NAME"), this.userStorage = o.userStorage, this.sessionAdapter = o.sessionAdapter, o.protectedEndpoints) {
+    if (super(r, o), this.errorBody = {}, this.protectedEndpoints = {}, this.protectedEndpointPrefixes = [], this.sessionDataName = "oauth", this.tokenLocations = ["header"], y("errorBody", E.Json, this, o, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), y("tokenLocations", E.JsonArray, this, o, "OAUTH_TOKEN_LOCATIONS"), y("sessionDataName", E.String, this, o, "OAUTH_SESSION_DATA_NAME"), this.userStorage = o.userStorage, this.sessionAdapter = o.sessionAdapter, o.protectedEndpoints) {
       const t = /^[!#\$%&'\(\)\*\+,\.\/a-zA-Z\[\]\^_`-]+/;
       for (const [e, s] of Object.entries(o.protectedEndpoints)) {
         if (!e.startsWith("/"))
           throw new c(h.Configuration, "protected endpoints must be absolute paths without the protocol and hostname");
-        s.scope && s.scope.forEach((i) => {
-          if (!t.test(i)) throw new c(h.Configuration, "Illegal characters in scope " + i);
+        s.scope && s.scope.forEach((a) => {
+          if (!t.test(a)) throw new c(h.Configuration, "Illegal characters in scope " + a);
         });
       }
-      this.protectedEndpoints = o.protectedEndpoints;
+      this.protectedEndpoints = { ...o.protectedEndpoints };
+      for (let e in o.protectedEndpoints) {
+        let s = this.protectedEndpoints[e];
+        s.suburls == !0 && (e.endsWith("/") || (e += "/", this.protectedEndpoints[e] = s), this.protectedEndpointPrefixes.push(e));
+      }
     }
     o.protectedEndpoints && (this.hook = async ({ event: t }) => {
-      var i, a;
+      var n, l;
       const e = t.url.pathname;
-      if (!(e in this.protectedEndpoints)) return;
-      const s = await this.authorized(t);
-      if (!(t.locals.user && t.locals.authType == "cookie" && this.protectedEndpoints[e].acceptSessionAuthorization != !0)) {
-        if (!s) {
+      let s = !1, a = "";
+      if (e in this.protectedEndpoints)
+        s = !0, a = e;
+      else
+        for (let u of this.protectedEndpointPrefixes)
+          e.startsWith(u) && (s = !0), a = u;
+      if (!s) return;
+      const i = await this.authorized(t);
+      if (!(t.locals.user && t.locals.authType == "cookie" && this.protectedEndpoints[a].acceptSessionAuthorization != !0)) {
+        if (!i) {
           t.locals.authError = "access_denied", t.locals.authErrorDescription = "No access token";
-          const n = this.authenticateHeader(t);
+          const u = this.authenticateHeader(t);
           return new Response(JSON.stringify(this.errorBody), {
             headers: {
               "content-type": "application/json",
-              "WWW-Authenticate": n
+              "WWW-Authenticate": u
             },
             status: 401
           });
         }
-        if (!s.authorized) {
-          const n = this.authenticateHeader(t);
+        if (!i.authorized) {
+          const u = this.authenticateHeader(t);
           return new Response(JSON.stringify(this.errorBody), {
             headers: {
               "content-type": "application/json",
-              "WWW-Authenticate": n
+              "WWW-Authenticate": u
             },
             status: 401
           });
         }
       }
-      if (s) {
-        if (t.locals.accessTokenPayload = s.tokenPayload, t.locals.user = s.user, (i = s.tokenPayload) != null && i.scope)
-          if (Array.isArray(s.tokenPayload.scope)) {
-            let n = [];
-            for (let l of s.tokenPayload.scope)
-              typeof l == "string" && n.push(l);
-            t.locals.scope = n;
-          } else typeof s.tokenPayload.scope == "string" && (t.locals.scope = s.tokenPayload.scope.split(" "));
-        if (this.protectedEndpoints[e].scope) {
-          for (let n of this.protectedEndpoints[e].scope ?? [])
-            if (!t.locals.scope || !t.locals.scope.includes(n) && this.protectedEndpoints[e].acceptSessionAuthorization != !0) {
-              d.logger.warn(u({
+      if (i) {
+        if (t.locals.accessTokenPayload = i.tokenPayload, t.locals.user = i.user, (n = i.tokenPayload) != null && n.scope)
+          if (Array.isArray(i.tokenPayload.scope)) {
+            let u = [];
+            for (let g of i.tokenPayload.scope)
+              typeof g == "string" && u.push(g);
+            t.locals.scope = u;
+          } else typeof i.tokenPayload.scope == "string" && (t.locals.scope = i.tokenPayload.scope.split(" "));
+        if (this.protectedEndpoints[a].scope) {
+          for (let u of this.protectedEndpoints[a].scope ?? [])
+            if (!t.locals.scope || !t.locals.scope.includes(u) && this.protectedEndpoints[a].acceptSessionAuthorization != !0) {
+              d.logger.warn(f({
                 msg: "Access token does not have sufficient scope",
-                username: (a = t.locals.user) == null ? void 0 : a.username,
+                username: (l = t.locals.user) == null ? void 0 : l.username,
                 url: t.request.url
               })), t.locals.scope = void 0, t.locals.accessTokenPayload = void 0, t.locals.user = void 0, t.locals.authError = "access_denied", t.locals.authErrorDescription = "Access token does not have sufficient scope";
-              const l = this.authenticateHeader(t);
+              const g = this.authenticateHeader(t);
               return new Response(JSON.stringify(this.errorBody), {
                 headers: {
                   "content-type": "application/json",
-                  "WWW-Authenticate": l
+                  "WWW-Authenticate": g
                 },
                 status: 401
               });
             }
         }
-        if (t.locals.authType = "oauth", t.locals.authError = s == null ? void 0 : s.error, (s == null ? void 0 : s.error) == "access_denied") {
-          const n = this.authenticateHeader(t);
+        if (t.locals.authType = "oauth", t.locals.authError = i == null ? void 0 : i.error, (i == null ? void 0 : i.error) == "access_denied") {
+          const u = this.authenticateHeader(t);
           return new Response(JSON.stringify(this.errorBody), {
             headers: {
               "content-type": "application/json",
-              "WWW-Authenticate": n
+              "WWW-Authenticate": u
             },
             status: 401
           });
-        } else if (s != null && s.error)
+        } else if (i != null && i.error)
           return new Response(JSON.stringify(this.errorBody), {
             headers: {
               "content-type": "application/json"
             },
             status: 500
           });
-        t.locals.authErrorDescription = s == null ? void 0 : s.error_description, d.logger.debug(u({ msg: "Resource server url", url: t.request.url, authorized: t.locals.accessTokenPayload != null }));
+        t.locals.authErrorDescription = i == null ? void 0 : i.error_description, d.logger.debug(f({ msg: "Resource server url", url: t.request.url, authorized: t.locals.accessTokenPayload != null }));
       }
     });
   }
@@ -2567,7 +2577,7 @@ class ge extends se {
         return { authorized: !1 };
     } catch (o) {
       const t = o;
-      return d.logger.debug(u({ err: o })), d.logger.error(u({ cerr: t })), r.locals.authError = "server_error", r.locals.authErrorDescription = t.message, { authorized: !1, error: "server_error", error_description: t.message };
+      return d.logger.debug(f({ err: o })), d.logger.error(f({ cerr: t })), r.locals.authError = "server_error", r.locals.authErrorDescription = t.message, { authorized: !1, error: "server_error", error_description: t.message };
     }
   }
   async tokenFromHeader(r) {
@@ -2635,11 +2645,11 @@ const D = class D {
     apiKey: t,
     oAuthAuthServer: e,
     oAuthClient: s,
-    oAuthClients: i,
-    oAuthResServer: a,
+    oAuthClients: a,
+    oAuthResServer: i,
     options: n
   }) {
-    this.loginUrl = "/login", this.audience = "", this.dummyLoad = async (f) => ({}), this.dummyActions = {}, this.dummyBff = async (f) => ({ status: 500, body: { error: "Unimplemented" } }), n || (n = {}), y("loginUrl", E.String, this, n, "LOGIN_URL", !1), n.isAdminFn && (D.isAdminFn = n.isAdminFn);
+    this.loginUrl = "/login", this.audience = "", this.dummyLoad = async (u) => ({}), this.dummyActions = {}, this.dummyBff = async (u) => ({ status: 500, body: { error: "Unimplemented" } }), n || (n = {}), y("loginUrl", E.String, this, n, "LOGIN_URL", !1), n.isAdminFn && (D.isAdminFn = n.isAdminFn);
     let l = {};
     if (n.authenticators && (l = n.authenticators), this.userStorage = n.userStorage, r) {
       if (!l)
@@ -2658,37 +2668,37 @@ const D = class D {
       );
     }
     if (e) {
-      let f = {};
-      this.loginUrl && (f.loginUrl = this.loginUrl), this.oAuthAuthServer = new ce(
+      let u = {};
+      this.loginUrl && (u.loginUrl = this.loginUrl), this.oAuthAuthServer = new ce(
         this,
         e.clientStorage,
         e.keyStorage,
         l,
-        { ...f, ...n, ...e.options }
+        { ...u, ...n, ...e.options }
       );
     }
-    if (s && i)
+    if (s && a)
       throw new c(h.Configuration, "Cannot specify both oAuthClient and oAuthClients");
     if (s && (this.oAuthClient = new G(
       this,
       s.authServerBaseUrl,
       { ...n, ...s.options }
-    )), i) {
+    )), a) {
       this.oAuthClients = [];
-      for (let f of i)
+      for (let u of a)
         this.oAuthClients.push(
           new G(
             this,
-            f.authServerBaseUrl,
-            { ...n, ...f.options }
+            u.authServerBaseUrl,
+            { ...n, ...u.options }
           )
         );
     }
-    a && (y("audience", E.String, this, n, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new ge(
+    i && (y("audience", E.String, this, n, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new ge(
       [new te(this.audience, n)],
-      { sessionAdapter: this.sessionAdapter, ...a.options, ...n }
-    )), this.hooks = async ({ event: f, resolve: g }) => {
-      const w = await this.unresolvedHooks(f);
+      { sessionAdapter: this.sessionAdapter, ...i.options, ...n }
+    )), this.hooks = async ({ event: u, resolve: g }) => {
+      const w = await this.unresolvedHooks(u);
       return w instanceof Response ? w : await g(w);
     };
   }
@@ -2791,18 +2801,18 @@ class we {
         reconfigure: async (t) => await this.reconfigureFactor2(t)
       },
       load: async (t) => {
-        var f;
-        let e = (f = t.locals.user) == null ? void 0 : f.username;
+        var u;
+        let e = (u = t.locals.user) == null ? void 0 : u.username;
         if (!this.isSessionUser(t) || !t.locals.user) {
           const g = await this.sessionServer.getSessionData(t, "factor2change");
           g != null && g.username || this.isSessionUser(t) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), e = g == null ? void 0 : g.username;
         }
-        let s = this.sessionServer.allowedFactor2 ?? [{ name: "none", friendlyName: "None", configurable: !1 }], i = {}, a = t.url.searchParams.get("required"), n;
-        a && (a = a.toLowerCase(), n = a == "true" || a == "1", n == !0 && (i.required = !0));
+        let s = this.sessionServer.allowedFactor2 ?? [{ name: "none", friendlyName: "None", configurable: !1 }], a = {}, i = t.url.searchParams.get("required"), n;
+        i && (i = i.toLowerCase(), n = i == "true" || i == "1", n == !0 && (a.required = !0));
         let l = t.url.searchParams.get("next");
-        return l && (i.next = l), {
+        return l && (a.next = l), {
           allowedFactor2: s,
-          ...i,
+          ...a,
           username: e,
           ...this.baseEndpoint(t)
         };
@@ -2812,12 +2822,12 @@ class we {
         default: async (t) => await this.changePassword(t)
       },
       load: async (t) => {
-        let e = {}, s = t.url.searchParams.get("required"), i, a = t.locals.user != null;
-        if (!a) {
+        let e = {}, s = t.url.searchParams.get("required"), a, i = t.locals.user != null;
+        if (!i) {
           const l = await this.sessionServer.getSessionData(t, "passwordchange");
-          l != null && l.username && (a = !0);
+          l != null && l.username && (i = !0);
         }
-        a || this.sessionServer.redirect(302, this.loginUrl), s && (s = s.toLowerCase(), i = s == "true" || s == "1", i == !0 && (e.required = !0));
+        i || this.sessionServer.redirect(302, this.loginUrl), s && (s = s.toLowerCase(), a = s == "true" || s == "1", a == !0 && (e.required = !0));
         let n = t.url.searchParams.get("next");
         return n && (e.next = n), {
           ...e,
@@ -2843,8 +2853,8 @@ class we {
         default: async (t) => await this.requestPasswordReset(t)
       },
       load: async (t) => {
-        let e = {}, s = t.url.searchParams.get("required"), i;
-        return s && (s = s.toLowerCase(), i = s == "true" || s == "1", i == !0 && (e.required = !0)), {
+        let e = {}, s = t.url.searchParams.get("required"), a;
+        return s && (s = s.toLowerCase(), a = s == "true" || s == "1", a == !0 && (e.required = !0)), {
           ...e,
           ...this.baseEndpoint(t)
         };
@@ -2864,14 +2874,14 @@ class we {
           try {
             return e = await this.resetPassword(t), e;
           } catch (s) {
-            const i = c.asCrossauthError(s);
+            const a = c.asCrossauthError(s);
             if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-            return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
+            return d.logger.debug(f({ err: a })), d.logger.error(f({ cerr: a })), {
               ok: !1,
               tokenValidated: !1,
               error: e == null ? void 0 : e.error,
-              errorCode: i.code,
-              errorCodeName: i.codeName,
+              errorCode: a.code,
+              errorCodeName: a.codeName,
               ...this.baseEndpoint(t)
             };
           }
@@ -2894,7 +2904,7 @@ class we {
             };
         } catch (e) {
           const s = c.asCrossauthError(e);
-          return d.logger.debug(u({ err: s })), d.logger.error(u({ cerr: s })), {
+          return d.logger.debug(f({ err: s })), d.logger.error(f({ cerr: s })), {
             tokenValidated: !1,
             error: s.message,
             errorCode: s.code,
@@ -2971,43 +2981,43 @@ class we {
     try {
       var t = new b();
       await t.loadData(r), o = t.toObject();
-      const e = t.get("username") ?? "", s = t.getAsBoolean("persist") ?? !1, i = o.next ?? this.loginRedirectUrl;
+      const e = t.get("username") ?? "", s = t.getAsBoolean("persist") ?? !1, a = o.next ?? this.loginRedirectUrl;
       if (e == "") throw new c(h.InvalidUsername, "Username field may not be empty");
-      let a = this.addToSession ? this.addToSession(r, o) : {};
+      let i = this.addToSession ? this.addToSession(r, o) : {};
       if (this.sessionServer.enableCsrfProtection && !r.locals.csrfToken) throw new c(h.InvalidCsrf);
       const n = this.sessionServer.getSessionCookieValue(r);
-      let { sessionCookie: l, csrfCookie: f, user: g } = await this.sessionServer.sessionManager.login(e, t.toObject(), a, s);
-      if (d.logger.debug(u({
+      let { sessionCookie: l, csrfCookie: u, user: g } = await this.sessionServer.sessionManager.login(e, t.toObject(), i, s);
+      if (d.logger.debug(f({
         msg: "Login: set session cookie " + l.name + " opts " + JSON.stringify(l.options),
         user: e
       })), r.cookies.set(
         l.name,
         l.value,
         P(l.options)
-      ), d.logger.debug(u({
-        msg: "Login: set csrf cookie " + f.name + " opts " + JSON.stringify(l.options),
+      ), d.logger.debug(f({
+        msg: "Login: set csrf cookie " + u.name + " opts " + JSON.stringify(l.options),
         user: e
       })), this.sessionServer.enableCsrfProtection && (r.cookies.set(
-        f.name,
-        f.value,
-        P(f.options)
-      ), r.locals.csrfToken = await this.sessionServer.sessionManager.createCsrfFormOrHeaderValue(f.value)), n)
+        u.name,
+        u.value,
+        P(u.options)
+      ), r.locals.csrfToken = await this.sessionServer.sessionManager.createCsrfFormOrHeaderValue(u.value)), n)
         try {
           await this.sessionServer.sessionManager.deleteSession(n);
         } catch (w) {
-          d.logger.warn(u({
+          d.logger.warn(f({
             msg: "Couldn't delete session ID from database",
             hashOfSessionId: this.sessionServer.getHashOfSessionId(r)
-          })), d.logger.debug(u({ err: w }));
+          })), d.logger.debug(f({ err: w }));
         }
       if (g.state == N.passwordChangeNeeded)
-        this.sessionServer.redirect(302, this.changePasswordUrl + "?required=true&next=" + encodeURIComponent("login?next=" + i));
+        this.sessionServer.redirect(302, this.changePasswordUrl + "?required=true&next=" + encodeURIComponent("login?next=" + a));
       else {
         if (g.state == N.passwordResetNeeded)
           throw new c(h.PasswordResetNeeded, "Please click on the link we sent you to reset your password");
         if (g.state == N.passwordAndFactor2ResetNeeded)
           throw new c(h.PasswordResetNeeded, "Please click on the link we sent you to reset your password");
-        this.sessionServer.allowedFactor2.length > 0 && g.state == N.factor2ResetNeeded || !this.sessionServer.allowedFactor2Names.includes(g.factor2 ? g.factor2 : "none") ? this.sessionServer.redirect(302, this.changeFactor2Url + "?required=true&next=" + encodeURIComponent("login?next=" + i)) : (!g.factor2 || g.factor2 == "") && (r.locals.user = g);
+        this.sessionServer.allowedFactor2.length > 0 && g.state == N.factor2ResetNeeded || !this.sessionServer.allowedFactor2Names.includes(g.factor2 ? g.factor2 : "none") ? this.sessionServer.redirect(302, this.changeFactor2Url + "?required=true&next=" + encodeURIComponent("login?next=" + a)) : (!g.factor2 || g.factor2 == "") && (r.locals.user = g);
       }
       return {
         user: g,
@@ -3018,7 +3028,7 @@ class we {
     } catch (e) {
       if (typeof e == "object" && e != null && "status" in e && "location" in e) throw e;
       let s = c.asCrossauthError(e, "Couldn't log in");
-      return d.logger.debug(u({ err: s })), d.logger.error(u({ cerr: s })), {
+      return d.logger.debug(f({ err: s })), d.logger.error(f({ cerr: s })), {
         error: s.message,
         ok: !1,
         formData: o,
@@ -3033,29 +3043,29 @@ class we {
   async loginWithUser(r, o, t) {
     const e = t.locals.sessionId, s = new b();
     await s.loadData(t);
-    let i = this.addToSession ? this.addToSession(t, s.toObject()) : {}, { sessionCookie: a, csrfCookie: n, csrfFormOrHeaderValue: l } = await this.sessionServer.sessionManager.login("", {}, i, void 0, r, o);
-    if (d.logger.debug(u({
-      msg: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
+    let a = this.addToSession ? this.addToSession(t, s.toObject()) : {}, { sessionCookie: i, csrfCookie: n, csrfFormOrHeaderValue: l } = await this.sessionServer.sessionManager.login("", {}, a, void 0, r, o);
+    if (d.logger.debug(f({
+      msg: "Login: set session cookie " + i.name + " opts " + JSON.stringify(i.options),
       user: r.username
     })), t.cookies.set(
-      a.name,
-      a.value,
-      P(a.options)
-    ), d.logger.debug(u({
-      msg: "Login: set csrf cookie " + n.name + " opts " + JSON.stringify(a.options),
+      i.name,
+      i.value,
+      P(i.options)
+    ), d.logger.debug(f({
+      msg: "Login: set csrf cookie " + n.name + " opts " + JSON.stringify(i.options),
       user: r.username
     })), this.sessionServer.enableCsrfProtection && t.cookies.set(
       n.name,
       n.value,
       P(n.options)
-    ), t.locals.user = r, t.locals.csrfToken = l, t.locals.sessionId = this.sessionServer.sessionManager.getSessionId(a.value), e)
+    ), t.locals.user = r, t.locals.csrfToken = l, t.locals.sessionId = this.sessionServer.sessionManager.getSessionId(i.value), e)
       try {
         await this.sessionServer.sessionManager.deleteSession(e);
-      } catch (f) {
-        d.logger.warn(u({
+      } catch (u) {
+        d.logger.warn(f({
           msg: "Couldn't delete session ID from database",
           hashOfSessionId: this.sessionServer.getHashOfSessionId(t)
-        })), d.logger.debug(u({ err: f }));
+        })), d.logger.debug(f({ err: u }));
       }
     return {
       user: r,
@@ -3079,14 +3089,14 @@ class we {
    */
   async logout(r) {
     try {
-      if (r.locals.sessionId && await this.sessionServer.sessionManager.logout(r.locals.sessionId), d.logger.debug(u({ msg: "Logout: clear cookie " + this.sessionServer.sessionManager.sessionCookieName })), r.cookies.delete(this.sessionServer.sessionManager.sessionCookieName, { path: "/" }), this.sessionServer.enableCsrfProtection && r.cookies.delete(this.sessionServer.sessionManager.csrfCookieName, { path: "/" }), r.locals.sessionId)
+      if (r.locals.sessionId && await this.sessionServer.sessionManager.logout(r.locals.sessionId), d.logger.debug(f({ msg: "Logout: clear cookie " + this.sessionServer.sessionManager.sessionCookieName })), r.cookies.delete(this.sessionServer.sessionManager.sessionCookieName, { path: "/" }), this.sessionServer.enableCsrfProtection && r.cookies.delete(this.sessionServer.sessionManager.csrfCookieName, { path: "/" }), r.locals.sessionId)
         try {
           await this.sessionServer.sessionManager.deleteSession(r.locals.sessionId);
         } catch (o) {
-          d.logger.warn(u({
+          d.logger.warn(f({
             msg: "Couldn't delete session ID from database",
             hashOfSessionId: this.sessionServer.getHashOfSessionId(r)
-          })), d.logger.debug(u({ err: o }));
+          })), d.logger.debug(f({ err: o }));
         }
       if (r.locals.sessionId = void 0, r.locals.user = void 0, this.sessionServer.enableCsrfProtection) {
         r.locals.csrfToken = void 0, r.cookies.delete(this.sessionServer.sessionManager.csrfCookieName, { path: "/" });
@@ -3096,7 +3106,7 @@ class we {
       return { ok: !0 };
     } catch (o) {
       const t = c.asCrossauthError(o);
-      return d.logger.debug(u({ err: t })), d.logger.error(u({ cerr: t })), {
+      return d.logger.debug(f({ err: t })), d.logger.error(f({ cerr: t })), {
         ok: !1,
         error: t.message,
         errorCode: t.code,
@@ -3166,18 +3176,18 @@ class we {
           "Illegal second factor " + o.factor2 + " requested"
         );
       (o.factor2 == "none" || o.factor2 == "") && (o.factor2 = void 0), s = this.sessionServer.createUserFn(r, o, this.sessionServer.userStorage.userEditableFields);
-      let i = this.sessionServer.authenticators[s.factor1].validateSecrets(o);
-      const a = this.sessionServer.authenticators[s.factor1].secretNames();
+      let a = this.sessionServer.authenticators[s.factor1].validateSecrets(o);
+      const i = this.sessionServer.authenticators[s.factor1].secretNames();
       let n = {};
       for (let w in o)
         if (w.startsWith("repeat_")) {
           const m = w.replace(/^repeat_/, "");
-          a.includes(m) && (n[m] = o[w]);
+          i.includes(m) && (n[m] = o[w]);
         }
       Object.keys(n).length === 0 && (n = void 0), s.state = "active", o.factor2 && o.factor2 != "none" ? s.state = "awaitingtwofactor" : this.sessionServer.enableEmailVerification && (s.state = "awaitingemailverification");
-      let f = [...this.sessionServer.validateUserFn(s), ...i];
-      if (f.length > 0)
-        throw new c(h.FormEntry, f);
+      let u = [...this.sessionServer.validateUserFn(s), ...a];
+      if (u.length > 0)
+        throw new c(h.FormEntry, u);
       let g = !1;
       try {
         const { user: w, secrets: m } = await this.sessionServer.userStorage.getUserByUsername(e);
@@ -3213,18 +3223,18 @@ class we {
           };
           return this.sessionServer.enableCsrfProtection && (m.csrfToken = r.locals.csrfToken), { factor2Data: m, ok: !0, factor2Required: !0, formData: o };
         } catch (m) {
-          d.logger.error(u({ err: m }));
+          d.logger.error(f({ err: m }));
           try {
             this.sessionServer.sessionManager.deleteUserByUsername(e);
           } catch (S) {
-            d.logger.error(u({ err: S }));
+            d.logger.error(f({ err: S }));
           }
         }
       }
       return { user: s, formData: o, ok: !0 };
     } catch (e) {
       let s = c.asCrossauthError(e, "Couldn't sign up");
-      return d.logger.debug(u({ err: s })), d.logger.error(u({ cerr: s })), {
+      return d.logger.debug(f({ err: s })), d.logger.error(f({ cerr: s })), {
         error: s.message,
         ok: !1,
         formData: o,
@@ -3275,7 +3285,7 @@ class we {
       };
     } catch (t) {
       const e = c.asCrossauthError(t);
-      return d.logger.debug(u({ err: t })), d.logger.error(u({ cerr: t })), {
+      return d.logger.debug(f({ err: t })), d.logger.error(f({ cerr: t })), {
         ok: !1,
         error: e.message,
         errorCode: e.code,
@@ -3309,8 +3319,8 @@ class we {
     try {
       var s = new b();
       await s.loadData(r), o = s.toObject();
-      const i = await this.sessionServer.getSessionData(r, "2fa");
-      if (i != null && i.factor2) e = i == null ? void 0 : i.factor2;
+      const a = await this.sessionServer.getSessionData(r, "2fa");
+      if (a != null && a.factor2) e = a == null ? void 0 : a.factor2;
       else throw new c(h.BadRequest, "Two factor authentication was not started");
       if (this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
         throw new c(h.InvalidCsrf);
@@ -3318,17 +3328,17 @@ class we {
         h.Unauthorized,
         "No session active while enabling 2FA.  Please enable cookies"
       );
-      let a = await this.sessionServer.sessionManager.completeTwoFactorSetup(
+      let i = await this.sessionServer.sessionManager.completeTwoFactorSetup(
         o,
         r.locals.sessionId
       );
-      return this.sessionServer.enableEmailVerification || await this.loginWithUser(a, !0, r), r.locals.user ? {
+      return this.sessionServer.enableEmailVerification || await this.loginWithUser(i, !0, r), r.locals.user ? {
         ok: !0,
-        user: a,
+        user: i,
         emailVerificationRequired: this.sessionServer.enableEmailVerification
-      } : await this.loginWithUser(a, !0, r);
-    } catch (i) {
-      const a = c.asCrossauthError(i);
+      } : await this.loginWithUser(i, !0, r);
+    } catch (a) {
+      const i = c.asCrossauthError(a);
       let n;
       try {
         n = (await this.sessionServer.sessionManager.repeatTwoFactorSignup(r.locals.sessionId ?? "")).userData;
@@ -3339,11 +3349,11 @@ class we {
         csrfToken: r.locals.csrfToken,
         username: n.username ?? "",
         factor2: e
-      }), d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
+      }), d.logger.debug(f({ err: a })), d.logger.error(f({ cerr: a })), {
         ok: !1,
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         formData: o,
         factor2Data: t,
         emailVerificationRequired: this.sessionServer.enableEmailVerification
@@ -3379,22 +3389,22 @@ class we {
       if (!s) throw new c(h.Unauthorized);
       if (this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
         throw new c(h.InvalidCsrf);
-      let i = this.addToSession ? this.addToSession(r, o) : {};
-      const { sessionCookie: a, csrfCookie: n, user: l } = await this.sessionServer.sessionManager.completeTwoFactorLogin(
+      let a = this.addToSession ? this.addToSession(r, o) : {};
+      const { sessionCookie: i, csrfCookie: n, user: l } = await this.sessionServer.sessionManager.completeTwoFactorLogin(
         o,
         s,
-        i,
+        a,
         e
       );
-      return d.logger.debug(u({
-        msg: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
+      return d.logger.debug(f({
+        msg: "Login: set session cookie " + i.name + " opts " + JSON.stringify(i.options),
         user: l == null ? void 0 : l.username
       })), r.cookies.set(
-        a.name,
-        a.value,
-        P(a.options)
-      ), d.logger.debug(u({
-        msg: "Login: set csrf cookie " + n.name + " opts " + JSON.stringify(a.options),
+        i.name,
+        i.value,
+        P(i.options)
+      ), d.logger.debug(f({
+        msg: "Login: set csrf cookie " + n.name + " opts " + JSON.stringify(i.options),
         user: l == null ? void 0 : l.username
       })), r.cookies.set(
         n.name,
@@ -3406,7 +3416,7 @@ class we {
       };
     } catch (e) {
       const s = c.asCrossauthError(e);
-      return d.logger.debug(u({ err: e })), d.logger.error(u({ cerr: e })), {
+      return d.logger.debug(f({ err: e })), d.logger.error(f({ cerr: e })), {
         ok: !1,
         error: s.message,
         errorCode: s.code,
@@ -3432,7 +3442,7 @@ class we {
       return await this.sessionServer.sessionManager.requestPasswordReset(e), { formData: o, ok: !0 };
     } catch (e) {
       let s = c.asCrossauthError(e, "Couldn't log in");
-      return d.logger.debug(u({ err: e })), d.logger.error(u({ cerr: e })), {
+      return d.logger.debug(f({ err: e })), d.logger.error(f({ cerr: e })), {
         error: s.message,
         errorCode: s.code,
         errorCodeName: s.codeName,
@@ -3460,7 +3470,7 @@ class we {
        *   - `formData` the form fields extracted from the request
        */
   async validatePasswordResetToken(r) {
-    d.logger.debug(u({ msg: "validatePasswordResetToken " + r.request.method }));
+    d.logger.debug(f({ msg: "validatePasswordResetToken " + r.request.method }));
     try {
       const o = r.params.token;
       if (!o) throw new c(h.InvalidToken, "Invalid email verification token");
@@ -3471,7 +3481,7 @@ class we {
       };
     } catch (o) {
       const t = c.asCrossauthError(o);
-      return d.logger.debug(u({ err: t })), d.logger.error(u({ cerr: t })), {
+      return d.logger.debug(f({ err: t })), d.logger.error(f({ cerr: t })), {
         ok: !1,
         error: t.message,
         errorCode: t.code,
@@ -3499,7 +3509,7 @@ class we {
        *   - `formData` the form fields extracted from the request
        */
   async resetPassword(r) {
-    d.logger.debug(u({ msg: "resetPassword" }));
+    d.logger.debug(f({ msg: "resetPassword" }));
     let o;
     try {
       var t = new b();
@@ -3512,17 +3522,17 @@ class we {
         );
       const e = r.params.token ?? "";
       if (e == "") throw new c(h.InvalidUsername, "No token provided");
-      const s = await this.sessionServer.sessionManager.userForPasswordResetToken(e), i = this.sessionServer.authenticators[s.factor1], a = i.secretNames();
+      const s = await this.sessionServer.sessionManager.userForPasswordResetToken(e), a = this.sessionServer.authenticators[s.factor1], i = a.secretNames();
       let n = {}, l = {};
       for (let w in o)
         if (w.startsWith("new_")) {
           const m = w.replace(/^new_/, "");
-          a.includes(m) && (n[m] = o[w]);
+          i.includes(m) && (n[m] = o[w]);
         } else if (w.startsWith("repeat_")) {
           const m = w.replace(/^repeat_/, "");
-          a.includes(m) && (l[m] = o[w]);
+          i.includes(m) && (l[m] = o[w]);
         }
-      if (Object.keys(l).length === 0 && (l = void 0), i.validateSecrets(n).length > 0)
+      if (Object.keys(l).length === 0 && (l = void 0), a.validateSecrets(n).length > 0)
         throw new c(h.PasswordFormat);
       const g = await this.sessionServer.sessionManager.resetSecret(e, 1, n, l);
       if (g.state == N.active)
@@ -3534,7 +3544,7 @@ class we {
     } catch (e) {
       if (p.isSvelteKitRedirect(e)) throw e;
       let s = c.asCrossauthError(e, "Couldn't log in");
-      return d.logger.debug(u({ err: s })), d.logger.error(u({ cerr: s })), {
+      return d.logger.debug(f({ err: s })), d.logger.error(f({ cerr: s })), {
         error: s.message,
         errorCode: s.code,
         errorCodeName: s.codeName,
@@ -3584,7 +3594,7 @@ class we {
       };
     } catch (o) {
       let t = c.asCrossauthError(o, "2FA failed");
-      return d.logger.debug(u({ err: t })), d.logger.error(u({ cerr: t })), {
+      return d.logger.debug(f({ err: t })), d.logger.error(f({ cerr: t })), {
         error: t.message,
         errorCode: t.code,
         errorCodeName: t.codeName,
@@ -3611,7 +3621,7 @@ class we {
        *   - `formData` the form fields extracted from the request
        */
   async changePassword(r) {
-    d.logger.debug(u({ msg: "changePassword" }));
+    d.logger.debug(f({ msg: "changePassword" }));
     let o;
     try {
       if (!this.sessionServer.userStorage) throw new c(h.Configuration, "Must provide user storage to use this function");
@@ -3637,20 +3647,20 @@ class we {
         e = r.locals.user;
       } else
         throw new c(h.InsufficientPriviledges);
-      const i = this.sessionServer.authenticators[e.factor1], a = i.secretNames();
-      let n = {}, l = {}, f = {};
+      const a = this.sessionServer.authenticators[e.factor1], i = a.secretNames();
+      let n = {}, l = {}, u = {};
       for (let m in o)
         if (m.startsWith("new_")) {
           const S = m.replace(/^new_/, "");
-          a.includes(S) && (l[S] = o[m]);
+          i.includes(S) && (l[S] = o[m]);
         } else if (m.startsWith("old_")) {
           const S = m.replace(/^old_/, "");
-          a.includes(S) && (n[S] = o[m]);
+          i.includes(S) && (n[S] = o[m]);
         } else if (m.startsWith("repeat_")) {
           const S = m.replace(/^repeat_/, "");
-          a.includes(S) && (f[S] = o[m]);
+          i.includes(S) && (u[S] = o[m]);
         }
-      if (Object.keys(f).length === 0 && (f = void 0), i.validateSecrets(l).length > 0)
+      if (Object.keys(u).length === 0 && (u = void 0), a.validateSecrets(l).length > 0)
         throw new c(h.PasswordFormat);
       const w = e.state;
       try {
@@ -3658,16 +3668,16 @@ class we {
           e.username,
           1,
           l,
-          f,
+          u,
           n
         );
       } catch (m) {
         const S = c.asCrossauthError(m);
-        if (d.logger.debug(u({ err: m })), s)
+        if (d.logger.debug(f({ err: m })), s)
           try {
             await this.sessionServer.userStorage.updateUser({ id: e.id, state: w });
           } catch (C) {
-            d.logger.debug(u({ err: C }));
+            d.logger.debug(f({ err: C }));
           }
         throw S;
       }
@@ -3677,7 +3687,7 @@ class we {
       };
     } catch (e) {
       let s = c.asCrossauthError(e, "Couldn't change password");
-      return d.logger.debug(u({ err: s })), d.logger.error(u({ cerr: s })), {
+      return d.logger.debug(f({ err: s })), d.logger.error(f({ cerr: s })), {
         error: s.message,
         ok: !1,
         errorCode: s.code,
@@ -3700,7 +3710,7 @@ class we {
        *     exception was raised
        */
   async deleteUser(r) {
-    d.logger.debug(u({ msg: "deleteUser" }));
+    d.logger.debug(f({ msg: "deleteUser" }));
     try {
       if (!this.sessionServer.userStorage) throw new c(h.Configuration, "Must provide user storage to use this function");
       if (this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
@@ -3712,7 +3722,7 @@ class we {
       };
     } catch (o) {
       let t = c.asCrossauthError(o, "Couldn't delete account");
-      return d.logger.debug(u({ err: t })), d.logger.error(u({ cerr: t })), {
+      return d.logger.debug(f({ err: t })), d.logger.error(f({ cerr: t })), {
         error: t.message,
         errorCode: t.code,
         errorCodeName: t.codeName,
@@ -3745,7 +3755,7 @@ class we {
    *     the link emailed to them to complete signup.
    */
   async updateUser(r) {
-    d.logger.debug(u({ msg: "updateUser" }));
+    d.logger.debug(f({ msg: "updateUser" }));
     let o;
     try {
       if (!this.sessionServer.userStorage) throw new c(h.Configuration, "Must provide user storage to use this function");
@@ -3768,19 +3778,19 @@ class we {
       let s = this.sessionServer.validateUserFn(e);
       if (s.length > 0)
         throw new c(h.FormEntry, s);
-      let { emailVerificationTokenSent: i } = await this.sessionServer.sessionManager.updateUser(r.locals.user, e);
-      if (!i) {
-        const a = await this.sessionServer.userStorage.getUserById(r.locals.user.id);
-        r.locals.user = a.user;
+      let { emailVerificationTokenSent: a } = await this.sessionServer.sessionManager.updateUser(r.locals.user, e);
+      if (!a) {
+        const i = await this.sessionServer.userStorage.getUserById(r.locals.user.id);
+        r.locals.user = i.user;
       }
       return {
         ok: !0,
         formData: o,
-        emailVerificationNeeded: i
+        emailVerificationNeeded: a
       };
     } catch (e) {
       let s = c.asCrossauthError(e, "Couldn't update account");
-      return d.logger.debug(u({ err: s })), d.logger.error(u({ cerr: s })), {
+      return d.logger.debug(f({ err: s })), d.logger.error(f({ cerr: s })), {
         error: s.message,
         errorCode: s.code,
         errorCodeName: s.codeName,
@@ -3812,7 +3822,7 @@ class we {
    */
   async changeFactor2(r) {
     var e;
-    d.logger.debug(u({ msg: "updateUser" }));
+    d.logger.debug(f({ msg: "updateUser" }));
     let o;
     try {
       if (!this.sessionServer.userStorage) throw new c(h.Configuration, "Must provide user storage to use this function");
@@ -3824,32 +3834,32 @@ class we {
         const l = await this.sessionServer.getSessionData(r, "factor2change");
         l != null && l.username || this.isSessionUser(r) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), s = l == null ? void 0 : l.username;
       }
-      let i = r.locals.user;
-      if (!i && s && (i = (await this.sessionServer.userStorage.getUserByUsername(
+      let a = r.locals.user;
+      if (!a && s && (a = (await this.sessionServer.userStorage.getUserByUsername(
         s,
         {
           skipActiveCheck: !0,
           skipEmailVerifiedCheck: !0
         }
-      )).user), !i)
+      )).user), !a)
         throw new c(h.InsufficientPriviledges);
       if (!r.locals.sessionId)
         throw new c(h.Unauthorized);
-      let a = o.factor2;
+      let i = o.factor2;
       if (o.factor2 && !this.sessionServer.allowedFactor2Names.includes(o.factor2))
         throw new c(
           h.Forbidden,
           "Illegal second factor " + o.factor2 + " requested"
         );
-      if ((o.factor2 == "none" || o.factor2 == "") && (a = void 0, !r.locals.user))
-        return await this.loginWithUser(i, !0, r);
-      const n = await this.sessionServer.sessionManager.initiateTwoFactorSetup(i, a, r.locals.sessionId);
-      return a ? {
+      if ((o.factor2 == "none" || o.factor2 == "") && (i = void 0, !r.locals.user))
+        return await this.loginWithUser(a, !0, r);
+      const n = await this.sessionServer.sessionManager.initiateTwoFactorSetup(a, i, r.locals.sessionId);
+      return i ? {
         ok: !0,
         formData: o,
         factor2Data: {
-          username: i.username,
-          factor2: a ?? "",
+          username: a.username,
+          factor2: i ?? "",
           userData: n,
           csrfToken: r.locals.csrfToken
         }
@@ -3858,11 +3868,11 @@ class we {
         formData: o
       };
     } catch (s) {
-      let i = c.asCrossauthError(s, "Couldn't update account");
-      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+      let a = c.asCrossauthError(s, "Couldn't update account");
+      return d.logger.debug(f({ err: a })), d.logger.error(f({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1,
         formData: o
       };
@@ -3888,7 +3898,7 @@ class we {
    */
   async reconfigureFactor2(r) {
     var e;
-    d.logger.debug(u({ msg: "updateUser" }));
+    d.logger.debug(f({ msg: "updateUser" }));
     let o;
     try {
       if (!this.sessionServer.userStorage) throw new c(h.Configuration, "Must provide user storage to use this function");
@@ -3897,50 +3907,50 @@ class we {
         throw new c(h.InvalidCsrf);
       let s = (e = r.locals.user) == null ? void 0 : e.username;
       if (!this.isSessionUser(r) || !r.locals.user) {
-        const f = await this.sessionServer.getSessionData(r, "factor2change");
-        f != null && f.username || this.isSessionUser(r) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), s = f == null ? void 0 : f.username;
+        const u = await this.sessionServer.getSessionData(r, "factor2change");
+        u != null && u.username || this.isSessionUser(r) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), s = u == null ? void 0 : u.username;
       }
-      let i = r.locals.user;
-      if (!i && s && (i = (await this.sessionServer.userStorage.getUserByUsername(
+      let a = r.locals.user;
+      if (!a && s && (a = (await this.sessionServer.userStorage.getUserByUsername(
         s,
         {
           skipActiveCheck: !0,
           skipEmailVerifiedCheck: !0
         }
-      )).user), !i)
+      )).user), !a)
         throw new c(h.InsufficientPriviledges);
       if (!r.locals.sessionId)
         throw new c(h.Unauthorized);
       if (!r.locals.sessionId)
         throw new c(h.Unauthorized);
-      let a = i.factor2;
-      const n = this.sessionServer.authenticators[a];
+      let i = a.factor2;
+      const n = this.sessionServer.authenticators[i];
       if (!n || n.secretNames().length == 0)
         throw new c(
           h.BadRequest,
           "Selected second factor does not have configuration"
         );
       const l = await this.sessionServer.sessionManager.initiateTwoFactorSetup(
-        i,
         a,
+        i,
         r.locals.sessionId
       );
       return {
         ok: !0,
         formData: o,
         factor2Data: {
-          username: i.username,
-          factor2: i.factor2 ?? "",
+          username: a.username,
+          factor2: a.factor2 ?? "",
           userData: l,
           csrfToken: r.locals.csrfToken
         }
       };
     } catch (s) {
-      let i = c.asCrossauthError(s, "Couldn't update account");
-      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+      let a = c.asCrossauthError(s, "Couldn't update account");
+      return d.logger.debug(f({ err: a })), d.logger.error(f({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1,
         formData: o
       };
@@ -3962,16 +3972,16 @@ async function me(k, r, o = 0, t = 10) {
     const { user: s } = await r.getUserByUsername(k);
     e.push(s);
   } catch (s) {
-    const i = c.asCrossauthError(s);
-    if (i.code != h.UserNotExist)
-      throw d.logger.debug(u({ err: i })), i;
+    const a = c.asCrossauthError(s);
+    if (a.code != h.UserNotExist)
+      throw d.logger.debug(f({ err: a })), a;
     try {
-      const { user: a } = await r.getUserByEmail(k);
-      e.push(a);
-    } catch (a) {
-      const n = c.asCrossauthError(a);
+      const { user: i } = await r.getUserByEmail(k);
+      e.push(i);
+    } catch (i) {
+      const n = c.asCrossauthError(i);
       if (n.code != h.UserNotExist)
-        throw d.logger.debug(u({ err: n })), i;
+        throw d.logger.debug(f({ err: n })), a;
     }
   }
   return e;
@@ -3990,12 +4000,12 @@ class ke {
     }, this.updateUserEndpoint = {
       actions: {
         default: async (t) => {
-          var i, a, n;
+          var a, i, n;
           const e = await this.getUserFromParam(t);
           return e.exception || !e.user ? {
             ok: !1,
-            error: ((i = e.exception) == null ? void 0 : i.message) ?? "Couldn't get user",
-            errorCode: (a = e.exception) == null ? void 0 : a.code,
+            error: ((a = e.exception) == null ? void 0 : a.message) ?? "Couldn't get user",
+            errorCode: (i = e.exception) == null ? void 0 : i.code,
             errorCodeName: (n = e.exception) == null ? void 0 : n.codeName
           } : await this.updateUser(e.user, t);
         }
@@ -4017,12 +4027,12 @@ class ke {
     }, this.changePasswordEndpoint = {
       actions: {
         default: async (t) => {
-          var i, a, n;
+          var a, i, n;
           const e = await this.getUserFromParam(t);
           return e.exception || !e.user ? {
             ok: !1,
-            error: ((i = e.exception) == null ? void 0 : i.message) ?? "Couldn't get user",
-            errorCode: (a = e.exception) == null ? void 0 : a.code,
+            error: ((a = e.exception) == null ? void 0 : a.message) ?? "Couldn't get user",
+            errorCode: (i = e.exception) == null ? void 0 : i.code,
             errorCodeName: (n = e.exception) == null ? void 0 : n.codeName
           } : await this.changePassword(e.user, t);
         }
@@ -4035,8 +4045,8 @@ class ke {
             editUser: e.user,
             ...this.baseEndpoint(t)
           };
-        let s = {}, i = t.url.searchParams.get("next");
-        return i && (s.next = i), {
+        let s = {}, a = t.url.searchParams.get("next");
+        return a && (s.next = a), {
           ...s,
           editUser: e.user,
           ...this.baseEndpoint(t)
@@ -4058,15 +4068,15 @@ class ke {
         default: async (t) => await this.deleteUser(t)
       },
       load: async (t) => {
-        var s, i, a;
+        var s, a, i;
         const e = await this.getUserFromParam(t);
         return e.exception || !e.user ? {
           error: "User doesn't exist",
           errorCode: (s = e.exception) == null ? void 0 : s.code,
-          errorCodeName: (i = e.exception) == null ? void 0 : i.codeName,
+          errorCodeName: (a = e.exception) == null ? void 0 : a.codeName,
           ...this.baseEndpoint(t)
         } : {
-          username: (a = e.user) == null ? void 0 : a.username,
+          username: (i = e.user) == null ? void 0 : i.username,
           ...this.baseEndpoint(t)
         };
       }
@@ -4117,20 +4127,20 @@ class ke {
     try {
       if (!this.sessionServer.userStorage) throw new c(h.Configuration, "Must provide user storage to use this function");
       (!r.locals.user || !p.isAdminFn(r.locals.user)) && this.sessionServer.error(401);
-      let s = [], i = [], a = [];
+      let s = [], a = [], i = [];
       if (!t)
         try {
           const l = r.url.searchParams.get("skip");
           l && (t = parseInt(l));
         } catch (l) {
-          d.logger.warn(u({ cerr: l, msg: "skip parameter is not an integer" }));
+          d.logger.warn(f({ cerr: l, msg: "skip parameter is not an integer" }));
         }
       if (t || (t = 0), !e)
         try {
           const l = r.url.searchParams.get("take");
           l && (e = parseInt(l));
         } catch (l) {
-          d.logger.warn(u({ cerr: l, msg: "take parameter is not an integer" }));
+          d.logger.warn(f({ cerr: l, msg: "take parameter is not an integer" }));
         }
       e || (e = 10);
       const n = r.url.searchParams.get("search");
@@ -4139,7 +4149,7 @@ class ke {
         this.sessionServer.userStorage,
         t,
         e
-      ), t > 0 && (i = await this.userSearchFn(
+      ), t > 0 && (a = await this.userSearchFn(
         o,
         this.sessionServer.userStorage,
         t - 1,
@@ -4147,7 +4157,7 @@ class ke {
       ))) : (s = await this.sessionServer.userStorage.getUsers(
         t,
         e
-      ), s.length == e && (a = await this.sessionServer.userStorage.getUsers(
+      ), s.length == e && (i = await this.sessionServer.userStorage.getUsers(
         t + e,
         1
       ))), {
@@ -4155,17 +4165,17 @@ class ke {
         users: s,
         skip: t,
         take: e,
-        hasPrevious: i.length > 0,
-        hasNext: a.length > 0,
+        hasPrevious: a.length > 0,
+        hasNext: i.length > 0,
         search: o
       };
     } catch (s) {
-      const i = c.asCrossauthError(s);
-      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
+      const a = c.asCrossauthError(s);
+      return d.logger.debug(f({ err: a })), d.logger.error(f({ cerr: a })), {
         ok: !1,
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         hasPrevious: !1,
         hasNext: !1,
         skip: t ?? 0,
@@ -4211,7 +4221,7 @@ class ke {
       if (!this.sessionServer.userStorage) throw new c(h.Configuration, "Must provide user storage to use this function");
       var e = new b();
       if (await e.loadData(o), t = e.toObject(), (!o.locals.user || !p.isAdminFn(o.locals.user)) && this.sessionServer.error(401), this.isSessionUser(o) && this.sessionServer.enableCsrfProtection && !o.locals.csrfToken) throw new c(h.InvalidCsrf);
-      const s = r.factor2, i = r.state;
+      const s = r.factor2, a = r.state;
       r.state = t.state ?? "active", r = this.sessionServer.updateUserFn(
         r,
         o,
@@ -4221,10 +4231,10 @@ class ke {
           ...this.sessionServer.userStorage.adminEditableFields
         }
       );
-      const a = r.factor2 && r.factor2 != "none" && r.factor2 != s;
-      if (a && !(r.state == i || r.state == "factor2ResetNeeded"))
+      const i = r.factor2 && r.factor2 != "none" && r.factor2 != s;
+      if (i && !(r.state == a || r.state == "factor2ResetNeeded"))
         throw new c(h.BadRequest, "Cannot change both factor2 and state at the same time");
-      a && (r.state = N.factor2ResetNeeded, d.logger.warn(u({
+      i && (r.state = N.factor2ResetNeeded, d.logger.warn(f({
         msg: `Setting state for user to ${N.factor2ResetNeeded}`,
         username: r.username
       })));
@@ -4232,19 +4242,19 @@ class ke {
       if (n.length > 0)
         throw new c(h.FormEntry, n);
       const l = await this.sessionServer.sessionManager.updateUser(r, r, !0, !0);
-      let f;
-      return l.emailVerificationTokenSent ? f = "An email verification token has been sent to the user" : l.passwordResetTokenSent && (f = "A password reset token has been sent to the user"), {
+      let u;
+      return l.emailVerificationTokenSent ? u = "An email verification token has been sent to the user" : l.passwordResetTokenSent && (u = "A password reset token has been sent to the user"), {
         ok: !0,
         formData: t,
-        info: f
+        info: u
       };
     } catch (s) {
       if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s, 401)) throw s;
-      let i = c.asCrossauthError(s, "Couldn't log in");
-      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+      let a = c.asCrossauthError(s, "Couldn't log in");
+      return d.logger.debug(f({ err: a })), d.logger.error(f({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1,
         formData: t
       };
@@ -4270,26 +4280,26 @@ class ke {
        *   - `formData` the form fields extracted from the request
        */
   async changePassword(r, o) {
-    d.logger.debug(u({ msg: "changePassword" }));
+    d.logger.debug(f({ msg: "changePassword" }));
     let t;
     try {
       var e = new b();
       if (await e.loadData(o), t = e.toObject(), (!o.locals.user || !p.isAdminFn(o.locals.user)) && this.sessionServer.error(401), this.isSessionUser(o) && this.sessionServer.enableCsrfProtection && !o.locals.csrfToken)
         throw new c(h.InvalidCsrf);
-      const s = this.sessionServer.authenticators[r.factor1], i = s.secretNames();
-      let a = {}, n = {}, l = {};
+      const s = this.sessionServer.authenticators[r.factor1], a = s.secretNames();
+      let i = {}, n = {}, l = {};
       for (let g in t)
         if (g.startsWith("new_")) {
           const w = g.replace(/^new_/, "");
-          i.includes(w) && (n[w] = t[g]);
+          a.includes(w) && (n[w] = t[g]);
         } else if (g.startsWith("old_")) {
           const w = g.replace(/^old_/, "");
-          i.includes(w) && (a[w] = t[g]);
+          a.includes(w) && (i[w] = t[g]);
         } else if (g.startsWith("repeat_")) {
           const w = g.replace(/^repeat_/, "");
-          i.includes(w) && (l[w] = t[g]);
+          a.includes(w) && (l[w] = t[g]);
         }
-      if (Object.keys(l).length === 0 && (l = void 0), Object.keys(a).length === 0 && (a = void 0), s.validateSecrets(n).length > 0)
+      if (Object.keys(l).length === 0 && (l = void 0), Object.keys(i).length === 0 && (i = void 0), s.validateSecrets(n).length > 0)
         throw new c(h.PasswordFormat);
       try {
         await this.sessionServer.sessionManager.changeSecrets(
@@ -4297,11 +4307,11 @@ class ke {
           1,
           n,
           l,
-          a
+          i
         );
       } catch (g) {
         const w = c.asCrossauthError(g);
-        throw d.logger.debug(u({ err: g })), w;
+        throw d.logger.debug(f({ err: g })), w;
       }
       return {
         ok: !0,
@@ -4309,11 +4319,11 @@ class ke {
       };
     } catch (s) {
       if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s, 401)) throw s;
-      let i = c.asCrossauthError(s, "Couldn't change password");
-      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+      let a = c.asCrossauthError(s, "Couldn't change password");
+      return d.logger.debug(f({ err: a })), d.logger.error(f({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1,
         formData: t
       };
@@ -4388,21 +4398,21 @@ class ke {
           ...this.sessionServer.userStorage.adminEditableFields
         }
       );
-      const i = this.sessionServer.authenticators[s.factor1].secretNames();
-      let a = !0;
-      for (let m of i)
-        !o[m] && !o["repeat_" + m] && (a = !1);
+      const a = this.sessionServer.authenticators[s.factor1].secretNames();
+      let i = !0;
+      for (let m of a)
+        !o[m] && !o["repeat_" + m] && (i = !1);
       let n = [], l = {};
-      if (a) {
+      if (i) {
         n = this.sessionServer.authenticators[s.factor1].validateSecrets(o);
         for (let m in o)
           if (m.startsWith("repeat_")) {
             const S = m.replace(/^repeat_/, "");
-            i.includes(S) && (l[S] = o[m]);
+            a.includes(S) && (l[S] = o[m]);
           }
         Object.keys(l).length === 0 && (l = void 0);
       }
-      a ? o.factor2 != null && (s.state = N.factor2ResetNeeded) : o.factor2 == null ? s.state = N.passwordResetNeeded : s.state = N.passwordAndFactor2ResetNeeded;
+      i ? o.factor2 != null && (s.state = N.factor2ResetNeeded) : o.factor2 == null ? s.state = N.passwordResetNeeded : s.state = N.passwordAndFactor2ResetNeeded;
       let g = [...this.sessionServer.validateUserFn(s), ...n];
       if (g.length > 0)
         throw new c(h.FormEntry, g);
@@ -4411,9 +4421,9 @@ class ke {
         o,
         l,
         !0,
-        !a
+        !i
       );
-      if (!a) {
+      if (!i) {
         let m = o.username;
         if ("user_email" in o && (m = o.user_email), oe.validateEmail(m), !m) throw new c(h.FormEntry, "No password given but no email address found either");
         await this.sessionServer.sessionManager.requestPasswordReset(m);
@@ -4421,7 +4431,7 @@ class ke {
       return { ok: !0, user: w, formData: o };
     } catch (e) {
       let s = c.asCrossauthError(e, "Couldn't create user");
-      return d.logger.debug(u({ err: s })), d.logger.error(u({ cerr: s })), {
+      return d.logger.debug(f({ err: s })), d.logger.error(f({ cerr: s })), {
         error: s.message,
         errorCode: s.code,
         errorCodeName: s.codeName,
@@ -4444,7 +4454,7 @@ class ke {
        *     exception was raised
        */
   async deleteUser(r) {
-    if (d.logger.debug(u({ msg: "deleteUser" })), !this.sessionServer.userStorage) throw new c(h.Configuration, "Must provide user storage to use this function");
+    if (d.logger.debug(f({ msg: "deleteUser" })), !this.sessionServer.userStorage) throw new c(h.Configuration, "Must provide user storage to use this function");
     try {
       const o = r.params.id;
       if (!o) throw new c(h.BadRequest, "User ID is undefined");
@@ -4455,7 +4465,7 @@ class ke {
       };
     } catch (o) {
       let t = c.asCrossauthError(o, "Couldn't delete account");
-      return d.logger.debug(u({ err: t })), d.logger.error(u({ cerr: t })), {
+      return d.logger.debug(f({ err: t })), d.logger.error(f({ cerr: t })), {
         error: t.message,
         errorCode: t.code,
         errorCodeName: t.codeName,
@@ -4487,18 +4497,18 @@ async function Se(k, r, o, t, e) {
   let s = [];
   if (o > 0) return [];
   try {
-    const i = await r.getClientById(k);
-    s.push(i);
-  } catch (i) {
-    const a = c.asCrossauthError(i);
-    if (a.code != h.UserNotExist)
-      throw d.logger.debug(u({ err: a })), a;
+    const a = await r.getClientById(k);
+    s.push(a);
+  } catch (a) {
+    const i = c.asCrossauthError(a);
+    if (i.code != h.UserNotExist)
+      throw d.logger.debug(f({ err: i })), i;
     try {
       s = await r.getClientByName(k, e);
     } catch (n) {
       const l = c.asCrossauthError(n);
       if (l.code != h.UserNotExist)
-        throw d.logger.debug(u({ err: l })), a;
+        throw d.logger.debug(f({ err: l })), i;
     }
   }
   return s;
@@ -4557,61 +4567,61 @@ class X {
       if (!this.sessionServer.clientStorage) throw new c(h.Configuration, "Must provide client storage to use this function");
       if (!r.locals.user)
         throw this.redirect(302, this.loginUrl + "?next=" + encodeURIComponent(r.request.url));
-      let i = [], a = [], n = [];
+      let a = [], i = [], n = [];
       if (!t)
         try {
-          const f = r.url.searchParams.get("skip");
-          f && (t = parseInt(f));
-        } catch (f) {
-          d.logger.warn(u({ cerr: f, msg: "skip parameter is not an integer" }));
+          const u = r.url.searchParams.get("skip");
+          u && (t = parseInt(u));
+        } catch (u) {
+          d.logger.warn(f({ cerr: u, msg: "skip parameter is not an integer" }));
         }
       if (t || (t = 0), !e)
         try {
-          const f = r.url.searchParams.get("take");
-          f && (e = parseInt(f));
-        } catch (f) {
-          d.logger.warn(u({ cerr: f, msg: "take parameter is not an integer" }));
+          const u = r.url.searchParams.get("take");
+          u && (e = parseInt(u));
+        } catch (u) {
+          d.logger.warn(f({ cerr: u, msg: "take parameter is not an integer" }));
         }
       e || (e = 10);
       const l = r.url.searchParams.get("search");
-      return !o && l != null && l != "" && (o = l), o || (o = ""), o.length == 0 && (o = void 0), o ? (i = await this.clientSearchFn(
+      return !o && l != null && l != "" && (o = l), o || (o = ""), o.length == 0 && (o = void 0), o ? (a = await this.clientSearchFn(
         o,
         this.sessionServer.clientStorage,
         t,
         e
-      ), t > 0 && (a = await this.clientSearchFn(
+      ), t > 0 && (i = await this.clientSearchFn(
         o,
         this.sessionServer.clientStorage,
         t - 1,
         1,
         s
-      ))) : (i = await this.sessionServer.clientStorage.getClients(
+      ))) : (a = await this.sessionServer.clientStorage.getClients(
         t,
         e,
         s
-      ), i.length == e && (n = await this.sessionServer.clientStorage.getClients(
+      ), a.length == e && (n = await this.sessionServer.clientStorage.getClients(
         t + e,
         1,
         s
       ))), {
         ok: !0,
-        clients: i,
+        clients: a,
         skip: t,
         take: e,
-        hasPrevious: a.length > 0,
+        hasPrevious: i.length > 0,
         hasNext: n.length > 0,
         search: o,
         clientUserId: s
       };
-    } catch (i) {
-      if (p.isSvelteKitRedirect(i) || p.isSvelteKitRedirect(i))
-        throw i;
-      const a = c.asCrossauthError(i);
-      return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
+    } catch (a) {
+      if (p.isSvelteKitRedirect(a) || p.isSvelteKitRedirect(a))
+        throw a;
+      const i = c.asCrossauthError(a);
+      return d.logger.debug(f({ err: i })), d.logger.error(f({ cerr: i })), {
         ok: !1,
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         hasPrevious: !1,
         hasNext: !1,
         skip: t ?? 0,
@@ -4634,21 +4644,21 @@ class X {
     try {
       if (!o) throw new c(h.BadRequest, "No client ID specified");
       if (!this.clientStorage) throw new c(h.Configuration, "No client storage specified");
-      const i = await this.clientStorage.getClientById(o), a = i.userid == null ? void 0 : await ((e = (t = this.sessionServer) == null ? void 0 : t.userStorage) == null ? void 0 : e.getUserById(i.userid)), n = (s = a == null ? void 0 : a.user) == null ? void 0 : s.username;
+      const a = await this.clientStorage.getClientById(o), i = a.userid == null ? void 0 : await ((e = (t = this.sessionServer) == null ? void 0 : t.userStorage) == null ? void 0 : e.getUserById(a.userid)), n = (s = i == null ? void 0 : i.user) == null ? void 0 : s.username;
       return {
         ok: !0,
-        client: i,
+        client: a,
         validFlows: this.validFlows,
         valid_flowNames: this.valid_flowNames,
         client_id: o,
         clientUsername: n
       };
-    } catch (i) {
-      let a = c.asCrossauthError(i, "Couldn't load client");
-      return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+    } catch (a) {
+      let i = c.asCrossauthError(a, "Couldn't load client");
+      return d.logger.debug(f({ err: i })), d.logger.error(f({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1,
         validFlows: this.validFlows,
         valid_flowNames: this.valid_flowNames,
@@ -4669,11 +4679,11 @@ class X {
    * @returns {@link UpdateClientFormData}.  If a new secret was created, it will be placed as plaintext in the client that is returned.
    */
   async updateClient_internal(r, o) {
-    var s, i;
+    var s, a;
     let t;
     try {
-      const a = r.params.client_id;
-      if (!a) throw new c(h.BadRequest, "No client ID given");
+      const i = r.params.client_id;
+      if (!i) throw new c(h.BadRequest, "No client ID given");
       var e = new b();
       if (await e.loadData(r), t = e.toObject(), this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
         throw new c(h.InvalidCsrf);
@@ -4683,21 +4693,21 @@ class X {
         try {
           B.validateUri(C);
         } catch (T) {
-          d.logger.error(u({ err: T })), l.push("[" + C + "]");
+          d.logger.error(f({ err: T })), l.push("[" + C + "]");
         }
       if (l.length > 0)
         throw new c(
           h.BadRequest,
           "The following redirect URIs are invalid: " + l.join(" ")
         );
-      let f = [];
+      let u = [];
       for (let C of this.validFlows)
-        C in t && f.push(C);
+        C in t && u.push(C);
       const g = {};
-      if (g.client_name = t.client_name, g.confidential = e.getAsBoolean("confidential") ?? !1, g.valid_flow = f, g.redirect_uri = n, o) {
+      if (g.client_name = t.client_name, g.confidential = e.getAsBoolean("confidential") ?? !1, g.valid_flow = u, g.redirect_uri = n, o) {
         let C = t.userid ?? void 0;
         if (C && ((s = this.sessionServer) != null && s.userStorage)) {
-          const { user: T } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
+          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
           C = T.id;
         }
         g.userid = t.userid ? Number(t.userid) : null;
@@ -4705,7 +4715,7 @@ class X {
       const w = e.getAsBoolean("resetSecret");
       if (!this.clientManager) throw new c(h.Configuration, "Cannot call this endpoint as you did not provide a clientStorage");
       const { client: m, newSecret: S } = await this.clientManager.updateClient(
-        a,
+        i,
         g,
         w
       );
@@ -4716,10 +4726,10 @@ class X {
         //plaintextSecret: resetSecret ? formData.client_secret : undefined,
         plaintextSecret: S && m.client_secret ? m.client_secret : void 0
       };
-    } catch (a) {
-      if (p.isSvelteKitRedirect(a) || p.isSvelteKitError(a)) throw a;
-      let n = c.asCrossauthError(a, "Couldn't update client");
-      return d.logger.debug(u({ err: n })), d.logger.error(u({ cerr: n })), {
+    } catch (i) {
+      if (p.isSvelteKitRedirect(i) || p.isSvelteKitError(i)) throw i;
+      let n = c.asCrossauthError(i, "Couldn't update client");
+      return d.logger.debug(f({ err: n })), d.logger.error(f({ cerr: n })), {
         error: n.message,
         errorCode: n.code,
         errorCodeName: n.codeName,
@@ -4737,7 +4747,7 @@ class X {
    * @returns {@link CreateClientPageData}.  
    */
   async emptyClient_internal(r, o) {
-    var e, s, i, a, n, l, f;
+    var e, s, a, i, n, l, u;
     try {
       var t = new b();
       await t.loadData(r);
@@ -4749,8 +4759,8 @@ class X {
           g = T.id;
         }
         const C = t.get("userid");
-        if (C && ((i = this.sessionServer) != null && i.userStorage)) {
-          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
+        if (C && ((a = this.sessionServer) != null && a.userStorage)) {
+          const { user: T } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
           g = T.id;
         }
       } else {
@@ -4758,7 +4768,7 @@ class X {
         g = r.locals.user.id;
       }
       if (!this.clientStorage) throw new c(h.Configuration, "No client storage specified");
-      const w = g == null ? void 0 : await ((l = (n = this.sessionServer) == null ? void 0 : n.userStorage) == null ? void 0 : l.getUserById(g)), m = (f = w == null ? void 0 : w.user) == null ? void 0 : f.username;
+      const w = g == null ? void 0 : await ((l = (n = this.sessionServer) == null ? void 0 : n.userStorage) == null ? void 0 : l.getUserById(g)), m = (u = w == null ? void 0 : w.user) == null ? void 0 : u.username;
       return {
         ok: !0,
         validFlows: this.validFlows,
@@ -4768,7 +4778,7 @@ class X {
       };
     } catch (g) {
       let w = c.asCrossauthError(g, "Couldn't initialize new client");
-      return d.logger.debug(u({ err: w })), d.logger.error(u({ cerr: w })), {
+      return d.logger.debug(f({ err: w })), d.logger.error(f({ cerr: w })), {
         error: w.message,
         errorCode: w.code,
         errorCodeName: w.codeName,
@@ -4790,7 +4800,7 @@ class X {
    * @returns {@link UpdateClientFormData}.  If a secret was created, it will be placed as plaintext in the client that is returned.  A random `client_id` is created.
    */
   async createClient_internal(r, o) {
-    var s, i, a, n;
+    var s, a, i, n;
     let t;
     try {
       var e = new b();
@@ -4799,7 +4809,7 @@ class X {
       if (o) {
         const C = e.get("userid");
         if (C && ((s = this.sessionServer) != null && s.userStorage)) {
-          const { user: T } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
+          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
           l = T.id;
         }
       } else {
@@ -4807,15 +4817,15 @@ class X {
         l = r.locals.user.id;
       }
       if (!this.clientStorage) throw new c(h.Configuration, "No client storage specified");
-      if (l && await ((n = (a = this.sessionServer) == null ? void 0 : a.userStorage) == null ? void 0 : n.getUserById(l)), this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
+      if (l && await ((n = (i = this.sessionServer) == null ? void 0 : i.userStorage) == null ? void 0 : n.getUserById(l)), this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
         throw new c(h.InvalidCsrf);
-      const f = !t.redirect_uri || t.redirect_uri.trim().length == 0 ? [] : t.redirect_uri.trim().split(/[, ][ \t\n]*/);
+      const u = !t.redirect_uri || t.redirect_uri.trim().length == 0 ? [] : t.redirect_uri.trim().split(/[, ][ \t\n]*/);
       let g = [];
-      for (let C of f)
+      for (let C of u)
         try {
           B.validateUri(C);
         } catch (T) {
-          d.logger.error(u({ err: T })), g.push("[" + C + "]");
+          d.logger.error(f({ err: T })), g.push("[" + C + "]");
         }
       if (g.length > 0)
         throw new c(
@@ -4826,12 +4836,12 @@ class X {
       for (let C of this.validFlows)
         C in t && w.push(C);
       const m = {};
-      if (m.client_name = t.client_name, m.confidential = e.getAsBoolean("confidential"), m.valid_flow = w, m.redirect_uri = f, o && (m.userid = t.userid ? Number(t.userid) : null), !this.clientManager) throw new c(h.Configuration, "Cannot call this endpoint as you did not provide a clientStorage");
+      if (m.client_name = t.client_name, m.confidential = e.getAsBoolean("confidential"), m.valid_flow = w, m.redirect_uri = u, o && (m.userid = t.userid ? Number(t.userid) : null), !this.clientManager) throw new c(h.Configuration, "Cannot call this endpoint as you did not provide a clientStorage");
       return {
         ok: !0,
         client: await this.clientManager.createClient(
           t.client_name,
-          f,
+          u,
           w,
           e.getAsBoolean("confidential") ?? !1,
           l
@@ -4840,11 +4850,11 @@ class X {
       };
     } catch (l) {
       if (p.isSvelteKitRedirect(l) || p.isSvelteKitError(l)) throw l;
-      let f = c.asCrossauthError(l, "Couldn't create client");
-      return d.logger.debug(u({ err: f })), d.logger.error(u({ cerr: f })), {
-        error: f.message,
-        errorCode: f.code,
-        errorCodeName: f.codeName,
+      let u = c.asCrossauthError(l, "Couldn't create client");
+      return d.logger.debug(f({ err: u })), d.logger.error(f({ cerr: u })), {
+        error: u.message,
+        errorCode: u.code,
+        errorCodeName: u.codeName,
         ok: !1,
         formData: t
       };
@@ -4863,19 +4873,19 @@ class X {
     try {
       if (!o) throw new c(h.BadRequest, "No client ID specified");
       if (!this.clientStorage) throw new c(h.Configuration, "No client storage specified");
-      const i = await this.clientStorage.getClientById(o), a = i.userid == null ? void 0 : await ((e = (t = this.sessionServer) == null ? void 0 : t.userStorage) == null ? void 0 : e.getUserById(i.userid)), n = (s = a == null ? void 0 : a.user) == null ? void 0 : s.username;
+      const a = await this.clientStorage.getClientById(o), i = a.userid == null ? void 0 : await ((e = (t = this.sessionServer) == null ? void 0 : t.userStorage) == null ? void 0 : e.getUserById(a.userid)), n = (s = i == null ? void 0 : i.user) == null ? void 0 : s.username;
       return {
         ok: !0,
-        client: i,
+        client: a,
         client_id: o,
         clientUsername: n
       };
-    } catch (i) {
-      let a = c.asCrossauthError(i, "Couldn't load client");
-      return d.logger.debug(u({ err: a })), d.logger.error(u({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+    } catch (a) {
+      let i = c.asCrossauthError(a, "Couldn't load client");
+      return d.logger.debug(f({ err: i })), d.logger.error(f({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1,
         client_id: o
       };
@@ -4896,19 +4906,19 @@ class X {
       const s = r.params.client_id;
       if (!s) throw new c(h.BadRequest, "No client ID given");
       if (!this.clientStorage) throw new c(h.Configuration, "No client storage specified");
-      const i = await ((t = this.clientStorage) == null ? void 0 : t.getClientById(s));
-      if (!o && i.userid != ((e = r.locals.user) == null ? void 0 : e.id))
+      const a = await ((t = this.clientStorage) == null ? void 0 : t.getClientById(s));
+      if (!o && a.userid != ((e = r.locals.user) == null ? void 0 : e.id))
         throw this.error(401, "Unauthorized");
       return await this.clientStorage.deleteClient(s), {
         ok: !0
       };
     } catch (s) {
       if (p.isSvelteKitRedirect(s) || p.isSvelteKitError(s)) throw s;
-      let i = c.asCrossauthError(s, "Couldn't delete client");
-      return d.logger.debug(u({ err: i })), d.logger.error(u({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+      let a = c.asCrossauthError(s, "Couldn't delete client");
+      return d.logger.debug(f({ err: a })), d.logger.error(f({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1
       };
     }
@@ -5005,7 +5015,7 @@ class Ce extends X {
     } catch (t) {
       if (p.isSvelteKitRedirect(t) || p.isSvelteKitError(t)) throw t;
       const e = c.asCrossauthError(t);
-      return d.logger.debug(u({ err: e })), d.logger.error(u({ cerr: e })), {
+      return d.logger.debug(f({ err: e })), d.logger.error(f({ cerr: e })), {
         ok: !1,
         error: e.message,
         errorCode: e.code,
@@ -5031,7 +5041,7 @@ class Ce extends X {
     } catch (t) {
       if (p.isSvelteKitRedirect(t) || p.isSvelteKitError(t)) throw t;
       const e = c.asCrossauthError(t);
-      return d.logger.debug(u({ err: e })), d.logger.error(u({ cerr: e })), {
+      return d.logger.debug(f({ err: e })), d.logger.error(f({ cerr: e })), {
         ok: !1,
         error: e.message,
         errorCode: e.code,
@@ -5055,7 +5065,7 @@ class Ce extends X {
     } catch (t) {
       if (p.isSvelteKitRedirect(t) || p.isSvelteKitError(t)) throw t;
       const e = c.asCrossauthError(t);
-      return d.logger.debug(u({ err: e })), d.logger.error(u({ cerr: e })), {
+      return d.logger.debug(f({ err: e })), d.logger.error(f({ cerr: e })), {
         ok: !1,
         error: e.message,
         errorCode: e.code,
@@ -5079,7 +5089,7 @@ class Ce extends X {
     } catch (t) {
       if (p.isSvelteKitRedirect(t) || p.isSvelteKitError(t)) throw t;
       const e = c.asCrossauthError(t);
-      return d.logger.debug(u({ err: e })), d.logger.error(u({ cerr: e })), {
+      return d.logger.debug(f({ err: e })), d.logger.error(f({ cerr: e })), {
         ok: !1,
         error: e.message,
         errorCode: e.code,
@@ -5118,7 +5128,7 @@ class ye extends X {
         try {
           e = t.url.searchParams.get("userid") ? Number(t.url.searchParams.get("userid")) : void 0;
         } catch {
-          d.logger.warn(u({ msg: "Invalid userid " + t.url.searchParams.get("userid") }));
+          d.logger.warn(f({ msg: "Invalid userid " + t.url.searchParams.get("userid") }));
         }
         const s = await this.searchClients(t, void 0, void 0, void 0, e);
         return {
@@ -5226,46 +5236,46 @@ function Ee(k) {
   return k.username == null ? r.push("Username must be given") : k.username.length < 2 ? r.push("Username must be at least 2 characters") : k.username.length > 254 && r.push("Username must be no longer than 254 characters"), r;
 }
 function _e(k, r, o) {
-  var i;
+  var a;
   let e = {
     username: r.username ?? "",
     state: "active"
   };
   const s = k.locals.user && p.isAdminFn(k.locals.user);
-  for (let a in r) {
-    let n = a.replace(/^user_/, "");
-    if (a.startsWith("user_") && (s || o.includes(n)))
+  for (let i in r) {
+    let n = i.replace(/^user_/, "");
+    if (i.startsWith("user_") && (s || o.includes(n)))
       if ("type_" + n in r) {
         if (r["type_" + n] == "string")
-          e[n] = r[a];
+          e[n] = r[i];
         else if (r["type_" + n] == "number" || r["type_" + n] == "integer" || r["type_" + n] == "float")
-          e[n] = Number(r[a]);
+          e[n] = Number(r[i]);
         else if (r["type_" + n] == "boolean") {
-          const l = (i = r[a]) == null ? void 0 : i.toLocaleLowerCase();
+          const l = (a = r[i]) == null ? void 0 : a.toLocaleLowerCase();
           e[n] = l == "1" || l == "y" || l == "t" || l == "yes" || l == "true";
         }
       } else
-        e[n] = r[a];
+        e[n] = r[i];
   }
   return e.factor1 = "localpassword", e.factor2 = r.factor2, e;
 }
 function ve(k, r, o, t) {
   var s;
   const e = r.locals.user && p.isAdminFn(r.locals.user);
-  for (let i in o) {
-    let a = i.replace(/^user_/, "");
-    if (i.startsWith("user_") && (e || t.includes(a)))
-      if ("type_" + a in o) {
-        if (o["type_" + a] == "string")
-          k[a] = o[i];
-        else if (o["type_" + a] == "number" || o["type_" + a] == "integer" || o["type_" + a] == "float")
-          k[a] = Number(o[i]);
-        else if (o["type_" + a] == "boolean") {
-          const n = (s = o[i]) == null ? void 0 : s.toLocaleLowerCase();
-          k[a] = n == "1" || n == "y" || n == "t" || n == "yes" || n == "true";
+  for (let a in o) {
+    let i = a.replace(/^user_/, "");
+    if (a.startsWith("user_") && (e || t.includes(i)))
+      if ("type_" + i in o) {
+        if (o["type_" + i] == "string")
+          k[i] = o[a];
+        else if (o["type_" + i] == "number" || o["type_" + i] == "integer" || o["type_" + i] == "float")
+          k[i] = Number(o[a]);
+        else if (o["type_" + i] == "boolean") {
+          const n = (s = o[a]) == null ? void 0 : s.toLocaleLowerCase();
+          k[i] = n == "1" || n == "y" || n == "t" || n == "yes" || n == "true";
         }
       } else
-        k[a] = o[i];
+        k[i] = o[a];
   }
   return k;
 }
@@ -5292,63 +5302,63 @@ class H {
           configurable: !1
         });
     y("enableEmailVerification", E.Boolean, this, t, "ENABLE_EMAIL_VERIFICATION"), y("enablePasswordReset", E.Boolean, this, t, "ENABLE_PASSWORD_RESET"), y("enableCsrfProtection", E.Boolean, this, t, "ENABLE_CSRF_PROTECTION"), y("editUserScope", E.String, this, t, "EDIT_USER_SCOPE"), t.validateUserFn && (this.validateUserFn = t.validateUserFn), t.createUserFn && (this.createUserFn = t.createUserFn), t.updateUserFn && (this.updateUserFn = t.updateUserFn), t.addToSession && (this.addToSession = t.addToSession), t.validateSession && (this.validateSession = t.validateSession), this.userEndpoints = new we(this, t), this.adminEndpoints = new ke(this, t), this.userClientEndpoints = new Ce(this, t), this.adminClientEndpoints = new ye(this, t), this.sessionHook = async ({ event: s }) => {
-      var f, g;
+      var u, g;
       d.logger.debug("Session hook");
-      let i = [];
-      const a = this.sessionManager.csrfCookieName, n = this.sessionManager.sessionCookieName;
+      let a = [];
+      const i = this.sessionManager.csrfCookieName, n = this.sessionManager.sessionCookieName;
       if (this.enableCsrfProtection) {
-        d.logger.debug(u({ msg: "Getting csrf cookie" }));
+        d.logger.debug(f({ msg: "Getting csrf cookie" }));
         let w;
         try {
           w = this.getCsrfCookieValue(s), w && this.sessionManager.validateCsrfCookie(w);
         } catch (m) {
-          d.logger.warn(u({ msg: "Invalid csrf cookie received", cerr: m, hashedCsrfCookie: this.getHashOfCsrfCookie(s) }));
+          d.logger.warn(f({ msg: "Invalid csrf cookie received", cerr: m, hashedCsrfCookie: this.getHashOfCsrfCookie(s) }));
           try {
-            this.clearCookie(a, this.sessionManager.csrfCookiePath, s);
+            this.clearCookie(i, this.sessionManager.csrfCookiePath, s);
           } catch (S) {
-            d.logger.debug(u({ err: S })), d.logger.error(u({ cerr: S, msg: "Couldn't delete CSRF cookie", ip: s.request.referrer, hashedCsrfCookie: this.getHashOfCsrfCookie(s) }));
+            d.logger.debug(f({ err: S })), d.logger.error(f({ cerr: S, msg: "Couldn't delete CSRF cookie", ip: s.request.referrer, hashedCsrfCookie: this.getHashOfCsrfCookie(s) }));
           }
           w = void 0, s.locals.csrfToken = void 0;
         }
         if (["GET", "OPTIONS", "HEAD"].includes(s.request.method))
           try {
             if (w) {
-              d.logger.debug(u({ msg: "Valid CSRF cookie - creating token" }));
+              d.logger.debug(f({ msg: "Valid CSRF cookie - creating token" }));
               const m = await this.sessionManager.createCsrfFormOrHeaderValue(w);
               s.locals.csrfToken = m;
             } else {
-              d.logger.debug(u({ msg: "Invalid CSRF cookie - recreating" }));
+              d.logger.debug(f({ msg: "Invalid CSRF cookie - recreating" }));
               const { csrfCookie: m, csrfFormOrHeaderValue: S } = await this.sessionManager.createCsrfToken();
               this.setCsrfCookie(m, s), s.locals.csrfToken = S;
             }
-            this.setHeader(x, s.locals.csrfToken, i);
+            this.setHeader(x, s.locals.csrfToken, a);
           } catch (m) {
-            d.logger.error(u({ msg: "Couldn't create CSRF token", cerr: m, user: (f = s.locals.user) == null ? void 0 : f.username, hashedSessionCookie: this.getHashOfSessionCookie(s) })), d.logger.debug(u({ err: m })), this.clearCookie(a, this.sessionManager.csrfCookiePath, s), s.locals.csrfToken = void 0;
+            d.logger.error(f({ msg: "Couldn't create CSRF token", cerr: m, user: (u = s.locals.user) == null ? void 0 : u.username, hashedSessionCookie: this.getHashOfSessionCookie(s) })), d.logger.debug(f({ err: m })), this.clearCookie(i, this.sessionManager.csrfCookiePath, s), s.locals.csrfToken = void 0;
           }
         else if (w)
           try {
-            await this.csrfToken(s, i);
+            await this.csrfToken(s, a);
           } catch (m) {
-            d.logger.error(u({ msg: "Couldn't create CSRF token", cerr: m, user: (g = s.locals.user) == null ? void 0 : g.username, hashedSessionCookie: this.getHashOfSessionCookie(s) })), d.logger.debug(u({ err: m }));
+            d.logger.error(f({ msg: "Couldn't create CSRF token", cerr: m, user: (g = s.locals.user) == null ? void 0 : g.username, hashedSessionCookie: this.getHashOfSessionCookie(s) })), d.logger.debug(f({ err: m }));
           }
       }
       s.locals.user = void 0, s.locals.authType = void 0;
       const l = this.getSessionCookieValue(s);
-      if (d.logger.debug(u({ msg: "Getting session cookie" })), l)
+      if (d.logger.debug(f({ msg: "Getting session cookie" })), l)
         try {
           const w = this.sessionManager.getSessionId(l);
           let { key: m, user: S } = await this.sessionManager.userForSessionId(w);
-          this.validateSession && this.validateSession(m, S, s), s.locals.sessionId = w, s.locals.user = S, s.locals.authType = "cookie", d.logger.debug(u({ msg: "Valid session id", user: S == null ? void 0 : S.username }));
+          this.validateSession && this.validateSession(m, S, s), s.locals.sessionId = w, s.locals.user = S, s.locals.authType = "cookie", d.logger.debug(f({ msg: "Valid session id", user: S == null ? void 0 : S.username }));
         } catch {
-          d.logger.warn(u({ msg: "Invalid session cookie received", hashedSessionCookie: this.getHashOfSessionCookie(s) })), this.clearCookie(n, this.sessionManager.sessionCookiePath, s);
+          d.logger.warn(f({ msg: "Invalid session cookie received", hashedSessionCookie: this.getHashOfSessionCookie(s) })), this.clearCookie(n, this.sessionManager.sessionCookiePath, s);
         }
-      return { headers: i };
+      return { headers: a };
     }, this.twoFAHook = async ({ event: s }) => {
-      var f;
-      if (d.logger.debug(u({ msg: "twoFAHook", username: (f = s.locals.user) == null ? void 0 : f.username })), !this.userStorage) throw this.error(500, "No user storage defined");
-      const i = this.getSessionCookieValue(s), a = this.isFactor2PageProtected(s), n = this.isFactor2ApiProtected(s);
+      var u;
+      if (d.logger.debug(f({ msg: "twoFAHook", username: (u = s.locals.user) == null ? void 0 : u.username })), !this.userStorage) throw this.error(500, "No user storage defined");
+      const a = this.getSessionCookieValue(s), i = this.isFactor2PageProtected(s), n = this.isFactor2ApiProtected(s);
       let l;
-      if (i)
+      if (a)
         if (s.locals.user) l = s.locals.user;
         else {
           const g = await this.getSessionData(s, "user");
@@ -5357,25 +5367,25 @@ class H {
             (w.user.status == N.active || w.user.state == N.factor2ResetNeeded) && (l = w.user);
           }
         }
-      if (l && i && l.factor2 != "" && (a || n))
-        if (d.logger.debug(u({ msg: "Factor2-protected endpoint visited" })), ["GET", "OPTIONS", "HEAD"].includes(s.request.method)) {
-          d.logger.debug(u({ msg: "Factor2-protected GET endpoint - cancelling 2FA" }));
+      if (l && a && l.factor2 != "" && (i || n))
+        if (d.logger.debug(f({ msg: "Factor2-protected endpoint visited" })), ["GET", "OPTIONS", "HEAD"].includes(s.request.method)) {
+          d.logger.debug(f({ msg: "Factor2-protected GET endpoint - cancelling 2FA" }));
           const g = this.getSessionCookieValue(s);
           if (g) {
             const w = this.sessionManager.getSessionId(g);
             if ("pre2fa" in await this.sessionManager.dataForSessionId(w)) {
-              d.logger.debug(u({ msg: "Cancelling 2FA" }));
+              d.logger.debug(f({ msg: "Cancelling 2FA" }));
               try {
                 await this.sessionManager.cancelTwoFactorPageVisit(g);
               } catch (S) {
-                d.logger.debug(u({ err: S })), d.logger.error(u({ msg: "Failed cancelling 2FA", cerr: S, user: l.username, hashedSessionCookie: this.getHashOfSessionCookie(s) }));
+                d.logger.debug(f({ err: S })), d.logger.error(f({ msg: "Failed cancelling 2FA", cerr: S, user: l.username, hashedSessionCookie: this.getHashOfSessionCookie(s) }));
               }
             }
           }
         } else {
-          const g = this.sessionManager.getSessionId(i), w = await this.sessionManager.dataForSessionId(g);
+          const g = this.sessionManager.getSessionId(a), w = await this.sessionManager.dataForSessionId(g);
           if ("pre2fa" in w) {
-            d.logger.debug(u({ msg: "Completing 2FA" }));
+            d.logger.debug(f({ msg: "Completing 2FA" }));
             const m = this.authenticators[w.pre2fa.factor2], S = [...m.secretNames(), ...m.transientSecretNames()];
             let C = {};
             const T = new b();
@@ -5388,21 +5398,21 @@ class H {
             try {
               await this.sessionManager.completeTwoFactorPageVisit(C, s.locals.sessionId ?? "");
             } catch (U) {
-              A = c.asCrossauthError(U), d.logger.debug(u({ err: U }));
+              A = c.asCrossauthError(U), d.logger.debug(f({ err: U }));
               const z = c.asCrossauthError(U);
-              d.logger.error(u({ msg: A.message, cerr: U, user: T.get("username"), errorCode: z.code, errorCodeName: z.codeName }));
+              d.logger.error(f({ msg: A.message, cerr: U, user: T.get("username"), errorCode: z.code, errorCodeName: z.codeName }));
             }
             if (A)
               if (A.code == h.Expired) {
-                d.logger.debug(u({ msg: "Error - cancelling 2FA" }));
+                d.logger.debug(f({ msg: "Error - cancelling 2FA" }));
                 try {
                   await this.sessionManager.cancelTwoFactorPageVisit(R);
                 } catch (U) {
-                  d.logger.error(u({ msg: "Failed cancelling 2FA", cerr: U, user: l.username, hashedSessionCookie: this.getHashOfSessionCookie(s) })), d.logger.debug(u({ err: U }));
+                  d.logger.error(f({ msg: "Failed cancelling 2FA", cerr: U, user: l.username, hashedSessionCookie: this.getHashOfSessionCookie(s) })), d.logger.debug(f({ err: U }));
                 }
                 return this.error(401, { message: "Sorry, your code has expired" }), { ok: !1, twofa: !0 };
               } else
-                return a ? {
+                return i ? {
                   twofa: !0,
                   ok: !1,
                   response: new Response("", {
@@ -5427,7 +5437,7 @@ class H {
                 };
             return H.updateRequest(s, w.pre2fa.body, w.pre2fa["content-type"]), { twofa: !0, ok: !0 };
           } else {
-            if (d.logger.debug(u({ msg: "Starting 2FA", username: l.username })), this.enableCsrfProtection && !s.locals.csrfToken) {
+            if (d.logger.debug(f({ msg: "Starting 2FA", username: l.username })), this.enableCsrfProtection && !s.locals.csrfToken) {
               const C = new c(h.Forbidden, "CSRF token missing");
               return {
                 twofa: !0,
@@ -5450,7 +5460,7 @@ class H {
             const m = new b();
             await m.loadData(s);
             let S = s.request.headers.get("content-type");
-            return await this.sessionManager.initiateTwoFactorPageVisit(l, s.locals.sessionId ?? "", m.toObject(), s.request.url.replace(/\?.*$/, ""), S || void 0), a ? {
+            return await this.sessionManager.initiateTwoFactorPageVisit(l, s.locals.sessionId ?? "", m.toObject(), s.request.url.replace(/\?.*$/, ""), S || void 0), i ? {
               twofa: !0,
               ok: !0,
               response: new Response("", {
@@ -5573,21 +5583,21 @@ class H {
    * @returns the string CSRF token for inclusion in forms
    */
   async csrfToken(r, o) {
-    var e, s, i;
+    var e, s, a;
     let t;
     if (r.request.headers && r.request.headers.has(x.toLowerCase())) {
-      const a = r.request.headers.get(x.toLowerCase());
-      Array.isArray(a) ? t = a[0] : a && (t = a);
+      const i = r.request.headers.get(x.toLowerCase());
+      Array.isArray(i) ? t = i[0] : i && (t = i);
     }
     if (!t) {
       if (!((e = r.request) != null && e.body)) {
-        d.logger.warn(u({ msg: "Received CSRF header but not token", ip: r.request.referrerPolicy, hashedCsrfCookie: this.getHashOfCsrfCookie(r) }));
+        d.logger.warn(f({ msg: "Received CSRF header but not token", ip: r.request.referrerPolicy, hashedCsrfCookie: this.getHashOfCsrfCookie(r) }));
         return;
       }
-      const a = r.request.headers.get("content-type");
-      if (a == "application/json")
-        t = (await ((i = (s = r.request) == null ? void 0 : s.clone()) == null ? void 0 : i.json())).csrfToken;
-      else if (a == "application/x-www-form-urlencoded" || a == "multipart/form-data") {
+      const i = r.request.headers.get("content-type");
+      if (i == "application/json")
+        t = (await ((a = (s = r.request) == null ? void 0 : s.clone()) == null ? void 0 : a.json())).csrfToken;
+      else if (i == "application/x-www-form-urlencoded" || i == "multipart/form-data") {
         const l = (await r.request.clone().formData()).get("csrfToken");
         l && typeof l == "string" && (t = l);
       }
@@ -5596,7 +5606,7 @@ class H {
       try {
         this.sessionManager.validateDoubleSubmitCsrfToken(this.getCsrfCookieValue(r), t), r.locals.csrfToken = t, this.setHeader(x, t, o);
       } catch {
-        d.logger.warn(u({ msg: "Invalid CSRF token", hashedCsrfCookie: this.getHashOfCsrfCookie(r) })), this.clearCookie(this.sessionManager.csrfCookieName, this.sessionManager.csrfCookiePath, r), r.locals.csrfToken = void 0;
+        d.logger.warn(f({ msg: "Invalid CSRF token", hashedCsrfCookie: this.getHashOfCsrfCookie(r) })), this.clearCookie(this.sessionManager.csrfCookieName, this.sessionManager.csrfCookiePath, r), r.locals.csrfToken = void 0;
       }
     else
       r.locals.csrfToken = void 0;
@@ -5620,8 +5630,8 @@ class H {
     else {
       e = "";
       for (let s in o) {
-        const i = o[s];
-        e.length > 0 && (e += "&"), e += encodeURIComponent(s) + "=" + encodeURIComponent(i);
+        const a = o[s];
+        e.length > 0 && (e += "&"), e += encodeURIComponent(s) + "=" + encodeURIComponent(a);
       }
     }
     return r.request = new Request(r.request.url, {
@@ -5655,7 +5665,7 @@ class H {
       return this.getSessionData(r, "pre2fa") != null;
     } catch (o) {
       const t = c.asCrossauthError(o);
-      return d.logger.debug(u({ err: t })), d.logger.error(u({ cerr: t, msg: "Couldn't get pre2fa data from session" })), !1;
+      return d.logger.debug(f({ err: t })), d.logger.error(f({ cerr: t, msg: "Couldn't get pre2fa data from session" })), !1;
     }
   }
   /////////////////////////////////////////////////////////////
@@ -5675,10 +5685,10 @@ class H {
     if (o.pathname == this.loginUrl) return !1;
     let t = !1;
     return t = this.loginProtectedExceptionPageEndpoints.reduce(
-      (s, i) => s || I(o.pathname, i),
+      (s, a) => s || I(o.pathname, a),
       t
     ), t ? !1 : this.loginProtectedPageEndpoints.reduce(
-      (s, i) => s || I(o.pathname, i),
+      (s, a) => s || I(o.pathname, a),
       !1
     );
   }
@@ -5696,10 +5706,10 @@ class H {
     if (o.pathname == this.loginUrl) return !1;
     let t = !1;
     return t = this.loginProtectedExceptionApiEndpoints.reduce(
-      (s, i) => s || I(o.pathname, i),
+      (s, a) => s || I(o.pathname, a),
       t
     ), t ? !1 : this.loginProtectedApiEndpoints.reduce(
-      (s, i) => s || I(o.pathname, i),
+      (s, a) => s || I(o.pathname, a),
       !1
     );
   }
@@ -5748,13 +5758,13 @@ class H {
     const o = new URL(typeof r == "string" ? r : r.request.url);
     let t = !1;
     return t = this.adminProtectedExceptionPageEndpoints.reduce(
-      (s, i) => s || I(o.pathname, i),
+      (s, a) => s || I(o.pathname, a),
       t
     ), t || (t = this.loginProtectedExceptionPageEndpoints.reduce(
-      (s, i) => s || I(o.pathname, i),
+      (s, a) => s || I(o.pathname, a),
       t
     ), t) ? !1 : this.adminPageEndpoints.reduce(
-      (s, i) => s || I(o.pathname, i),
+      (s, a) => s || I(o.pathname, a),
       !1
     );
   }
@@ -5771,13 +5781,13 @@ class H {
     const o = new URL(typeof r == "string" ? r : r.request.url);
     let t = !1;
     return t = this.adminProtectedExceptionApiEndpoints.reduce(
-      (s, i) => s || I(o.pathname, i),
+      (s, a) => s || I(o.pathname, a),
       t
     ), t || (t = this.loginProtectedExceptionApiEndpoints.reduce(
-      (s, i) => s || I(o.pathname, i),
+      (s, a) => s || I(o.pathname, a),
       t
     ), t) ? !1 : this.adminApiEndpoints.reduce(
-      (s, i) => s || I(o.pathname, i),
+      (s, a) => s || I(o.pathname, a),
       !1
     );
   }
@@ -5794,20 +5804,20 @@ class H {
    * @returns the session cookie value
    */
   async createAnonymousSession(r, o) {
-    d.logger.debug(u({ msg: "Creating anonympous session ID  " }));
+    d.logger.debug(f({ msg: "Creating anonympous session ID  " }));
     const t = new b();
     await t.loadData(r);
     let e = this.addToSession ? this.addToSession(r, t.toObject()) : {};
     o && (e.data = JSON.stringify(o));
-    let { sessionCookie: s, csrfCookie: i, csrfFormOrHeaderValue: a } = await this.sessionManager.createAnonymousSession(e);
+    let { sessionCookie: s, csrfCookie: a, csrfFormOrHeaderValue: i } = await this.sessionManager.createAnonymousSession(e);
     r.cookies.set(
       s.name,
       s.value,
       P(s.options)
-    ), this.enableCsrfProtection && (r.locals.csrfToken = a, r.cookies.set(
-      i.name,
-      i.value,
-      P(i.options)
+    ), this.enableCsrfProtection && (r.locals.csrfToken = i, r.cookies.set(
+      a.name,
+      a.value,
+      P(a.options)
     )), r.locals.user = void 0;
     const n = this.sessionManager.getSessionId(s.value);
     return r.locals.sessionId = n, s.value;
@@ -5832,7 +5842,7 @@ class H {
       } else
         r.locals.sessionId = void 0, r.locals.user = void 0;
     } catch (o) {
-      d.logger.error(u({ errr: o }));
+      d.logger.error(f({ errr: o }));
     }
   }
   ////////////////////////////////////////////////////////////////
@@ -5858,10 +5868,10 @@ class H {
       const t = r.locals.sessionId ? await this.sessionManager.dataForSessionId(r.locals.sessionId) : void 0;
       if (t && o in t) return t[o];
     } catch (t) {
-      d.logger.error(u({
+      d.logger.error(f({
         msg: "Couldn't get " + o + "from session",
         cerr: t
-      })), d.logger.debug(u({ err: t }));
+      })), d.logger.debug(f({ err: t }));
     }
   }
   /**
@@ -5896,7 +5906,7 @@ class H {
    * @param name the name of the field to set
    */
   async deleteSessionData(r, o) {
-    r.locals.sessionId ? await this.sessionManager.deleteSessionData(r.locals.sessionId, o) : d.logger.debug(u({ msg: `Attempting to delete session data ${o} when no session is present` }));
+    r.locals.sessionId ? await this.sessionManager.deleteSessionData(r.locals.sessionId, o) : d.logger.debug(f({ msg: `Attempting to delete session data ${o} when no session is present` }));
   }
 }
 export {