@crossauth/sveltekit 0.0.35 → 0.0.37

package/dist/index.js

@@ -1,6 +1,6 @@
 import { minimatch as I } from "minimatch";
-import { ApiKeyManager as K, KeyStorage as $, toCookieSerializeOptions as R, Crypto as F, OAuthAuthorizationServer as Z, setParameter as y, ParamType as E, DoubleSubmitCsrfToken as ee, OAuthClientManager as B, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
-import { CrossauthError as n, ErrorCode as u, CrossauthLogger as l, j as f, OAuthFlows as _, UserState as N, httpStatus as q } from "@crossauth/common";
+import { ApiKeyManager as K, KeyStorage as $, toCookieSerializeOptions as R, Crypto as F, OAuthAuthorizationServer as Z, setParameter as y, ParamType as _, DoubleSubmitCsrfToken as ee, OAuthClientManager as B, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
+import { CrossauthError as n, ErrorCode as u, CrossauthLogger as l, j as f, OAuthFlows as E, UserState as N, httpStatus as q } from "@crossauth/common";
 import { json as v, redirect as Q, error as Y } from "@sveltejs/kit";
 import "cookie";
 import { jwtDecode as M } from "jwt-decode";
@@ -26,11 +26,11 @@ class b {
     this.clone = r;
   }
   async loadData(r) {
-    var s, e, t, i;
+    var s, e, t, a;
     if (!((s = r.request) != null && s.body))
       return;
     const o = r.request.headers.get("content-type");
-    o == "application/json" ? this.jsonData = this.clone ? await ((t = (e = r.request) == null ? void 0 : e.clone()) == null ? void 0 : t.json()) : await ((i = r.request) == null ? void 0 : i.json()) : (o == "application/x-www-form-urlencoded" || o != null && o.startsWith("multipart/form-data")) && (this.formData = this.clone ? await r.request.clone().formData() : await r.request.formData());
+    o == "application/json" ? this.jsonData = this.clone ? await ((t = (e = r.request) == null ? void 0 : e.clone()) == null ? void 0 : t.json()) : await ((a = r.request) == null ? void 0 : a.json()) : (o == "application/x-www-form-urlencoded" || o != null && o.startsWith("multipart/form-data")) && (this.formData = this.clone ? await r.request.clone().formData() : await r.request.formData());
   }
   get(r) {
     if (this.jsonData) return this.jsonData[r];
@@ -92,29 +92,29 @@ class ne {
           l.logger.debug(f({
             msg: "Received authorization header"
           }));
-          const i = await this.apiKeyManager.validateToken(
+          const a = await this.apiKeyManager.validateToken(
             t
           );
           l.logger.debug(f({
             msg: "Valid API key",
-            hahedApiKey: K.hashSignedApiKeyValue(i.value)
+            hahedApiKey: K.hashSignedApiKeyValue(a.value)
           }));
-          const a = $.decodeData(i.data);
-          if (e.locals.apiKey = { ...i, ...a }, "scope" in a && Array.isArray(a.scope)) {
+          const i = $.decodeData(a.data);
+          if (e.locals.apiKey = { ...a, ...i }, "scope" in i && Array.isArray(i.scope)) {
             let c = [];
-            for (let d of a.scope)
+            for (let d of i.scope)
               typeof d == "string" && c.push(d);
             e.locals.scope = c;
           }
-          if (i.userid)
+          if (a.userid)
             try {
-              const { user: c } = await this.userStorage.getUserById(i.userid);
-              e.locals.user = c, e.locals.authType = "apiKey", l.logger.debug(f({ msg: "API key is for user", userid: c.id, user: c.username, hahedApiKey: K.hashSignedApiKeyValue(i.value) }));
+              const { user: c } = await this.userStorage.getUserById(a.userid);
+              e.locals.user = c, e.locals.authType = "apiKey", l.logger.debug(f({ msg: "API key is for user", userid: c.id, user: c.username, hahedApiKey: K.hashSignedApiKeyValue(a.value) }));
             } catch (c) {
-              l.logger.error(f({ msg: "API key has invalid user", userid: i.userid, hashedApiKey: K.hashSignedApiKeyValue(i.value) })), l.logger.debug(f({ err: c }));
+              l.logger.error(f({ msg: "API key has invalid user", userid: a.userid, hashedApiKey: K.hashSignedApiKeyValue(a.value) })), l.logger.debug(f({ err: c }));
             }
-        } catch (i) {
-          l.logger.error(f({ msg: "Invalid authorization header received", header: t })), l.logger.debug(f({ err: i }));
+        } catch (a) {
+          l.logger.error(f({ msg: "Invalid authorization header received", header: t })), l.logger.debug(f({ err: a }));
         }
     };
   }
@@ -130,9 +130,9 @@ class ce {
    * @param options see {@link SvelteKitAuthorizationServerOptions}
    */
   constructor(r, o, s, e, t = {}) {
-    var i;
+    var a;
     this.loginUrl = "/login", this.refreshTokenType = "json", this.refreshTokenCookieName = "CROSSAUTH_REFRESH_TOKEN", this.refreshTokenCookieDomain = void 0, this.refreshTokenCookieHttpOnly = !1, this.refreshTokenCookiePath = "/", this.refreshTokenCookieSecure = !0, this.refreshTokenCookieSameSite = "strict", this.authorizeEndpointUrl = "/oauth/authorize", this.tokenEndpointUrl = "/oauth/token", this.jwksEndpointUrl = "/oauth/jwks", this.oidcConfigurationEndpoint = {
-      get: async (a) => v(this.authServer.oidcConfiguration(
+      get: async (i) => v(this.authServer.oidcConfiguration(
         {
           authorizeEndpoint: this.authorizeEndpointUrl,
           tokenEndpoint: this.tokenEndpointUrl,
@@ -141,7 +141,7 @@ class ce {
         }
       ))
     }, this.jwksGetEndpoint = {
-      get: async (a) => {
+      get: async (i) => {
         try {
           return v(this.authServer.jwks());
         } catch (c) {
@@ -153,7 +153,7 @@ class ce {
         }
       }
     }, this.getCsrfTokenEndpoint = {
-      get: async (a) => {
+      get: async (i) => {
         var d;
         if (!this.csrfTokens) return v({
           ok: !1,
@@ -166,7 +166,7 @@ class ce {
             csrfCookie: h,
             csrfFormOrHeaderValue: g
           } = await this.createCsrfToken();
-          return c = h.value, a.cookies.set(
+          return c = h.value, i.cookies.set(
             h.name,
             h.value,
             R(h.options)
@@ -175,7 +175,7 @@ class ce {
           const g = n.asCrossauthError(h);
           return l.logger.error(f({
             msg: "getcsrftoken failure",
-            user: (d = a.locals.user) == null ? void 0 : d.username,
+            user: (d = i.locals.user) == null ? void 0 : d.username,
             hashedCsrfCookie: F.hash(c.split(".")[0]),
             error: g.code,
             errorCodeName: g.codeName
@@ -187,15 +187,15 @@ class ce {
         }
       }
     }, this.authorizeEndpoint = {
-      load: async (a) => {
+      load: async (i) => {
         var w, S;
-        if (!(this.authServer.validFlows.includes(_.AuthorizationCode) || this.authServer.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(_.OidcAuthorizationCode)))
+        if (!(this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode)))
           throw this.error(401, "authorize cannot be called because the authorization code flows are not supported");
-        if (!a.locals.user) return this.redirect(
+        if (!i.locals.user) return this.redirect(
           302,
-          this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
+          this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
         );
-        let c = this.getAuthorizeQuery(a);
+        let c = this.getAuthorizeQuery(i);
         if (!c.query) return c.error;
         let d = c.query;
         l.logger.debug(f({ msg: "validating authorize parameters" }));
@@ -203,10 +203,10 @@ class ce {
         if (h ? (g = new n(u.BadRequest, h), l.logger.error(f({
           msg: "authorize parameter invalid",
           cerr: g,
-          user: (w = a.locals.user) == null ? void 0 : w.username
+          user: (w = i.locals.user) == null ? void 0 : w.username
         }))) : l.logger.error(f({
           msg: "authorize parameter valid",
-          user: (S = a.locals.user) == null ? void 0 : S.username
+          user: (S = i.locals.user) == null ? void 0 : S.username
         })), g)
           return {
             ok: !1,
@@ -219,18 +219,18 @@ class ce {
           scope: d.scope
         })), d.scope ? p = await this.authServer.hasAllScopes(
           d.client_id,
-          a.locals.user,
+          i.locals.user,
           d.scope.split(" ")
         ) : p = await this.authServer.hasAllScopes(
           d.client_id,
-          a.locals.user,
+          i.locals.user,
           [null]
         ), p) {
           l.logger.debug(f({
             msg: "All scopes authorized",
             scope: d.scope
           }));
-          const C = await this.authorize(a, !0, {
+          const C = await this.authorize(i, !0, {
             responseType: d.response_type,
             client_id: d.client_id,
             redirect_uri: d.redirect_uri,
@@ -254,7 +254,7 @@ class ce {
             return {
               ok: !0,
               authorizationNeeded: {
-                user: a.locals.user,
+                user: i.locals.user,
                 response_type: d.response_type,
                 client_id: d.client_id,
                 client_name: C.client_name,
@@ -264,7 +264,7 @@ class ce {
                 state: d.state,
                 code_challenge: d.code_challenge,
                 code_challenge_method: d.code_challenge_method,
-                csrfToken: a.locals.csrfToken
+                csrfToken: i.locals.csrfToken
               },
               ...this.baseEndpoint
             };
@@ -280,12 +280,12 @@ class ce {
       },
       // load
       actions: {
-        default: async (a) => {
+        default: async (i) => {
           var h;
           let c;
           try {
             var d = new b();
-            await d.loadData(a), c = d.toObject();
+            await d.loadData(i), c = d.toObject();
             const g = d.getAsBoolean("authorized"), p = c.response_type, w = c.client_id, S = c.redirect_uri, C = c.scope, T = c.state, P = c.code_challenge, U = c.code_challenge_method;
             let A;
             if (g == null && (A = "authorized"), p ? w ? S ? T || (A = "state") : A = "redirect_uri" : A = "client_id" : A = "response_type", A)
@@ -294,12 +294,12 @@ class ce {
                 error: "invalid_request",
                 error_description: "Invalid form: does not contain " + A + " parameter"
               };
-            if (!a.locals.user) return this.redirect(
+            if (!i.locals.user) return this.redirect(
               302,
-              this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
+              this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
             );
-            if ((h = this.svelteKitServer.sessionServer) != null && h.enableCsrfProtection && !a.locals.csrfToken) throw new n(u.InvalidCsrf);
-            const z = await this.authorize(a, g ?? !1, {
+            if ((h = this.svelteKitServer.sessionServer) != null && h.enableCsrfProtection && !i.locals.csrfToken) throw new n(u.InvalidCsrf);
+            const z = await this.authorize(i, g ?? !1, {
               responseType: p,
               client_id: w,
               redirect_uri: S,
@@ -326,22 +326,22 @@ class ce {
         }
       }
     }, this.tokenEndpoint = {
-      post: async (a) => {
+      post: async (i) => {
         let c;
         try {
-          if (!(this.authServer.validFlows.includes(_.AuthorizationCode) || this.authServer.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(_.OidcAuthorizationCode) || this.authServer.validFlows.includes(_.ClientCredentials) || this.authServer.validFlows.includes(_.RefreshToken) || this.authServer.validFlows.includes(_.Password) || this.authServer.validFlows.includes(_.PasswordMfa || this.authServer.validFlows.includes(_.DeviceCode))))
+          if (!(this.authServer.validFlows.includes(E.AuthorizationCode) || this.authServer.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(E.OidcAuthorizationCode) || this.authServer.validFlows.includes(E.ClientCredentials) || this.authServer.validFlows.includes(E.RefreshToken) || this.authServer.validFlows.includes(E.Password) || this.authServer.validFlows.includes(E.PasswordMfa || this.authServer.validFlows.includes(E.DeviceCode))))
             return v({
               ok: !1,
               error: "invalid_request",
               error_description: "Token endpoint cannot be called as the supported OAuth flow types don't require it"
             }, { status: 500 });
           var d = new b();
-          await d.loadData(a), c = d.toObject();
-          const { client_id: h, client_secret: g } = this.getClientIdAndSecret(c, a);
-          let p = c.refresh_token, w = a.cookies.get(this.refreshTokenCookieName);
+          await d.loadData(i), c = d.toObject();
+          const { client_id: h, client_secret: g } = this.getClientIdAndSecret(c, i);
+          let p = c.refresh_token, w = i.cookies.get(this.refreshTokenCookieName);
           if ((this.refreshTokenType == "cookie" && w || this.refreshTokenType == "both" && w && p == null) && this.csrfTokens) {
-            const C = a.cookies.get(this.csrfTokens.cookieName);
-            let T = a.request.headers.get(this.csrfTokens.headerName.toLowerCase());
+            const C = i.cookies.get(this.csrfTokens.cookieName);
+            let T = i.request.headers.get(this.csrfTokens.headerName.toLowerCase());
             if (Array.isArray(T) && (T = T[0]), !C || !T)
               return v({
                 ok: !1,
@@ -375,7 +375,7 @@ class ce {
             refreshToken: p,
             deviceCode: c.device_code
           });
-          if (S.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(a, S.refresh_token, S.expires_in), S.error == "authorization_pending")
+          if (S.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(i, S.refresh_token, S.expires_in), S.error == "authorization_pending")
             return v(S);
           if (S.error || !S.access_token) {
             let C = "server_error", T = "Neither code nor error received when requestoing authorization";
@@ -393,10 +393,10 @@ class ce {
         }
       }
     }, this.mfaAuthenticatorsEndpoint = {
-      get: async (a) => {
+      get: async (i) => {
         try {
           var c = new b();
-          return await c.loadData(a), v(await this.mfaAuthenticators(a));
+          return await c.loadData(i), v(await this.mfaAuthenticators(i));
         } catch (d) {
           const h = n.asCrossauthError(d);
           return l.logger.debug({ err: d }), l.logger.error({ cerr: d }), v({
@@ -405,11 +405,11 @@ class ce {
           });
         }
       },
-      post: async (a) => {
+      post: async (i) => {
         try {
           var c = new b();
-          await c.loadData(a);
-          let d = await this.mfaAuthenticators(a), h = 200;
+          await c.loadData(i);
+          let d = await this.mfaAuthenticators(i), h = 200;
           return !Array.isArray(d) && d.error == "access_denied" ? h = 401 : !Array.isArray(d) && d.error && (h = 500), v(d, { status: h });
         } catch (d) {
           const h = n.asCrossauthError(d);
@@ -420,11 +420,11 @@ class ce {
         }
       }
     }, this.mfaChallengeEndpoint = {
-      post: async (a) => {
+      post: async (i) => {
         try {
           var c = new b();
-          await c.loadData(a);
-          const d = await this.mfaChallenge(a);
+          await c.loadData(i);
+          const d = await this.mfaChallenge(i);
           let h = 200;
           return d.error == "access_denied" ? h = 401 : d.error && (h = 500), v(d, { status: h });
         } catch (d) {
@@ -436,18 +436,18 @@ class ce {
         }
       }
     }, this.deviceAuthorizationEndpoint = {
-      post: async (a) => {
+      post: async (i) => {
         let c;
         try {
-          if (!this.authServer.validFlows.includes(_.DeviceCode))
+          if (!this.authServer.validFlows.includes(E.DeviceCode))
             return v({
               ok: !1,
               error: "invalid_request",
               error_description: "Device authorization endpoint cannot be called as the supported OAuth flow types don't require it"
             });
           var d = new b();
-          await d.loadData(a), c = d.toObject();
-          const { client_id: h, client_secret: g } = this.getClientIdAndSecret(c, a), p = await this.authServer.deviceAuthorizationEndpoint({
+          await d.loadData(i), c = d.toObject();
+          const { client_id: h, client_secret: g } = this.getClientIdAndSecret(c, i), p = await this.authServer.deviceAuthorizationEndpoint({
             client_id: h,
             client_secret: g,
             scope: c.scope
@@ -474,31 +474,31 @@ class ce {
         }
       }
     }, this.deviceEndpoint = {
-      load: async (a) => {
-        if (!this.authServer.validFlows.includes(_.DeviceCode))
+      load: async (i) => {
+        if (!this.authServer.validFlows.includes(E.DeviceCode))
           throw this.error(401, "device cannot be called because the device code flow is not supported");
-        if (!a.locals.user) return this.redirect(
+        if (!i.locals.user) return this.redirect(
           302,
-          this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
+          this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
         );
-        let c = a.url.searchParams.get("user_code");
-        return c ? await this.applyUserCode(c, a, a.locals.user) : {
+        let c = i.url.searchParams.get("user_code");
+        return c ? await this.applyUserCode(c, i, i.locals.user) : {
           ok: !0,
           completed: !1,
           retryAllowed: !0,
-          user: a.locals.user,
-          csrfToken: a.locals.csrfToken
+          user: i.locals.user,
+          csrfToken: i.locals.csrfToken
         };
       },
       // load
       actions: {
-        userCode: async (a) => {
-          if (!a.locals.user) throw this.error(401, "Access Denied");
+        userCode: async (i) => {
+          if (!i.locals.user) throw this.error(401, "Access Denied");
           try {
             var c = new b();
-            await c.loadData(a);
+            await c.loadData(i);
             const d = c.get("user_code");
-            return d ? await this.applyUserCode(d, a, a.locals.user) : {
+            return d ? await this.applyUserCode(d, i, i.locals.user) : {
               ok: !1,
               completed: !1,
               retryAllowed: !0,
@@ -517,12 +517,12 @@ class ce {
             };
           }
         },
-        authorize: async (a) => {
+        authorize: async (i) => {
           var h;
           let c;
           try {
             var d = new b();
-            await d.loadData(a), c = d.toObject();
+            await d.loadData(i), c = d.toObject();
             const g = d.getAsBoolean("authorized"), p = c.scope, w = c.client_id, S = c.user_code;
             let C;
             if (g == null && (C = "authorized"), w == null && (C = "client_id"), S == null && (C = "user_code"), C)
@@ -533,18 +533,18 @@ class ce {
                 error: "invalid_request",
                 error_description: "Invalid form: does not contain " + C + " parameter"
               };
-            if (!a.locals.user) return this.redirect(
+            if (!i.locals.user) return this.redirect(
               302,
-              this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
+              this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
             );
-            if ((h = this.svelteKitServer.sessionServer) != null && h.enableCsrfProtection && !a.locals.csrfToken) throw new n(u.InvalidCsrf);
-            return (await this.authServer.validateAndPersistScope(w, p, a.locals.user)).error ? {
+            if ((h = this.svelteKitServer.sessionServer) != null && h.enableCsrfProtection && !i.locals.csrfToken) throw new n(u.InvalidCsrf);
+            return (await this.authServer.validateAndPersistScope(w, p, i.locals.user)).error ? {
               ok: !1,
               completed: !1,
               retryAllowed: !1,
               error: "unauthorized_client",
               error_description: "You did not authorize access to your account"
-            } : await this.applyUserCode(S, a, a.locals.user);
+            } : await this.applyUserCode(S, i, i.locals.user);
           } catch (g) {
             if (m.isSvelteKitError(g) || m.isSvelteKitRedirect(g)) throw g;
             let p = n.asCrossauthError(g, "Couldn't process authorization code");
@@ -563,7 +563,7 @@ class ce {
       s,
       e,
       t
-    ), y("loginUrl", E.String, this, t, "LOGIN_URL"), y("refreshTokenType", E.String, this, t, "OAUTH_REFRESH_TOKEN_TYPE"), y("refreshTokenCookieName", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), y("refreshTokenCookieDomain", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), y("refreshTokenCookieHttpOnly", E.Boolean, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), y("refreshTokenCookiePath", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), y("refreshTokenCookieSecure", E.Boolean, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), y("refreshTokenCookieSameSite", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), y("authorizeEndpointUrl", E.String, this, t, "OAUTH_AUTHORIZE_ENDPOINT"), y("tokenEndpointUrl", E.String, this, t, "OAUTH_TOKEN_ENDPOINT"), y("jwksEndpointUrl", E.String, this, t, "OAUTH_JWKS_ENDPOINT"), this.refreshTokenType != "json" && (((i = this.svelteKitServer.sessionServer) == null ? void 0 : i.enableCsrfProtection) == !0 ? this.csrfTokens = this.svelteKitServer.sessionServer.sessionManager.csrfTokens : this.csrfTokens = new ee(t.doubleSubmitCookieOptions));
+    ), y("loginUrl", _.String, this, t, "LOGIN_URL"), y("refreshTokenType", _.String, this, t, "OAUTH_REFRESH_TOKEN_TYPE"), y("refreshTokenCookieName", _.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), y("refreshTokenCookieDomain", _.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), y("refreshTokenCookieHttpOnly", _.Boolean, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), y("refreshTokenCookiePath", _.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), y("refreshTokenCookieSecure", _.Boolean, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), y("refreshTokenCookieSameSite", _.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), y("authorizeEndpointUrl", _.String, this, t, "OAUTH_AUTHORIZE_ENDPOINT"), y("tokenEndpointUrl", _.String, this, t, "OAUTH_TOKEN_ENDPOINT"), y("jwksEndpointUrl", _.String, this, t, "OAUTH_JWKS_ENDPOINT"), this.refreshTokenType != "json" && (((a = this.svelteKitServer.sessionServer) == null ? void 0 : a.enableCsrfProtection) == !0 ? this.csrfTokens = this.svelteKitServer.sessionServer.sessionManager.csrfTokens : this.csrfTokens = new ee(t.doubleSubmitCookieOptions));
   }
   /**
    * Returns this server's OIDC configuration.  Just wraps
@@ -585,8 +585,8 @@ class ce {
     responseType: s,
     client_id: e,
     redirect_uri: t,
-    scope: i,
-    state: a,
+    scope: a,
+    state: i,
     codeChallenge: c,
     codeChallengeMethod: d
   }) {
@@ -596,8 +596,8 @@ class ce {
         responseType: s,
         client_id: e,
         redirect_uri: t,
-        scope: i,
-        state: a,
+        scope: a,
+        state: i,
         codeChallenge: c,
         codeChallengeMethod: d,
         user: r.locals.user
@@ -616,7 +616,7 @@ class ce {
       throw this.redirect(302, this.authServer.redirect_uri(
         t,
         p,
-        a
+        i
       ));
     } else {
       const w = new n(
@@ -690,13 +690,13 @@ class ce {
     if (o = this.requireGetParam(r, "client_id"), o) return { error: o };
     if (o = this.requireGetParam(r, "redirect_uri"), o) return { error: o };
     if (o = this.requireGetParam(r, "state"), o) return { error: o };
-    const s = r.url.searchParams.get("response_type") ?? "", e = r.url.searchParams.get("client_id") ?? "", t = r.url.searchParams.get("redirect_uri") ?? "", i = r.url.searchParams.get("scope") ?? void 0, a = r.url.searchParams.get("state") ?? "", c = r.url.searchParams.get("code_challenge") ?? void 0, d = r.url.searchParams.get("code_challenge_method") ?? void 0;
+    const s = r.url.searchParams.get("response_type") ?? "", e = r.url.searchParams.get("client_id") ?? "", t = r.url.searchParams.get("redirect_uri") ?? "", a = r.url.searchParams.get("scope") ?? void 0, i = r.url.searchParams.get("state") ?? "", c = r.url.searchParams.get("code_challenge") ?? void 0, d = r.url.searchParams.get("code_challenge_method") ?? void 0;
     return { query: {
       response_type: s,
       client_id: e,
       redirect_uri: t,
-      scope: i,
-      state: a,
+      scope: a,
+      state: i,
       code_challenge: c,
       code_challenge_method: d
     }, error: { error: "Unknown error", error_description: "Unknown error", ok: !0 } };
@@ -710,18 +710,18 @@ class ce {
     if (e = this.requireBodyParam(s, "challenge_type"), e) return { error: e };
     if (e = this.requireBodyParam(s, "mfa_token"), e) return { error: e };
     if (e = this.requireBodyParam(s, "authenticator_id"), e) return { error: e };
-    const t = s.client_id ?? "", i = s.challenge_type ?? "", a = s.mfa_token ?? "", c = s.authenticator_id ?? "", d = s.client_secret ?? void 0;
+    const t = s.client_id ?? "", a = s.challenge_type ?? "", i = s.mfa_token ?? "", c = s.authenticator_id ?? "", d = s.client_secret ?? void 0;
     return { query: {
       client_id: t,
       client_secret: d,
-      challenge_type: i,
-      mfa_token: a,
+      challenge_type: a,
+      mfa_token: i,
       authenticator_id: c
     }, error: { error: "Unknown error", error_description: "Unknown error", ok: !0 } };
   }
   async mfaAuthenticators(r) {
-    var i;
-    const o = (i = r.request.headers.get("authorization")) == null ? void 0 : i.split(" ");
+    var a;
+    const o = (a = r.request.headers.get("authorization")) == null ? void 0 : a.split(" ");
     if (!o || o.length != 2)
       return {
         error: "access_denied",
@@ -752,31 +752,31 @@ class ce {
     let s = r.client_id, e = r.client_secret;
     const t = o.request.headers.get("authorization");
     if (t) {
-      let i, a;
+      let a, i;
       const c = t.split(" ");
       if (c.length == 2 && c[0].toLocaleLowerCase() == "basic") {
         const h = F.base64Decode(c[1]).split(":", 2);
-        h.length == 2 && (i = h[0], a = h[1]);
+        h.length == 2 && (a = h[0], i = h[1]);
       }
-      i == null || a == null ? l.logger.warn(f({
+      a == null || i == null ? l.logger.warn(f({
         msg: "Ignoring malform authenization header " + t
-      })) : (s = i, e = a);
+      })) : (s = a, e = i);
     }
     return { client_id: s, client_secret: e };
   }
   async applyUserCode(r, o, s) {
-    var e, t, i;
+    var e, t, a;
     try {
-      const a = await this.authServer.deviceEndpoint({ userCode: r, user: s });
-      if (a.error)
+      const i = await this.authServer.deviceEndpoint({ userCode: r, user: s });
+      if (i.error)
         return {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
-          error: a.error,
-          error_description: a.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      if (!a.client_id)
+      if (!i.client_id)
         return l.logger.error(f({ msg: "No client id found for user code", userCodeHash: F.hash(r), ip: o.request.referrer, username: (e = o.locals.user) == null ? void 0 : e.username })), {
           ok: !1,
           completed: !1,
@@ -784,33 +784,33 @@ class ce {
           error: "server_error",
           error_description: "No client id found for user code"
         };
-      if (a.error == "access_denied")
+      if (i.error == "access_denied")
         return l.logger.error(f({ msg: "Incorrect user code given", userCodeHash: F.hash(r), ip: o.request.referrer, username: (t = o.locals.user) == null ? void 0 : t.username })), this.authServer.userCodeThrottle > 0 && await ((h) => new Promise((g) => setTimeout(g, h)))(this.authServer.userCodeThrottle), {
           ok: !1,
           completed: !1,
           retryAllowed: !0,
-          error: a.error,
-          error_description: a.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      if (a.error == "expired_token")
-        return l.logger.error(f({ msg: "Expired user code", userCodeHash: F.hash(r), ip: o.request.referrer, username: (i = o.locals.user) == null ? void 0 : i.username })), {
+      if (i.error == "expired_token")
+        return l.logger.error(f({ msg: "Expired user code", userCodeHash: F.hash(r), ip: o.request.referrer, username: (a = o.locals.user) == null ? void 0 : a.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
-          error: a.error,
-          error_description: a.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      const c = await this.clientStorage.getClientById(a.client_id);
-      return a.scopeAuthorizationNeeded ? {
+      const c = await this.clientStorage.getClientById(i.client_id);
+      return i.scopeAuthorizationNeeded ? {
         ok: !0,
         completed: !1,
         retryAllowed: !0,
         authorizationNeeded: {
           user: s,
-          client_id: a.client_id,
+          client_id: i.client_id,
           client_name: c.client_name,
-          scope: a.scope,
-          scopes: a.scope ? a.scope.split(" ") : [],
+          scope: i.scope,
+          scopes: i.scope ? i.scope.split(" ") : [],
           csrfToken: o.locals.csrfToken
         },
         user: o.locals.user,
@@ -823,8 +823,8 @@ class ce {
         user: o.locals.user,
         csrfToken: o.locals.csrfToken
       };
-    } catch (a) {
-      const c = n.asCrossauthError(a);
+    } catch (i) {
+      const c = n.asCrossauthError(i);
       return l.logger.debug(f({ err: c })), l.logger.error(f({ msg: c.message, cerr: c })), {
         ok: !1,
         completed: !1,
@@ -931,8 +931,8 @@ async function j(k, r, o) {
     );
   let s = k.expires_in;
   if (!s && k.access_token && r.jwtTokens.includes("access")) {
-    const i = M(k.access_token);
-    i.exp && (s = i.exp);
+    const a = M(k.access_token);
+    a.exp && (s = a.exp);
   }
   if (!s)
     throw new n(
@@ -942,8 +942,8 @@ async function j(k, r, o) {
   const e = Date.now() + s * 1e3;
   let t = { ...k, expires_at: e };
   if ("id_token" in k) {
-    let i = k.id_payload ?? O(k.id_token);
-    i && (t.id_payload = i);
+    let a = k.id_payload ?? O(k.id_token);
+    a && (t.id_payload = a);
   }
   await r.storeSessionData(o, t);
 }
@@ -965,8 +965,8 @@ async function de(k, r, o, s, e) {
     if (!s) return r.redirect(302, r.authorizedUrl);
   } catch (t) {
     if (m.isSvelteKitError(t) || m.isSvelteKitRedirect(t)) throw t;
-    const i = n.asCrossauthError(t);
-    return l.logger.debug(f({ err: i })), l.logger.debug(f({ cerr: i, msg: "Error receiving tokens" })), r.errorFn(r.server, o, i);
+    const a = n.asCrossauthError(t);
+    return l.logger.debug(f({ err: a })), l.logger.debug(f({ cerr: a, msg: "Error receiving tokens" })), r.errorFn(r.server, o, a);
   }
 }
 async function he(k, r, o, s, e) {
@@ -987,8 +987,8 @@ async function he(k, r, o, s, e) {
     return v({ ok: !0, ...k });
   } catch (t) {
     if (m.isSvelteKitError(t) || m.isSvelteKitRedirect(t)) throw t;
-    const i = n.asCrossauthError(t);
-    return l.logger.debug(f({ err: i })), l.logger.debug(f({ cerr: i, msg: "Error receiving tokens" })), r.errorFn(r.server, o, i);
+    const a = n.asCrossauthError(t);
+    return l.logger.debug(f({ err: a })), l.logger.debug(f({ cerr: a, msg: "Error receiving tokens" })), r.errorFn(r.server, o, a);
   }
 }
 async function ue(k, r, o, s, e) {
@@ -1008,11 +1008,11 @@ async function ue(k, r, o, s, e) {
     return r.jwtTokens.includes("id") && (t.id_payload = k.id_payload ?? O(k.id_token)), t.id_payload && await e(o, t.id_payload), t;
   } catch (t) {
     if (m.isSvelteKitError(t) || m.isSvelteKitRedirect(t)) throw t;
-    const i = n.asCrossauthError(t);
-    return l.logger.debug(f({ err: i })), l.logger.debug(f({ cerr: i, msg: "Error receiving tokens" })), {
+    const a = n.asCrossauthError(t);
+    return l.logger.debug(f({ err: a })), l.logger.debug(f({ cerr: a, msg: "Error receiving tokens" })), {
       ok: !1,
-      error: i.oauthErrorCode,
-      error_description: i.message
+      error: a.oauthErrorCode,
+      error_description: a.message
     };
   }
 }
@@ -1048,14 +1048,14 @@ class G extends re {
    * @param options See {@link SvelteKitOAuthClientOptions}
    */
   constructor(r, o, s) {
-    if (super(o, s), this.sessionDataName = "oauth", this.receiveTokenFn = J, this.errorFn = W, this.loginUrl = "/login", this.validFlows = [_.All], this.authorizedUrl = "", this.autoRefreshActive = {}, this.loginProtectedFlows = [], this.tokenResponseType = "sendJson", this.errorResponseType = "sendJson", this.bffEndpoints = [], this.bffEndpointName = "bff", this.tokenEndpoints = [], this.bffMaxTries = 1, this.bffSleepMilliseconds = 500, this.jwtTokens = ["access", "id", "refresh"], this.testMiddleware = !1, this.testEvent = void 0, this.authorizationCodeFlowEndpoint = {
+    if (super(o, s), this.sessionDataName = "oauth", this.receiveTokenFn = J, this.errorFn = W, this.loginUrl = "/login", this.validFlows = [E.All], this.authorizedUrl = "", this.autoRefreshActive = {}, this.loginProtectedFlows = [], this.tokenResponseType = "sendJson", this.errorResponseType = "sendJson", this.bffEndpoints = [], this.bffEndpointName = "bff", this.tokenEndpoints = [], this.bffMaxTries = 1, this.bffSleepMilliseconds = 500, this.jwtTokens = ["access", "id", "refresh"], this.testMiddleware = !1, this.testEvent = void 0, this.authorizationCodeFlowEndpoint = {
       get: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
           const t = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
           return this.errorFn(this.server, e, t);
         }
         try {
-          if (!this.validFlows.includes(_.AuthorizationCode)) {
+          if (!this.validFlows.includes(E.AuthorizationCode)) {
             const g = new n(u.Unauthorized, "Authorization flow is not supported");
             return this.errorFn(this.server, e, g);
           }
@@ -1063,9 +1063,9 @@ class G extends re {
             throw new n(u.Configuration, "Need session server or adapter for authorization code flow");
           let t = e.url.searchParams.get("scope") ?? void 0;
           t == "" && (t = void 0);
-          const i = this.randomValue(this.stateLength), a = { scope: t, state: i };
-          await this.storeSessionData(e, a);
-          const { url: c, error: d, error_description: h } = await this.startAuthorizationCodeFlow(i, t);
+          const a = this.randomValue(this.stateLength), i = { scope: t, state: a };
+          await this.storeSessionData(e, i);
+          const { url: c, error: d, error_description: h } = await this.startAuthorizationCodeFlow(a, t);
           if (d || !c) {
             const g = n.fromOAuthError(
               d ?? "server_error",
@@ -1078,8 +1078,8 @@ class G extends re {
           })), this.redirect(302, c);
         } catch (t) {
           if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-          const i = n.asCrossauthError(t);
-          return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), this.errorFn(this.server, e, i);
+          const a = n.asCrossauthError(t);
+          return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), this.errorFn(this.server, e, a);
         }
       },
       load: async (e) => {
@@ -1095,7 +1095,7 @@ class G extends re {
           };
         }
         try {
-          if (!this.validFlows.includes(_.AuthorizationCode)) {
+          if (!this.validFlows.includes(E.AuthorizationCode)) {
             const g = new n(u.Unauthorized, "Authorization flow is not supported");
             return {
               ok: !1,
@@ -1107,9 +1107,9 @@ class G extends re {
             throw new n(u.Configuration, "Need session server or adapter for authorization code flow");
           let t = e.url.searchParams.get("scope") ?? void 0;
           t == "" && (t = void 0);
-          const i = this.randomValue(this.stateLength), a = { scope: t, state: i };
-          await this.storeSessionData(e, a);
-          const { url: c, error: d, error_description: h } = await this.startAuthorizationCodeFlow(i, t);
+          const a = this.randomValue(this.stateLength), i = { scope: t, state: a };
+          await this.storeSessionData(e, i);
+          const { url: c, error: d, error_description: h } = await this.startAuthorizationCodeFlow(a, t);
           if (d || !c) {
             const g = n.fromOAuthError(
               d ?? "server_error",
@@ -1126,11 +1126,11 @@ class G extends re {
           })), this.redirect(302, c);
         } catch (t) {
           if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-          const i = n.asCrossauthError(t);
+          const a = n.asCrossauthError(t);
           return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), {
             ok: !1,
-            error: i.oauthErrorCode,
-            error_description: i.message
+            error: a.oauthErrorCode,
+            error_description: a.message
           };
         }
       }
@@ -1141,7 +1141,7 @@ class G extends re {
           return this.errorFn(this.server, e, t);
         }
         try {
-          if (!this.validFlows.includes(_.AuthorizationCodeWithPKCE)) {
+          if (!this.validFlows.includes(E.AuthorizationCodeWithPKCE)) {
             const w = new n(u.Unauthorized, "Authorization flow is not supported");
             return this.errorFn(this.server, e, w);
           }
@@ -1149,9 +1149,9 @@ class G extends re {
             throw new n(u.Configuration, "Need session server or adapter for authorization code flow");
           let t = e.url.searchParams.get("scope") ?? void 0;
           t == "" && (t = void 0);
-          const i = this.randomValue(this.stateLength), { codeChallenge: a, codeVerifier: c } = await this.codeChallengeAndVerifier(), d = { scope: t, state: i, codeChallenge: a, codeVerifier: c };
+          const a = this.randomValue(this.stateLength), { codeChallenge: i, codeVerifier: c } = await this.codeChallengeAndVerifier(), d = { scope: t, state: a, codeChallenge: i, codeVerifier: c };
           await this.storeSessionData(e, d);
-          const { url: h, error: g, error_description: p } = await this.startAuthorizationCodeFlow(i, t, a, !0);
+          const { url: h, error: g, error_description: p } = await this.startAuthorizationCodeFlow(a, t, i, !0);
           if (g || !h) {
             const w = n.fromOAuthError(
               g ?? "server_error",
@@ -1164,11 +1164,11 @@ class G extends re {
           })), this.redirect(302, h);
         } catch (t) {
           if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-          const i = n.asCrossauthError(t);
+          const a = n.asCrossauthError(t);
           return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), v({
-            error: i.oauthErrorCode,
-            error_description: i.message
-          }, { status: i.httpStatus });
+            error: a.oauthErrorCode,
+            error_description: a.message
+          }, { status: a.httpStatus });
         }
       },
       load: async (e) => {
@@ -1184,7 +1184,7 @@ class G extends re {
           };
         }
         try {
-          if (!this.validFlows.includes(_.AuthorizationCodeWithPKCE)) {
+          if (!this.validFlows.includes(E.AuthorizationCodeWithPKCE)) {
             const w = new n(u.Unauthorized, "Authorization flow is not supported");
             return {
               ok: !1,
@@ -1196,9 +1196,9 @@ class G extends re {
             throw new n(u.Configuration, "Need session server or adapter for authorization code flow");
           let t = e.url.searchParams.get("scope") ?? void 0;
           t == "" && (t = void 0);
-          const i = this.randomValue(this.stateLength), { codeChallenge: a, codeVerifier: c } = await this.codeChallengeAndVerifier(), d = { scope: t, state: i, codeChallenge: a, codeVerifier: c };
+          const a = this.randomValue(this.stateLength), { codeChallenge: i, codeVerifier: c } = await this.codeChallengeAndVerifier(), d = { scope: t, state: a, codeChallenge: i, codeVerifier: c };
           await this.storeSessionData(e, d);
-          const { url: h, error: g, error_description: p } = await this.startAuthorizationCodeFlow(i, t, a, !0);
+          const { url: h, error: g, error_description: p } = await this.startAuthorizationCodeFlow(a, t, i, !0);
           if (g || !h) {
             const w = n.fromOAuthError(
               g ?? "server_error",
@@ -1215,11 +1215,11 @@ class G extends re {
           })), this.redirect(302, h);
         } catch (t) {
           if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-          const i = n.asCrossauthError(t);
+          const a = n.asCrossauthError(t);
           return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), {
             ok: !1,
-            error: i.oauthErrorCode,
-            error_description: i.message
+            error: a.oauthErrorCode,
+            error_description: a.message
           };
         }
       }
@@ -1227,20 +1227,20 @@ class G extends re {
       get: async (e) => {
         var t;
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const i = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
-          return this.errorFn(this.server, e, i);
+          const a = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
+          return this.errorFn(this.server, e, a);
         }
         try {
-          if (!(this.validFlows.includes(_.AuthorizationCode) || this.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.validFlows.includes(_.OidcAuthorizationCode))) {
+          if (!(this.validFlows.includes(E.AuthorizationCode) || this.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.validFlows.includes(E.OidcAuthorizationCode))) {
             const p = new n(u.Unauthorized, "Authorization flows are not supported");
             return this.errorFn(this.server, e, p);
           }
           l.logger.debug(f({ msg: "redirectUriEndpoint, token response type " + this.tokenResponseType }));
-          const i = e.url.searchParams.get("code") ?? "", a = e.url.searchParams.get("state") ?? void 0, c = e.url.searchParams.get("error") ?? void 0, d = e.url.searchParams.get("error") ?? void 0, h = await ((t = this.server.sessionAdapter) == null ? void 0 : t.getSessionData(e, this.sessionDataName));
-          if ((h == null ? void 0 : h.state) != a)
+          const a = e.url.searchParams.get("code") ?? "", i = e.url.searchParams.get("state") ?? void 0, c = e.url.searchParams.get("error") ?? void 0, d = e.url.searchParams.get("error") ?? void 0, h = await ((t = this.server.sessionAdapter) == null ? void 0 : t.getSessionData(e, this.sessionDataName));
+          if ((h == null ? void 0 : h.state) != i)
             throw new n(u.Unauthorized, "State does not match");
           const g = this.errorIfIdTokenInvalid(await this.redirectEndpoint(
-            i,
+            a,
             h == null ? void 0 : h.scope,
             h == null ? void 0 : h.codeVerifier,
             c,
@@ -1265,10 +1265,10 @@ class G extends re {
             !1,
             this.setEventLocalsUser
           );
-        } catch (i) {
-          if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
-          const a = n.asCrossauthError(i);
-          return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), this.errorFn(this.server, e, a);
+        } catch (a) {
+          if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
+          const i = n.asCrossauthError(a);
+          return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), this.errorFn(this.server, e, i);
         }
       },
       load: async (e) => {
@@ -1277,15 +1277,15 @@ class G extends re {
           /*this.tokenResponseType == "saveInSessionAndRedirect" ||*/
           this.tokenResponseType == "sendJson" || this.tokenResponseType == "saveInSessionAndLoad"
         ) {
-          const i = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use get not load");
+          const a = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use get not load");
           return {
             ok: !1,
-            error: i.oauthErrorCode,
-            error_description: i.message
+            error: a.oauthErrorCode,
+            error_description: a.message
           };
         }
         try {
-          if (!(this.validFlows.includes(_.AuthorizationCode) || this.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.validFlows.includes(_.OidcAuthorizationCode))) {
+          if (!(this.validFlows.includes(E.AuthorizationCode) || this.validFlows.includes(E.AuthorizationCodeWithPKCE) || this.validFlows.includes(E.OidcAuthorizationCode))) {
             const w = new n(u.Unauthorized, "Authorization flows are not supported");
             return {
               ok: !1,
@@ -1293,11 +1293,11 @@ class G extends re {
               error_description: w.message
             };
           }
-          const i = e.url.searchParams.get("code") ?? "", a = e.url.searchParams.get("state") ?? void 0, c = e.url.searchParams.get("error") ?? void 0, d = e.url.searchParams.get("error") ?? void 0, h = await ((t = this.server.sessionAdapter) == null ? void 0 : t.getSessionData(e, this.sessionDataName));
-          if ((h == null ? void 0 : h.state) != a)
+          const a = e.url.searchParams.get("code") ?? "", i = e.url.searchParams.get("state") ?? void 0, c = e.url.searchParams.get("error") ?? void 0, d = e.url.searchParams.get("error") ?? void 0, h = await ((t = this.server.sessionAdapter) == null ? void 0 : t.getSessionData(e, this.sessionDataName));
+          if ((h == null ? void 0 : h.state) != i)
             throw new n(u.Unauthorized, "State does not match");
           const g = this.errorIfIdTokenInvalid(await this.redirectEndpoint(
-            i,
+            a,
             h == null ? void 0 : h.scope,
             h == null ? void 0 : h.codeVerifier,
             c,
@@ -1341,35 +1341,35 @@ class G extends re {
           } : {
             ...p
           };
-        } catch (i) {
-          if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
-          const a = n.asCrossauthError(i);
-          return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), {
+        } catch (a) {
+          if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
+          const i = n.asCrossauthError(a);
+          return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), {
             ok: !1,
-            error: a.oauthErrorCode,
-            error_description: a.message
+            error: i.oauthErrorCode,
+            error_description: i.message
           };
         }
       }
     }, this.clientCredentialsFlowEndpoint = {
       post: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const a = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
-          return this.errorFn(this.server, e, a);
+          const i = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
+          return this.errorFn(this.server, e, i);
         }
         let t;
         try {
-          if (!this.validFlows.includes(_.ClientCredentials)) {
+          if (!this.validFlows.includes(E.ClientCredentials)) {
             const d = new n(u.Unauthorized, "Client credentials flow is not supported");
             return this.errorFn(this.server, e, d);
           }
-          var i = new b();
-          await i.loadData(e), t = i.toObject();
-          const a = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(t == null ? void 0 : t.scope));
-          if (a.error) {
+          var a = new b();
+          await a.loadData(e), t = a.toObject();
+          const i = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(t == null ? void 0 : t.scope));
+          if (i.error) {
             const d = n.fromOAuthError(
-              a.error,
-              a.error_description
+              i.error,
+              i.error_description
             );
             return await this.errorFn(
               this.server,
@@ -1378,17 +1378,17 @@ class G extends re {
             );
           }
           const c = await this.receiveTokenFn(
-            a,
+            i,
             this,
             e,
             !1,
             this.setEventLocalsUser
           );
           return c instanceof Response ? c : this.pack(c);
-        } catch (a) {
-          if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
-          const c = n.asCrossauthError(a);
-          return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), this.errorFn(this.server, e, c);
+        } catch (i) {
+          if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
+          const c = n.asCrossauthError(i);
+          return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), this.errorFn(this.server, e, c);
         }
       },
       actions: {
@@ -1400,27 +1400,27 @@ class G extends re {
             throw new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
           let t;
           try {
-            if (!this.validFlows.includes(_.ClientCredentials))
+            if (!this.validFlows.includes(E.ClientCredentials))
               throw new n(u.Unauthorized, "Client credentials flow is not supported");
-            var i = new b();
-            await i.loadData(e), t = i.toObject();
-            const a = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(t == null ? void 0 : t.scope));
-            if (a.error)
+            var a = new b();
+            await a.loadData(e), t = a.toObject();
+            const i = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(t == null ? void 0 : t.scope));
+            if (i.error)
               throw n.fromOAuthError(
-                a.error,
-                a.error_description
+                i.error,
+                i.error_description
               );
             return await this.receiveTokenFn(
-              a,
+              i,
               this,
               e,
               !1,
               this.setEventLocalsUser
             ) ?? {};
-          } catch (a) {
-            if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
-            const c = n.asCrossauthError(a);
-            return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), {
+          } catch (i) {
+            if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
+            const c = n.asCrossauthError(i);
+            return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), {
               ok: !1,
               error: c.oauthErrorCode,
               error_description: c.message
@@ -1431,17 +1431,17 @@ class G extends re {
     }, this.refreshTokenFlowEndpoint = {
       post: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const a = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
-          return this.errorFn(this.server, e, a);
+          const i = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
+          return this.errorFn(this.server, e, i);
         }
         let t;
         try {
-          if (!this.validFlows.includes(_.RefreshToken)) {
+          if (!this.validFlows.includes(E.RefreshToken)) {
             const h = new n(u.Unauthorized, "Refresh token flow is not supported");
             return this.errorFn(this.server, e, h);
           }
-          var i = new b();
-          if (await i.loadData(e), t = i.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
+          var a = new b();
+          if (await a.loadData(e), t = a.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
             try {
               if (!this.server.sessionAdapter.getCsrfToken(e))
                 throw new n(u.InvalidCsrf);
@@ -1450,8 +1450,8 @@ class G extends re {
               const g = new n(u.Unauthorized, "CSRF token not present");
               return this.errorFn(this.server, e, g);
             }
-          let a = t.refresh_token;
-          if (!a && this.server.sessionAdapter) {
+          let i = t.refresh_token;
+          if (!i && this.server.sessionAdapter) {
             const h = await this.server.sessionAdapter.getSessionData(e, this.sessionDataName);
             if (!(h != null && h.refresh_token)) {
               const g = new n(
@@ -1460,16 +1460,16 @@ class G extends re {
               );
               return this.errorFn(this.server, e, g);
             }
-            a = h.refresh_token;
+            i = h.refresh_token;
           }
-          if (!a) {
+          if (!i) {
             const h = new n(
               u.BadRequest,
               "No refresh token supplied"
             );
             return this.errorFn(this.server, e, h);
           }
-          const c = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(a)), d = await this.receiveTokenFn(
+          const c = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(i)), d = await this.receiveTokenFn(
             c,
             this,
             e,
@@ -1478,10 +1478,10 @@ class G extends re {
           );
           if (c && d instanceof Response) return d;
           throw new n(u.UnknownError, "Receive token function did not return a Response");
-        } catch (a) {
-          if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
-          const c = n.asCrossauthError(a);
-          return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), this.errorFn(this.server, e, c);
+        } catch (i) {
+          if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
+          const c = n.asCrossauthError(i);
+          return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), this.errorFn(this.server, e, c);
         }
       },
       actions: {
@@ -1493,34 +1493,34 @@ class G extends re {
             throw new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
           let t;
           try {
-            if (!this.validFlows.includes(_.RefreshToken)) {
+            if (!this.validFlows.includes(E.RefreshToken)) {
               const h = new n(u.Unauthorized, "Refresh token flow is not supported");
               return this.errorFn(this.server, e, h);
             }
-            var i = new b();
-            if (await i.loadData(e), t = i.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
+            var a = new b();
+            if (await a.loadData(e), t = a.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
               try {
                 if (!this.server.sessionAdapter.getCsrfToken(e))
                   throw new n(u.InvalidCsrf);
               } catch (h) {
                 throw m.isSvelteKitError(h) || m.isSvelteKitRedirect(h) ? h : new n(u.Unauthorized, "CSRF token not present");
               }
-            let a = t.refresh_token;
-            if (!a && this.server.sessionAdapter) {
+            let i = t.refresh_token;
+            if (!i && this.server.sessionAdapter) {
               const h = await this.server.sessionAdapter.getSessionData(e, this.sessionDataName);
               if (!(h != null && h.refresh_token))
                 throw new n(
                   u.BadRequest,
                   "No refresh token in session or in parameters"
                 );
-              a = h.refresh_token;
+              i = h.refresh_token;
             }
-            if (!a)
+            if (!i)
               throw new n(
                 u.BadRequest,
                 "No refresh token supplied"
               );
-            const c = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(a)), d = await this.receiveTokenFn(
+            const c = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(i)), d = await this.receiveTokenFn(
               c,
               this,
               e,
@@ -1529,10 +1529,10 @@ class G extends re {
             ) ?? {};
             if (d instanceof Response) throw new n(u.Configuration, "Refresh token flow should return an object not Response");
             return d;
-          } catch (a) {
-            if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
-            const c = n.asCrossauthError(a);
-            return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), {
+          } catch (i) {
+            if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
+            const c = n.asCrossauthError(i);
+            return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), {
               ok: !1,
               error: c.oauthErrorCode,
               error_description: c.message
@@ -1581,8 +1581,8 @@ class G extends re {
       post: async (e) => {
         const t = await this.startDeviceCodeFlow_internal(e);
         if (t.error) {
-          const i = n.fromOAuthError(t.error, t.error_description);
-          return v(t, { status: i.httpStatus });
+          const a = n.fromOAuthError(t.error, t.error_description);
+          return v(t, { status: a.httpStatus });
         }
         return v(t);
       }
@@ -1598,40 +1598,40 @@ class G extends re {
         if (t instanceof Response) return t;
         if (t == null) return new Response(null, { status: 204 });
         if (t.error) {
-          const i = n.fromOAuthError(t.error, t.error_description);
-          return v(t, { status: i.httpStatus });
+          const a = n.fromOAuthError(t.error, t.error_description);
+          return v(t, { status: a.httpStatus });
         }
         return v(t);
       }
     }, this.passwordFlowEndpoint = {
-      post: async (e) => await this.passwordFlow_post(e, (t, i) => this.passwordPost(t, i)),
+      post: async (e) => await this.passwordFlow_post(e, (t, a) => this.passwordPost(t, a)),
       actions: {
-        password: async (e) => await this.passwordFlow_action(e, (t, i) => this.passwordPost(t, i)),
-        passwordOtp: async (e) => await this.passwordFlow_action(e, (t, i) => this.passwordOtp(t, i)),
-        passwordOob: async (e) => await this.passwordFlow_action(e, (t, i) => this.passwordOob(t, i))
+        password: async (e) => await this.passwordFlow_action(e, (t, a) => this.passwordPost(t, a)),
+        passwordOtp: async (e) => await this.passwordFlow_action(e, (t, a) => this.passwordOtp(t, a)),
+        passwordOob: async (e) => await this.passwordFlow_action(e, (t, a) => this.passwordOob(t, a))
       }
     }, this.passwordOtpEndpoint = {
-      post: async (e) => await this.passwordFlow_post(e, (t, i) => this.passwordOtp(t, i)),
+      post: async (e) => await this.passwordFlow_post(e, (t, a) => this.passwordOtp(t, a)),
       actions: {
-        default: async (e) => await this.passwordFlow_action(e, (t, i) => this.passwordOtp(t, i))
+        default: async (e) => await this.passwordFlow_action(e, (t, a) => this.passwordOtp(t, a))
       }
     }, this.passwordOobEndpoint = {
-      post: async (e) => await this.passwordFlow_post(e, (t, i) => this.passwordOob(t, i)),
+      post: async (e) => await this.passwordFlow_post(e, (t, a) => this.passwordOob(t, a)),
       actions: {
-        default: async (e) => await this.passwordFlow_action(e, (t, i) => this.passwordOob(t, i))
+        default: async (e) => await this.passwordFlow_action(e, (t, a) => this.passwordOob(t, a))
       }
     }, this.deleteTokensEndpoint = {
       post: async (e) => {
-        var t, i;
+        var t, a;
         try {
           return await this.deleteSessionData(e), v({ ok: !0 });
-        } catch (a) {
-          if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
-          const c = n.asCrossauthError(a);
+        } catch (i) {
+          if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
+          const c = n.asCrossauthError(i);
           return l.logger.debug({ err: c }), l.logger.error({ cerr: c }), v({
             ok: !1,
             user: (t = this.server.sessionAdapter) == null ? void 0 : t.getUser(e),
-            csrfToken: (i = this.server.sessionAdapter) == null ? void 0 : i.getCsrfToken(e),
+            csrfToken: (a = this.server.sessionAdapter) == null ? void 0 : a.getCsrfToken(e),
             errorCode: c.code,
             errorCodeName: c.codeName,
             errorMessage: c.message
@@ -1640,16 +1640,16 @@ class G extends re {
       },
       actions: {
         default: async (e) => {
-          var t, i;
+          var t, a;
           try {
             return await this.deleteSessionData(e), { ok: !0 };
-          } catch (a) {
-            if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
-            const c = n.asCrossauthError(a);
+          } catch (i) {
+            if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
+            const c = n.asCrossauthError(i);
             return l.logger.debug({ err: c }), l.logger.error({ cerr: c }), {
               ok: !1,
               user: (t = this.server.sessionAdapter) == null ? void 0 : t.getUser(e),
-              csrfToken: (i = this.server.sessionAdapter) == null ? void 0 : i.getCsrfToken(e),
+              csrfToken: (a = this.server.sessionAdapter) == null ? void 0 : a.getCsrfToken(e),
               errorCode: c.code,
               errorCodeName: c.codeName,
               errorMessage: c.message
@@ -1720,9 +1720,9 @@ class G extends re {
       actions: {
         default: async (e) => await this.tokens(e, this.tokenEndpoints)
       }
-    }, this.server = r, y("sessionDataName", E.String, this, s, "OAUTH_SESSION_DATA_NAME"), y("tokenResponseType", E.String, this, s, "OAUTH_TOKEN_RESPONSE_TYPE"), y("errorResponseType", E.String, this, s, "OAUTH_ERROR_RESPONSE_TYPE"), y("loginUrl", E.String, this, s, "LOGIN_URL"), y("bffEndpointName", E.String, this, s, "OAUTH_BFF_ENDPOINT_NAME"), y("bffBaseUrl", E.String, this, s, "OAUTH_BFF_BASEURL"), y("redirect_uri", E.String, this, s, "OAUTH_REDIRECTURI", !0), y("authorizedUrl", E.String, this, s, "AUTHORIZED_URL", !1), y("validFlows", E.JsonArray, this, s, "OAUTH_validFlows"), y("bffMaxTries", E.Number, this, s, "OAUTH_BFF_MAX_RETRIES"), y("bffSleepMilliseconds", E.Number, this, s, "OAUTH_BFF_SLEEP_MILLISECONDS"), y("jwtTokens", E.JsonArray, this, s, "OAUTH_JWT_TOKENS"), this.bffEndpointName && !this.bffEndpointName.startsWith("/") && (this.bffEndpointName = "/" + this.bffEndpointName), this.bffEndpointName && this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), this.bffBaseUrl && this.bffBaseUrl.endsWith("/") && (this.bffBaseUrl = this.bffBaseUrl.substring(0, this.bffBaseUrl.length - 1)), s.redirect && (this.redirect = s.redirect), s.error && (this.error = s.error), this.validFlows.length == 1 && this.validFlows[0] == _.All)
-      this.validFlows = _.allFlows();
-    else if (!_.areAllValidFlows(this.validFlows))
+    }, this.server = r, y("sessionDataName", _.String, this, s, "OAUTH_SESSION_DATA_NAME"), y("tokenResponseType", _.String, this, s, "OAUTH_TOKEN_RESPONSE_TYPE"), y("errorResponseType", _.String, this, s, "OAUTH_ERROR_RESPONSE_TYPE"), y("loginUrl", _.String, this, s, "LOGIN_URL"), y("bffEndpointName", _.String, this, s, "OAUTH_BFF_ENDPOINT_NAME"), y("bffBaseUrl", _.String, this, s, "OAUTH_BFF_BASEURL"), y("redirect_uri", _.String, this, s, "OAUTH_REDIRECTURI", !0), y("authorizedUrl", _.String, this, s, "AUTHORIZED_URL", !1), y("validFlows", _.JsonArray, this, s, "OAUTH_validFlows"), y("bffMaxTries", _.Number, this, s, "OAUTH_BFF_MAX_RETRIES"), y("bffSleepMilliseconds", _.Number, this, s, "OAUTH_BFF_SLEEP_MILLISECONDS"), y("jwtTokens", _.JsonArray, this, s, "OAUTH_JWT_TOKENS"), this.bffEndpointName && !this.bffEndpointName.startsWith("/") && (this.bffEndpointName = "/" + this.bffEndpointName), this.bffEndpointName && this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), this.bffBaseUrl && this.bffBaseUrl.endsWith("/") && (this.bffBaseUrl = this.bffBaseUrl.substring(0, this.bffBaseUrl.length - 1)), s.redirect && (this.redirect = s.redirect), s.error && (this.error = s.error), this.validFlows.length == 1 && this.validFlows[0] == E.All)
+      this.validFlows = E.allFlows();
+    else if (!E.areAllValidFlows(this.validFlows))
       throw new n(u.Configuration, "Invalid flows specificied in " + this.validFlows.join(","));
     try {
       new URL(this.redirect_uri ?? "");
@@ -1732,9 +1732,9 @@ class G extends re {
     if (s.tokenEndpoints && (this.tokenEndpoints = s.tokenEndpoints), this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), s.bffEndpoints && (this.bffEndpoints = s.bffEndpoints.map((e) => ({ ...e, methodsString: e.methods.map((t) => t) }))), this.bffEndpoints)
       for (let e of this.bffEndpoints)
         e.url.startsWith("/") || (e.url = "/" + e.url);
-    if (this.loginProtectedFlows.length == 1 && this.loginProtectedFlows[0] == _.All)
+    if (this.loginProtectedFlows.length == 1 && this.loginProtectedFlows[0] == E.All)
       this.loginProtectedFlows = this.validFlows;
-    else if (!_.areAllValidFlows(this.loginProtectedFlows))
+    else if (!E.areAllValidFlows(this.loginProtectedFlows))
       throw new n(
         u.Configuration,
         "Invalid flows specificied in " + this.loginProtectedFlows.join(",")
@@ -1764,8 +1764,8 @@ class G extends re {
       if (e.locals.user || !r.sessionAdapter) return;
       let t = await r.sessionAdapter.getSessionData(e, this.sessionDataName);
       if (t && t.id_payload) {
-        let i = t.expires_at;
-        i && i > Date.now() && t.id_payload.sub && await this.setEventLocalsUser(e, t.id_payload);
+        let a = t.expires_at;
+        a && a > Date.now() && t.id_payload.sub && await this.setEventLocalsUser(e, t.id_payload);
       }
       this.testMiddleware && (this.testEvent = e);
     };
@@ -1798,12 +1798,12 @@ class G extends re {
         o.password,
         o.scope
       );
-      if (e.error == "mfa_required" && e.mfa_token && this.validFlows.includes(_.PasswordMfa)) {
+      if (e.error == "mfa_required" && e.mfa_token && this.validFlows.includes(E.PasswordMfa)) {
         const t = e.mfa_token;
-        let i = o.scope;
-        if (i == "" && (i = void 0), e = this.errorIfIdTokenInvalid(await this.passwordMfa(
+        let a = o.scope;
+        if (a == "" && (a = void 0), e = this.errorIfIdTokenInvalid(await this.passwordMfa(
           t,
-          i,
+          a,
           r
         )), e.error)
           throw n.fromOAuthError(
@@ -1839,11 +1839,11 @@ class G extends re {
       };
     const t = e.authenticators[0];
     if (t.authenticator_type == "otp") {
-      const a = await this.mfaOtpRequest(r, t.id);
-      if (a.error || a.challenge_type != "otp") {
+      const i = await this.mfaOtpRequest(r, t.id);
+      if (i.error || i.challenge_type != "otp") {
         const c = n.fromOAuthError(
-          a.error ?? "server_error",
-          a.error_description ?? "Invalid response from MFA OTP challenge"
+          i.error ?? "server_error",
+          i.error_description ?? "Invalid response from MFA OTP challenge"
         );
         return l.logger.debug({ err: c }), l.logger.error({ cerr: c }), {
           error: c.oauthErrorCode,
@@ -1853,14 +1853,14 @@ class G extends re {
       return {
         scope: o,
         mfa_token: r,
-        challenge_type: a.challenge_type
+        challenge_type: i.challenge_type
       };
     } else if (t.authenticator_type == "oob") {
-      const a = await this.mfaOobRequest(r, t.id);
-      if (a.error || a.challenge_type != "oob" || !a.oob_code || a.binding_method != "prompt") {
+      const i = await this.mfaOobRequest(r, t.id);
+      if (i.error || i.challenge_type != "oob" || !i.oob_code || i.binding_method != "prompt") {
         const c = n.fromOAuthError(
-          a.error ?? "server_error",
-          a.error_description ?? "Invalid response from MFA OOB challenge"
+          i.error ?? "server_error",
+          i.error_description ?? "Invalid response from MFA OOB challenge"
         );
         return l.logger.debug({ err: c }), l.logger.error({ cerr: c }), {
           error: c.oauthErrorCode,
@@ -1871,19 +1871,19 @@ class G extends re {
         scope: o,
         mfa_token: r,
         oob_channel: t.oob_channel,
-        challenge_type: a.challenge_type,
-        binding_method: a.binding_method,
-        oob_code: a.oob_code,
+        challenge_type: i.challenge_type,
+        binding_method: i.binding_method,
+        oob_code: i.oob_code,
         name: t.name
       };
     }
-    const i = new n(
+    const a = new n(
       u.UnknownError,
       "Unsupported MFA type " + t.authenticator_type + " returned"
     );
     return {
-      error: i.oauthErrorCode,
-      error_description: i.message
+      error: a.oauthErrorCode,
+      error_description: a.message
     };
   }
   async passwordOtp(r, o) {
@@ -1938,10 +1938,10 @@ class G extends re {
       if (o.locals.sessionId && this.autoRefreshActive[o.locals.sessionId]) return;
       try {
         o.locals.sessionId && (this.autoRefreshActive[o.locals.sessionId] = !0);
-        const i = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(e));
-        if (!i.error && !i.access_token && (i.error = "server_error", i.error_description = "Unexpectedly did not receive error or access token"), !i.error) {
+        const a = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(e));
+        if (!a.error && !a.access_token && (a.error = "server_error", a.error_description = "Unexpectedly did not receive error or access token"), !a.error) {
           const d = await this.receiveTokenFn(
-            i,
+            a,
             this,
             o,
             r == "silent",
@@ -1951,43 +1951,43 @@ class G extends re {
         }
         if (r != "silent") {
           const d = n.fromOAuthError(
-            i.error ?? "server_error",
-            i.error_description
+            a.error ?? "server_error",
+            a.error_description
           );
           return r == "page" ? this.errorFn(this.server, o, d) : {
             error: d.oauthErrorCode,
             error_description: d.message
           };
         }
-        let a = i.expires_in;
-        if (!a && i.access_token) {
-          const d = M(i.access_token);
-          d.exp && (a = d.exp);
+        let i = a.expires_in;
+        if (!i && a.access_token) {
+          const d = M(a.access_token);
+          d.exp && (i = d.exp);
         }
-        if (!a)
+        if (!i)
           throw new n(
             u.BadRequest,
             "OAuth server did not return an expiry for the access token"
           );
-        const c = (/* @__PURE__ */ new Date()).getTime() + a * 1e3;
+        const c = (/* @__PURE__ */ new Date()).getTime() + i * 1e3;
         return {
-          access_token: i.access_token,
-          refresh_token: i.refresh_token,
-          expires_in: i.expires_in,
+          access_token: a.access_token,
+          refresh_token: a.refresh_token,
+          expires_in: a.expires_in,
           expires_at: c,
-          error: i.error,
-          error_description: i.error_description
+          error: a.error,
+          error_description: a.error_description
         };
-      } catch (i) {
-        if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
-        if (l.logger.debug(f({ err: i })), l.logger.error(f({
-          cerr: i,
+      } catch (a) {
+        if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
+        if (l.logger.debug(f({ err: a })), l.logger.error(f({
+          cerr: a,
           msg: "Failed refreshing access token"
         })), r != "silent") {
-          const a = n.asCrossauthError(i);
-          return r == "page" ? this.errorFn(this.server, o, a) : {
-            error: a.oauthErrorCode,
-            error_description: a.message
+          const i = n.asCrossauthError(a);
+          return r == "page" ? this.errorFn(this.server, o, i) : {
+            error: i.oauthErrorCode,
+            error_description: i.message
           };
         }
         return {
@@ -2063,17 +2063,17 @@ class G extends re {
     }
     let s;
     try {
-      if (!(this.validFlows.includes(_.Password) || this.validFlows.includes(_.PasswordMfa))) {
-        const a = new n(u.Unauthorized, "Password flow is not supported");
-        return this.errorFn(this.server, r, a);
+      if (!(this.validFlows.includes(E.Password) || this.validFlows.includes(E.PasswordMfa))) {
+        const i = new n(u.Unauthorized, "Password flow is not supported");
+        return this.errorFn(this.server, r, i);
       }
       var e = new b();
       if (await e.loadData(r), s = e.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
             throw new n(u.InvalidCsrf);
-        } catch (a) {
-          if (m.isSvelteKitError(a) || m.isSvelteKitRedirect(a)) throw a;
+        } catch (i) {
+          if (m.isSvelteKitError(i) || m.isSvelteKitRedirect(i)) throw i;
           const c = new n(u.Unauthorized, "CSRF token not present");
           return this.errorFn(this.server, r, c);
         }
@@ -2083,19 +2083,19 @@ class G extends re {
         ok: !1,
         ...t
       };
-      const i = await this.receiveTokenFn(
+      const a = await this.receiveTokenFn(
         t,
         this,
         r,
         !1,
         this.setEventLocalsUser
       );
-      if (t && i instanceof Response) return i;
+      if (t && a instanceof Response) return a;
       throw new n(u.UnknownError, "Receive token function did not return a Response");
     } catch (t) {
       if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-      const i = n.asCrossauthError(t);
-      return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), this.errorFn(this.server, r, i);
+      const a = n.asCrossauthError(t);
+      return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), this.errorFn(this.server, r, a);
     }
   }
   async passwordFlow_action(r, o) {
@@ -2106,17 +2106,17 @@ class G extends re {
       throw new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
     let s;
     try {
-      if (!(this.validFlows.includes(_.Password) || this.validFlows.includes(_.PasswordMfa))) {
-        const a = new n(u.Unauthorized, "Password and Password MFA flows are not supported");
-        return this.errorFn(this.server, r, a);
+      if (!(this.validFlows.includes(E.Password) || this.validFlows.includes(E.PasswordMfa))) {
+        const i = new n(u.Unauthorized, "Password and Password MFA flows are not supported");
+        return this.errorFn(this.server, r, i);
       }
       var e = new b();
       if (await e.loadData(r), s = e.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
             throw new n(u.InvalidCsrf);
-        } catch (a) {
-          throw m.isSvelteKitError(a) || m.isSvelteKitRedirect(a) ? a : new n(u.Unauthorized, "CSRF token not present");
+        } catch (i) {
+          throw m.isSvelteKitError(i) || m.isSvelteKitRedirect(i) ? i : new n(u.Unauthorized, "CSRF token not present");
         }
       const t = await o(r, s);
       if (!t) throw new n(u.UnknownError, "Password flow returned no data");
@@ -2126,28 +2126,28 @@ class G extends re {
           ...t
         };
       if (t.challenge_type) {
-        if (!this.validFlows.includes(_.PasswordMfa)) {
-          const a = new n(u.Unauthorized, "Password MFA flow is not supported");
-          return this.errorFn(this.server, r, a);
+        if (!this.validFlows.includes(E.PasswordMfa)) {
+          const i = new n(u.Unauthorized, "Password MFA flow is not supported");
+          return this.errorFn(this.server, r, i);
         }
         return t;
       }
-      const i = await this.receiveTokenFn(
+      const a = await this.receiveTokenFn(
         t,
         this,
         r,
         !1,
         this.setEventLocalsUser
       ) ?? {};
-      if (i instanceof Response) throw new n(u.Configuration, "Refresh token flow should return an object not Response");
-      return i;
+      if (a instanceof Response) throw new n(u.Configuration, "Refresh token flow should return an object not Response");
+      return a;
     } catch (t) {
       if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-      const i = n.asCrossauthError(t);
+      const a = n.asCrossauthError(t);
       return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), {
         ok: !1,
-        error: i.oauthErrorCode,
-        error_description: i.message
+        error: a.oauthErrorCode,
+        error_description: a.message
       };
     }
   }
@@ -2173,30 +2173,30 @@ class G extends re {
       let t = o.url;
       if (!t) {
         if (!r.url.pathname.startsWith(this.bffEndpointName)) throw new n(u.Unauthorized, "Attempt to call BFF url with the wrong prefix");
-        const i = r.url.pathname.substring(this.bffEndpointName.length);
-        let a = ((e = r.url.searchParams) == null ? void 0 : e.toString()) ?? void 0;
-        a && a != "" && (a = "?" + a), t = new URL(this.bffBaseUrl + i + a);
+        const a = r.url.pathname.substring(this.bffEndpointName.length);
+        let i = ((e = r.url.searchParams) == null ? void 0 : e.toString()) ?? void 0;
+        i && i != "" && (i = "?" + i), t = new URL(this.bffBaseUrl + a + i);
       }
       o.headers || (o.headers = new Headers());
-      for (let i = 0; i < this.bffMaxTries; ++i) {
-        i > 0 && await new Promise((g) => setTimeout(g, this.bffSleepMilliseconds));
-        const a = await this.server.sessionAdapter.getSessionData(
+      for (let a = 0; a < this.bffMaxTries; ++a) {
+        a > 0 && await new Promise((g) => setTimeout(g, this.bffSleepMilliseconds));
+        const i = await this.server.sessionAdapter.getSessionData(
           r,
           this.sessionDataName
         );
-        if (!a) {
-          if (i == this.bffMaxTries)
+        if (!i) {
+          if (a == this.bffMaxTries)
             throw new n(u.Unauthorized, "No access token found");
           continue;
         }
-        let c = a.access_token;
-        if (a && a.access_token) {
+        let c = i.access_token;
+        if (i && i.access_token) {
           const g = await this.refresh(
             "silent",
             r,
             !0,
-            a.refresh_token,
-            a.expires_at
+            i.refresh_token,
+            i.expires_at
           );
           if (g instanceof Response) throw new n(u.Configuration, "Expected object when refreshing tokens, not Response");
           if (g != null && g.access_token)
@@ -2218,7 +2218,7 @@ class G extends re {
           headers: o.headers,
           method: o.method ?? r.request.method
         }), d.status == 401) {
-          if (i < this.bffMaxTries - 1)
+          if (a < this.bffMaxTries - 1)
             continue;
           return d;
         } else
@@ -2227,11 +2227,11 @@ class G extends re {
       return new Response(null, { status: 401 });
     } catch (t) {
       if (m.isSvelteKitError(t) || m.isSvelteKitRedirect(t)) throw t;
-      const i = n.asCrossauthError(t);
-      return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), v({
-        error: i.oauthErrorCode,
-        error_description: i.message
-      }, { status: i.httpStatus });
+      const a = n.asCrossauthError(t);
+      return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), v({
+        error: a.oauthErrorCode,
+        error_description: a.message
+      }, { status: a.httpStatus });
     }
   }
   async unpack(r) {
@@ -2269,16 +2269,16 @@ class G extends re {
       const s = r.url.pathname.substring(this.bffEndpointName.length);
       let e;
       for (let t = 0; t < this.bffEndpoints.length; ++t) {
-        let i = this.bffEndpoints[t];
-        if (i.matchSubUrls) {
-          let a = i.url, c = i.url;
-          if (c.endsWith("/") || (c += "/"), i.methodsString.includes(r.request.method) && (s.startsWith(c) || s == a)) {
+        let a = this.bffEndpoints[t];
+        if (a.matchSubUrls) {
+          let i = a.url, c = a.url;
+          if (c.endsWith("/") || (c += "/"), a.methodsString.includes(r.request.method) && (s.startsWith(c) || s == i)) {
             e = t;
             break;
           }
         } else {
-          let a = i.url;
-          if (i.methodsString.includes(r.request.method) && s == a) {
+          let i = a.url;
+          if (a.methodsString.includes(r.request.method) && s == i) {
             e = t;
             break;
           }
@@ -2308,23 +2308,23 @@ class G extends re {
       if (!this.tokenEndpoints || this.tokenEndpoints.length == 0)
         throw new n(u.Unauthorized, "No tokens have been made available");
       let t = Array.isArray(o) ? o : [o];
-      const i = await this.server.sessionAdapter.getSessionData(
+      const a = await this.server.sessionAdapter.getSessionData(
         r,
         this.sessionDataName
       );
-      if (!i)
+      if (!a)
         throw new n(u.Unauthorized, "No access token found");
-      let a = {}, c, d = !1;
+      let i = {}, c, d = !1;
       for (let h of t) {
         if (!this.tokenEndpoints.includes(h)) throw new n(u.Unauthorized, "Token type " + h + " may not be returned");
         d = !1;
         let g = h;
         h.startsWith("have_") && (g = h.replace("have_", ""), d = !0);
         const p = g.replace("_token", ""), w = e && this.jwtTokens.includes(p);
-        let S = this.tokenPayload(g, i, d, w);
-        d ? a[h] = S.ok : S && (a[h] = S), c = a[h];
+        let S = this.tokenPayload(g, a, d, w);
+        d ? i[h] = S.ok : S && (i[h] = S), c = i[h];
       }
-      return Array.isArray(o) ? { status: 200, body: a } : c ? d ? { status: 200, body: typeof c == "boolean" ? { ok: c } : c } : { status: 200, body: c } : o.startsWith("have_") ? { status: 200, body: { ok: !1 } } : { status: 204 };
+      return Array.isArray(o) ? { status: 200, body: i } : c ? d ? { status: 200, body: typeof c == "boolean" ? { ok: c } : c } : { status: 200, body: c } : o.startsWith("have_") ? { status: 200, body: { ok: !1 } } : { status: 204 };
     } catch (s) {
       if (m.isSvelteKitError(s) || m.isSvelteKitRedirect(s)) throw s;
       const e = n.asCrossauthError(s);
@@ -2341,7 +2341,7 @@ class G extends re {
   async startDeviceCodeFlow_internal(r) {
     let o;
     try {
-      if (!this.validFlows.includes(_.DeviceCode))
+      if (!this.validFlows.includes(E.DeviceCode))
         throw new n(u.Unauthorized, "Device code flow is not supported");
       var s = new b();
       if (await s.loadData(r), o = s.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
@@ -2355,13 +2355,13 @@ class G extends re {
       e == "" && (e = void 0);
       let t = this.authServerBaseUrl;
       t.endsWith("/") || (t += "/"), t += this.deviceAuthorizationUrl;
-      const i = await this.startDeviceCodeFlow(t, e);
-      let a;
-      return i.verification_uri_complete && await ae.toDataURL(i.verification_uri_complete).then((c) => {
-        a = c;
+      const a = await this.startDeviceCodeFlow(t, e);
+      let i;
+      return a.verification_uri_complete && await ae.toDataURL(a.verification_uri_complete).then((c) => {
+        i = c;
       }).catch((c) => {
         l.logger.debug(f({ err: c })), l.logger.warn(f({ msg: "Couldn't generate verification URL QR Code" }));
-      }), a ? { verification_uri_qrdata: a, ...i } : i;
+      }), i ? { verification_uri_qrdata: i, ...a } : a;
     } catch (e) {
       if (m.isSvelteKitRedirect(e) || m.isSvelteKitError(e)) throw e;
       const t = n.asCrossauthError(e);
@@ -2374,15 +2374,15 @@ class G extends re {
   async pollDeviceCodeFlow_internal(r) {
     let o;
     try {
-      if (!this.validFlows.includes(_.DeviceCode))
+      if (!this.validFlows.includes(E.DeviceCode))
         throw new n(u.Unauthorized, "Device code flow is not supported");
       var s = new b();
       if (await s.loadData(r), o = s.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
             throw new n(u.InvalidCsrf);
-        } catch (i) {
-          throw m.isSvelteKitError(i) || m.isSvelteKitRedirect(i) ? i : new n(u.Unauthorized, "CSRF token not present");
+        } catch (a) {
+          throw m.isSvelteKitError(a) || m.isSvelteKitRedirect(a) ? a : new n(u.Unauthorized, "CSRF token not present");
         }
       let e = o.device_code;
       if (!e) throw new n(u.BadRequest, "No device code given when polling for user authorization");
@@ -2397,8 +2397,8 @@ class G extends re {
         );
       {
         if (t.error == "authorization_pending") return { ok: !0, ...t };
-        let i = t.error ?? "server_error", a = t.error_description ?? "Didn't receive an access token";
-        const c = n.fromOAuthError(i, a);
+        let a = t.error ?? "server_error", i = t.error_description ?? "Didn't receive an access token";
+        const c = n.fromOAuthError(a, i);
         return this.errorFn(this.server, r, c);
       }
     } catch (e) {
@@ -2424,19 +2424,19 @@ class G extends re {
     ));
   }
   async storeSessionData(r, o) {
-    var s, e, t, i;
+    var s, e, t, a;
     if (this.server.sessionServer) {
-      let a = (s = this.server.sessionServer) == null ? void 0 : s.getSessionCookieValue(r);
-      a ? await ((t = this.server.sessionAdapter) == null ? void 0 : t.updateSessionData(
+      let i = (s = this.server.sessionServer) == null ? void 0 : s.getSessionCookieValue(r);
+      i ? await ((t = this.server.sessionAdapter) == null ? void 0 : t.updateSessionData(
         r,
         this.sessionDataName,
         o
-      )) : a = await ((e = this.server.sessionServer) == null ? void 0 : e.createAnonymousSession(
+      )) : i = await ((e = this.server.sessionServer) == null ? void 0 : e.createAnonymousSession(
         r,
         { [this.sessionDataName]: o }
       ));
     } else
-      await ((i = this.server.sessionAdapter) == null ? void 0 : i.updateSessionData(
+      await ((a = this.server.sessionAdapter) == null ? void 0 : a.updateSessionData(
         r,
         this.sessionDataName,
         o
@@ -2455,13 +2455,13 @@ class ge extends se {
    * @param options See {@link SvelteKitOAuthResourceServerOptions}
    */
   constructor(r, o = {}) {
-    if (super(r, o), this.errorBody = {}, this.protectedEndpoints = {}, this.protectedEndpointPrefixes = [], this.sessionDataName = "oauth", this.tokenLocations = ["header"], y("errorBody", E.Json, this, o, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), y("tokenLocations", E.JsonArray, this, o, "OAUTH_TOKEN_LOCATIONS"), y("sessionDataName", E.String, this, o, "OAUTH_SESSION_DATA_NAME"), this.userStorage = o.userStorage, this.sessionAdapter = o.sessionAdapter, o.protectedEndpoints) {
+    if (super(r, o), this.errorBody = {}, this.protectedEndpoints = {}, this.protectedEndpointPrefixes = [], this.sessionDataName = "oauth", this.tokenLocations = ["header"], y("errorBody", _.Json, this, o, "OAUTH_RESSERVER_ACCESS_DENIED_BODY"), y("tokenLocations", _.JsonArray, this, o, "OAUTH_TOKEN_LOCATIONS"), y("sessionDataName", _.String, this, o, "OAUTH_SESSION_DATA_NAME"), this.userStorage = o.userStorage, this.sessionAdapter = o.sessionAdapter, o.protectedEndpoints) {
       const s = /^[!#\$%&'\(\)\*\+,\.\/a-zA-Z\[\]\^_`-]+/;
       for (const [e, t] of Object.entries(o.protectedEndpoints)) {
         if (!e.startsWith("/"))
           throw new n(u.Configuration, "protected endpoints must be absolute paths without the protocol and hostname");
-        t.scope && t.scope.forEach((i) => {
-          if (!s.test(i)) throw new n(u.Configuration, "Illegal characters in scope " + i);
+        t.scope && t.scope.forEach((a) => {
+          if (!s.test(a)) throw new n(u.Configuration, "Illegal characters in scope " + a);
         });
       }
       this.protectedEndpoints = { ...o.protectedEndpoints };
@@ -2473,16 +2473,16 @@ class ge extends se {
     o.protectedEndpoints && (this.hook = async ({ event: s }) => {
       var c, d;
       const e = s.url.pathname;
-      let t = !1, i = "";
+      let t = !1, a = "";
       if (e in this.protectedEndpoints)
-        t = !0, i = e;
+        t = !0, a = e;
       else
         for (let h of this.protectedEndpointPrefixes)
-          e.startsWith(h) && (t = !0), i = h;
+          e.startsWith(h) && (t = !0), a = h;
       if (!t) return;
-      const a = await this.authorized(s);
-      if (!(s.locals.user && s.locals.authType == "cookie" && this.protectedEndpoints[i].acceptSessionAuthorization != !0)) {
-        if (!a) {
+      const i = await this.authorized(s);
+      if (!(s.locals.user && s.locals.authType == "cookie" && this.protectedEndpoints[a].acceptSessionAuthorization != !0)) {
+        if (!i) {
           s.locals.authError = "access_denied", s.locals.authErrorDescription = "No access token";
           const h = this.authenticateHeader(s);
           return new Response(JSON.stringify(this.errorBody), {
@@ -2493,7 +2493,7 @@ class ge extends se {
             status: 401
           });
         }
-        if (!a.authorized) {
+        if (!i.authorized) {
           const h = this.authenticateHeader(s);
           return new Response(JSON.stringify(this.errorBody), {
             headers: {
@@ -2504,17 +2504,17 @@ class ge extends se {
           });
         }
       }
-      if (a) {
-        if (s.locals.accessTokenPayload = a.tokenPayload, s.locals.user = a.user, (c = a.tokenPayload) != null && c.scope)
-          if (Array.isArray(a.tokenPayload.scope)) {
+      if (i) {
+        if (s.locals.accessTokenPayload = i.tokenPayload, s.locals.user = i.user, (c = i.tokenPayload) != null && c.scope)
+          if (Array.isArray(i.tokenPayload.scope)) {
             let h = [];
-            for (let g of a.tokenPayload.scope)
+            for (let g of i.tokenPayload.scope)
               typeof g == "string" && h.push(g);
             s.locals.scope = h;
-          } else typeof a.tokenPayload.scope == "string" && (s.locals.scope = a.tokenPayload.scope.split(" "));
-        if (this.protectedEndpoints[i].scope) {
-          for (let h of this.protectedEndpoints[i].scope ?? [])
-            if (!s.locals.scope || !s.locals.scope.includes(h) && this.protectedEndpoints[i].acceptSessionAuthorization != !0) {
+          } else typeof i.tokenPayload.scope == "string" && (s.locals.scope = i.tokenPayload.scope.split(" "));
+        if (this.protectedEndpoints[a].scope) {
+          for (let h of this.protectedEndpoints[a].scope ?? [])
+            if (!s.locals.scope || !s.locals.scope.includes(h) && this.protectedEndpoints[a].acceptSessionAuthorization != !0) {
               l.logger.warn(f({
                 msg: "Access token does not have sufficient scope",
                 username: (d = s.locals.user) == null ? void 0 : d.username,
@@ -2530,7 +2530,7 @@ class ge extends se {
               });
             }
         }
-        if (s.locals.authType = "oauth", s.locals.authError = a == null ? void 0 : a.error, (a == null ? void 0 : a.error) == "access_denied") {
+        if (s.locals.authType = "oauth", s.locals.authError = i == null ? void 0 : i.error, (i == null ? void 0 : i.error) == "access_denied") {
           const h = this.authenticateHeader(s);
           return new Response(JSON.stringify(this.errorBody), {
             headers: {
@@ -2539,14 +2539,14 @@ class ge extends se {
             },
             status: 401
           });
-        } else if (a != null && a.error)
+        } else if (i != null && i.error)
           return new Response(JSON.stringify(this.errorBody), {
             headers: {
               "content-type": "application/json"
             },
             status: 500
           });
-        s.locals.authErrorDescription = a == null ? void 0 : a.error_description, l.logger.debug(f({ msg: "Resource server url", url: s.request.url, authorized: s.locals.accessTokenPayload != null }));
+        s.locals.authErrorDescription = i == null ? void 0 : i.error_description, l.logger.debug(f({ msg: "Resource server url", url: s.request.url, authorized: s.locals.accessTokenPayload != null }));
       }
     });
   }
@@ -2672,11 +2672,11 @@ const D = class D {
     apiKey: s,
     oAuthAuthServer: e,
     oAuthClient: t,
-    oAuthClients: i,
-    oAuthResServer: a,
+    oAuthClients: a,
+    oAuthResServer: i,
     options: c
   }) {
-    this.loginUrl = "/login", this.audience = "", this.dummyLoad = async (h) => ({}), this.dummyActions = {}, this.dummyBff = async (h) => ({ status: 500, body: { error: "Unimplemented" } }), c || (c = {}), y("loginUrl", E.String, this, c, "LOGIN_URL", !1), c.isAdminFn && (D.isAdminFn = c.isAdminFn);
+    this.loginUrl = "/login", this.audience = "", this.dummyLoad = async (h) => ({}), this.dummyActions = {}, this.dummyBff = async (h) => ({ status: 500, body: { error: "Unimplemented" } }), c || (c = {}), y("loginUrl", _.String, this, c, "LOGIN_URL", !1), c.isAdminFn && (D.isAdminFn = c.isAdminFn);
     let d = {};
     if (c.authenticators && (d = c.authenticators), this.userStorage = c.userStorage, r) {
       if (!d)
@@ -2704,15 +2704,15 @@ const D = class D {
         { ...h, ...c, ...e.options }
       );
     }
-    if (t && i)
+    if (t && a)
       throw new n(u.Configuration, "Cannot specify both oAuthClient and oAuthClients");
     if (t && (this.oAuthClient = new G(
       this,
       t.authServerBaseUrl,
       { ...c, ...t.options }
-    )), i) {
+    )), a) {
       this.oAuthClients = [];
-      for (let h of i)
+      for (let h of a)
         this.oAuthClients.push(
           new G(
             this,
@@ -2721,9 +2721,9 @@ const D = class D {
           )
         );
     }
-    a && (y("audience", E.String, this, c, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new ge(
+    i && (y("audience", _.String, this, c, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new ge(
       [new te(this.audience, c)],
-      { sessionAdapter: this.sessionAdapter, ...a.options, ...c }
+      { sessionAdapter: this.sessionAdapter, ...i.options, ...c }
     )), this.hooks = async ({ event: h, resolve: g }) => {
       const p = await this.unresolvedHooks(h);
       return p instanceof Response ? p : await g(p);
@@ -2834,12 +2834,12 @@ class we {
           const g = await this.sessionServer.getSessionData(s, "factor2change");
           g != null && g.username || this.isSessionUser(s) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), e = g == null ? void 0 : g.username;
         }
-        let t = this.sessionServer.allowedFactor2 ?? [{ name: "none", friendlyName: "None", configurable: !1 }], i = {}, a = s.url.searchParams.get("required"), c;
-        a && (a = a.toLowerCase(), c = a == "true" || a == "1", c == !0 && (i.required = !0));
+        let t = this.sessionServer.allowedFactor2 ?? [{ name: "none", friendlyName: "None", configurable: !1 }], a = {}, i = s.url.searchParams.get("required"), c;
+        i && (i = i.toLowerCase(), c = i == "true" || i == "1", c == !0 && (a.required = !0));
         let d = s.url.searchParams.get("next");
-        return d && (i.next = d), {
+        return d && (a.next = d), {
           allowedFactor2: t,
-          ...i,
+          ...a,
           username: e,
           ...this.baseEndpoint(s)
         };
@@ -2849,12 +2849,12 @@ class we {
         default: async (s) => await this.changePassword(s)
       },
       load: async (s) => {
-        let e = {}, t = s.url.searchParams.get("required"), i, a = s.locals.user != null;
-        if (!a) {
+        let e = {}, t = s.url.searchParams.get("required"), a, i = s.locals.user != null;
+        if (!i) {
           const d = await this.sessionServer.getSessionData(s, "passwordchange");
-          d != null && d.username && (a = !0);
+          d != null && d.username && (i = !0);
         }
-        a || this.sessionServer.redirect(302, this.loginUrl), t && (t = t.toLowerCase(), i = t == "true" || t == "1", i == !0 && (e.required = !0));
+        i || this.sessionServer.redirect(302, this.loginUrl), t && (t = t.toLowerCase(), a = t == "true" || t == "1", a == !0 && (e.required = !0));
         let c = s.url.searchParams.get("next");
         return c && (e.next = c), {
           ...e,
@@ -2880,8 +2880,8 @@ class we {
         default: async (s) => await this.requestPasswordReset(s)
       },
       load: async (s) => {
-        let e = {}, t = s.url.searchParams.get("required"), i;
-        return t && (t = t.toLowerCase(), i = t == "true" || t == "1", i == !0 && (e.required = !0)), {
+        let e = {}, t = s.url.searchParams.get("required"), a;
+        return t && (t = t.toLowerCase(), a = t == "true" || t == "1", a == !0 && (e.required = !0)), {
           ...e,
           ...this.baseEndpoint(s)
         };
@@ -2901,14 +2901,14 @@ class we {
           try {
             return e = await this.resetPassword(s), e;
           } catch (t) {
-            const i = n.asCrossauthError(t);
+            const a = n.asCrossauthError(t);
             if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-            return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
+            return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
               ok: !1,
               tokenValidated: !1,
               error: e == null ? void 0 : e.error,
-              errorCode: i.code,
-              errorCodeName: i.codeName,
+              errorCode: a.code,
+              errorCodeName: a.codeName,
               ...this.baseEndpoint(s)
             };
           }
@@ -2956,7 +2956,7 @@ class we {
           ...e
         };
       }
-    }, this.sessionServer = r, y("changePasswordUrl", E.String, this, o, "CHANGE_PASSWORD_URL"), y("requestPasswordResetUrl", E.String, this, o, "REQUEST_PASSWORD_RESET_URL"), y("changeFactor2Url", E.String, this, o, "CHANGE_FACTOR2_URL"), y("loginRedirectUrl", E.JsonArray, this, o, "LOGIN_REDIRECT_URL"), y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.addToSession && (this.addToSession = o.addToSession);
+    }, this.sessionServer = r, y("changePasswordUrl", _.String, this, o, "CHANGE_PASSWORD_URL"), y("requestPasswordResetUrl", _.String, this, o, "REQUEST_PASSWORD_RESET_URL"), y("changeFactor2Url", _.String, this, o, "CHANGE_FACTOR2_URL"), y("loginRedirectUrl", _.JsonArray, this, o, "LOGIN_REDIRECT_URL"), y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.addToSession && (this.addToSession = o.addToSession);
   }
   /** Returns whether there is a user logged in with a cookie-based session
    */
@@ -3009,12 +3009,13 @@ class we {
       var s = new b();
       await s.loadData(r), o = s.toObject();
       const e = s.get("username") ?? "", t = s.getAsBoolean("persist") ?? !1;
-      let i = o.next ?? this.loginRedirectUrl;
-      if (i.includes("/__data.json") && (i = i.substring(0, i.indexOf("/__data.json"))), e == "") throw new n(u.InvalidUsername, "Username field may not be empty");
-      let a = this.addToSession ? this.addToSession(r, o) : {};
+      o.next.includes("/__data.json") && (o.next = o.next.substring(0, o.next.indexOf("/__data.json")));
+      let a = o.next ?? this.loginRedirectUrl;
+      if (e == "") throw new n(u.InvalidUsername, "Username field may not be empty");
+      let i = this.addToSession ? this.addToSession(r, o) : {};
       if (this.sessionServer.enableCsrfProtection && !r.locals.csrfToken) throw new n(u.InvalidCsrf);
       const c = this.sessionServer.getSessionCookieValue(r);
-      let { sessionCookie: d, csrfCookie: h, user: g } = await this.sessionServer.sessionManager.login(e, s.toObject(), a, t);
+      let { sessionCookie: d, csrfCookie: h, user: g } = await this.sessionServer.sessionManager.login(e, s.toObject(), i, t);
       if (l.logger.debug(f({
         msg: "Login: set session cookie " + d.name + " opts " + JSON.stringify(d.options),
         user: e
@@ -3039,19 +3040,19 @@ class we {
           })), l.logger.debug(f({ err: p }));
         }
       if (g.state == N.passwordChangeNeeded)
-        this.sessionServer.redirect(302, this.changePasswordUrl + "?required=true&next=" + encodeURIComponent("login?next=" + i));
+        this.sessionServer.redirect(302, this.changePasswordUrl + "?required=true&next=" + encodeURIComponent("login?next=" + a));
       else {
         if (g.state == N.passwordResetNeeded)
           throw new n(u.PasswordResetNeeded, "Please click on the link we sent you to reset your password");
         if (g.state == N.passwordAndFactor2ResetNeeded)
           throw new n(u.PasswordResetNeeded, "Please click on the link we sent you to reset your password");
-        this.sessionServer.allowedFactor2.length > 0 && g.state == N.factor2ResetNeeded || !this.sessionServer.allowedFactor2Names.includes(g.factor2 ? g.factor2 : "none") ? this.sessionServer.redirect(302, this.changeFactor2Url + "?required=true&next=" + encodeURIComponent("login?next=" + i)) : (!g.factor2 || g.factor2 == "") && (r.locals.user = g);
+        this.sessionServer.allowedFactor2.length > 0 && g.state == N.factor2ResetNeeded || !this.sessionServer.allowedFactor2Names.includes(g.factor2 ? g.factor2 : "none") ? this.sessionServer.redirect(302, this.changeFactor2Url + "?required=true&next=" + encodeURIComponent("login?next=" + a)) : (!g.factor2 || g.factor2 == "") && (r.locals.user = g);
       }
       return {
         user: g,
         formData: o,
         factor2Required: g.factor2 && g.factor2 != "",
-        next: i,
+        next: a,
         ok: !0
       };
     } catch (e) {
@@ -3072,22 +3073,22 @@ class we {
   async loginWithUser(r, o, s) {
     const e = s.locals.sessionId, t = new b();
     await t.loadData(s);
-    let i = this.addToSession ? this.addToSession(s, t.toObject()) : {}, { sessionCookie: a, csrfCookie: c, csrfFormOrHeaderValue: d } = await this.sessionServer.sessionManager.login("", {}, i, void 0, r, o);
+    let a = this.addToSession ? this.addToSession(s, t.toObject()) : {}, { sessionCookie: i, csrfCookie: c, csrfFormOrHeaderValue: d } = await this.sessionServer.sessionManager.login("", {}, a, void 0, r, o);
     if (l.logger.debug(f({
-      msg: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
+      msg: "Login: set session cookie " + i.name + " opts " + JSON.stringify(i.options),
       user: r.username
     })), s.cookies.set(
-      a.name,
-      a.value,
-      R(a.options)
+      i.name,
+      i.value,
+      R(i.options)
     ), l.logger.debug(f({
-      msg: "Login: set csrf cookie " + c.name + " opts " + JSON.stringify(a.options),
+      msg: "Login: set csrf cookie " + c.name + " opts " + JSON.stringify(i.options),
       user: r.username
     })), this.sessionServer.enableCsrfProtection && s.cookies.set(
       c.name,
       c.value,
       R(c.options)
-    ), s.locals.user = r, s.locals.csrfToken = d, s.locals.sessionId = this.sessionServer.sessionManager.getSessionId(a.value), e)
+    ), s.locals.user = r, s.locals.csrfToken = d, s.locals.sessionId = this.sessionServer.sessionManager.getSessionId(i.value), e)
       try {
         await this.sessionServer.sessionManager.deleteSession(e);
       } catch (h) {
@@ -3204,17 +3205,17 @@ class we {
           u.Forbidden,
           "Illegal second factor " + o.factor2 + " requested"
         );
-      (o.factor2 == "none" || o.factor2 == "") && (o.factor2 = void 0), t = this.sessionServer.createUserFn(r, o, this.sessionServer.userStorage.userEditableFields);
-      let i = this.sessionServer.authenticators[t.factor1].validateSecrets(o);
-      const a = this.sessionServer.authenticators[t.factor1].secretNames();
+      (o.factor2 == "none" || o.factor2 == "") && (o.factor2 = void 0), t = this.sessionServer.createUserFn(r, o, this.sessionServer.userStorage.userEditableFields, this.sessionServer.userAllowedFactor1);
+      let a = this.sessionServer.authenticators[t.factor1].validateSecrets(o);
+      const i = this.sessionServer.authenticators[t.factor1].secretNames();
       let c = {};
       for (let p in o)
         if (p.startsWith("repeat_")) {
           const w = p.replace(/^repeat_/, "");
-          a.includes(w) && (c[w] = o[p]);
+          i.includes(w) && (c[w] = o[p]);
         }
       Object.keys(c).length === 0 && (c = void 0), t.state = "active", o.factor2 && o.factor2 != "none" ? t.state = "awaitingtwofactor" : this.sessionServer.enableEmailVerification && (t.state = "awaitingemailverification");
-      let h = [...this.sessionServer.validateUserFn(t), ...i];
+      let h = [...this.sessionServer.validateUserFn(t), ...a];
       if (h.length > 0)
         throw new n(u.FormEntry, h);
       let g = !1;
@@ -3348,8 +3349,8 @@ class we {
     try {
       var t = new b();
       await t.loadData(r), o = t.toObject();
-      const i = await this.sessionServer.getSessionData(r, "2fa");
-      if (i != null && i.factor2) e = i == null ? void 0 : i.factor2;
+      const a = await this.sessionServer.getSessionData(r, "2fa");
+      if (a != null && a.factor2) e = a == null ? void 0 : a.factor2;
       else throw new n(u.BadRequest, "Two factor authentication was not started");
       if (this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
         throw new n(u.InvalidCsrf);
@@ -3357,17 +3358,17 @@ class we {
         u.Unauthorized,
         "No session active while enabling 2FA.  Please enable cookies"
       );
-      let a = await this.sessionServer.sessionManager.completeTwoFactorSetup(
+      let i = await this.sessionServer.sessionManager.completeTwoFactorSetup(
         o,
         r.locals.sessionId
       );
-      return this.sessionServer.enableEmailVerification || await this.loginWithUser(a, !0, r), r.locals.user ? {
+      return this.sessionServer.enableEmailVerification || await this.loginWithUser(i, !0, r), r.locals.user ? {
         ok: !0,
-        user: a,
+        user: i,
         emailVerificationRequired: this.sessionServer.enableEmailVerification
-      } : await this.loginWithUser(a, !0, r);
-    } catch (i) {
-      const a = n.asCrossauthError(i);
+      } : await this.loginWithUser(i, !0, r);
+    } catch (a) {
+      const i = n.asCrossauthError(a);
       let c;
       try {
         c = (await this.sessionServer.sessionManager.repeatTwoFactorSignup(r.locals.sessionId ?? "")).userData;
@@ -3378,11 +3379,11 @@ class we {
         csrfToken: r.locals.csrfToken,
         username: c.username ?? "",
         factor2: e
-      }), l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
+      }), l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
         ok: !1,
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         formData: o,
         factor2Data: s,
         emailVerificationRequired: this.sessionServer.enableEmailVerification
@@ -3418,22 +3419,22 @@ class we {
       if (!t) throw new n(u.Unauthorized);
       if (this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
         throw new n(u.InvalidCsrf);
-      let i = this.addToSession ? this.addToSession(r, o) : {};
-      const { sessionCookie: a, csrfCookie: c, user: d } = await this.sessionServer.sessionManager.completeTwoFactorLogin(
+      let a = this.addToSession ? this.addToSession(r, o) : {};
+      const { sessionCookie: i, csrfCookie: c, user: d } = await this.sessionServer.sessionManager.completeTwoFactorLogin(
         o,
         t,
-        i,
+        a,
         e
       );
       return l.logger.debug(f({
-        msg: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
+        msg: "Login: set session cookie " + i.name + " opts " + JSON.stringify(i.options),
         user: d == null ? void 0 : d.username
       })), r.cookies.set(
-        a.name,
-        a.value,
-        R(a.options)
+        i.name,
+        i.value,
+        R(i.options)
       ), l.logger.debug(f({
-        msg: "Login: set csrf cookie " + c.name + " opts " + JSON.stringify(a.options),
+        msg: "Login: set csrf cookie " + c.name + " opts " + JSON.stringify(i.options),
         user: d == null ? void 0 : d.username
       })), r.cookies.set(
         c.name,
@@ -3552,17 +3553,17 @@ class we {
         );
       const e = r.params.token ?? "";
       if (e == "") throw new n(u.InvalidUsername, "No token provided");
-      const t = await this.sessionServer.sessionManager.userForPasswordResetToken(e), i = this.sessionServer.authenticators[t.factor1], a = i.secretNames();
+      const t = await this.sessionServer.sessionManager.userForPasswordResetToken(e), a = this.sessionServer.authenticators[t.factor1], i = a.secretNames();
       let c = {}, d = {};
       for (let p in o)
         if (p.startsWith("new_")) {
           const w = p.replace(/^new_/, "");
-          a.includes(w) && (c[w] = o[p]);
+          i.includes(w) && (c[w] = o[p]);
         } else if (p.startsWith("repeat_")) {
           const w = p.replace(/^repeat_/, "");
-          a.includes(w) && (d[w] = o[p]);
+          i.includes(w) && (d[w] = o[p]);
         }
-      if (Object.keys(d).length === 0 && (d = void 0), i.validateSecrets(c).length > 0)
+      if (Object.keys(d).length === 0 && (d = void 0), a.validateSecrets(c).length > 0)
         throw new n(u.PasswordFormat);
       const g = await this.sessionServer.sessionManager.resetSecret(e, 1, c, d);
       if (g.state == N.active)
@@ -3677,20 +3678,20 @@ class we {
         e = r.locals.user;
       } else
         throw new n(u.InsufficientPriviledges);
-      const i = this.sessionServer.authenticators[e.factor1], a = i.secretNames();
+      const a = this.sessionServer.authenticators[e.factor1], i = a.secretNames();
       let c = {}, d = {}, h = {};
       for (let w in o)
         if (w.startsWith("new_")) {
           const S = w.replace(/^new_/, "");
-          a.includes(S) && (d[S] = o[w]);
+          i.includes(S) && (d[S] = o[w]);
         } else if (w.startsWith("old_")) {
           const S = w.replace(/^old_/, "");
-          a.includes(S) && (c[S] = o[w]);
+          i.includes(S) && (c[S] = o[w]);
         } else if (w.startsWith("repeat_")) {
           const S = w.replace(/^repeat_/, "");
-          a.includes(S) && (h[S] = o[w]);
+          i.includes(S) && (h[S] = o[w]);
         }
-      if (Object.keys(h).length === 0 && (h = void 0), i.validateSecrets(d).length > 0)
+      if (Object.keys(h).length === 0 && (h = void 0), a.validateSecrets(d).length > 0)
         throw new n(u.PasswordFormat);
       const p = e.state;
       try {
@@ -3808,15 +3809,15 @@ class we {
       let t = this.sessionServer.validateUserFn(e);
       if (t.length > 0)
         throw new n(u.FormEntry, t);
-      let { emailVerificationTokenSent: i } = await this.sessionServer.sessionManager.updateUser(r.locals.user, e);
-      if (!i) {
-        const a = await this.sessionServer.userStorage.getUserById(r.locals.user.id);
-        r.locals.user = a.user;
+      let { emailVerificationTokenSent: a } = await this.sessionServer.sessionManager.updateUser(r.locals.user, e);
+      if (!a) {
+        const i = await this.sessionServer.userStorage.getUserById(r.locals.user.id);
+        r.locals.user = i.user;
       }
       return {
         ok: !0,
         formData: o,
-        emailVerificationNeeded: i
+        emailVerificationNeeded: a
       };
     } catch (e) {
       let t = n.asCrossauthError(e, "Couldn't update account");
@@ -3864,32 +3865,32 @@ class we {
         const d = await this.sessionServer.getSessionData(r, "factor2change");
         d != null && d.username || this.isSessionUser(r) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), t = d == null ? void 0 : d.username;
       }
-      let i = r.locals.user;
-      if (!i && t && (i = (await this.sessionServer.userStorage.getUserByUsername(
+      let a = r.locals.user;
+      if (!a && t && (a = (await this.sessionServer.userStorage.getUserByUsername(
         t,
         {
           skipActiveCheck: !0,
           skipEmailVerifiedCheck: !0
         }
-      )).user), !i)
+      )).user), !a)
         throw new n(u.InsufficientPriviledges);
       if (!r.locals.sessionId)
         throw new n(u.Unauthorized);
-      let a = o.factor2;
+      let i = o.factor2;
       if (o.factor2 && !this.sessionServer.allowedFactor2Names.includes(o.factor2))
         throw new n(
           u.Forbidden,
           "Illegal second factor " + o.factor2 + " requested"
         );
-      if ((o.factor2 == "none" || o.factor2 == "") && (a = void 0, !r.locals.user))
-        return await this.loginWithUser(i, !0, r);
-      const c = await this.sessionServer.sessionManager.initiateTwoFactorSetup(i, a, r.locals.sessionId);
-      return a ? {
+      if ((o.factor2 == "none" || o.factor2 == "") && (i = void 0, !r.locals.user))
+        return await this.loginWithUser(a, !0, r);
+      const c = await this.sessionServer.sessionManager.initiateTwoFactorSetup(a, i, r.locals.sessionId);
+      return i ? {
         ok: !0,
         formData: o,
         factor2Data: {
-          username: i.username,
-          factor2: a ?? "",
+          username: a.username,
+          factor2: i ?? "",
           userData: c,
           csrfToken: r.locals.csrfToken
         }
@@ -3898,11 +3899,11 @@ class we {
         formData: o
       };
     } catch (t) {
-      let i = n.asCrossauthError(t, "Couldn't update account");
-      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+      let a = n.asCrossauthError(t, "Couldn't update account");
+      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1,
         formData: o
       };
@@ -3940,47 +3941,47 @@ class we {
         const h = await this.sessionServer.getSessionData(r, "factor2change");
         h != null && h.username || this.isSessionUser(r) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), t = h == null ? void 0 : h.username;
       }
-      let i = r.locals.user;
-      if (!i && t && (i = (await this.sessionServer.userStorage.getUserByUsername(
+      let a = r.locals.user;
+      if (!a && t && (a = (await this.sessionServer.userStorage.getUserByUsername(
         t,
         {
           skipActiveCheck: !0,
           skipEmailVerifiedCheck: !0
         }
-      )).user), !i)
+      )).user), !a)
         throw new n(u.InsufficientPriviledges);
       if (!r.locals.sessionId)
         throw new n(u.Unauthorized);
       if (!r.locals.sessionId)
         throw new n(u.Unauthorized);
-      let a = i.factor2;
-      const c = this.sessionServer.authenticators[a];
+      let i = a.factor2;
+      const c = this.sessionServer.authenticators[i];
       if (!c || c.secretNames().length == 0)
         throw new n(
           u.BadRequest,
           "Selected second factor does not have configuration"
         );
       const d = await this.sessionServer.sessionManager.initiateTwoFactorSetup(
-        i,
         a,
+        i,
         r.locals.sessionId
       );
       return {
         ok: !0,
         formData: o,
         factor2Data: {
-          username: i.username,
-          factor2: i.factor2 ?? "",
+          username: a.username,
+          factor2: a.factor2 ?? "",
           userData: d,
           csrfToken: r.locals.csrfToken
         }
       };
     } catch (t) {
-      let i = n.asCrossauthError(t, "Couldn't update account");
-      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+      let a = n.asCrossauthError(t, "Couldn't update account");
+      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1,
         formData: o
       };
@@ -4002,16 +4003,16 @@ async function me(k, r, o = 0, s = 10) {
     const { user: t } = await r.getUserByUsername(k);
     e.push(t);
   } catch (t) {
-    const i = n.asCrossauthError(t);
-    if (i.code != u.UserNotExist)
-      throw l.logger.debug(f({ err: i })), i;
+    const a = n.asCrossauthError(t);
+    if (a.code != u.UserNotExist)
+      throw l.logger.debug(f({ err: a })), a;
     try {
-      const { user: a } = await r.getUserByEmail(k);
-      e.push(a);
-    } catch (a) {
-      const c = n.asCrossauthError(a);
+      const { user: i } = await r.getUserByEmail(k);
+      e.push(i);
+    } catch (i) {
+      const c = n.asCrossauthError(i);
       if (c.code != u.UserNotExist)
-        throw l.logger.debug(f({ err: c })), i;
+        throw l.logger.debug(f({ err: c })), a;
     }
   }
   return e;
@@ -4030,12 +4031,12 @@ class ke {
     }, this.updateUserEndpoint = {
       actions: {
         default: async (s) => {
-          var i, a, c;
+          var a, i, c;
           const e = await this.getUserFromParam(s);
           return e.exception || !e.user ? {
             ok: !1,
-            error: ((i = e.exception) == null ? void 0 : i.message) ?? "Couldn't get user",
-            errorCode: (a = e.exception) == null ? void 0 : a.code,
+            error: ((a = e.exception) == null ? void 0 : a.message) ?? "Couldn't get user",
+            errorCode: (i = e.exception) == null ? void 0 : i.code,
             errorCodeName: (c = e.exception) == null ? void 0 : c.codeName
           } : await this.updateUser(e.user, s);
         }
@@ -4057,12 +4058,12 @@ class ke {
     }, this.changePasswordEndpoint = {
       actions: {
         default: async (s) => {
-          var i, a, c;
+          var a, i, c;
           const e = await this.getUserFromParam(s);
           return e.exception || !e.user ? {
             ok: !1,
-            error: ((i = e.exception) == null ? void 0 : i.message) ?? "Couldn't get user",
-            errorCode: (a = e.exception) == null ? void 0 : a.code,
+            error: ((a = e.exception) == null ? void 0 : a.message) ?? "Couldn't get user",
+            errorCode: (i = e.exception) == null ? void 0 : i.code,
             errorCodeName: (c = e.exception) == null ? void 0 : c.codeName
           } : await this.changePassword(e.user, s);
         }
@@ -4075,8 +4076,8 @@ class ke {
             editUser: e.user,
             ...this.baseEndpoint(s)
           };
-        let t = {}, i = s.url.searchParams.get("next");
-        return i && (t.next = i), {
+        let t = {}, a = s.url.searchParams.get("next");
+        return a && (t.next = a), {
           ...t,
           editUser: e.user,
           ...this.baseEndpoint(s)
@@ -4098,15 +4099,15 @@ class ke {
         default: async (s) => await this.deleteUser(s)
       },
       load: async (s) => {
-        var t, i, a;
+        var t, a, i;
         const e = await this.getUserFromParam(s);
         return e.exception || !e.user ? {
           error: "User doesn't exist",
           errorCode: (t = e.exception) == null ? void 0 : t.code,
-          errorCodeName: (i = e.exception) == null ? void 0 : i.codeName,
+          errorCodeName: (a = e.exception) == null ? void 0 : a.codeName,
           ...this.baseEndpoint(s)
         } : {
-          username: (a = e.user) == null ? void 0 : a.username,
+          username: (i = e.user) == null ? void 0 : i.username,
           ...this.baseEndpoint(s)
         };
       }
@@ -4157,7 +4158,7 @@ class ke {
     try {
       if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
       (!r.locals.user || !m.isAdminFn(r.locals.user)) && this.sessionServer.error(401);
-      let t = [], i = [], a = [];
+      let t = [], a = [], i = [];
       if (!s)
         try {
           const d = r.url.searchParams.get("skip");
@@ -4179,7 +4180,7 @@ class ke {
         this.sessionServer.userStorage,
         s,
         e
-      ), s > 0 && (i = await this.userSearchFn(
+      ), s > 0 && (a = await this.userSearchFn(
         o,
         this.sessionServer.userStorage,
         s - 1,
@@ -4187,7 +4188,7 @@ class ke {
       ))) : (t = await this.sessionServer.userStorage.getUsers(
         s,
         e
-      ), t.length == e && (a = await this.sessionServer.userStorage.getUsers(
+      ), t.length == e && (i = await this.sessionServer.userStorage.getUsers(
         s + e,
         1
       ))), {
@@ -4195,17 +4196,17 @@ class ke {
         users: t,
         skip: s,
         take: e,
-        hasPrevious: i.length > 0,
-        hasNext: a.length > 0,
+        hasPrevious: a.length > 0,
+        hasNext: i.length > 0,
         search: o
       };
     } catch (t) {
-      const i = n.asCrossauthError(t);
-      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
+      const a = n.asCrossauthError(t);
+      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
         ok: !1,
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         hasPrevious: !1,
         hasNext: !1,
         skip: s ?? 0,
@@ -4251,7 +4252,7 @@ class ke {
       if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
       var e = new b();
       if (await e.loadData(o), s = e.toObject(), (!o.locals.user || !m.isAdminFn(o.locals.user)) && this.sessionServer.error(401), this.isSessionUser(o) && this.sessionServer.enableCsrfProtection && !o.locals.csrfToken) throw new n(u.InvalidCsrf);
-      const t = r.factor2, i = r.state;
+      const t = r.factor2, a = r.state;
       r.state = s.state ?? "active", r = this.sessionServer.updateUserFn(
         r,
         o,
@@ -4261,10 +4262,10 @@ class ke {
           ...this.sessionServer.userStorage.adminEditableFields
         }
       );
-      const a = r.factor2 && r.factor2 != "none" && r.factor2 != t;
-      if (a && !(r.state == i || r.state == "factor2ResetNeeded"))
+      const i = r.factor2 && r.factor2 != "none" && r.factor2 != t;
+      if (i && !(r.state == a || r.state == "factor2ResetNeeded"))
         throw new n(u.BadRequest, "Cannot change both factor2 and state at the same time");
-      a && (r.state = N.factor2ResetNeeded, l.logger.warn(f({
+      i && (r.state = N.factor2ResetNeeded, l.logger.warn(f({
         msg: `Setting state for user to ${N.factor2ResetNeeded}`,
         username: r.username
       })));
@@ -4280,11 +4281,11 @@ class ke {
       };
     } catch (t) {
       if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t, 401)) throw t;
-      let i = n.asCrossauthError(t, "Couldn't log in");
-      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+      let a = n.asCrossauthError(t, "Couldn't log in");
+      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1,
         formData: s
       };
@@ -4316,20 +4317,20 @@ class ke {
       var e = new b();
       if (await e.loadData(o), s = e.toObject(), (!o.locals.user || !m.isAdminFn(o.locals.user)) && this.sessionServer.error(401), this.isSessionUser(o) && this.sessionServer.enableCsrfProtection && !o.locals.csrfToken)
         throw new n(u.InvalidCsrf);
-      const t = this.sessionServer.authenticators[r.factor1], i = t.secretNames();
-      let a = {}, c = {}, d = {};
+      const t = this.sessionServer.authenticators[r.factor1], a = t.secretNames();
+      let i = {}, c = {}, d = {};
       for (let g in s)
         if (g.startsWith("new_")) {
           const p = g.replace(/^new_/, "");
-          i.includes(p) && (c[p] = s[g]);
+          a.includes(p) && (c[p] = s[g]);
         } else if (g.startsWith("old_")) {
           const p = g.replace(/^old_/, "");
-          i.includes(p) && (a[p] = s[g]);
+          a.includes(p) && (i[p] = s[g]);
         } else if (g.startsWith("repeat_")) {
           const p = g.replace(/^repeat_/, "");
-          i.includes(p) && (d[p] = s[g]);
+          a.includes(p) && (d[p] = s[g]);
         }
-      if (Object.keys(d).length === 0 && (d = void 0), Object.keys(a).length === 0 && (a = void 0), t.validateSecrets(c).length > 0)
+      if (Object.keys(d).length === 0 && (d = void 0), Object.keys(i).length === 0 && (i = void 0), t.validateSecrets(c).length > 0)
         throw new n(u.PasswordFormat);
       try {
         await this.sessionServer.sessionManager.changeSecrets(
@@ -4337,7 +4338,7 @@ class ke {
           1,
           c,
           d,
-          a
+          i
         );
       } catch (g) {
         const p = n.asCrossauthError(g);
@@ -4349,11 +4350,11 @@ class ke {
       };
     } catch (t) {
       if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t, 401)) throw t;
-      let i = n.asCrossauthError(t, "Couldn't change password");
-      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+      let a = n.asCrossauthError(t, "Couldn't change password");
+      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1,
         formData: s
       };
@@ -4426,23 +4427,24 @@ class ke {
         {
           ...this.sessionServer.userStorage.userEditableFields,
           ...this.sessionServer.userStorage.adminEditableFields
-        }
+        },
+        this.sessionServer.adminAllowedFactor1
       );
-      const i = this.sessionServer.authenticators[t.factor1].secretNames();
-      let a = !0;
-      for (let w of i)
-        !o[w] && !o["repeat_" + w] && (a = !1);
+      const a = this.sessionServer.authenticators[t.factor1].secretNames();
+      let i = !0;
+      for (let w of a)
+        !o[w] && !o["repeat_" + w] && (i = !1);
       let c = [], d = {};
-      if (a) {
+      if (i) {
         c = this.sessionServer.authenticators[t.factor1].validateSecrets(o);
         for (let w in o)
           if (w.startsWith("repeat_")) {
             const S = w.replace(/^repeat_/, "");
-            i.includes(S) && (d[S] = o[w]);
+            a.includes(S) && (d[S] = o[w]);
           }
         Object.keys(d).length === 0 && (d = void 0);
       }
-      a ? o.factor2 != null && (t.state = N.factor2ResetNeeded) : o.factor2 == null ? t.state = N.passwordResetNeeded : t.state = N.passwordAndFactor2ResetNeeded;
+      i ? o.factor2 != null && (t.state = N.factor2ResetNeeded) : o.factor2 == null ? t.state = N.passwordResetNeeded : t.state = N.passwordAndFactor2ResetNeeded;
       let g = [...this.sessionServer.validateUserFn(t), ...c];
       if (g.length > 0)
         throw new n(u.FormEntry, g);
@@ -4451,9 +4453,9 @@ class ke {
         o,
         d,
         !0,
-        !a
+        !i
       );
-      if (!a) {
+      if (!i) {
         let w = o.username;
         if ("user_email" in o && (w = o.user_email), oe.validateEmail(w), !w) throw new n(u.FormEntry, "No password given but no email address found either");
         await this.sessionServer.sessionManager.requestPasswordReset(w);
@@ -4527,18 +4529,18 @@ async function Se(k, r, o, s, e) {
   let t = [];
   if (o > 0) return [];
   try {
-    const i = await r.getClientById(k);
-    t.push(i);
-  } catch (i) {
-    const a = n.asCrossauthError(i);
-    if (a.code != u.UserNotExist)
-      throw l.logger.debug(f({ err: a })), a;
+    const a = await r.getClientById(k);
+    t.push(a);
+  } catch (a) {
+    const i = n.asCrossauthError(a);
+    if (i.code != u.UserNotExist)
+      throw l.logger.debug(f({ err: i })), i;
     try {
       t = await r.getClientByName(k, e);
     } catch (c) {
       const d = n.asCrossauthError(c);
       if (d.code != u.UserNotExist)
-        throw l.logger.debug(f({ err: d })), a;
+        throw l.logger.debug(f({ err: d })), i;
     }
   }
   return t;
@@ -4551,7 +4553,7 @@ class X {
    * @param options See {@link SvelteKitSessionServerOptions}
    */
   constructor(r, o) {
-    this.loginUrl = "/login", this.clientSearchFn = Se, this.validFlows = ["all"], this.sessionServer = r, y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect ?? Q, this.error = o.error ?? Y, y("validFlows", E.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == _.All && (this.validFlows = _.allFlows()), this.valid_flowNames = _.flowNames(this.validFlows), o.clientStorage && (this.clientManager = new B(o)), this.clientStorage = o.clientStorage;
+    this.loginUrl = "/login", this.clientSearchFn = Se, this.validFlows = ["all"], this.sessionServer = r, y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect ?? Q, this.error = o.error ?? Y, y("validFlows", _.JsonArray, this, o, "OAUTH_validFlows"), this.validFlows.length == 1 && this.validFlows[0] == E.All && (this.validFlows = E.allFlows()), this.valid_flowNames = E.flowNames(this.validFlows), o.clientStorage && (this.clientManager = new B(o)), this.clientStorage = o.clientStorage;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -4597,7 +4599,7 @@ class X {
       if (!this.sessionServer.clientStorage) throw new n(u.Configuration, "Must provide client storage to use this function");
       if (!r.locals.user)
         throw this.redirect(302, this.loginUrl + "?next=" + encodeURIComponent(r.request.url));
-      let i = [], a = [], c = [];
+      let a = [], i = [], c = [];
       if (!s)
         try {
           const h = r.url.searchParams.get("skip");
@@ -4614,44 +4616,44 @@ class X {
         }
       e || (e = 10);
       const d = r.url.searchParams.get("search");
-      return !o && d != null && d != "" && (o = d), o || (o = ""), o.length == 0 && (o = void 0), o ? (i = await this.clientSearchFn(
+      return !o && d != null && d != "" && (o = d), o || (o = ""), o.length == 0 && (o = void 0), o ? (a = await this.clientSearchFn(
         o,
         this.sessionServer.clientStorage,
         s,
         e
-      ), s > 0 && (a = await this.clientSearchFn(
+      ), s > 0 && (i = await this.clientSearchFn(
         o,
         this.sessionServer.clientStorage,
         s - 1,
         1,
         t
-      ))) : (i = await this.sessionServer.clientStorage.getClients(
+      ))) : (a = await this.sessionServer.clientStorage.getClients(
         s,
         e,
         t
-      ), i.length == e && (c = await this.sessionServer.clientStorage.getClients(
+      ), a.length == e && (c = await this.sessionServer.clientStorage.getClients(
         s + e,
         1,
         t
       ))), {
         ok: !0,
-        clients: i,
+        clients: a,
         skip: s,
         take: e,
-        hasPrevious: a.length > 0,
+        hasPrevious: i.length > 0,
         hasNext: c.length > 0,
         search: o,
         clientUserId: t
       };
-    } catch (i) {
-      if (m.isSvelteKitRedirect(i) || m.isSvelteKitRedirect(i))
-        throw i;
-      const a = n.asCrossauthError(i);
-      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
+    } catch (a) {
+      if (m.isSvelteKitRedirect(a) || m.isSvelteKitRedirect(a))
+        throw a;
+      const i = n.asCrossauthError(a);
+      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
         ok: !1,
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         hasPrevious: !1,
         hasNext: !1,
         skip: s ?? 0,
@@ -4674,21 +4676,21 @@ class X {
     try {
       if (!o) throw new n(u.BadRequest, "No client ID specified");
       if (!this.clientStorage) throw new n(u.Configuration, "No client storage specified");
-      const i = await this.clientStorage.getClientById(o), a = i.userid == null ? void 0 : await ((e = (s = this.sessionServer) == null ? void 0 : s.userStorage) == null ? void 0 : e.getUserById(i.userid)), c = (t = a == null ? void 0 : a.user) == null ? void 0 : t.username;
+      const a = await this.clientStorage.getClientById(o), i = a.userid == null ? void 0 : await ((e = (s = this.sessionServer) == null ? void 0 : s.userStorage) == null ? void 0 : e.getUserById(a.userid)), c = (t = i == null ? void 0 : i.user) == null ? void 0 : t.username;
       return {
         ok: !0,
-        client: i,
+        client: a,
         validFlows: this.validFlows,
         valid_flowNames: this.valid_flowNames,
         client_id: o,
         clientUsername: c
       };
-    } catch (i) {
-      let a = n.asCrossauthError(i, "Couldn't load client");
-      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+    } catch (a) {
+      let i = n.asCrossauthError(a, "Couldn't load client");
+      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1,
         validFlows: this.validFlows,
         valid_flowNames: this.valid_flowNames,
@@ -4709,11 +4711,11 @@ class X {
    * @returns {@link UpdateClientFormData}.  If a new secret was created, it will be placed as plaintext in the client that is returned.
    */
   async updateClient_internal(r, o) {
-    var t, i;
+    var t, a;
     let s;
     try {
-      const a = r.params.client_id;
-      if (!a) throw new n(u.BadRequest, "No client ID given");
+      const i = r.params.client_id;
+      if (!i) throw new n(u.BadRequest, "No client ID given");
       var e = new b();
       if (await e.loadData(r), s = e.toObject(), this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
         throw new n(u.InvalidCsrf);
@@ -4737,7 +4739,7 @@ class X {
       if (g.client_name = s.client_name, g.confidential = e.getAsBoolean("confidential") ?? !1, g.valid_flow = h, g.redirect_uri = c, o) {
         let C = s.userid ?? void 0;
         if (C && ((t = this.sessionServer) != null && t.userStorage)) {
-          const { user: T } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
+          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
           C = T.id;
         }
         g.userid = s.userid ? Number(s.userid) : null;
@@ -4745,7 +4747,7 @@ class X {
       const p = e.getAsBoolean("resetSecret");
       if (!this.clientManager) throw new n(u.Configuration, "Cannot call this endpoint as you did not provide a clientStorage");
       const { client: w, newSecret: S } = await this.clientManager.updateClient(
-        a,
+        i,
         g,
         p
       );
@@ -4756,9 +4758,9 @@ class X {
         //plaintextSecret: resetSecret ? formData.client_secret : undefined,
         plaintextSecret: S && w.client_secret ? w.client_secret : void 0
       };
-    } catch (a) {
-      if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
-      let c = n.asCrossauthError(a, "Couldn't update client");
+    } catch (i) {
+      if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
+      let c = n.asCrossauthError(i, "Couldn't update client");
       return l.logger.debug(f({ err: c })), l.logger.error(f({ cerr: c })), {
         error: c.message,
         errorCode: c.code,
@@ -4777,7 +4779,7 @@ class X {
    * @returns {@link CreateClientPageData}.  
    */
   async emptyClient_internal(r, o) {
-    var e, t, i, a, c, d, h;
+    var e, t, a, i, c, d, h;
     try {
       var s = new b();
       await s.loadData(r);
@@ -4789,8 +4791,8 @@ class X {
           g = T.id;
         }
         const C = s.get("userid");
-        if (C && ((i = this.sessionServer) != null && i.userStorage)) {
-          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
+        if (C && ((a = this.sessionServer) != null && a.userStorage)) {
+          const { user: T } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
           g = T.id;
         }
       } else {
@@ -4830,7 +4832,7 @@ class X {
    * @returns {@link UpdateClientFormData}.  If a secret was created, it will be placed as plaintext in the client that is returned.  A random `client_id` is created.
    */
   async createClient_internal(r, o) {
-    var t, i, a, c;
+    var t, a, i, c;
     let s;
     try {
       var e = new b();
@@ -4839,7 +4841,7 @@ class X {
       if (o) {
         const C = e.get("userid");
         if (C && ((t = this.sessionServer) != null && t.userStorage)) {
-          const { user: T } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
+          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
           d = T.id;
         }
       } else {
@@ -4847,7 +4849,7 @@ class X {
         d = r.locals.user.id;
       }
       if (!this.clientStorage) throw new n(u.Configuration, "No client storage specified");
-      if (d && await ((c = (a = this.sessionServer) == null ? void 0 : a.userStorage) == null ? void 0 : c.getUserById(d)), this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
+      if (d && await ((c = (i = this.sessionServer) == null ? void 0 : i.userStorage) == null ? void 0 : c.getUserById(d)), this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
         throw new n(u.InvalidCsrf);
       const h = !s.redirect_uri || s.redirect_uri.trim().length == 0 ? [] : s.redirect_uri.trim().split(/[, ][ \t\n]*/);
       let g = [];
@@ -4903,19 +4905,19 @@ class X {
     try {
       if (!o) throw new n(u.BadRequest, "No client ID specified");
       if (!this.clientStorage) throw new n(u.Configuration, "No client storage specified");
-      const i = await this.clientStorage.getClientById(o), a = i.userid == null ? void 0 : await ((e = (s = this.sessionServer) == null ? void 0 : s.userStorage) == null ? void 0 : e.getUserById(i.userid)), c = (t = a == null ? void 0 : a.user) == null ? void 0 : t.username;
+      const a = await this.clientStorage.getClientById(o), i = a.userid == null ? void 0 : await ((e = (s = this.sessionServer) == null ? void 0 : s.userStorage) == null ? void 0 : e.getUserById(a.userid)), c = (t = i == null ? void 0 : i.user) == null ? void 0 : t.username;
       return {
         ok: !0,
-        client: i,
+        client: a,
         client_id: o,
         clientUsername: c
       };
-    } catch (i) {
-      let a = n.asCrossauthError(i, "Couldn't load client");
-      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+    } catch (a) {
+      let i = n.asCrossauthError(a, "Couldn't load client");
+      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1,
         client_id: o
       };
@@ -4936,19 +4938,19 @@ class X {
       const t = r.params.client_id;
       if (!t) throw new n(u.BadRequest, "No client ID given");
       if (!this.clientStorage) throw new n(u.Configuration, "No client storage specified");
-      const i = await ((s = this.clientStorage) == null ? void 0 : s.getClientById(t));
-      if (!o && i.userid != ((e = r.locals.user) == null ? void 0 : e.id))
+      const a = await ((s = this.clientStorage) == null ? void 0 : s.getClientById(t));
+      if (!o && a.userid != ((e = r.locals.user) == null ? void 0 : e.id))
         throw this.error(401, "Unauthorized");
       return await this.clientStorage.deleteClient(t), {
         ok: !0
       };
     } catch (t) {
       if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-      let i = n.asCrossauthError(t, "Couldn't delete client");
-      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+      let a = n.asCrossauthError(t, "Couldn't delete client");
+      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1
       };
     }
@@ -5017,7 +5019,7 @@ class Ce extends X {
       actions: {
         default: async (s) => await this.deleteClient(s)
       }
-    }, this.sessionServer = r, y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
+    }, this.sessionServer = r, y("loginUrl", _.JsonArray, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -5199,7 +5201,7 @@ class ye extends X {
       actions: {
         default: async (s) => await this.deleteClient(s)
       }
-    }, this.sessionServer = r, y("loginUrl", E.String, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
+    }, this.sessionServer = r, y("loginUrl", _.String, this, o, "LOGIN_URL"), o.clientSearchFn && (this.clientSearchFn = o.clientSearchFn), this.redirect = o.redirect, this.error = o.error;
   }
   ///////////////////////////////////////////////////////////////////
   // Functions callable from apps
@@ -5261,51 +5263,51 @@ class ye extends X {
   }
 }
 const x = "X-CROSSAUTH-CSRF";
-function Ee(k) {
+function _e(k) {
   let r = [];
   return k.username == null ? r.push("Username must be given") : k.username.length < 2 ? r.push("Username must be at least 2 characters") : k.username.length > 254 && r.push("Username must be no longer than 254 characters"), r;
 }
-function _e(k, r, o) {
+function Ee(k, r, o, s = ["localpassword"]) {
   var i;
-  let e = {
+  let t = {
     username: r.username ?? "",
     state: "active"
   };
-  const t = k.locals.user && m.isAdminFn(k.locals.user);
-  for (let a in r) {
-    let c = a.replace(/^user_/, "");
-    if (a.startsWith("user_") && (t || o.includes(c)))
-      if ("type_" + c in r) {
-        if (r["type_" + c] == "string")
-          e[c] = r[a];
-        else if (r["type_" + c] == "number" || r["type_" + c] == "integer" || r["type_" + c] == "float")
-          e[c] = Number(r[a]);
-        else if (r["type_" + c] == "boolean") {
-          const d = (i = r[a]) == null ? void 0 : i.toLocaleLowerCase();
-          e[c] = d == "1" || d == "y" || d == "t" || d == "yes" || d == "true";
+  const a = k.locals.user && m.isAdminFn(k.locals.user);
+  for (let c in r) {
+    let d = c.replace(/^user_/, "");
+    if (c.startsWith("user_") && (a || o.includes(d)))
+      if ("type_" + d in r) {
+        if (r["type_" + d] == "string")
+          t[d] = r[c];
+        else if (r["type_" + d] == "number" || r["type_" + d] == "integer" || r["type_" + d] == "float")
+          t[d] = Number(r[c]);
+        else if (r["type_" + d] == "boolean") {
+          const h = (i = r[c]) == null ? void 0 : i.toLocaleLowerCase();
+          t[d] = h == "1" || h == "y" || h == "t" || h == "yes" || h == "true";
         }
       } else
-        e[c] = r[a];
+        t[d] = r[c];
   }
-  return e.factor1 = "localpassword", e.factor2 = r.factor2, e;
+  return t.factor1 = "localpassword", r.factor1 && s.includes(r.factor1) && (t.factor1 = r.factor1), t.factor2 = r.factor2, t;
 }
 function ve(k, r, o, s) {
   var t;
   const e = r.locals.user && m.isAdminFn(r.locals.user);
-  for (let i in o) {
-    let a = i.replace(/^user_/, "");
-    if (i.startsWith("user_") && (e || s.includes(a)))
-      if ("type_" + a in o) {
-        if (o["type_" + a] == "string")
-          k[a] = o[i];
-        else if (o["type_" + a] == "number" || o["type_" + a] == "integer" || o["type_" + a] == "float")
-          k[a] = Number(o[i]);
-        else if (o["type_" + a] == "boolean") {
-          const c = (t = o[i]) == null ? void 0 : t.toLocaleLowerCase();
-          k[a] = c == "1" || c == "y" || c == "t" || c == "yes" || c == "true";
+  for (let a in o) {
+    let i = a.replace(/^user_/, "");
+    if (a.startsWith("user_") && (e || s.includes(i)))
+      if ("type_" + i in o) {
+        if (o["type_" + i] == "string")
+          k[i] = o[a];
+        else if (o["type_" + i] == "number" || o["type_" + i] == "integer" || o["type_" + i] == "float")
+          k[i] = Number(o[a]);
+        else if (o["type_" + i] == "boolean") {
+          const c = (t = o[a]) == null ? void 0 : t.toLocaleLowerCase();
+          k[i] = c == "1" || c == "y" || c == "t" || c == "yes" || c == "true";
         }
       } else
-        k[a] = o[i];
+        k[i] = o[a];
   }
   return k;
 }
@@ -5318,9 +5320,9 @@ class H {
    * @param options See {@link SvelteKitSessionServerOptions}.
    */
   constructor(r, o, s = {}) {
-    this.validateUserFn = Ee, this.createUserFn = _e, this.updateUserFn = ve, this.allowedFactor2 = [], this.allowedFactor2Names = [], this.factor2ProtectedPageEndpoints = [], this.factor2ProtectedApiEndpoints = [], this.loginProtectedPageEndpoints = [], this.loginProtectedApiEndpoints = [], this.loginProtectedExceptionPageEndpoints = [], this.loginProtectedExceptionApiEndpoints = [], this.adminPageEndpoints = [], this.adminApiEndpoints = [], this.adminProtectedExceptionPageEndpoints = [], this.adminProtectedExceptionApiEndpoints = [], this.unauthorizedUrl = void 0, this.enableCsrfProtection = !0, this.enableEmailVerification = !1, this.enablePasswordReset = !1, this.factor2Url = "/factor2", this.loginUrl = "/login", this.keyStorage = r, this.userStorage = s.userStorage, this.clientStorage = s.clientStorage, this.authenticators = o, this.sessionManager = new ie(r, o, s), this.redirect = s.redirect ?? Q, this.error = s.error ?? Y, y("factor2Url", E.String, this, s, "FACTOR2_URL"), this.factor2Url.endsWith("/") || (this.factor2Url += "/"), y("factor2ProtectedPageEndpoints", E.JsonArray, this, s, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), y("factor2ProtectedApiEndpoints", E.JsonArray, this, s, "FACTOR2_PROTECTED_API_ENDPOINTS"), y("loginProtectedPageEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_PAGE_ENDPOINTS"), y("loginProtectedApiEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_API_ENDPOINTS"), y("loginProtectedExceptionPageEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("loginProtectedExceptionApiEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("adminPageEndpoints", E.JsonArray, this, s, "ADMIN_PAGE_ENDPOINTS"), y("adminApiEndpoints", E.JsonArray, this, s, "ADMIN_API_ENDPOINTS"), y("adminProtectedExceptionPageEndpoints", E.JsonArray, this, s, "ADMIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("adminProtectedExceptionApiEndpoints", E.JsonArray, this, s, "ADMIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("loginUrl", E.JsonArray, this, s, "LOGIN_URL"), y("unauthorizedUrl", E.JsonArray, this, s, "UNAUTHORIZED_PAGE");
+    this.validateUserFn = _e, this.createUserFn = Ee, this.updateUserFn = ve, this.allowedFactor2 = [], this.allowedFactor2Names = [], this.factor2ProtectedPageEndpoints = [], this.factor2ProtectedApiEndpoints = [], this.loginProtectedPageEndpoints = [], this.loginProtectedApiEndpoints = [], this.loginProtectedExceptionPageEndpoints = [], this.loginProtectedExceptionApiEndpoints = [], this.adminPageEndpoints = [], this.adminApiEndpoints = [], this.adminProtectedExceptionPageEndpoints = [], this.adminProtectedExceptionApiEndpoints = [], this.unauthorizedUrl = void 0, this.enableCsrfProtection = !0, this.enableEmailVerification = !1, this.enablePasswordReset = !1, this.factor2Url = "/factor2", this.loginUrl = "/login", this.userAllowedFactor1 = ["localpassword"], this.adminAllowedFactor1 = ["localpassword"], this.keyStorage = r, this.userStorage = s.userStorage, this.clientStorage = s.clientStorage, this.authenticators = o, this.sessionManager = new ie(r, o, s), this.redirect = s.redirect ?? Q, this.error = s.error ?? Y, y("factor2Url", _.String, this, s, "FACTOR2_URL"), this.factor2Url.endsWith("/") || (this.factor2Url += "/"), y("factor2ProtectedPageEndpoints", _.JsonArray, this, s, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), y("factor2ProtectedApiEndpoints", _.JsonArray, this, s, "FACTOR2_PROTECTED_API_ENDPOINTS"), y("loginProtectedPageEndpoints", _.JsonArray, this, s, "LOGIN_PROTECTED_PAGE_ENDPOINTS"), y("loginProtectedApiEndpoints", _.JsonArray, this, s, "LOGIN_PROTECTED_API_ENDPOINTS"), y("loginProtectedExceptionPageEndpoints", _.JsonArray, this, s, "LOGIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("loginProtectedExceptionApiEndpoints", _.JsonArray, this, s, "LOGIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("adminPageEndpoints", _.JsonArray, this, s, "ADMIN_PAGE_ENDPOINTS"), y("adminApiEndpoints", _.JsonArray, this, s, "ADMIN_API_ENDPOINTS"), y("adminProtectedExceptionPageEndpoints", _.JsonArray, this, s, "ADMIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("adminProtectedExceptionApiEndpoints", _.JsonArray, this, s, "ADMIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("loginUrl", _.JsonArray, this, s, "LOGIN_URL"), y("unauthorizedUrl", _.JsonArray, this, s, "UNAUTHORIZED_PAGE"), y("userAllowedFactor1", _.JsonArray, this, s, "USER_ALLOWED_FACTOR1"), y("adminAllowedFactor1", _.JsonArray, this, s, "ADMIN_ALLOWED_FACTOR1");
     let e = {};
-    if (y("allowedFactor2", E.JsonArray, e, s, "ALLOWED_FACTOR2"), this.allowedFactor2Names = s.allowedFactor2 ?? ["none"], e.allowedFactor2)
+    if (y("allowedFactor2", _.JsonArray, e, s, "ALLOWED_FACTOR2"), this.allowedFactor2Names = s.allowedFactor2 ?? ["none"], e.allowedFactor2)
       for (let t of e.allowedFactor2)
         t in this.authenticators ? this.allowedFactor2.push({
           name: t,
@@ -5331,11 +5333,11 @@ class H {
           friendlyName: "None",
           configurable: !1
         });
-    y("enableEmailVerification", E.Boolean, this, s, "ENABLE_EMAIL_VERIFICATION"), y("enablePasswordReset", E.Boolean, this, s, "ENABLE_PASSWORD_RESET"), y("enableCsrfProtection", E.Boolean, this, s, "ENABLE_CSRF_PROTECTION"), y("editUserScope", E.String, this, s, "EDIT_USER_SCOPE"), s.validateUserFn && (this.validateUserFn = s.validateUserFn), s.createUserFn && (this.createUserFn = s.createUserFn), s.updateUserFn && (this.updateUserFn = s.updateUserFn), s.addToSession && (this.addToSession = s.addToSession), s.validateSession && (this.validateSession = s.validateSession), this.userEndpoints = new we(this, s), this.adminEndpoints = new ke(this, s), this.userClientEndpoints = new Ce(this, s), this.adminClientEndpoints = new ye(this, s), this.sessionHook = async ({ event: t }) => {
+    y("enableEmailVerification", _.Boolean, this, s, "ENABLE_EMAIL_VERIFICATION"), y("enablePasswordReset", _.Boolean, this, s, "ENABLE_PASSWORD_RESET"), y("enableCsrfProtection", _.Boolean, this, s, "ENABLE_CSRF_PROTECTION"), y("editUserScope", _.String, this, s, "EDIT_USER_SCOPE"), s.validateUserFn && (this.validateUserFn = s.validateUserFn), s.createUserFn && (this.createUserFn = s.createUserFn), s.updateUserFn && (this.updateUserFn = s.updateUserFn), s.addToSession && (this.addToSession = s.addToSession), s.validateSession && (this.validateSession = s.validateSession), this.userEndpoints = new we(this, s), this.adminEndpoints = new ke(this, s), this.userClientEndpoints = new Ce(this, s), this.adminClientEndpoints = new ye(this, s), this.sessionHook = async ({ event: t }) => {
       var h, g;
       l.logger.debug("Session hook");
-      let i = [];
-      const a = this.sessionManager.csrfCookieName, c = this.sessionManager.sessionCookieName;
+      let a = [];
+      const i = this.sessionManager.csrfCookieName, c = this.sessionManager.sessionCookieName;
       if (this.enableCsrfProtection) {
         l.logger.debug(f({ msg: "Getting csrf cookie" }));
         let p;
@@ -5344,7 +5346,7 @@ class H {
         } catch (w) {
           l.logger.warn(f({ msg: "Invalid csrf cookie received", cerr: w, hashedCsrfCookie: this.getHashOfCsrfCookie(t) }));
           try {
-            this.clearCookie(a, this.sessionManager.csrfCookiePath, t);
+            this.clearCookie(i, this.sessionManager.csrfCookiePath, t);
           } catch (S) {
             l.logger.debug(f({ err: S })), l.logger.error(f({ cerr: S, msg: "Couldn't delete CSRF cookie", ip: t.request.referrer, hashedCsrfCookie: this.getHashOfCsrfCookie(t) }));
           }
@@ -5361,13 +5363,13 @@ class H {
               const { csrfCookie: w, csrfFormOrHeaderValue: S } = await this.sessionManager.createCsrfToken();
               this.setCsrfCookie(w, t), t.locals.csrfToken = S;
             }
-            this.setHeader(x, t.locals.csrfToken, i);
+            this.setHeader(x, t.locals.csrfToken, a);
           } catch (w) {
-            l.logger.error(f({ msg: "Couldn't create CSRF token", cerr: w, user: (h = t.locals.user) == null ? void 0 : h.username, hashedSessionCookie: this.getHashOfSessionCookie(t) })), l.logger.debug(f({ err: w })), this.clearCookie(a, this.sessionManager.csrfCookiePath, t), t.locals.csrfToken = void 0;
+            l.logger.error(f({ msg: "Couldn't create CSRF token", cerr: w, user: (h = t.locals.user) == null ? void 0 : h.username, hashedSessionCookie: this.getHashOfSessionCookie(t) })), l.logger.debug(f({ err: w })), this.clearCookie(i, this.sessionManager.csrfCookiePath, t), t.locals.csrfToken = void 0;
           }
         else if (p)
           try {
-            await this.csrfToken(t, i);
+            await this.csrfToken(t, a);
           } catch (w) {
             l.logger.error(f({ msg: "Couldn't create CSRF token", cerr: w, user: (g = t.locals.user) == null ? void 0 : g.username, hashedSessionCookie: this.getHashOfSessionCookie(t) })), l.logger.debug(f({ err: w }));
           }
@@ -5382,13 +5384,13 @@ class H {
         } catch {
           l.logger.warn(f({ msg: "Invalid session cookie received", hashedSessionCookie: this.getHashOfSessionCookie(t) })), this.clearCookie(c, this.sessionManager.sessionCookiePath, t);
         }
-      return { headers: i };
+      return { headers: a };
     }, this.twoFAHook = async ({ event: t }) => {
       var h;
       if (l.logger.debug(f({ msg: "twoFAHook", username: (h = t.locals.user) == null ? void 0 : h.username })), !this.userStorage) throw this.error(500, "No user storage defined");
-      const i = this.getSessionCookieValue(t), a = this.isFactor2PageProtected(t), c = this.isFactor2ApiProtected(t);
+      const a = this.getSessionCookieValue(t), i = this.isFactor2PageProtected(t), c = this.isFactor2ApiProtected(t);
       let d;
-      if (i)
+      if (a)
         if (t.locals.user) d = t.locals.user;
         else {
           const g = await this.getSessionData(t, "user");
@@ -5397,7 +5399,7 @@ class H {
             (p.user.status == N.active || p.user.state == N.factor2ResetNeeded) && (d = p.user);
           }
         }
-      if (d && i && d.factor2 != "" && (a || c))
+      if (d && a && d.factor2 != "" && (i || c))
         if (l.logger.debug(f({ msg: "Factor2-protected endpoint visited" })), ["GET", "OPTIONS", "HEAD"].includes(t.request.method)) {
           l.logger.debug(f({ msg: "Factor2-protected GET endpoint - cancelling 2FA" }));
           const g = this.getSessionCookieValue(t);
@@ -5413,7 +5415,7 @@ class H {
             }
           }
         } else {
-          const g = this.sessionManager.getSessionId(i), p = await this.sessionManager.dataForSessionId(g);
+          const g = this.sessionManager.getSessionId(a), p = await this.sessionManager.dataForSessionId(g);
           if ("pre2fa" in p) {
             l.logger.debug(f({ msg: "Completing 2FA" }));
             const w = this.authenticators[p.pre2fa.factor2], S = [...w.secretNames(), ...w.transientSecretNames()];
@@ -5442,7 +5444,7 @@ class H {
                 }
                 return this.error(401, { message: "Sorry, your code has expired" }), { ok: !1, twofa: !0 };
               } else
-                return a ? {
+                return i ? {
                   twofa: !0,
                   ok: !1,
                   response: new Response("", {
@@ -5490,7 +5492,7 @@ class H {
             const w = new b();
             await w.loadData(t);
             let S = t.request.headers.get("content-type");
-            return await this.sessionManager.initiateTwoFactorPageVisit(d, t.locals.sessionId ?? "", w.toObject(), t.request.url.replace(/\?.*$/, ""), S || void 0), a ? {
+            return await this.sessionManager.initiateTwoFactorPageVisit(d, t.locals.sessionId ?? "", w.toObject(), t.request.url.replace(/\?.*$/, ""), S || void 0), i ? {
               twofa: !0,
               ok: !0,
               response: new Response("", {
@@ -5613,21 +5615,21 @@ class H {
    * @returns the string CSRF token for inclusion in forms
    */
   async csrfToken(r, o) {
-    var e, t, i;
+    var e, t, a;
     let s;
     if (r.request.headers && r.request.headers.has(x.toLowerCase())) {
-      const a = r.request.headers.get(x.toLowerCase());
-      Array.isArray(a) ? s = a[0] : a && (s = a);
+      const i = r.request.headers.get(x.toLowerCase());
+      Array.isArray(i) ? s = i[0] : i && (s = i);
     }
     if (!s) {
       if (!((e = r.request) != null && e.body)) {
         l.logger.warn(f({ msg: "Received CSRF header but not token", ip: r.request.referrerPolicy, hashedCsrfCookie: this.getHashOfCsrfCookie(r) }));
         return;
       }
-      const a = r.request.headers.get("content-type");
-      if (a == "application/json")
-        s = (await ((i = (t = r.request) == null ? void 0 : t.clone()) == null ? void 0 : i.json())).csrfToken;
-      else if (a == "application/x-www-form-urlencoded" || a == "multipart/form-data") {
+      const i = r.request.headers.get("content-type");
+      if (i == "application/json")
+        s = (await ((a = (t = r.request) == null ? void 0 : t.clone()) == null ? void 0 : a.json())).csrfToken;
+      else if (i == "application/x-www-form-urlencoded" || i == "multipart/form-data") {
         const d = (await r.request.clone().formData()).get("csrfToken");
         d && typeof d == "string" && (s = d);
       }
@@ -5660,8 +5662,8 @@ class H {
     else {
       e = "";
       for (let t in o) {
-        const i = o[t];
-        e.length > 0 && (e += "&"), e += encodeURIComponent(t) + "=" + encodeURIComponent(i);
+        const a = o[t];
+        e.length > 0 && (e += "&"), e += encodeURIComponent(t) + "=" + encodeURIComponent(a);
       }
     }
     return r.request = new Request(r.request.url, {
@@ -5715,10 +5717,10 @@ class H {
     if (o.pathname == this.loginUrl) return !1;
     let s = !1;
     return s = this.loginProtectedExceptionPageEndpoints.reduce(
-      (t, i) => t || I(o.pathname, i),
+      (t, a) => t || I(o.pathname, a),
       s
     ), s ? !1 : this.loginProtectedPageEndpoints.reduce(
-      (t, i) => t || I(o.pathname, i),
+      (t, a) => t || I(o.pathname, a),
       !1
     );
   }
@@ -5736,10 +5738,10 @@ class H {
     if (o.pathname == this.loginUrl) return !1;
     let s = !1;
     return s = this.loginProtectedExceptionApiEndpoints.reduce(
-      (t, i) => t || I(o.pathname, i),
+      (t, a) => t || I(o.pathname, a),
       s
     ), s ? !1 : this.loginProtectedApiEndpoints.reduce(
-      (t, i) => t || I(o.pathname, i),
+      (t, a) => t || I(o.pathname, a),
       !1
     );
   }
@@ -5788,13 +5790,13 @@ class H {
     const o = new URL(typeof r == "string" ? r : r.request.url);
     let s = !1;
     return s = this.adminProtectedExceptionPageEndpoints.reduce(
-      (t, i) => t || I(o.pathname, i),
+      (t, a) => t || I(o.pathname, a),
       s
     ), s || (s = this.loginProtectedExceptionPageEndpoints.reduce(
-      (t, i) => t || I(o.pathname, i),
+      (t, a) => t || I(o.pathname, a),
       s
     ), s) ? !1 : this.adminPageEndpoints.reduce(
-      (t, i) => t || I(o.pathname, i),
+      (t, a) => t || I(o.pathname, a),
       !1
     );
   }
@@ -5811,13 +5813,13 @@ class H {
     const o = new URL(typeof r == "string" ? r : r.request.url);
     let s = !1;
     return s = this.adminProtectedExceptionApiEndpoints.reduce(
-      (t, i) => t || I(o.pathname, i),
+      (t, a) => t || I(o.pathname, a),
       s
     ), s || (s = this.loginProtectedExceptionApiEndpoints.reduce(
-      (t, i) => t || I(o.pathname, i),
+      (t, a) => t || I(o.pathname, a),
       s
     ), s) ? !1 : this.adminApiEndpoints.reduce(
-      (t, i) => t || I(o.pathname, i),
+      (t, a) => t || I(o.pathname, a),
       !1
     );
   }
@@ -5839,15 +5841,15 @@ class H {
     await s.loadData(r);
     let e = this.addToSession ? this.addToSession(r, s.toObject()) : {};
     o && (e.data = JSON.stringify(o));
-    let { sessionCookie: t, csrfCookie: i, csrfFormOrHeaderValue: a } = await this.sessionManager.createAnonymousSession(e);
+    let { sessionCookie: t, csrfCookie: a, csrfFormOrHeaderValue: i } = await this.sessionManager.createAnonymousSession(e);
     r.cookies.set(
       t.name,
       t.value,
       R(t.options)
-    ), this.enableCsrfProtection && (r.locals.csrfToken = a, r.cookies.set(
-      i.name,
-      i.value,
-      R(i.options)
+    ), this.enableCsrfProtection && (r.locals.csrfToken = i, r.cookies.set(
+      a.name,
+      a.value,
+      R(a.options)
     )), r.locals.user = void 0;
     const c = this.sessionManager.getSessionId(t.value);
     return r.locals.sessionId = c, t.value;