@crossauth/sveltekit 0.0.36 → 0.0.38

package/dist/index.js

@@ -1,6 +1,6 @@
-import { minimatch as I } from "minimatch";
-import { ApiKeyManager as K, KeyStorage as $, toCookieSerializeOptions as R, Crypto as F, OAuthAuthorizationServer as Z, setParameter as y, ParamType as E, DoubleSubmitCsrfToken as ee, OAuthClientManager as B, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
-import { CrossauthError as n, ErrorCode as u, CrossauthLogger as l, j as f, OAuthFlows as _, UserState as N, httpStatus as q } from "@crossauth/common";
+import { minimatch as N } from "minimatch";
+import { ApiKeyManager as q, KeyStorage as $, toCookieSerializeOptions as P, Crypto as A, OAuthAuthorizationServer as Z, setParameter as y, ParamType as E, DoubleSubmitCsrfToken as ee, OAuthClientManager as B, OAuthClientBackend as re, OAuthResourceServer as se, OAuthTokenConsumer as te, TokenEmailer as oe, SessionManager as ie } from "@crossauth/backend";
+import { CrossauthError as n, ErrorCode as h, CrossauthLogger as l, j as f, OAuthFlows as _, UserState as I, httpStatus as K } from "@crossauth/common";
 import { json as v, redirect as Q, error as Y } from "@sveltejs/kit";
 import "cookie";
 import { jwtDecode as M } from "jwt-decode";
@@ -26,11 +26,11 @@ class b {
     this.clone = r;
   }
   async loadData(r) {
-    var s, e, t, a;
+    var s, e, t, i;
     if (!((s = r.request) != null && s.body))
       return;
     const o = r.request.headers.get("content-type");
-    o == "application/json" ? this.jsonData = this.clone ? await ((t = (e = r.request) == null ? void 0 : e.clone()) == null ? void 0 : t.json()) : await ((a = r.request) == null ? void 0 : a.json()) : (o == "application/x-www-form-urlencoded" || o != null && o.startsWith("multipart/form-data")) && (this.formData = this.clone ? await r.request.clone().formData() : await r.request.formData());
+    o == "application/json" ? this.jsonData = this.clone ? await ((t = (e = r.request) == null ? void 0 : e.clone()) == null ? void 0 : t.json()) : await ((i = r.request) == null ? void 0 : i.json()) : (o == "application/x-www-form-urlencoded" || o != null && o.startsWith("multipart/form-data")) && (this.formData = this.clone ? await r.request.clone().formData() : await r.request.formData());
   }
   get(r) {
     if (this.jsonData) return this.jsonData[r];
@@ -54,7 +54,7 @@ class b {
       try {
         return Number(o);
       } catch {
-        throw new n(u.FormEntry, "Value for " + r + " is not a number");
+        throw new n(h.FormEntry, "Value for " + r + " is not a number");
       }
   }
   has(r) {
@@ -84,7 +84,7 @@ class ne {
    * @param options See {@link SvelteKitApiKeyServerOptions}
    */
   constructor(r, o, s = {}) {
-    this.userStorage = r, this.apiKeyManager = new K(o, s), this.hook = async ({ event: e }) => {
+    this.userStorage = r, this.apiKeyManager = new q(o, s), this.hook = async ({ event: e }) => {
       l.logger.debug("APIKey hook");
       const t = e.request.headers.get("authorization");
       if (t)
@@ -92,29 +92,29 @@ class ne {
           l.logger.debug(f({
             msg: "Received authorization header"
           }));
-          const a = await this.apiKeyManager.validateToken(
+          const i = await this.apiKeyManager.validateToken(
             t
           );
           l.logger.debug(f({
             msg: "Valid API key",
-            hahedApiKey: K.hashSignedApiKeyValue(a.value)
+            hahedApiKey: q.hashSignedApiKeyValue(i.value)
           }));
-          const i = $.decodeData(a.data);
-          if (e.locals.apiKey = { ...a, ...i }, "scope" in i && Array.isArray(i.scope)) {
+          const a = $.decodeData(i.data);
+          if (e.locals.apiKey = { ...i, ...a }, "scope" in a && Array.isArray(a.scope)) {
             let c = [];
-            for (let d of i.scope)
+            for (let d of a.scope)
               typeof d == "string" && c.push(d);
             e.locals.scope = c;
           }
-          if (a.userid)
+          if (i.userid)
             try {
-              const { user: c } = await this.userStorage.getUserById(a.userid);
-              e.locals.user = c, e.locals.authType = "apiKey", l.logger.debug(f({ msg: "API key is for user", userid: c.id, user: c.username, hahedApiKey: K.hashSignedApiKeyValue(a.value) }));
+              const { user: c } = await this.userStorage.getUserById(i.userid);
+              e.locals.user = c, e.locals.authType = "apiKey", l.logger.debug(f({ msg: "API key is for user", userid: c.id, user: c.username, hahedApiKey: q.hashSignedApiKeyValue(i.value) }));
             } catch (c) {
-              l.logger.error(f({ msg: "API key has invalid user", userid: a.userid, hashedApiKey: K.hashSignedApiKeyValue(a.value) })), l.logger.debug(f({ err: c }));
+              l.logger.error(f({ msg: "API key has invalid user", userid: i.userid, hashedApiKey: q.hashSignedApiKeyValue(i.value) })), l.logger.debug(f({ err: c }));
             }
-        } catch (a) {
-          l.logger.error(f({ msg: "Invalid authorization header received", header: t })), l.logger.debug(f({ err: a }));
+        } catch (i) {
+          l.logger.error(f({ msg: "Invalid authorization header received", header: t })), l.logger.debug(f({ err: i }));
         }
     };
   }
@@ -130,9 +130,9 @@ class ce {
    * @param options see {@link SvelteKitAuthorizationServerOptions}
    */
   constructor(r, o, s, e, t = {}) {
-    var a;
+    var i;
     this.loginUrl = "/login", this.refreshTokenType = "json", this.refreshTokenCookieName = "CROSSAUTH_REFRESH_TOKEN", this.refreshTokenCookieDomain = void 0, this.refreshTokenCookieHttpOnly = !1, this.refreshTokenCookiePath = "/", this.refreshTokenCookieSecure = !0, this.refreshTokenCookieSameSite = "strict", this.authorizeEndpointUrl = "/oauth/authorize", this.tokenEndpointUrl = "/oauth/token", this.jwksEndpointUrl = "/oauth/jwks", this.oidcConfigurationEndpoint = {
-      get: async (i) => v(this.authServer.oidcConfiguration(
+      get: async (a) => v(this.authServer.oidcConfiguration(
         {
           authorizeEndpoint: this.authorizeEndpointUrl,
           tokenEndpoint: this.tokenEndpointUrl,
@@ -141,7 +141,7 @@ class ce {
         }
       ))
     }, this.jwksGetEndpoint = {
-      get: async (i) => {
+      get: async (a) => {
         try {
           return v(this.authServer.jwks());
         } catch (c) {
@@ -153,7 +153,7 @@ class ce {
         }
       }
     }, this.getCsrfTokenEndpoint = {
-      get: async (i) => {
+      get: async (a) => {
         var d;
         if (!this.csrfTokens) return v({
           ok: !1,
@@ -163,23 +163,23 @@ class ce {
         let c = "";
         try {
           const {
-            csrfCookie: h,
+            csrfCookie: u,
             csrfFormOrHeaderValue: g
           } = await this.createCsrfToken();
-          return c = h.value, i.cookies.set(
-            h.name,
-            h.value,
-            R(h.options)
+          return c = u.value, a.cookies.set(
+            u.name,
+            u.value,
+            P(u.options)
           ), v({ ok: !0, csrfToken: g });
-        } catch (h) {
-          const g = n.asCrossauthError(h);
+        } catch (u) {
+          const g = n.asCrossauthError(u);
           return l.logger.error(f({
             msg: "getcsrftoken failure",
-            user: (d = i.locals.user) == null ? void 0 : d.username,
-            hashedCsrfCookie: F.hash(c.split(".")[0]),
+            user: (d = a.locals.user) == null ? void 0 : d.username,
+            hashedCsrfCookie: A.hash(c.split(".")[0]),
             error: g.code,
             errorCodeName: g.codeName
-          })), l.logger.debug(f({ err: h })), l.logger.error({ cerr: h }), v({
+          })), l.logger.debug(f({ err: u })), l.logger.error({ cerr: u }), v({
             ok: !1,
             error: g.oauthErrorCode,
             error_description: g.message
@@ -187,50 +187,50 @@ class ce {
         }
       }
     }, this.authorizeEndpoint = {
-      load: async (i) => {
-        var w, S;
+      load: async (a) => {
+        var p, S;
         if (!(this.authServer.validFlows.includes(_.AuthorizationCode) || this.authServer.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(_.OidcAuthorizationCode)))
           throw this.error(401, "authorize cannot be called because the authorization code flows are not supported");
-        if (!i.locals.user) return this.redirect(
+        if (!a.locals.user) return this.redirect(
           302,
-          this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
+          this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
         );
-        let c = this.getAuthorizeQuery(i);
+        let c = this.getAuthorizeQuery(a);
         if (!c.query) return c.error;
         let d = c.query;
         l.logger.debug(f({ msg: "validating authorize parameters" }));
-        let { error_description: h } = this.authServer.validateAuthorizeParameters(d), g;
-        if (h ? (g = new n(u.BadRequest, h), l.logger.error(f({
+        let { error_description: u } = this.authServer.validateAuthorizeParameters(d), g;
+        if (u ? (g = new n(h.BadRequest, u), l.logger.error(f({
           msg: "authorize parameter invalid",
           cerr: g,
-          user: (w = i.locals.user) == null ? void 0 : w.username
+          user: (p = a.locals.user) == null ? void 0 : p.username
         }))) : l.logger.error(f({
           msg: "authorize parameter valid",
-          user: (S = i.locals.user) == null ? void 0 : S.username
+          user: (S = a.locals.user) == null ? void 0 : S.username
         })), g)
           return {
             ok: !1,
             error: g.oauthErrorCode,
             error_description: g.message
           };
-        let p = !1;
+        let w = !1;
         if (l.logger.debug(f({
           msg: "Checking scopes have been authorized",
           scope: d.scope
-        })), d.scope ? p = await this.authServer.hasAllScopes(
+        })), d.scope ? w = await this.authServer.hasAllScopes(
           d.client_id,
-          i.locals.user,
+          a.locals.user,
           d.scope.split(" ")
-        ) : p = await this.authServer.hasAllScopes(
+        ) : w = await this.authServer.hasAllScopes(
           d.client_id,
-          i.locals.user,
+          a.locals.user,
           [null]
-        ), p) {
+        ), w) {
           l.logger.debug(f({
             msg: "All scopes authorized",
             scope: d.scope
           }));
-          const C = await this.authorize(i, !0, {
+          const C = await this.authorize(a, !0, {
             responseType: d.response_type,
             client_id: d.client_id,
             redirect_uri: d.redirect_uri,
@@ -254,7 +254,7 @@ class ce {
             return {
               ok: !0,
               authorizationNeeded: {
-                user: i.locals.user,
+                user: a.locals.user,
                 response_type: d.response_type,
                 client_id: d.client_id,
                 client_name: C.client_name,
@@ -264,13 +264,13 @@ class ce {
                 state: d.state,
                 code_challenge: d.code_challenge,
                 code_challenge_method: d.code_challenge_method,
-                csrfToken: i.locals.csrfToken
+                csrfToken: a.locals.csrfToken
               },
               ...this.baseEndpoint
             };
           } catch (C) {
-            const T = C;
-            return l.logger.debug(f({ err: T })), {
+            const U = C;
+            return l.logger.debug(f({ err: U })), {
               ok: !1,
               error: "unauthorized_client",
               error_description: "Not a valid client"
@@ -280,33 +280,33 @@ class ce {
       },
       // load
       actions: {
-        default: async (i) => {
-          var h;
+        default: async (a) => {
+          var u;
           let c;
           try {
             var d = new b();
-            await d.loadData(i), c = d.toObject();
-            const g = d.getAsBoolean("authorized"), p = c.response_type, w = c.client_id, S = c.redirect_uri, C = c.scope, T = c.state, P = c.code_challenge, U = c.code_challenge_method;
-            let A;
-            if (g == null && (A = "authorized"), p ? w ? S ? T || (A = "state") : A = "redirect_uri" : A = "client_id" : A = "response_type", A)
+            await d.loadData(a), c = d.toObject();
+            const g = d.getAsBoolean("authorized"), w = c.response_type, p = c.client_id, S = c.redirect_uri, C = c.scope, U = c.state, R = c.code_challenge, F = c.code_challenge_method;
+            let T;
+            if (g == null && (T = "authorized"), w ? p ? S ? U || (T = "state") : T = "redirect_uri" : T = "client_id" : T = "response_type", T)
               return {
                 ok: !1,
                 error: "invalid_request",
-                error_description: "Invalid form: does not contain " + A + " parameter"
+                error_description: "Invalid form: does not contain " + T + " parameter"
               };
-            if (!i.locals.user) return this.redirect(
+            if (!a.locals.user) return this.redirect(
               302,
-              this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
+              this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
             );
-            if ((h = this.svelteKitServer.sessionServer) != null && h.enableCsrfProtection && !i.locals.csrfToken) throw new n(u.InvalidCsrf);
-            const z = await this.authorize(i, g ?? !1, {
-              responseType: p,
-              client_id: w,
+            if ((u = this.svelteKitServer.sessionServer) != null && u.enableCsrfProtection && !a.locals.csrfToken) throw new n(h.InvalidCsrf);
+            const z = await this.authorize(a, g ?? !1, {
+              responseType: w,
+              client_id: p,
               redirect_uri: S,
               scope: C,
-              state: T,
-              codeChallenge: P,
-              codeChallengeMethod: U
+              state: U,
+              codeChallenge: R,
+              codeChallengeMethod: F
             });
             return {
               ok: !1,
@@ -315,10 +315,10 @@ class ce {
             };
           } catch (g) {
             if (m.isSvelteKitError(g) || m.isSvelteKitRedirect(g)) throw g;
-            let p = n.asCrossauthError(g, "Couldn't process authorization code");
+            let w = n.asCrossauthError(g, "Couldn't process authorization code");
             return {
-              error: p.oauthErrorCode,
-              error_description: p.message,
+              error: w.oauthErrorCode,
+              error_description: w.message,
               ok: !1,
               formData: c
             };
@@ -326,7 +326,7 @@ class ce {
         }
       }
     }, this.tokenEndpoint = {
-      post: async (i) => {
+      post: async (a) => {
         let c;
         try {
           if (!(this.authServer.validFlows.includes(_.AuthorizationCode) || this.authServer.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.authServer.validFlows.includes(_.OidcAuthorizationCode) || this.authServer.validFlows.includes(_.ClientCredentials) || this.authServer.validFlows.includes(_.RefreshToken) || this.authServer.validFlows.includes(_.Password) || this.authServer.validFlows.includes(_.PasswordMfa || this.authServer.validFlows.includes(_.DeviceCode))))
@@ -336,32 +336,32 @@ class ce {
               error_description: "Token endpoint cannot be called as the supported OAuth flow types don't require it"
             }, { status: 500 });
           var d = new b();
-          await d.loadData(i), c = d.toObject();
-          const { client_id: h, client_secret: g } = this.getClientIdAndSecret(c, i);
-          let p = c.refresh_token, w = i.cookies.get(this.refreshTokenCookieName);
-          if ((this.refreshTokenType == "cookie" && w || this.refreshTokenType == "both" && w && p == null) && this.csrfTokens) {
-            const C = i.cookies.get(this.csrfTokens.cookieName);
-            let T = i.request.headers.get(this.csrfTokens.headerName.toLowerCase());
-            if (Array.isArray(T) && (T = T[0]), !C || !T)
+          await d.loadData(a), c = d.toObject();
+          const { client_id: u, client_secret: g } = this.getClientIdAndSecret(c, a);
+          let w = c.refresh_token, p = a.cookies.get(this.refreshTokenCookieName);
+          if ((this.refreshTokenType == "cookie" && p || this.refreshTokenType == "both" && p && w == null) && this.csrfTokens) {
+            const C = a.cookies.get(this.csrfTokens.cookieName);
+            let U = a.request.headers.get(this.csrfTokens.headerName.toLowerCase());
+            if (Array.isArray(U) && (U = U[0]), !C || !U)
               return v({
                 ok: !1,
                 error: "access_denied",
                 error_description: "Invalid csrf token"
               }, { status: 401 });
             try {
-              this.csrfTokens.validateDoubleSubmitCsrfToken(C, T);
-            } catch (P) {
-              return l.logger.debug(f({ err: P })), l.logger.warn(f({ cerr: P, msg: "Invalid csrf token", client_id: c.client_id })), v({
+              this.csrfTokens.validateDoubleSubmitCsrfToken(C, U);
+            } catch (R) {
+              return l.logger.debug(f({ err: R })), l.logger.warn(f({ cerr: R, msg: "Invalid csrf token", client_id: c.client_id })), v({
                 ok: !1,
                 error: "access_denied",
                 error_description: "Invalid csrf token"
               }, { status: 401 });
             }
-            p = w;
+            w = p;
           }
           const S = await this.authServer.tokenEndpoint({
             grantType: c.grant_type,
-            client_id: h,
+            client_id: u,
             client_secret: g,
             scope: c.scope,
             codeVerifier: c.code_verifier,
@@ -372,71 +372,71 @@ class ce {
             oobCode: c.oob_code,
             bindingCode: c.binding_code,
             otp: c.otp,
-            refreshToken: p,
+            refreshToken: w,
             deviceCode: c.device_code
           });
-          if (S.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(i, S.refresh_token, S.expires_in), S.error == "authorization_pending")
+          if (S.refresh_token && this.refreshTokenType != "json" && this.setRefreshTokenCookie(a, S.refresh_token, S.expires_in), S.error == "authorization_pending")
             return v(S);
           if (S.error || !S.access_token) {
-            let C = "server_error", T = "Neither code nor error received when requestoing authorization";
-            S.error && (C = S.error), S.error_description && (T = S.error_description);
-            const P = n.fromOAuthError(C, T);
-            return l.logger.error(f({ cerr: P })), v(S, { status: P.httpStatus });
+            let C = "server_error", U = "Neither code nor error received when requestoing authorization";
+            S.error && (C = S.error), S.error_description && (U = S.error_description);
+            const R = n.fromOAuthError(C, U);
+            return l.logger.error(f({ cerr: R })), v(S, { status: R.httpStatus });
           }
           return v(S);
-        } catch (h) {
-          const g = n.asCrossauthError(h);
-          return l.logger.debug({ err: h }), l.logger.error({ cerr: h }), v({
+        } catch (u) {
+          const g = n.asCrossauthError(u);
+          return l.logger.debug({ err: u }), l.logger.error({ cerr: u }), v({
             error: g.oauthErrorCode,
             error_description: g.message
           }, { status: g.httpStatus });
         }
       }
     }, this.mfaAuthenticatorsEndpoint = {
-      get: async (i) => {
+      get: async (a) => {
         try {
           var c = new b();
-          return await c.loadData(i), v(await this.mfaAuthenticators(i));
+          return await c.loadData(a), v(await this.mfaAuthenticators(a));
         } catch (d) {
-          const h = n.asCrossauthError(d);
+          const u = n.asCrossauthError(d);
           return l.logger.debug({ err: d }), l.logger.error({ cerr: d }), v({
-            error: h.oauthErrorCode,
-            error_description: h.message
+            error: u.oauthErrorCode,
+            error_description: u.message
           });
         }
       },
-      post: async (i) => {
+      post: async (a) => {
         try {
           var c = new b();
-          await c.loadData(i);
-          let d = await this.mfaAuthenticators(i), h = 200;
-          return !Array.isArray(d) && d.error == "access_denied" ? h = 401 : !Array.isArray(d) && d.error && (h = 500), v(d, { status: h });
+          await c.loadData(a);
+          let d = await this.mfaAuthenticators(a), u = 200;
+          return !Array.isArray(d) && d.error == "access_denied" ? u = 401 : !Array.isArray(d) && d.error && (u = 500), v(d, { status: u });
         } catch (d) {
-          const h = n.asCrossauthError(d);
+          const u = n.asCrossauthError(d);
           return l.logger.debug({ err: d }), l.logger.error({ cerr: d }), v({
-            error: h.oauthErrorCode,
-            error_description: h.message
-          }, { status: h.httpStatus });
+            error: u.oauthErrorCode,
+            error_description: u.message
+          }, { status: u.httpStatus });
         }
       }
     }, this.mfaChallengeEndpoint = {
-      post: async (i) => {
+      post: async (a) => {
         try {
           var c = new b();
-          await c.loadData(i);
-          const d = await this.mfaChallenge(i);
-          let h = 200;
-          return d.error == "access_denied" ? h = 401 : d.error && (h = 500), v(d, { status: h });
+          await c.loadData(a);
+          const d = await this.mfaChallenge(a);
+          let u = 200;
+          return d.error == "access_denied" ? u = 401 : d.error && (u = 500), v(d, { status: u });
         } catch (d) {
-          const h = n.asCrossauthError(d);
+          const u = n.asCrossauthError(d);
           return l.logger.debug({ err: d }), l.logger.error({ cerr: d }), v({
-            error: h.oauthErrorCode,
-            error_description: h.message
+            error: u.oauthErrorCode,
+            error_description: u.message
           }, { status: 500 });
         }
       }
     }, this.deviceAuthorizationEndpoint = {
-      post: async (i) => {
+      post: async (a) => {
         let c;
         try {
           if (!this.authServer.validFlows.includes(_.DeviceCode))
@@ -446,59 +446,59 @@ class ce {
               error_description: "Device authorization endpoint cannot be called as the supported OAuth flow types don't require it"
             });
           var d = new b();
-          await d.loadData(i), c = d.toObject();
-          const { client_id: h, client_secret: g } = this.getClientIdAndSecret(c, i), p = await this.authServer.deviceAuthorizationEndpoint({
-            client_id: h,
+          await d.loadData(a), c = d.toObject();
+          const { client_id: u, client_secret: g } = this.getClientIdAndSecret(c, a), w = await this.authServer.deviceAuthorizationEndpoint({
+            client_id: u,
             client_secret: g,
             scope: c.scope
           });
-          if (p.error) {
-            const w = n.fromOAuthError(p.error, p.error_description);
-            return l.logger.error(f({ cerr: w })), v(p, { status: 500 });
+          if (w.error) {
+            const p = n.fromOAuthError(w.error, w.error_description);
+            return l.logger.error(f({ cerr: p })), v(w, { status: 500 });
           }
-          if (!p.device_code || !p.user_code || !p.verification_uri || !p.verification_uri_complete || !p.expires_in) {
-            let w = "server_error", S = "Device authorization result has missing data";
-            const C = new n(u.UnknownError, S);
+          if (!w.device_code || !w.user_code || !w.verification_uri || !w.verification_uri_complete || !w.expires_in) {
+            let p = "server_error", S = "Device authorization result has missing data";
+            const C = new n(h.UnknownError, S);
             return l.logger.error(f({ cerr: C })), v({
-              error: w,
+              error: p,
               error_description: S
             }, { status: 500 });
           }
-          return v(p);
-        } catch (h) {
-          const g = n.asCrossauthError(h);
-          return l.logger.debug({ err: h }), l.logger.error({ cerr: h }), v({
+          return v(w);
+        } catch (u) {
+          const g = n.asCrossauthError(u);
+          return l.logger.debug({ err: u }), l.logger.error({ cerr: u }), v({
             error: g.oauthErrorCode,
             error_description: g.message
           }, { status: 500 });
         }
       }
     }, this.deviceEndpoint = {
-      load: async (i) => {
+      load: async (a) => {
         if (!this.authServer.validFlows.includes(_.DeviceCode))
           throw this.error(401, "device cannot be called because the device code flow is not supported");
-        if (!i.locals.user) return this.redirect(
+        if (!a.locals.user) return this.redirect(
           302,
-          this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
+          this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
         );
-        let c = i.url.searchParams.get("user_code");
-        return c ? await this.applyUserCode(c, i, i.locals.user) : {
+        let c = a.url.searchParams.get("user_code");
+        return c ? await this.applyUserCode(c, a, a.locals.user) : {
           ok: !0,
           completed: !1,
           retryAllowed: !0,
-          user: i.locals.user,
-          csrfToken: i.locals.csrfToken
+          user: a.locals.user,
+          csrfToken: a.locals.csrfToken
         };
       },
       // load
       actions: {
-        userCode: async (i) => {
-          if (!i.locals.user) throw this.error(401, "Access Denied");
+        userCode: async (a) => {
+          if (!a.locals.user) throw this.error(401, "Access Denied");
           try {
             var c = new b();
-            await c.loadData(i);
+            await c.loadData(a);
             const d = c.get("user_code");
-            return d ? await this.applyUserCode(d, i, i.locals.user) : {
+            return d ? await this.applyUserCode(d, a, a.locals.user) : {
               ok: !1,
               completed: !1,
               retryAllowed: !0,
@@ -507,25 +507,25 @@ class ce {
             };
           } catch (d) {
             if (m.isSvelteKitError(d) || m.isSvelteKitRedirect(d)) throw d;
-            let h = n.asCrossauthError(d, "Couldn't validate user code");
+            let u = n.asCrossauthError(d, "Couldn't validate user code");
             return {
               ok: !1,
               completed: !1,
               retryAllowed: !0,
-              error: h.oauthErrorCode,
-              error_description: h.message
+              error: u.oauthErrorCode,
+              error_description: u.message
             };
           }
         },
-        authorize: async (i) => {
-          var h;
+        authorize: async (a) => {
+          var u;
           let c;
           try {
             var d = new b();
-            await d.loadData(i), c = d.toObject();
-            const g = d.getAsBoolean("authorized"), p = c.scope, w = c.client_id, S = c.user_code;
+            await d.loadData(a), c = d.toObject();
+            const g = d.getAsBoolean("authorized"), w = c.scope, p = c.client_id, S = c.user_code;
             let C;
-            if (g == null && (C = "authorized"), w == null && (C = "client_id"), S == null && (C = "user_code"), C)
+            if (g == null && (C = "authorized"), p == null && (C = "client_id"), S == null && (C = "user_code"), C)
               return {
                 ok: !1,
                 completed: !1,
@@ -533,24 +533,24 @@ class ce {
                 error: "invalid_request",
                 error_description: "Invalid form: does not contain " + C + " parameter"
               };
-            if (!i.locals.user) return this.redirect(
+            if (!a.locals.user) return this.redirect(
               302,
-              this.loginUrl + "?next=" + encodeURIComponent(i.request.url)
+              this.loginUrl + "?next=" + encodeURIComponent(a.request.url)
             );
-            if ((h = this.svelteKitServer.sessionServer) != null && h.enableCsrfProtection && !i.locals.csrfToken) throw new n(u.InvalidCsrf);
-            return (await this.authServer.validateAndPersistScope(w, p, i.locals.user)).error ? {
+            if ((u = this.svelteKitServer.sessionServer) != null && u.enableCsrfProtection && !a.locals.csrfToken) throw new n(h.InvalidCsrf);
+            return (await this.authServer.validateAndPersistScope(p, w, a.locals.user)).error ? {
               ok: !1,
               completed: !1,
               retryAllowed: !1,
               error: "unauthorized_client",
               error_description: "You did not authorize access to your account"
-            } : await this.applyUserCode(S, i, i.locals.user);
+            } : await this.applyUserCode(S, a, a.locals.user);
           } catch (g) {
             if (m.isSvelteKitError(g) || m.isSvelteKitRedirect(g)) throw g;
-            let p = n.asCrossauthError(g, "Couldn't process authorization code");
+            let w = n.asCrossauthError(g, "Couldn't process authorization code");
             return {
-              error: p.oauthErrorCode,
-              error_description: p.message,
+              error: w.oauthErrorCode,
+              error_description: w.message,
               ok: !1,
               completed: !1,
               retryAllowed: !1
@@ -563,7 +563,7 @@ class ce {
       s,
       e,
       t
-    ), y("loginUrl", E.String, this, t, "LOGIN_URL"), y("refreshTokenType", E.String, this, t, "OAUTH_REFRESH_TOKEN_TYPE"), y("refreshTokenCookieName", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), y("refreshTokenCookieDomain", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), y("refreshTokenCookieHttpOnly", E.Boolean, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), y("refreshTokenCookiePath", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), y("refreshTokenCookieSecure", E.Boolean, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), y("refreshTokenCookieSameSite", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), y("authorizeEndpointUrl", E.String, this, t, "OAUTH_AUTHORIZE_ENDPOINT"), y("tokenEndpointUrl", E.String, this, t, "OAUTH_TOKEN_ENDPOINT"), y("jwksEndpointUrl", E.String, this, t, "OAUTH_JWKS_ENDPOINT"), this.refreshTokenType != "json" && (((a = this.svelteKitServer.sessionServer) == null ? void 0 : a.enableCsrfProtection) == !0 ? this.csrfTokens = this.svelteKitServer.sessionServer.sessionManager.csrfTokens : this.csrfTokens = new ee(t.doubleSubmitCookieOptions));
+    ), y("loginUrl", E.String, this, t, "LOGIN_URL"), y("refreshTokenType", E.String, this, t, "OAUTH_REFRESH_TOKEN_TYPE"), y("refreshTokenCookieName", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_NAME"), y("refreshTokenCookieDomain", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_DOMAIN"), y("refreshTokenCookieHttpOnly", E.Boolean, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_HTTPONLY"), y("refreshTokenCookiePath", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_PATH"), y("refreshTokenCookieSecure", E.Boolean, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_SECURE"), y("refreshTokenCookieSameSite", E.String, this, t, "OAUTH_REFRESH_TOKEN_COOKIE_SAMESITE"), y("authorizeEndpointUrl", E.String, this, t, "OAUTH_AUTHORIZE_ENDPOINT"), y("tokenEndpointUrl", E.String, this, t, "OAUTH_TOKEN_ENDPOINT"), y("jwksEndpointUrl", E.String, this, t, "OAUTH_JWKS_ENDPOINT"), this.refreshTokenType != "json" && (((i = this.svelteKitServer.sessionServer) == null ? void 0 : i.enableCsrfProtection) == !0 ? this.csrfTokens = this.svelteKitServer.sessionServer.sessionManager.csrfTokens : this.csrfTokens = new ee(t.doubleSubmitCookieOptions));
   }
   /**
    * Returns this server's OIDC configuration.  Just wraps
@@ -585,55 +585,55 @@ class ce {
     responseType: s,
     client_id: e,
     redirect_uri: t,
-    scope: a,
-    state: i,
+    scope: i,
+    state: a,
     codeChallenge: c,
     codeChallengeMethod: d
   }) {
-    let h, g, p;
+    let u, g, w;
     if (o) {
-      const w = await this.authServer.authorizeGetEndpoint({
+      const p = await this.authServer.authorizeGetEndpoint({
         responseType: s,
         client_id: e,
         redirect_uri: t,
-        scope: a,
-        state: i,
+        scope: i,
+        state: a,
         codeChallenge: c,
         codeChallengeMethod: d,
         user: r.locals.user
       });
-      if (p = w.code, h = w.error, g = w.error_description, h || !p) {
+      if (w = p.code, u = p.error, g = p.error_description, u || !w) {
         const S = n.fromOAuthError(
-          h ?? "server_error",
+          u ?? "server_error",
           g ?? "Neither code nor error received"
         );
         return l.logger.error(f({ cerr: S })), {
           ok: !1,
-          error: h,
+          error: u,
           error_description: g
         };
       }
       throw this.redirect(302, this.authServer.redirect_uri(
         t,
-        p,
-        i
+        w,
+        a
       ));
     } else {
-      const w = new n(
-        u.Unauthorized,
+      const p = new n(
+        h.Unauthorized,
         "You have not granted access"
       );
-      l.logger.debug(f({ err: w })), l.logger.error(f({ cerr: w })), l.logger.error(f({
+      l.logger.debug(f({ err: p })), l.logger.error(f({ cerr: p })), l.logger.error(f({
         msg: g,
-        errorCode: w.code,
-        errorCodeName: w.codeName
+        errorCode: p.code,
+        errorCodeName: p.codeName
       }));
       try {
         throw B.validateUri(t), this.redirect(302, t + "?error=access_denied&error_description=" + encodeURIComponent("Access was not granted"));
       } catch (S) {
         if (m.isSvelteKitError(S) || m.isSvelteKitRedirect(S)) throw S;
         return l.logger.error(f({
-          msg: `Couldn't send error message ${w.codeName} to ${t}}`
+          msg: `Couldn't send error message ${p.codeName} to ${t}}`
         })), {
           ok: !1,
           error: "server_error",
@@ -651,7 +651,7 @@ class ce {
    * @returns a CSRF cookie and value to put in the form or CSRF header
    */
   async createCsrfToken() {
-    if (!this.csrfTokens) throw new n(u.Configuration, "CSRF tokens not enabled");
+    if (!this.csrfTokens) throw new n(h.Configuration, "CSRF tokens not enabled");
     this.csrfTokens.makeCsrfCookie(this.csrfTokens.createCsrfToken());
     const r = this.csrfTokens.createCsrfToken(), o = this.csrfTokens.makeCsrfFormOrHeaderToken(r);
     return {
@@ -690,13 +690,13 @@ class ce {
     if (o = this.requireGetParam(r, "client_id"), o) return { error: o };
     if (o = this.requireGetParam(r, "redirect_uri"), o) return { error: o };
     if (o = this.requireGetParam(r, "state"), o) return { error: o };
-    const s = r.url.searchParams.get("response_type") ?? "", e = r.url.searchParams.get("client_id") ?? "", t = r.url.searchParams.get("redirect_uri") ?? "", a = r.url.searchParams.get("scope") ?? void 0, i = r.url.searchParams.get("state") ?? "", c = r.url.searchParams.get("code_challenge") ?? void 0, d = r.url.searchParams.get("code_challenge_method") ?? void 0;
+    const s = r.url.searchParams.get("response_type") ?? "", e = r.url.searchParams.get("client_id") ?? "", t = r.url.searchParams.get("redirect_uri") ?? "", i = r.url.searchParams.get("scope") ?? void 0, a = r.url.searchParams.get("state") ?? "", c = r.url.searchParams.get("code_challenge") ?? void 0, d = r.url.searchParams.get("code_challenge_method") ?? void 0;
     return { query: {
       response_type: s,
       client_id: e,
       redirect_uri: t,
-      scope: a,
-      state: i,
+      scope: i,
+      state: a,
       code_challenge: c,
       code_challenge_method: d
     }, error: { error: "Unknown error", error_description: "Unknown error", ok: !0 } };
@@ -710,18 +710,18 @@ class ce {
     if (e = this.requireBodyParam(s, "challenge_type"), e) return { error: e };
     if (e = this.requireBodyParam(s, "mfa_token"), e) return { error: e };
     if (e = this.requireBodyParam(s, "authenticator_id"), e) return { error: e };
-    const t = s.client_id ?? "", a = s.challenge_type ?? "", i = s.mfa_token ?? "", c = s.authenticator_id ?? "", d = s.client_secret ?? void 0;
+    const t = s.client_id ?? "", i = s.challenge_type ?? "", a = s.mfa_token ?? "", c = s.authenticator_id ?? "", d = s.client_secret ?? void 0;
     return { query: {
       client_id: t,
       client_secret: d,
-      challenge_type: a,
-      mfa_token: i,
+      challenge_type: i,
+      mfa_token: a,
       authenticator_id: c
     }, error: { error: "Unknown error", error_description: "Unknown error", ok: !0 } };
   }
   async mfaAuthenticators(r) {
-    var a;
-    const o = (a = r.request.headers.get("authorization")) == null ? void 0 : a.split(" ");
+    var i;
+    const o = (i = r.request.headers.get("authorization")) == null ? void 0 : i.split(" ");
     if (!o || o.length != 2)
       return {
         error: "access_denied",
@@ -752,65 +752,65 @@ class ce {
     let s = r.client_id, e = r.client_secret;
     const t = o.request.headers.get("authorization");
     if (t) {
-      let a, i;
+      let i, a;
       const c = t.split(" ");
       if (c.length == 2 && c[0].toLocaleLowerCase() == "basic") {
-        const h = F.base64Decode(c[1]).split(":", 2);
-        h.length == 2 && (a = h[0], i = h[1]);
+        const u = A.base64Decode(c[1]).split(":", 2);
+        u.length == 2 && (i = u[0], a = u[1]);
       }
-      a == null || i == null ? l.logger.warn(f({
+      i == null || a == null ? l.logger.warn(f({
         msg: "Ignoring malform authenization header " + t
-      })) : (s = a, e = i);
+      })) : (s = i, e = a);
     }
     return { client_id: s, client_secret: e };
   }
   async applyUserCode(r, o, s) {
-    var e, t, a;
+    var e, t, i;
     try {
-      const i = await this.authServer.deviceEndpoint({ userCode: r, user: s });
-      if (i.error)
+      const a = await this.authServer.deviceEndpoint({ userCode: r, user: s });
+      if (a.error)
         return {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
-          error: i.error,
-          error_description: i.error_description
+          error: a.error,
+          error_description: a.error_description
         };
-      if (!i.client_id)
-        return l.logger.error(f({ msg: "No client id found for user code", userCodeHash: F.hash(r), ip: o.request.referrer, username: (e = o.locals.user) == null ? void 0 : e.username })), {
+      if (!a.client_id)
+        return l.logger.error(f({ msg: "No client id found for user code", userCodeHash: A.hash(r), ip: o.request.referrer, username: (e = o.locals.user) == null ? void 0 : e.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
           error: "server_error",
           error_description: "No client id found for user code"
         };
-      if (i.error == "access_denied")
-        return l.logger.error(f({ msg: "Incorrect user code given", userCodeHash: F.hash(r), ip: o.request.referrer, username: (t = o.locals.user) == null ? void 0 : t.username })), this.authServer.userCodeThrottle > 0 && await ((h) => new Promise((g) => setTimeout(g, h)))(this.authServer.userCodeThrottle), {
+      if (a.error == "access_denied")
+        return l.logger.error(f({ msg: "Incorrect user code given", userCodeHash: A.hash(r), ip: o.request.referrer, username: (t = o.locals.user) == null ? void 0 : t.username })), this.authServer.userCodeThrottle > 0 && await ((u) => new Promise((g) => setTimeout(g, u)))(this.authServer.userCodeThrottle), {
           ok: !1,
           completed: !1,
           retryAllowed: !0,
-          error: i.error,
-          error_description: i.error_description
+          error: a.error,
+          error_description: a.error_description
         };
-      if (i.error == "expired_token")
-        return l.logger.error(f({ msg: "Expired user code", userCodeHash: F.hash(r), ip: o.request.referrer, username: (a = o.locals.user) == null ? void 0 : a.username })), {
+      if (a.error == "expired_token")
+        return l.logger.error(f({ msg: "Expired user code", userCodeHash: A.hash(r), ip: o.request.referrer, username: (i = o.locals.user) == null ? void 0 : i.username })), {
           ok: !1,
           completed: !1,
           retryAllowed: !1,
-          error: i.error,
-          error_description: i.error_description
+          error: a.error,
+          error_description: a.error_description
         };
-      const c = await this.clientStorage.getClientById(i.client_id);
-      return i.scopeAuthorizationNeeded ? {
+      const c = await this.clientStorage.getClientById(a.client_id);
+      return a.scopeAuthorizationNeeded ? {
         ok: !0,
         completed: !1,
         retryAllowed: !0,
         authorizationNeeded: {
           user: s,
-          client_id: i.client_id,
+          client_id: a.client_id,
           client_name: c.client_name,
-          scope: i.scope,
-          scopes: i.scope ? i.scope.split(" ") : [],
+          scope: a.scope,
+          scopes: a.scope ? a.scope.split(" ") : [],
           csrfToken: o.locals.csrfToken
         },
         user: o.locals.user,
@@ -823,8 +823,8 @@ class ce {
         user: o.locals.user,
         csrfToken: o.locals.csrfToken
       };
-    } catch (i) {
-      const c = n.asCrossauthError(i);
+    } catch (a) {
+      const c = n.asCrossauthError(a);
       return l.logger.debug(f({ err: c })), l.logger.error(f({ msg: c.message, cerr: c })), {
         ok: !1,
         completed: !1,
@@ -870,7 +870,7 @@ function O(k) {
   let r;
   if (k)
     try {
-      r = JSON.parse(F.base64Decode(k.split(".")[1]));
+      r = JSON.parse(A.base64Decode(k.split(".")[1]));
     } catch (o) {
       const s = n.asCrossauthError(o);
       l.logger.debug(f({ err: s })), l.logger.error(f({ msg: "Couldn't decode token", cerr: s }));
@@ -886,7 +886,7 @@ function L(k, r) {
   if (k.access_token)
     try {
       if (k.access_token && r.includes("access")) {
-        const s = M(k.access_token), e = s.jti ? s.jti : s.sid ? s.sid : "", t = e ? F.hash(e) : void 0;
+        const s = M(k.access_token), e = s.jti ? s.jti : s.sid ? s.sid : "", t = e ? A.hash(e) : void 0;
         l.logger.debug(f({
           msg: "Got access token",
           accessTokenHash: t
@@ -900,7 +900,7 @@ function L(k, r) {
       if (k.id_token && r.includes("id")) {
         const s = k.id_payload ?? M(k.id_token);
         if (s) {
-          const e = s.jti ? s.jti : s.sid ? s.sid : "", t = e ? F.hash(e) : void 0;
+          const e = s.jti ? s.jti : s.sid ? s.sid : "", t = e ? A.hash(e) : void 0;
           l.logger.debug(f({
             msg: "Got id token",
             idTokenHash: t
@@ -913,7 +913,7 @@ function L(k, r) {
   if (k.refresh_token && r.includes("refresh"))
     try {
       if (k.refresh_token) {
-        const s = (o = M(k.refresh_token)) == null ? void 0 : o.jti, e = s ? F.hash(s) : void 0;
+        const s = (o = M(k.refresh_token)) == null ? void 0 : o.jti, e = s ? A.hash(s) : void 0;
         l.logger.debug(f({
           msg: "Got refresh token",
           refreshTokenHash: e
@@ -926,24 +926,24 @@ function L(k, r) {
 async function j(k, r, o) {
   if (!r.server.sessionAdapter)
     throw new n(
-      u.Configuration,
+      h.Configuration,
       "Cannot update session data if not using sessions"
     );
   let s = k.expires_in;
   if (!s && k.access_token && r.jwtTokens.includes("access")) {
-    const a = M(k.access_token);
-    a.exp && (s = a.exp);
+    const i = M(k.access_token);
+    i.exp && (s = i.exp);
   }
   if (!s)
     throw new n(
-      u.BadRequest,
+      h.BadRequest,
       "OAuth server did not return an expiry for the access token"
     );
   const e = Date.now() + s * 1e3;
   let t = { ...k, expires_at: e };
   if ("id_token" in k) {
-    let a = k.id_payload ?? O(k.id_token);
-    a && (t.id_payload = a);
+    let i = k.id_payload ?? O(k.id_token);
+    i && (t.id_payload = i);
   }
   await r.storeSessionData(o, t);
 }
@@ -965,8 +965,8 @@ async function de(k, r, o, s, e) {
     if (!s) return r.redirect(302, r.authorizedUrl);
   } catch (t) {
     if (m.isSvelteKitError(t) || m.isSvelteKitRedirect(t)) throw t;
-    const a = n.asCrossauthError(t);
-    return l.logger.debug(f({ err: a })), l.logger.debug(f({ cerr: a, msg: "Error receiving tokens" })), r.errorFn(r.server, o, a);
+    const i = n.asCrossauthError(t);
+    return l.logger.debug(f({ err: i })), l.logger.debug(f({ cerr: i, msg: "Error receiving tokens" })), r.errorFn(r.server, o, i);
   }
 }
 async function he(k, r, o, s, e) {
@@ -987,8 +987,8 @@ async function he(k, r, o, s, e) {
     return v({ ok: !0, ...k });
   } catch (t) {
     if (m.isSvelteKitError(t) || m.isSvelteKitRedirect(t)) throw t;
-    const a = n.asCrossauthError(t);
-    return l.logger.debug(f({ err: a })), l.logger.debug(f({ cerr: a, msg: "Error receiving tokens" })), r.errorFn(r.server, o, a);
+    const i = n.asCrossauthError(t);
+    return l.logger.debug(f({ err: i })), l.logger.debug(f({ cerr: i, msg: "Error receiving tokens" })), r.errorFn(r.server, o, i);
   }
 }
 async function ue(k, r, o, s, e) {
@@ -1008,11 +1008,11 @@ async function ue(k, r, o, s, e) {
     return r.jwtTokens.includes("id") && (t.id_payload = k.id_payload ?? O(k.id_token)), t.id_payload && await e(o, t.id_payload), t;
   } catch (t) {
     if (m.isSvelteKitError(t) || m.isSvelteKitRedirect(t)) throw t;
-    const a = n.asCrossauthError(t);
-    return l.logger.debug(f({ err: a })), l.logger.debug(f({ cerr: a, msg: "Error receiving tokens" })), {
+    const i = n.asCrossauthError(t);
+    return l.logger.debug(f({ err: i })), l.logger.debug(f({ cerr: i, msg: "Error receiving tokens" })), {
       ok: !1,
-      error: a.oauthErrorCode,
-      error_description: a.message
+      error: i.oauthErrorCode,
+      error_description: i.message
     };
   }
 }
@@ -1051,25 +1051,25 @@ class G extends re {
     if (super(o, s), this.sessionDataName = "oauth", this.receiveTokenFn = J, this.errorFn = W, this.loginUrl = "/login", this.validFlows = [_.All], this.authorizedUrl = "", this.autoRefreshActive = {}, this.loginProtectedFlows = [], this.tokenResponseType = "sendJson", this.errorResponseType = "sendJson", this.bffEndpoints = [], this.bffEndpointName = "bff", this.tokenEndpoints = [], this.bffMaxTries = 1, this.bffSleepMilliseconds = 500, this.jwtTokens = ["access", "id", "refresh"], this.testMiddleware = !1, this.testEvent = void 0, this.authorizationCodeFlowEndpoint = {
       get: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const t = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
+          const t = new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
           return this.errorFn(this.server, e, t);
         }
         try {
           if (!this.validFlows.includes(_.AuthorizationCode)) {
-            const g = new n(u.Unauthorized, "Authorization flow is not supported");
+            const g = new n(h.Unauthorized, "Authorization flow is not supported");
             return this.errorFn(this.server, e, g);
           }
           if (!this.server.sessionAdapter)
-            throw new n(u.Configuration, "Need session server or adapter for authorization code flow");
+            throw new n(h.Configuration, "Need session server or adapter for authorization code flow");
           let t = e.url.searchParams.get("scope") ?? void 0;
           t == "" && (t = void 0);
-          const a = this.randomValue(this.stateLength), i = { scope: t, state: a };
-          await this.storeSessionData(e, i);
-          const { url: c, error: d, error_description: h } = await this.startAuthorizationCodeFlow(a, t);
+          const i = this.randomValue(this.stateLength), a = { scope: t, state: i };
+          await this.storeSessionData(e, a);
+          const { url: c, error: d, error_description: u } = await this.startAuthorizationCodeFlow(i, t);
           if (d || !c) {
             const g = n.fromOAuthError(
               d ?? "server_error",
-              h
+              u
             );
             return await this.errorFn(this.server, e, g);
           }
@@ -1078,8 +1078,8 @@ class G extends re {
           })), this.redirect(302, c);
         } catch (t) {
           if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-          const a = n.asCrossauthError(t);
-          return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), this.errorFn(this.server, e, a);
+          const i = n.asCrossauthError(t);
+          return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), this.errorFn(this.server, e, i);
         }
       },
       load: async (e) => {
@@ -1087,7 +1087,7 @@ class G extends re {
           /*this.tokenResponseType == "saveInSessionAndRedirect" ||*/
           this.tokenResponseType == "sendJson" || this.tokenResponseType == "saveInSessionAndLoad"
         ) {
-          const t = new n(u.Unauthorized, "Authorization flow is not supported");
+          const t = new n(h.Unauthorized, "Authorization flow is not supported");
           return {
             ok: !1,
             error: t.oauthErrorCode,
@@ -1096,7 +1096,7 @@ class G extends re {
         }
         try {
           if (!this.validFlows.includes(_.AuthorizationCode)) {
-            const g = new n(u.Unauthorized, "Authorization flow is not supported");
+            const g = new n(h.Unauthorized, "Authorization flow is not supported");
             return {
               ok: !1,
               error: g.oauthErrorCode,
@@ -1104,16 +1104,16 @@ class G extends re {
             };
           }
           if (!this.server.sessionAdapter)
-            throw new n(u.Configuration, "Need session server or adapter for authorization code flow");
+            throw new n(h.Configuration, "Need session server or adapter for authorization code flow");
           let t = e.url.searchParams.get("scope") ?? void 0;
           t == "" && (t = void 0);
-          const a = this.randomValue(this.stateLength), i = { scope: t, state: a };
-          await this.storeSessionData(e, i);
-          const { url: c, error: d, error_description: h } = await this.startAuthorizationCodeFlow(a, t);
+          const i = this.randomValue(this.stateLength), a = { scope: t, state: i };
+          await this.storeSessionData(e, a);
+          const { url: c, error: d, error_description: u } = await this.startAuthorizationCodeFlow(i, t);
           if (d || !c) {
             const g = n.fromOAuthError(
               d ?? "server_error",
-              h
+              u
             );
             return {
               ok: !1,
@@ -1126,49 +1126,49 @@ class G extends re {
           })), this.redirect(302, c);
         } catch (t) {
           if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-          const a = n.asCrossauthError(t);
+          const i = n.asCrossauthError(t);
           return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), {
             ok: !1,
-            error: a.oauthErrorCode,
-            error_description: a.message
+            error: i.oauthErrorCode,
+            error_description: i.message
           };
         }
       }
     }, this.authorizationCodeFlowWithPKCEEndpoint = {
       get: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const t = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
+          const t = new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
           return this.errorFn(this.server, e, t);
         }
         try {
           if (!this.validFlows.includes(_.AuthorizationCodeWithPKCE)) {
-            const w = new n(u.Unauthorized, "Authorization flow is not supported");
-            return this.errorFn(this.server, e, w);
+            const p = new n(h.Unauthorized, "Authorization flow is not supported");
+            return this.errorFn(this.server, e, p);
           }
           if (!this.server.sessionAdapter)
-            throw new n(u.Configuration, "Need session server or adapter for authorization code flow");
+            throw new n(h.Configuration, "Need session server or adapter for authorization code flow");
           let t = e.url.searchParams.get("scope") ?? void 0;
           t == "" && (t = void 0);
-          const a = this.randomValue(this.stateLength), { codeChallenge: i, codeVerifier: c } = await this.codeChallengeAndVerifier(), d = { scope: t, state: a, codeChallenge: i, codeVerifier: c };
+          const i = this.randomValue(this.stateLength), { codeChallenge: a, codeVerifier: c } = await this.codeChallengeAndVerifier(), d = { scope: t, state: i, codeChallenge: a, codeVerifier: c };
           await this.storeSessionData(e, d);
-          const { url: h, error: g, error_description: p } = await this.startAuthorizationCodeFlow(a, t, i, !0);
-          if (g || !h) {
-            const w = n.fromOAuthError(
+          const { url: u, error: g, error_description: w } = await this.startAuthorizationCodeFlow(i, t, a, !0);
+          if (g || !u) {
+            const p = n.fromOAuthError(
               g ?? "server_error",
-              p
+              w
             );
-            return await this.errorFn(this.server, e, w);
+            return await this.errorFn(this.server, e, p);
           }
-          throw this.oauthLogFetch ? l.logger.debug(f({ msg: "OAuth redirect", url: h })) : l.logger.debug(f({
+          throw this.oauthLogFetch ? l.logger.debug(f({ msg: "OAuth redirect", url: u })) : l.logger.debug(f({
             msg: "OAuth redirect"
-          })), this.redirect(302, h);
+          })), this.redirect(302, u);
         } catch (t) {
           if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-          const a = n.asCrossauthError(t);
+          const i = n.asCrossauthError(t);
           return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), v({
-            error: a.oauthErrorCode,
-            error_description: a.message
-          }, { status: a.httpStatus });
+            error: i.oauthErrorCode,
+            error_description: i.message
+          }, { status: i.httpStatus });
         }
       },
       load: async (e) => {
@@ -1176,7 +1176,7 @@ class G extends re {
           /*this.tokenResponseType == "saveInSessionAndRedirect" ||*/
           this.tokenResponseType == "sendJson" || this.tokenResponseType == "saveInSessionAndLoad"
         ) {
-          const t = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use get not load");
+          const t = new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use get not load");
           return {
             ok: !1,
             error: t.oauthErrorCode,
@@ -1185,41 +1185,41 @@ class G extends re {
         }
         try {
           if (!this.validFlows.includes(_.AuthorizationCodeWithPKCE)) {
-            const w = new n(u.Unauthorized, "Authorization flow is not supported");
+            const p = new n(h.Unauthorized, "Authorization flow is not supported");
             return {
               ok: !1,
-              error: w.oauthErrorCode,
-              error_description: w.message
+              error: p.oauthErrorCode,
+              error_description: p.message
             };
           }
           if (!this.server.sessionAdapter)
-            throw new n(u.Configuration, "Need session server or adapter for authorization code flow");
+            throw new n(h.Configuration, "Need session server or adapter for authorization code flow");
           let t = e.url.searchParams.get("scope") ?? void 0;
           t == "" && (t = void 0);
-          const a = this.randomValue(this.stateLength), { codeChallenge: i, codeVerifier: c } = await this.codeChallengeAndVerifier(), d = { scope: t, state: a, codeChallenge: i, codeVerifier: c };
+          const i = this.randomValue(this.stateLength), { codeChallenge: a, codeVerifier: c } = await this.codeChallengeAndVerifier(), d = { scope: t, state: i, codeChallenge: a, codeVerifier: c };
           await this.storeSessionData(e, d);
-          const { url: h, error: g, error_description: p } = await this.startAuthorizationCodeFlow(a, t, i, !0);
-          if (g || !h) {
-            const w = n.fromOAuthError(
+          const { url: u, error: g, error_description: w } = await this.startAuthorizationCodeFlow(i, t, a, !0);
+          if (g || !u) {
+            const p = n.fromOAuthError(
               g ?? "server_error",
-              p
+              w
             );
             return {
               ok: !1,
-              error: w.oauthErrorCode,
-              error_description: w.message
+              error: p.oauthErrorCode,
+              error_description: p.message
             };
           }
-          throw this.oauthLogFetch ? l.logger.debug(f({ msg: "OAuth redirect", url: h })) : l.logger.debug(f({
+          throw this.oauthLogFetch ? l.logger.debug(f({ msg: "OAuth redirect", url: u })) : l.logger.debug(f({
             msg: "OAuth redirect"
-          })), this.redirect(302, h);
+          })), this.redirect(302, u);
         } catch (t) {
           if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-          const a = n.asCrossauthError(t);
+          const i = n.asCrossauthError(t);
           return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), {
             ok: !1,
-            error: a.oauthErrorCode,
-            error_description: a.message
+            error: i.oauthErrorCode,
+            error_description: i.message
           };
         }
       }
@@ -1227,35 +1227,35 @@ class G extends re {
       get: async (e) => {
         var t;
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const a = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
-          return this.errorFn(this.server, e, a);
+          const i = new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
+          return this.errorFn(this.server, e, i);
         }
         try {
           if (!(this.validFlows.includes(_.AuthorizationCode) || this.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.validFlows.includes(_.OidcAuthorizationCode))) {
-            const p = new n(u.Unauthorized, "Authorization flows are not supported");
-            return this.errorFn(this.server, e, p);
+            const w = new n(h.Unauthorized, "Authorization flows are not supported");
+            return this.errorFn(this.server, e, w);
           }
           l.logger.debug(f({ msg: "redirectUriEndpoint, token response type " + this.tokenResponseType }));
-          const a = e.url.searchParams.get("code") ?? "", i = e.url.searchParams.get("state") ?? void 0, c = e.url.searchParams.get("error") ?? void 0, d = e.url.searchParams.get("error") ?? void 0, h = await ((t = this.server.sessionAdapter) == null ? void 0 : t.getSessionData(e, this.sessionDataName));
-          if ((h == null ? void 0 : h.state) != i)
-            throw new n(u.Unauthorized, "State does not match");
+          const i = e.url.searchParams.get("code") ?? "", a = e.url.searchParams.get("state") ?? void 0, c = e.url.searchParams.get("error") ?? void 0, d = e.url.searchParams.get("error") ?? void 0, u = await ((t = this.server.sessionAdapter) == null ? void 0 : t.getSessionData(e, this.sessionDataName));
+          if ((u == null ? void 0 : u.state) != a)
+            throw new n(h.Unauthorized, "State does not match");
           const g = this.errorIfIdTokenInvalid(await this.redirectEndpoint(
-            a,
-            h == null ? void 0 : h.scope,
-            h == null ? void 0 : h.codeVerifier,
+            i,
+            u == null ? void 0 : u.scope,
+            u == null ? void 0 : u.codeVerifier,
             c,
             d
           ));
           if (g.error) return this.errorFn(this.server, e, n.fromOAuthError(g.error, g.error_description));
           if (g.error) {
-            const p = n.fromOAuthError(
+            const w = n.fromOAuthError(
               g.error,
               g.error_description
             );
             return await this.errorFn(
               this.server,
               e,
-              p
+              w
             );
           }
           return await this.receiveTokenFn(
@@ -1265,10 +1265,10 @@ class G extends re {
             !1,
             this.setEventLocalsUser
           );
-        } catch (a) {
-          if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
-          const i = n.asCrossauthError(a);
-          return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), this.errorFn(this.server, e, i);
+        } catch (i) {
+          if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
+          const a = n.asCrossauthError(i);
+          return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), this.errorFn(this.server, e, a);
         }
       },
       load: async (e) => {
@@ -1277,29 +1277,29 @@ class G extends re {
           /*this.tokenResponseType == "saveInSessionAndRedirect" ||*/
           this.tokenResponseType == "sendJson" || this.tokenResponseType == "saveInSessionAndLoad"
         ) {
-          const a = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use get not load");
+          const i = new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use get not load");
           return {
             ok: !1,
-            error: a.oauthErrorCode,
-            error_description: a.message
+            error: i.oauthErrorCode,
+            error_description: i.message
           };
         }
         try {
           if (!(this.validFlows.includes(_.AuthorizationCode) || this.validFlows.includes(_.AuthorizationCodeWithPKCE) || this.validFlows.includes(_.OidcAuthorizationCode))) {
-            const w = new n(u.Unauthorized, "Authorization flows are not supported");
+            const p = new n(h.Unauthorized, "Authorization flows are not supported");
             return {
               ok: !1,
-              error: w.oauthErrorCode,
-              error_description: w.message
+              error: p.oauthErrorCode,
+              error_description: p.message
             };
           }
-          const a = e.url.searchParams.get("code") ?? "", i = e.url.searchParams.get("state") ?? void 0, c = e.url.searchParams.get("error") ?? void 0, d = e.url.searchParams.get("error") ?? void 0, h = await ((t = this.server.sessionAdapter) == null ? void 0 : t.getSessionData(e, this.sessionDataName));
-          if ((h == null ? void 0 : h.state) != i)
-            throw new n(u.Unauthorized, "State does not match");
+          const i = e.url.searchParams.get("code") ?? "", a = e.url.searchParams.get("state") ?? void 0, c = e.url.searchParams.get("error") ?? void 0, d = e.url.searchParams.get("error") ?? void 0, u = await ((t = this.server.sessionAdapter) == null ? void 0 : t.getSessionData(e, this.sessionDataName));
+          if ((u == null ? void 0 : u.state) != a)
+            throw new n(h.Unauthorized, "State does not match");
           const g = this.errorIfIdTokenInvalid(await this.redirectEndpoint(
-            a,
-            h == null ? void 0 : h.scope,
-            h == null ? void 0 : h.codeVerifier,
+            i,
+            u == null ? void 0 : u.scope,
+            u == null ? void 0 : u.codeVerifier,
             c,
             d
           ));
@@ -1309,67 +1309,67 @@ class G extends re {
             error_description: g.error_description
           };
           if (g.error) {
-            const w = n.fromOAuthError(
+            const p = n.fromOAuthError(
               g.error,
               g.error_description
             );
             return {
               ok: !1,
-              error: w.oauthErrorCode,
-              error_description: w.message
+              error: p.oauthErrorCode,
+              error_description: p.message
             };
           }
-          const p = await this.receiveTokenFn(
+          const w = await this.receiveTokenFn(
             g,
             this,
             e,
             !1,
             this.setEventLocalsUser
           );
-          return p instanceof Response ? {
+          return w instanceof Response ? {
             ok: !1,
             error: "server_error",
             error_description: "When using load, receiveTokenFn should return an object not a Response"
-          } : p == null ? {
+          } : w == null ? {
             ok: !1,
             error: "server_error",
             error_description: "No response received from receiveTokenFn"
-          } : p.error ? {
+          } : w.error ? {
             ok: !1,
-            error: p.error,
-            error_description: p.error_description
+            error: w.error,
+            error_description: w.error_description
           } : {
-            ...p
+            ...w
           };
-        } catch (a) {
-          if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
-          const i = n.asCrossauthError(a);
-          return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), {
+        } catch (i) {
+          if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
+          const a = n.asCrossauthError(i);
+          return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), {
             ok: !1,
-            error: i.oauthErrorCode,
-            error_description: i.message
+            error: a.oauthErrorCode,
+            error_description: a.message
           };
         }
       }
     }, this.clientCredentialsFlowEndpoint = {
       post: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const i = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
-          return this.errorFn(this.server, e, i);
+          const a = new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
+          return this.errorFn(this.server, e, a);
         }
         let t;
         try {
           if (!this.validFlows.includes(_.ClientCredentials)) {
-            const d = new n(u.Unauthorized, "Client credentials flow is not supported");
+            const d = new n(h.Unauthorized, "Client credentials flow is not supported");
             return this.errorFn(this.server, e, d);
           }
-          var a = new b();
-          await a.loadData(e), t = a.toObject();
-          const i = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(t == null ? void 0 : t.scope));
-          if (i.error) {
+          var i = new b();
+          await i.loadData(e), t = i.toObject();
+          const a = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(t == null ? void 0 : t.scope));
+          if (a.error) {
             const d = n.fromOAuthError(
-              i.error,
-              i.error_description
+              a.error,
+              a.error_description
             );
             return await this.errorFn(
               this.server,
@@ -1378,17 +1378,17 @@ class G extends re {
             );
           }
           const c = await this.receiveTokenFn(
-            i,
+            a,
             this,
             e,
             !1,
             this.setEventLocalsUser
           );
           return c instanceof Response ? c : this.pack(c);
-        } catch (i) {
-          if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
-          const c = n.asCrossauthError(i);
-          return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), this.errorFn(this.server, e, c);
+        } catch (a) {
+          if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
+          const c = n.asCrossauthError(a);
+          return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), this.errorFn(this.server, e, c);
         }
       },
       actions: {
@@ -1397,30 +1397,30 @@ class G extends re {
             /*this.tokenResponseType == "saveInSessionAndRedirect" ||*/
             this.tokenResponseType == "sendJson" || this.tokenResponseType == "saveInSessionAndLoad"
           )
-            throw new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
+            throw new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
           let t;
           try {
             if (!this.validFlows.includes(_.ClientCredentials))
-              throw new n(u.Unauthorized, "Client credentials flow is not supported");
-            var a = new b();
-            await a.loadData(e), t = a.toObject();
-            const i = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(t == null ? void 0 : t.scope));
-            if (i.error)
+              throw new n(h.Unauthorized, "Client credentials flow is not supported");
+            var i = new b();
+            await i.loadData(e), t = i.toObject();
+            const a = this.errorIfIdTokenInvalid(await this.clientCredentialsFlow(t == null ? void 0 : t.scope));
+            if (a.error)
               throw n.fromOAuthError(
-                i.error,
-                i.error_description
+                a.error,
+                a.error_description
               );
             return await this.receiveTokenFn(
-              i,
+              a,
               this,
               e,
               !1,
               this.setEventLocalsUser
             ) ?? {};
-          } catch (i) {
-            if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
-            const c = n.asCrossauthError(i);
-            return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), {
+          } catch (a) {
+            if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
+            const c = n.asCrossauthError(a);
+            return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), {
               ok: !1,
               error: c.oauthErrorCode,
               error_description: c.message
@@ -1431,45 +1431,45 @@ class G extends re {
     }, this.refreshTokenFlowEndpoint = {
       post: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const i = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
-          return this.errorFn(this.server, e, i);
+          const a = new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
+          return this.errorFn(this.server, e, a);
         }
         let t;
         try {
           if (!this.validFlows.includes(_.RefreshToken)) {
-            const h = new n(u.Unauthorized, "Refresh token flow is not supported");
-            return this.errorFn(this.server, e, h);
+            const u = new n(h.Unauthorized, "Refresh token flow is not supported");
+            return this.errorFn(this.server, e, u);
           }
-          var a = new b();
-          if (await a.loadData(e), t = a.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
+          var i = new b();
+          if (await i.loadData(e), t = i.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
             try {
               if (!this.server.sessionAdapter.getCsrfToken(e))
-                throw new n(u.InvalidCsrf);
-            } catch (h) {
-              if (m.isSvelteKitError(h) || m.isSvelteKitRedirect(h)) throw h;
-              const g = new n(u.Unauthorized, "CSRF token not present");
+                throw new n(h.InvalidCsrf);
+            } catch (u) {
+              if (m.isSvelteKitError(u) || m.isSvelteKitRedirect(u)) throw u;
+              const g = new n(h.Unauthorized, "CSRF token not present");
               return this.errorFn(this.server, e, g);
             }
-          let i = t.refresh_token;
-          if (!i && this.server.sessionAdapter) {
-            const h = await this.server.sessionAdapter.getSessionData(e, this.sessionDataName);
-            if (!(h != null && h.refresh_token)) {
+          let a = t.refresh_token;
+          if (!a && this.server.sessionAdapter) {
+            const u = await this.server.sessionAdapter.getSessionData(e, this.sessionDataName);
+            if (!(u != null && u.refresh_token)) {
               const g = new n(
-                u.BadRequest,
+                h.BadRequest,
                 "No refresh token in session or in parameters"
               );
               return this.errorFn(this.server, e, g);
             }
-            i = h.refresh_token;
+            a = u.refresh_token;
           }
-          if (!i) {
-            const h = new n(
-              u.BadRequest,
+          if (!a) {
+            const u = new n(
+              h.BadRequest,
               "No refresh token supplied"
             );
-            return this.errorFn(this.server, e, h);
+            return this.errorFn(this.server, e, u);
           }
-          const c = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(i)), d = await this.receiveTokenFn(
+          const c = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(a)), d = await this.receiveTokenFn(
             c,
             this,
             e,
@@ -1477,11 +1477,11 @@ class G extends re {
             this.setEventLocalsUser
           );
           if (c && d instanceof Response) return d;
-          throw new n(u.UnknownError, "Receive token function did not return a Response");
-        } catch (i) {
-          if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
-          const c = n.asCrossauthError(i);
-          return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), this.errorFn(this.server, e, c);
+          throw new n(h.UnknownError, "Receive token function did not return a Response");
+        } catch (a) {
+          if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
+          const c = n.asCrossauthError(a);
+          return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), this.errorFn(this.server, e, c);
         }
       },
       actions: {
@@ -1490,49 +1490,49 @@ class G extends re {
             /*this.tokenResponseType == "saveInSessionAndRedirect" ||*/
             this.tokenResponseType == "sendJson" || this.tokenResponseType == "saveInSessionAndLoad"
           )
-            throw new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
+            throw new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
           let t;
           try {
             if (!this.validFlows.includes(_.RefreshToken)) {
-              const h = new n(u.Unauthorized, "Refresh token flow is not supported");
-              return this.errorFn(this.server, e, h);
+              const u = new n(h.Unauthorized, "Refresh token flow is not supported");
+              return this.errorFn(this.server, e, u);
             }
-            var a = new b();
-            if (await a.loadData(e), t = a.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
+            var i = new b();
+            if (await i.loadData(e), t = i.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
               try {
                 if (!this.server.sessionAdapter.getCsrfToken(e))
-                  throw new n(u.InvalidCsrf);
-              } catch (h) {
-                throw m.isSvelteKitError(h) || m.isSvelteKitRedirect(h) ? h : new n(u.Unauthorized, "CSRF token not present");
+                  throw new n(h.InvalidCsrf);
+              } catch (u) {
+                throw m.isSvelteKitError(u) || m.isSvelteKitRedirect(u) ? u : new n(h.Unauthorized, "CSRF token not present");
               }
-            let i = t.refresh_token;
-            if (!i && this.server.sessionAdapter) {
-              const h = await this.server.sessionAdapter.getSessionData(e, this.sessionDataName);
-              if (!(h != null && h.refresh_token))
+            let a = t.refresh_token;
+            if (!a && this.server.sessionAdapter) {
+              const u = await this.server.sessionAdapter.getSessionData(e, this.sessionDataName);
+              if (!(u != null && u.refresh_token))
                 throw new n(
-                  u.BadRequest,
+                  h.BadRequest,
                   "No refresh token in session or in parameters"
                 );
-              i = h.refresh_token;
+              a = u.refresh_token;
             }
-            if (!i)
+            if (!a)
               throw new n(
-                u.BadRequest,
+                h.BadRequest,
                 "No refresh token supplied"
               );
-            const c = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(i)), d = await this.receiveTokenFn(
+            const c = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(a)), d = await this.receiveTokenFn(
               c,
               this,
               e,
               !1,
               this.setEventLocalsUser
             ) ?? {};
-            if (d instanceof Response) throw new n(u.Configuration, "Refresh token flow should return an object not Response");
+            if (d instanceof Response) throw new n(h.Configuration, "Refresh token flow should return an object not Response");
             return d;
-          } catch (i) {
-            if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
-            const c = n.asCrossauthError(i);
-            return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), {
+          } catch (a) {
+            if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
+            const c = n.asCrossauthError(a);
+            return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), {
               ok: !1,
               error: c.oauthErrorCode,
               error_description: c.message
@@ -1543,7 +1543,7 @@ class G extends re {
     }, this.refreshTokensIfExpiredEndpoint = {
       post: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const t = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
+          const t = new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
           return this.errorFn(this.server, e, t);
         }
         return this.pack(await this.refreshTokens(e, "post", !0));
@@ -1554,14 +1554,14 @@ class G extends re {
             /*this.tokenResponseType == "saveInSessionAndRedirect" ||*/
             this.tokenResponseType == "sendJson" || this.tokenResponseType == "saveInSessionAndLoad"
           )
-            throw new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
+            throw new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
           return this.refreshTokens(e, "page", !0);
         }
       }
     }, this.autoRefreshTokensIfExpiredEndpoint = {
       post: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const t = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
+          const t = new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
           return this.errorFn(this.server, e, t);
         }
         return this.pack(await this.refreshTokens(e, "silent", !0));
@@ -1569,7 +1569,7 @@ class G extends re {
     }, this.autoRefreshTokensEndpoint = {
       post: async (e) => {
         if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-          const t = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
+          const t = new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
           return this.errorFn(this.server, e, t);
         }
         return this.pack(await this.refreshTokens(e, "silent", !1));
@@ -1581,8 +1581,8 @@ class G extends re {
       post: async (e) => {
         const t = await this.startDeviceCodeFlow_internal(e);
         if (t.error) {
-          const a = n.fromOAuthError(t.error, t.error_description);
-          return v(t, { status: a.httpStatus });
+          const i = n.fromOAuthError(t.error, t.error_description);
+          return v(t, { status: i.httpStatus });
         }
         return v(t);
       }
@@ -1598,40 +1598,40 @@ class G extends re {
         if (t instanceof Response) return t;
         if (t == null) return new Response(null, { status: 204 });
         if (t.error) {
-          const a = n.fromOAuthError(t.error, t.error_description);
-          return v(t, { status: a.httpStatus });
+          const i = n.fromOAuthError(t.error, t.error_description);
+          return v(t, { status: i.httpStatus });
         }
         return v(t);
       }
     }, this.passwordFlowEndpoint = {
-      post: async (e) => await this.passwordFlow_post(e, (t, a) => this.passwordPost(t, a)),
+      post: async (e) => await this.passwordFlow_post(e, (t, i) => this.passwordPost(t, i)),
       actions: {
-        password: async (e) => await this.passwordFlow_action(e, (t, a) => this.passwordPost(t, a)),
-        passwordOtp: async (e) => await this.passwordFlow_action(e, (t, a) => this.passwordOtp(t, a)),
-        passwordOob: async (e) => await this.passwordFlow_action(e, (t, a) => this.passwordOob(t, a))
+        password: async (e) => await this.passwordFlow_action(e, (t, i) => this.passwordPost(t, i)),
+        passwordOtp: async (e) => await this.passwordFlow_action(e, (t, i) => this.passwordOtp(t, i)),
+        passwordOob: async (e) => await this.passwordFlow_action(e, (t, i) => this.passwordOob(t, i))
       }
     }, this.passwordOtpEndpoint = {
-      post: async (e) => await this.passwordFlow_post(e, (t, a) => this.passwordOtp(t, a)),
+      post: async (e) => await this.passwordFlow_post(e, (t, i) => this.passwordOtp(t, i)),
       actions: {
-        default: async (e) => await this.passwordFlow_action(e, (t, a) => this.passwordOtp(t, a))
+        default: async (e) => await this.passwordFlow_action(e, (t, i) => this.passwordOtp(t, i))
       }
     }, this.passwordOobEndpoint = {
-      post: async (e) => await this.passwordFlow_post(e, (t, a) => this.passwordOob(t, a)),
+      post: async (e) => await this.passwordFlow_post(e, (t, i) => this.passwordOob(t, i)),
       actions: {
-        default: async (e) => await this.passwordFlow_action(e, (t, a) => this.passwordOob(t, a))
+        default: async (e) => await this.passwordFlow_action(e, (t, i) => this.passwordOob(t, i))
       }
     }, this.deleteTokensEndpoint = {
       post: async (e) => {
-        var t, a;
+        var t, i;
         try {
           return await this.deleteSessionData(e), v({ ok: !0 });
-        } catch (i) {
-          if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
-          const c = n.asCrossauthError(i);
+        } catch (a) {
+          if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
+          const c = n.asCrossauthError(a);
           return l.logger.debug({ err: c }), l.logger.error({ cerr: c }), v({
             ok: !1,
             user: (t = this.server.sessionAdapter) == null ? void 0 : t.getUser(e),
-            csrfToken: (a = this.server.sessionAdapter) == null ? void 0 : a.getCsrfToken(e),
+            csrfToken: (i = this.server.sessionAdapter) == null ? void 0 : i.getCsrfToken(e),
             errorCode: c.code,
             errorCodeName: c.codeName,
             errorMessage: c.message
@@ -1640,16 +1640,16 @@ class G extends re {
       },
       actions: {
         default: async (e) => {
-          var t, a;
+          var t, i;
           try {
             return await this.deleteSessionData(e), { ok: !0 };
-          } catch (i) {
-            if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
-            const c = n.asCrossauthError(i);
+          } catch (a) {
+            if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
+            const c = n.asCrossauthError(a);
             return l.logger.debug({ err: c }), l.logger.error({ cerr: c }), {
               ok: !1,
               user: (t = this.server.sessionAdapter) == null ? void 0 : t.getUser(e),
-              csrfToken: (a = this.server.sessionAdapter) == null ? void 0 : a.getCsrfToken(e),
+              csrfToken: (i = this.server.sessionAdapter) == null ? void 0 : i.getCsrfToken(e),
               errorCode: c.code,
               errorCodeName: c.codeName,
               errorMessage: c.message
@@ -1723,11 +1723,11 @@ class G extends re {
     }, this.server = r, y("sessionDataName", E.String, this, s, "OAUTH_SESSION_DATA_NAME"), y("tokenResponseType", E.String, this, s, "OAUTH_TOKEN_RESPONSE_TYPE"), y("errorResponseType", E.String, this, s, "OAUTH_ERROR_RESPONSE_TYPE"), y("loginUrl", E.String, this, s, "LOGIN_URL"), y("bffEndpointName", E.String, this, s, "OAUTH_BFF_ENDPOINT_NAME"), y("bffBaseUrl", E.String, this, s, "OAUTH_BFF_BASEURL"), y("redirect_uri", E.String, this, s, "OAUTH_REDIRECTURI", !0), y("authorizedUrl", E.String, this, s, "AUTHORIZED_URL", !1), y("validFlows", E.JsonArray, this, s, "OAUTH_validFlows"), y("bffMaxTries", E.Number, this, s, "OAUTH_BFF_MAX_RETRIES"), y("bffSleepMilliseconds", E.Number, this, s, "OAUTH_BFF_SLEEP_MILLISECONDS"), y("jwtTokens", E.JsonArray, this, s, "OAUTH_JWT_TOKENS"), this.bffEndpointName && !this.bffEndpointName.startsWith("/") && (this.bffEndpointName = "/" + this.bffEndpointName), this.bffEndpointName && this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), this.bffBaseUrl && this.bffBaseUrl.endsWith("/") && (this.bffBaseUrl = this.bffBaseUrl.substring(0, this.bffBaseUrl.length - 1)), s.redirect && (this.redirect = s.redirect), s.error && (this.error = s.error), this.validFlows.length == 1 && this.validFlows[0] == _.All)
       this.validFlows = _.allFlows();
     else if (!_.areAllValidFlows(this.validFlows))
-      throw new n(u.Configuration, "Invalid flows specificied in " + this.validFlows.join(","));
+      throw new n(h.Configuration, "Invalid flows specificied in " + this.validFlows.join(","));
     try {
       new URL(this.redirect_uri ?? "");
     } catch {
-      throw new n(u.Configuration, "Invalid redirect Uri " + this.redirect_uri);
+      throw new n(h.Configuration, "Invalid redirect Uri " + this.redirect_uri);
     }
     if (s.tokenEndpoints && (this.tokenEndpoints = s.tokenEndpoints), this.bffEndpointName.endsWith("/") && (this.bffEndpointName = this.bffEndpointName.substring(0, this.bffEndpointName.length - 1)), s.bffEndpoints && (this.bffEndpoints = s.bffEndpoints.map((e) => ({ ...e, methodsString: e.methods.map((t) => t) }))), this.bffEndpoints)
       for (let e of this.bffEndpoints)
@@ -1736,36 +1736,36 @@ class G extends re {
       this.loginProtectedFlows = this.validFlows;
     else if (!_.areAllValidFlows(this.loginProtectedFlows))
       throw new n(
-        u.Configuration,
+        h.Configuration,
         "Invalid flows specificied in " + this.loginProtectedFlows.join(",")
       );
     if (this.tokenResponseType == "custom" && !s.receiveTokenFn)
       throw new n(
-        u.Configuration,
+        h.Configuration,
         "Token response type of custom selected but receiveTokenFn not defined"
       );
     if (this.tokenResponseType == "custom" && s.receiveTokenFn ? this.receiveTokenFn = s.receiveTokenFn : this.tokenResponseType == "sendJson" ? this.receiveTokenFn = J : this.tokenResponseType == "sendInPage" ? this.receiveTokenFn = fe : this.tokenResponseType == "saveInSessionAndLoad" ? this.receiveTokenFn = ue : this.tokenResponseType == "saveInSessionAndRedirect" ? this.receiveTokenFn = de : this.tokenResponseType == "saveInSessionAndReturn" && (this.receiveTokenFn = he), (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "saveInSessionAndRedirect") && this.authorizedUrl == "")
-      throw new n(u.Configuration, "If tokenResponseType is" + this.tokenResponseType + ", must provide authorizedUrl");
+      throw new n(h.Configuration, "If tokenResponseType is" + this.tokenResponseType + ", must provide authorizedUrl");
     if ((this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "saveInSessionAndRedirect") && this.server.sessionAdapter == null)
-      throw new n(u.Configuration, "If tokenResponseType is" + this.tokenResponseType + ", must activate the session server");
+      throw new n(h.Configuration, "If tokenResponseType is" + this.tokenResponseType + ", must activate the session server");
     if (this.errorResponseType == "custom" && !s.errorFn)
       throw new n(
-        u.Configuration,
+        h.Configuration,
         "Error response type of custom selected but errorFn not defined"
       );
-    if (this.errorResponseType == "custom" && s.errorFn ? this.errorFn = s.errorFn : this.errorResponseType == "sendJson" ? this.errorFn = W : this.errorResponseType == "svelteKitError" && (this.errorFn = le), !s.redirect) throw new n(u.Configuration, "Must provide the SvelteKit redirect function");
-    if (!s.error && this.errorResponseType == "svelteKitError") throw new n(u.Configuration, "Must provide the SvelteKit error function");
+    if (this.errorResponseType == "custom" && s.errorFn ? this.errorFn = s.errorFn : this.errorResponseType == "sendJson" ? this.errorFn = W : this.errorResponseType == "svelteKitError" && (this.errorFn = le), !s.redirect) throw new n(h.Configuration, "Must provide the SvelteKit redirect function");
+    if (!s.error && this.errorResponseType == "svelteKitError") throw new n(h.Configuration, "Must provide the SvelteKit error function");
     if (this.loginProtectedFlows.length > 0 && this.loginUrl == "")
       throw new n(
-        u.Configuration,
+        h.Configuration,
         "loginUrl must be set if protecting oauth endpoints"
       );
     this.hook = async ({ event: e }) => {
       if (e.locals.user || !r.sessionAdapter) return;
       let t = await r.sessionAdapter.getSessionData(e, this.sessionDataName);
       if (t && t.id_payload) {
-        let a = t.expires_at;
-        a && a > Date.now() && t.id_payload.sub && await this.setEventLocalsUser(e, t.id_payload);
+        let i = t.expires_at;
+        i && i > Date.now() && t.id_payload.sub && await this.setEventLocalsUser(e, t.id_payload);
       }
       this.testMiddleware && (this.testEvent = e);
     };
@@ -1800,10 +1800,10 @@ class G extends re {
       );
       if (e.error == "mfa_required" && e.mfa_token && this.validFlows.includes(_.PasswordMfa)) {
         const t = e.mfa_token;
-        let a = o.scope;
-        if (a == "" && (a = void 0), e = this.errorIfIdTokenInvalid(await this.passwordMfa(
+        let i = o.scope;
+        if (i == "" && (i = void 0), e = this.errorIfIdTokenInvalid(await this.passwordMfa(
           t,
-          a,
+          i,
           r
         )), e.error)
           throw n.fromOAuthError(
@@ -1839,11 +1839,11 @@ class G extends re {
       };
     const t = e.authenticators[0];
     if (t.authenticator_type == "otp") {
-      const i = await this.mfaOtpRequest(r, t.id);
-      if (i.error || i.challenge_type != "otp") {
+      const a = await this.mfaOtpRequest(r, t.id);
+      if (a.error || a.challenge_type != "otp") {
         const c = n.fromOAuthError(
-          i.error ?? "server_error",
-          i.error_description ?? "Invalid response from MFA OTP challenge"
+          a.error ?? "server_error",
+          a.error_description ?? "Invalid response from MFA OTP challenge"
         );
         return l.logger.debug({ err: c }), l.logger.error({ cerr: c }), {
           error: c.oauthErrorCode,
@@ -1853,14 +1853,14 @@ class G extends re {
       return {
         scope: o,
         mfa_token: r,
-        challenge_type: i.challenge_type
+        challenge_type: a.challenge_type
       };
     } else if (t.authenticator_type == "oob") {
-      const i = await this.mfaOobRequest(r, t.id);
-      if (i.error || i.challenge_type != "oob" || !i.oob_code || i.binding_method != "prompt") {
+      const a = await this.mfaOobRequest(r, t.id);
+      if (a.error || a.challenge_type != "oob" || !a.oob_code || a.binding_method != "prompt") {
         const c = n.fromOAuthError(
-          i.error ?? "server_error",
-          i.error_description ?? "Invalid response from MFA OOB challenge"
+          a.error ?? "server_error",
+          a.error_description ?? "Invalid response from MFA OOB challenge"
         );
         return l.logger.debug({ err: c }), l.logger.error({ cerr: c }), {
           error: c.oauthErrorCode,
@@ -1871,19 +1871,19 @@ class G extends re {
         scope: o,
         mfa_token: r,
         oob_channel: t.oob_channel,
-        challenge_type: i.challenge_type,
-        binding_method: i.binding_method,
-        oob_code: i.oob_code,
+        challenge_type: a.challenge_type,
+        binding_method: a.binding_method,
+        oob_code: a.oob_code,
         name: t.name
       };
     }
-    const a = new n(
-      u.UnknownError,
+    const i = new n(
+      h.UnknownError,
       "Unsupported MFA type " + t.authenticator_type + " returned"
     );
     return {
-      error: a.oauthErrorCode,
-      error_description: a.message
+      error: i.oauthErrorCode,
+      error_description: i.message
     };
   }
   async passwordOtp(r, o) {
@@ -1919,7 +1919,7 @@ class G extends re {
     return e.error ? (l.logger.warn(f({
       msg: "Error completing MFA",
       user: (t = this.server.sessionAdapter) == null ? void 0 : t.getUser(r),
-      hashedMfaToken: o.mfa_token ? F.hash(o.mfa_token) : void 0
+      hashedMfaToken: o.mfa_token ? A.hash(o.mfa_token) : void 0
     })), {
       error: e.error,
       error_description: e.error_description
@@ -1938,10 +1938,10 @@ class G extends re {
       if (o.locals.sessionId && this.autoRefreshActive[o.locals.sessionId]) return;
       try {
         o.locals.sessionId && (this.autoRefreshActive[o.locals.sessionId] = !0);
-        const a = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(e));
-        if (!a.error && !a.access_token && (a.error = "server_error", a.error_description = "Unexpectedly did not receive error or access token"), !a.error) {
+        const i = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(e));
+        if (!i.error && !i.access_token && (i.error = "server_error", i.error_description = "Unexpectedly did not receive error or access token"), !i.error) {
           const d = await this.receiveTokenFn(
-            a,
+            i,
             this,
             o,
             r == "silent",
@@ -1951,43 +1951,43 @@ class G extends re {
         }
         if (r != "silent") {
           const d = n.fromOAuthError(
-            a.error ?? "server_error",
-            a.error_description
+            i.error ?? "server_error",
+            i.error_description
           );
           return r == "page" ? this.errorFn(this.server, o, d) : {
             error: d.oauthErrorCode,
             error_description: d.message
           };
         }
-        let i = a.expires_in;
-        if (!i && a.access_token) {
-          const d = M(a.access_token);
-          d.exp && (i = d.exp);
+        let a = i.expires_in;
+        if (!a && i.access_token) {
+          const d = M(i.access_token);
+          d.exp && (a = d.exp);
         }
-        if (!i)
+        if (!a)
           throw new n(
-            u.BadRequest,
+            h.BadRequest,
             "OAuth server did not return an expiry for the access token"
           );
-        const c = (/* @__PURE__ */ new Date()).getTime() + i * 1e3;
+        const c = (/* @__PURE__ */ new Date()).getTime() + a * 1e3;
         return {
-          access_token: a.access_token,
-          refresh_token: a.refresh_token,
-          expires_in: a.expires_in,
+          access_token: i.access_token,
+          refresh_token: i.refresh_token,
+          expires_in: i.expires_in,
           expires_at: c,
-          error: a.error,
-          error_description: a.error_description
+          error: i.error,
+          error_description: i.error_description
         };
-      } catch (a) {
-        if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
-        if (l.logger.debug(f({ err: a })), l.logger.error(f({
-          cerr: a,
+      } catch (i) {
+        if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
+        if (l.logger.debug(f({ err: i })), l.logger.error(f({
+          cerr: i,
           msg: "Failed refreshing access token"
         })), r != "silent") {
-          const i = n.asCrossauthError(a);
-          return r == "page" ? this.errorFn(this.server, o, i) : {
-            error: i.oauthErrorCode,
-            error_description: i.message
+          const a = n.asCrossauthError(i);
+          return r == "page" ? this.errorFn(this.server, o, a) : {
+            error: a.oauthErrorCode,
+            error_description: a.message
           };
         }
         return {
@@ -2018,7 +2018,7 @@ class G extends re {
         if (o == "silent")
           return new Response(null, { status: 204 });
         throw new n(
-          u.InvalidSession,
+          h.InvalidSession,
           "No tokens found in session"
         );
       }
@@ -2031,7 +2031,7 @@ class G extends re {
       );
       if (t && "id_token" in t && (t = this.errorIfIdTokenInvalid(t)), o == "silent") {
         if (t instanceof Response)
-          throw new n(u.Configuration, "Unexpected error: refresh: mode is silent but didn't receive an object");
+          throw new n(h.Configuration, "Unexpected error: refresh: mode is silent but didn't receive an object");
         return { ok: !0, expires_at: t == null ? void 0 : t.expires_at };
       } else if (o == "post") {
         if (t == null) return this.receiveTokenFn(
@@ -2043,7 +2043,7 @@ class G extends re {
         );
         if (t != null) {
           if (t instanceof Response) return t;
-          throw new n(u.Configuration, "refreshTokenFn for post should return Response not object");
+          throw new n(h.Configuration, "refreshTokenFn for post should return Response not object");
         }
       }
     } catch (e) {
@@ -2058,44 +2058,44 @@ class G extends re {
   }
   async passwordFlow_post(r, o) {
     if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
-      const t = new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
+      const t = new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
       return this.errorFn(this.server, r, t);
     }
     let s;
     try {
       if (!(this.validFlows.includes(_.Password) || this.validFlows.includes(_.PasswordMfa))) {
-        const i = new n(u.Unauthorized, "Password flow is not supported");
-        return this.errorFn(this.server, r, i);
+        const a = new n(h.Unauthorized, "Password flow is not supported");
+        return this.errorFn(this.server, r, a);
       }
       var e = new b();
       if (await e.loadData(r), s = e.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
-            throw new n(u.InvalidCsrf);
-        } catch (i) {
-          if (m.isSvelteKitError(i) || m.isSvelteKitRedirect(i)) throw i;
-          const c = new n(u.Unauthorized, "CSRF token not present");
+            throw new n(h.InvalidCsrf);
+        } catch (a) {
+          if (m.isSvelteKitError(a) || m.isSvelteKitRedirect(a)) throw a;
+          const c = new n(h.Unauthorized, "CSRF token not present");
           return this.errorFn(this.server, r, c);
         }
       const t = this.errorIfIdTokenInvalid(await o(r, s));
-      if (!t) throw new n(u.UnknownError, "Password flow returned no data");
+      if (!t) throw new n(h.UnknownError, "Password flow returned no data");
       if (t.error) return {
         ok: !1,
         ...t
       };
-      const a = await this.receiveTokenFn(
+      const i = await this.receiveTokenFn(
         t,
         this,
         r,
         !1,
         this.setEventLocalsUser
       );
-      if (t && a instanceof Response) return a;
-      throw new n(u.UnknownError, "Receive token function did not return a Response");
+      if (t && i instanceof Response) return i;
+      throw new n(h.UnknownError, "Receive token function did not return a Response");
     } catch (t) {
       if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-      const a = n.asCrossauthError(t);
-      return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), this.errorFn(this.server, r, a);
+      const i = n.asCrossauthError(t);
+      return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), this.errorFn(this.server, r, i);
     }
   }
   async passwordFlow_action(r, o) {
@@ -2103,23 +2103,23 @@ class G extends re {
       /*this.tokenResponseType == "saveInSessionAndRedirect" ||*/
       this.tokenResponseType == "sendJson" || this.tokenResponseType == "saveInSessionAndLoad"
     )
-      throw new n(u.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
+      throw new n(h.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
     let s;
     try {
       if (!(this.validFlows.includes(_.Password) || this.validFlows.includes(_.PasswordMfa))) {
-        const i = new n(u.Unauthorized, "Password and Password MFA flows are not supported");
-        return this.errorFn(this.server, r, i);
+        const a = new n(h.Unauthorized, "Password and Password MFA flows are not supported");
+        return this.errorFn(this.server, r, a);
       }
       var e = new b();
       if (await e.loadData(r), s = e.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
-            throw new n(u.InvalidCsrf);
-        } catch (i) {
-          throw m.isSvelteKitError(i) || m.isSvelteKitRedirect(i) ? i : new n(u.Unauthorized, "CSRF token not present");
+            throw new n(h.InvalidCsrf);
+        } catch (a) {
+          throw m.isSvelteKitError(a) || m.isSvelteKitRedirect(a) ? a : new n(h.Unauthorized, "CSRF token not present");
         }
       const t = await o(r, s);
-      if (!t) throw new n(u.UnknownError, "Password flow returned no data");
+      if (!t) throw new n(h.UnknownError, "Password flow returned no data");
       if (t.error)
         return {
           ok: !1,
@@ -2127,27 +2127,27 @@ class G extends re {
         };
       if (t.challenge_type) {
         if (!this.validFlows.includes(_.PasswordMfa)) {
-          const i = new n(u.Unauthorized, "Password MFA flow is not supported");
-          return this.errorFn(this.server, r, i);
+          const a = new n(h.Unauthorized, "Password MFA flow is not supported");
+          return this.errorFn(this.server, r, a);
         }
         return t;
       }
-      const a = await this.receiveTokenFn(
+      const i = await this.receiveTokenFn(
         t,
         this,
         r,
         !1,
         this.setEventLocalsUser
       ) ?? {};
-      if (a instanceof Response) throw new n(u.Configuration, "Refresh token flow should return an object not Response");
-      return a;
+      if (i instanceof Response) throw new n(h.Configuration, "Refresh token flow should return an object not Response");
+      return i;
     } catch (t) {
       if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-      const a = n.asCrossauthError(t);
+      const i = n.asCrossauthError(t);
       return l.logger.debug({ err: t }), l.logger.error({ cerr: t }), {
         ok: !1,
-        error: a.oauthErrorCode,
-        error_description: a.message
+        error: i.oauthErrorCode,
+        error_description: i.message
       };
     }
   }
@@ -2166,59 +2166,59 @@ class G extends re {
   async bff(r, o = {}) {
     var e;
     try {
-      if (!this.server.sessionAdapter) throw new n(u.Configuration, "Session server must be instantiated to use bff()");
-      if (!this.server.oAuthClient) throw new n(u.Configuration, "OAuth Client not found");
-      if (!this.bffBaseUrl) throw new n(u.Configuration, "Must set bffBaseUrl to use bff()");
-      if (!this.bffEndpointName) throw new n(u.Configuration, "Must set bffEndpointName to use bff()");
+      if (!this.server.sessionAdapter) throw new n(h.Configuration, "Session server must be instantiated to use bff()");
+      if (!this.server.oAuthClient) throw new n(h.Configuration, "OAuth Client not found");
+      if (!this.bffBaseUrl) throw new n(h.Configuration, "Must set bffBaseUrl to use bff()");
+      if (!this.bffEndpointName) throw new n(h.Configuration, "Must set bffEndpointName to use bff()");
       let t = o.url;
       if (!t) {
-        if (!r.url.pathname.startsWith(this.bffEndpointName)) throw new n(u.Unauthorized, "Attempt to call BFF url with the wrong prefix");
-        const a = r.url.pathname.substring(this.bffEndpointName.length);
-        let i = ((e = r.url.searchParams) == null ? void 0 : e.toString()) ?? void 0;
-        i && i != "" && (i = "?" + i), t = new URL(this.bffBaseUrl + a + i);
+        if (!r.url.pathname.startsWith(this.bffEndpointName)) throw new n(h.Unauthorized, "Attempt to call BFF url with the wrong prefix");
+        const i = r.url.pathname.substring(this.bffEndpointName.length);
+        let a = ((e = r.url.searchParams) == null ? void 0 : e.toString()) ?? void 0;
+        a && a != "" && (a = "?" + a), t = new URL(this.bffBaseUrl + i + a);
       }
       o.headers || (o.headers = new Headers());
-      for (let a = 0; a < this.bffMaxTries; ++a) {
-        a > 0 && await new Promise((g) => setTimeout(g, this.bffSleepMilliseconds));
-        const i = await this.server.sessionAdapter.getSessionData(
+      for (let i = 0; i < this.bffMaxTries; ++i) {
+        i > 0 && await new Promise((g) => setTimeout(g, this.bffSleepMilliseconds));
+        const a = await this.server.sessionAdapter.getSessionData(
           r,
           this.sessionDataName
         );
-        if (!i) {
-          if (a == this.bffMaxTries)
-            throw new n(u.Unauthorized, "No access token found");
+        if (!a) {
+          if (i == this.bffMaxTries)
+            throw new n(h.Unauthorized, "No access token found");
           continue;
         }
-        let c = i.access_token;
-        if (i && i.access_token) {
+        let c = a.access_token;
+        if (a && a.access_token) {
           const g = await this.refresh(
             "silent",
             r,
             !0,
-            i.refresh_token,
-            i.expires_at
+            a.refresh_token,
+            a.expires_at
           );
-          if (g instanceof Response) throw new n(u.Configuration, "Expected object when refreshing tokens, not Response");
+          if (g instanceof Response) throw new n(h.Configuration, "Expected object when refreshing tokens, not Response");
           if (g != null && g.access_token)
             c = g.access_token;
           else if (g != null && g.error)
             continue;
         }
         o.headers.set("accept", "application/json"), o.headers.set("content-type", "application/json"), c && o.headers.set("authorization", "Bearer " + c);
-        let d, h;
+        let d, u;
         if (r.request.body) {
           var s = new b();
-          await s.loadData(r), h = s.toObject();
+          await s.loadData(r), u = s.toObject();
         }
-        if (l.logger.debug(f({ msg: "Calling BFF URL", url: t, method: r.request.method })), h ? d = await fetch(t, {
+        if (l.logger.debug(f({ msg: "Calling BFF URL", url: t, method: r.request.method })), u ? d = await fetch(t, {
           headers: o.headers,
           method: o.method ?? r.request.method,
-          body: JSON.stringify(h ?? "{}")
+          body: JSON.stringify(u ?? "{}")
         }) : d = await fetch(t, {
           headers: o.headers,
           method: o.method ?? r.request.method
         }), d.status == 401) {
-          if (a < this.bffMaxTries - 1)
+          if (i < this.bffMaxTries - 1)
             continue;
           return d;
         } else
@@ -2227,11 +2227,11 @@ class G extends re {
       return new Response(null, { status: 401 });
     } catch (t) {
       if (m.isSvelteKitError(t) || m.isSvelteKitRedirect(t)) throw t;
-      const a = n.asCrossauthError(t);
-      return l.logger.debug({ err: a }), l.logger.error({ cerr: a }), v({
-        error: a.oauthErrorCode,
-        error_description: a.message
-      }, { status: a.httpStatus });
+      const i = n.asCrossauthError(t);
+      return l.logger.debug({ err: i }), l.logger.error({ cerr: i }), v({
+        error: i.oauthErrorCode,
+        error_description: i.message
+      }, { status: i.httpStatus });
     }
   }
   async unpack(r) {
@@ -2260,32 +2260,32 @@ class G extends re {
    */
   async allBff(r, o = {}) {
     try {
-      if (l.logger.debug(f({ msg: "Called allBff", url: r.url.toString() })), !this.server.sessionAdapter) throw new n(u.Configuration, "Session server must be instantiated to use bff()");
-      if (!this.server.oAuthClient) throw new n(u.Configuration, "OAuth Client not found");
-      if (!this.bffBaseUrl) throw new n(u.Configuration, "Must set bffBaseUrl to use bff()");
-      if (!this.bffEndpointName) throw new n(u.Configuration, "Must set bffEndpointName to use bff()");
-      if (!this.bffEndpoints || this.bffEndpoints.length == 0) throw new n(u.Unauthorized, "Invalid BFF endpoint");
-      if (!r.url.pathname.startsWith(this.bffEndpointName)) throw new n(u.Unauthorized, "Attempt to call BFF url with the wrong prefix");
+      if (l.logger.debug(f({ msg: "Called allBff", url: r.url.toString() })), !this.server.sessionAdapter) throw new n(h.Configuration, "Session server must be instantiated to use bff()");
+      if (!this.server.oAuthClient) throw new n(h.Configuration, "OAuth Client not found");
+      if (!this.bffBaseUrl) throw new n(h.Configuration, "Must set bffBaseUrl to use bff()");
+      if (!this.bffEndpointName) throw new n(h.Configuration, "Must set bffEndpointName to use bff()");
+      if (!this.bffEndpoints || this.bffEndpoints.length == 0) throw new n(h.Unauthorized, "Invalid BFF endpoint");
+      if (!r.url.pathname.startsWith(this.bffEndpointName)) throw new n(h.Unauthorized, "Attempt to call BFF url with the wrong prefix");
       const s = r.url.pathname.substring(this.bffEndpointName.length);
       let e;
       for (let t = 0; t < this.bffEndpoints.length; ++t) {
-        let a = this.bffEndpoints[t];
-        if (a.matchSubUrls) {
-          let i = a.url, c = a.url;
-          if (c.endsWith("/") || (c += "/"), a.methodsString.includes(r.request.method) && (s.startsWith(c) || s == i)) {
+        let i = this.bffEndpoints[t];
+        if (i.matchSubUrls) {
+          let a = i.url, c = i.url;
+          if (c.endsWith("/") || (c += "/"), i.methodsString.includes(r.request.method) && (s.startsWith(c) || s == a)) {
             e = t;
             break;
           }
         } else {
-          let i = a.url;
-          if (a.methodsString.includes(r.request.method) && s == i) {
+          let a = i.url;
+          if (i.methodsString.includes(r.request.method) && s == a) {
             e = t;
             break;
           }
         }
       }
       if (e != null) return await this.bff(r, o);
-      throw new n(u.Unauthorized, "Illegal BFF URL called " + r.url.toString());
+      throw new n(h.Unauthorized, "Illegal BFF URL called " + r.url.toString());
     } catch (s) {
       if (m.isSvelteKitError(s) || m.isSvelteKitRedirect(s)) throw s;
       const e = n.asCrossauthError(s);
@@ -2303,28 +2303,28 @@ class G extends re {
       let s = new b(!0);
       await s.loadData(r);
       const e = s.getAsBoolean("decode") ?? !0;
-      if (!this.server.sessionAdapter) throw new n(u.Configuration, "Session server must be instantiated to use bff()");
-      if (!this.server.oAuthClient) throw new n(u.Configuration, "OAuth Client not found");
+      if (!this.server.sessionAdapter) throw new n(h.Configuration, "Session server must be instantiated to use bff()");
+      if (!this.server.oAuthClient) throw new n(h.Configuration, "OAuth Client not found");
       if (!this.tokenEndpoints || this.tokenEndpoints.length == 0)
-        throw new n(u.Unauthorized, "No tokens have been made available");
+        throw new n(h.Unauthorized, "No tokens have been made available");
       let t = Array.isArray(o) ? o : [o];
-      const a = await this.server.sessionAdapter.getSessionData(
+      const i = await this.server.sessionAdapter.getSessionData(
         r,
         this.sessionDataName
       );
-      if (!a)
-        throw new n(u.Unauthorized, "No access token found");
-      let i = {}, c, d = !1;
-      for (let h of t) {
-        if (!this.tokenEndpoints.includes(h)) throw new n(u.Unauthorized, "Token type " + h + " may not be returned");
+      if (!i)
+        throw new n(h.Unauthorized, "No access token found");
+      let a = {}, c, d = !1;
+      for (let u of t) {
+        if (!this.tokenEndpoints.includes(u)) throw new n(h.Unauthorized, "Token type " + u + " may not be returned");
         d = !1;
-        let g = h;
-        h.startsWith("have_") && (g = h.replace("have_", ""), d = !0);
-        const p = g.replace("_token", ""), w = e && this.jwtTokens.includes(p);
-        let S = this.tokenPayload(g, a, d, w);
-        d ? i[h] = S.ok : S && (i[h] = S), c = i[h];
+        let g = u;
+        u.startsWith("have_") && (g = u.replace("have_", ""), d = !0);
+        const w = g.replace("_token", ""), p = e && this.jwtTokens.includes(w);
+        let S = this.tokenPayload(g, i, d, p);
+        d ? a[u] = S.ok : S && (a[u] = S), c = a[u];
       }
-      return Array.isArray(o) ? { status: 200, body: i } : c ? d ? { status: 200, body: typeof c == "boolean" ? { ok: c } : c } : { status: 200, body: c } : o.startsWith("have_") ? { status: 200, body: { ok: !1 } } : { status: 204 };
+      return Array.isArray(o) ? { status: 200, body: a } : c ? d ? { status: 200, body: typeof c == "boolean" ? { ok: c } : c } : { status: 200, body: c } : o.startsWith("have_") ? { status: 200, body: { ok: !1 } } : { status: 204 };
     } catch (s) {
       if (m.isSvelteKitError(s) || m.isSvelteKitRedirect(s)) throw s;
       const e = n.asCrossauthError(s);
@@ -2342,26 +2342,26 @@ class G extends re {
     let o;
     try {
       if (!this.validFlows.includes(_.DeviceCode))
-        throw new n(u.Unauthorized, "Device code flow is not supported");
+        throw new n(h.Unauthorized, "Device code flow is not supported");
       var s = new b();
       if (await s.loadData(r), o = s.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
-            throw new n(u.InvalidCsrf);
+            throw new n(h.InvalidCsrf);
         } catch (c) {
-          throw m.isSvelteKitError(c) || m.isSvelteKitRedirect(c) ? c : new n(u.Unauthorized, "CSRF token not present");
+          throw m.isSvelteKitError(c) || m.isSvelteKitRedirect(c) ? c : new n(h.Unauthorized, "CSRF token not present");
         }
       let e = o.scope;
       e == "" && (e = void 0);
       let t = this.authServerBaseUrl;
       t.endsWith("/") || (t += "/"), t += this.deviceAuthorizationUrl;
-      const a = await this.startDeviceCodeFlow(t, e);
-      let i;
-      return a.verification_uri_complete && await ae.toDataURL(a.verification_uri_complete).then((c) => {
-        i = c;
+      const i = await this.startDeviceCodeFlow(t, e);
+      let a;
+      return i.verification_uri_complete && await ae.toDataURL(i.verification_uri_complete).then((c) => {
+        a = c;
       }).catch((c) => {
         l.logger.debug(f({ err: c })), l.logger.warn(f({ msg: "Couldn't generate verification URL QR Code" }));
-      }), i ? { verification_uri_qrdata: i, ...a } : a;
+      }), a ? { verification_uri_qrdata: a, ...i } : i;
     } catch (e) {
       if (m.isSvelteKitRedirect(e) || m.isSvelteKitError(e)) throw e;
       const t = n.asCrossauthError(e);
@@ -2375,17 +2375,17 @@ class G extends re {
     let o;
     try {
       if (!this.validFlows.includes(_.DeviceCode))
-        throw new n(u.Unauthorized, "Device code flow is not supported");
+        throw new n(h.Unauthorized, "Device code flow is not supported");
       var s = new b();
       if (await s.loadData(r), o = s.toObject(), this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
         try {
           if (!this.server.sessionAdapter.getCsrfToken(r))
-            throw new n(u.InvalidCsrf);
-        } catch (a) {
-          throw m.isSvelteKitError(a) || m.isSvelteKitRedirect(a) ? a : new n(u.Unauthorized, "CSRF token not present");
+            throw new n(h.InvalidCsrf);
+        } catch (i) {
+          throw m.isSvelteKitError(i) || m.isSvelteKitRedirect(i) ? i : new n(h.Unauthorized, "CSRF token not present");
         }
       let e = o.device_code;
-      if (!e) throw new n(u.BadRequest, "No device code given when polling for user authorization");
+      if (!e) throw new n(h.BadRequest, "No device code given when polling for user authorization");
       const t = this.errorIfIdTokenInvalid(await this.pollDeviceCodeFlow(e));
       if (t.access_token && !t.error)
         return await this.receiveTokenFn(
@@ -2397,8 +2397,8 @@ class G extends re {
         );
       {
         if (t.error == "authorization_pending") return { ok: !0, ...t };
-        let a = t.error ?? "server_error", i = t.error_description ?? "Didn't receive an access token";
-        const c = n.fromOAuthError(a, i);
+        let i = t.error ?? "server_error", a = t.error_description ?? "Didn't receive an access token";
+        const c = n.fromOAuthError(i, a);
         return this.errorFn(this.server, r, c);
       }
     } catch (e) {
@@ -2412,10 +2412,10 @@ class G extends re {
     if (this.server.sessionAdapter && this.server.sessionAdapter.csrfProtectionEnabled())
       try {
         if (!this.server.sessionAdapter.getCsrfToken(r))
-          throw new n(u.InvalidCsrf);
+          throw new n(h.InvalidCsrf);
       } catch (s) {
         if (m.isSvelteKitError(s) || m.isSvelteKitRedirect(s)) throw s;
-        const e = new n(u.Unauthorized, "CSRF token not present");
+        const e = new n(h.Unauthorized, "CSRF token not present");
         return this.errorFn(this.server, r, e);
       }
     await ((o = this.server.sessionAdapter) == null ? void 0 : o.deleteSessionData(
@@ -2424,19 +2424,19 @@ class G extends re {
     ));
   }
   async storeSessionData(r, o) {
-    var s, e, t, a;
+    var s, e, t, i;
     if (this.server.sessionServer) {
-      let i = (s = this.server.sessionServer) == null ? void 0 : s.getSessionCookieValue(r);
-      i ? await ((t = this.server.sessionAdapter) == null ? void 0 : t.updateSessionData(
+      let a = (s = this.server.sessionServer) == null ? void 0 : s.getSessionCookieValue(r);
+      a ? await ((t = this.server.sessionAdapter) == null ? void 0 : t.updateSessionData(
         r,
         this.sessionDataName,
         o
-      )) : i = await ((e = this.server.sessionServer) == null ? void 0 : e.createAnonymousSession(
+      )) : a = await ((e = this.server.sessionServer) == null ? void 0 : e.createAnonymousSession(
         r,
         { [this.sessionDataName]: o }
       ));
     } else
-      await ((a = this.server.sessionAdapter) == null ? void 0 : a.updateSessionData(
+      await ((i = this.server.sessionAdapter) == null ? void 0 : i.updateSessionData(
         r,
         this.sessionDataName,
         o
@@ -2446,7 +2446,7 @@ class G extends re {
     return r.id_token && this.jwtTokens.includes("id"), r;
   }
 }
-class Pe {
+class Re {
 }
 class ge extends se {
   /**
@@ -2459,9 +2459,9 @@ class ge extends se {
       const s = /^[!#\$%&'\(\)\*\+,\.\/a-zA-Z\[\]\^_`-]+/;
       for (const [e, t] of Object.entries(o.protectedEndpoints)) {
         if (!e.startsWith("/"))
-          throw new n(u.Configuration, "protected endpoints must be absolute paths without the protocol and hostname");
-        t.scope && t.scope.forEach((a) => {
-          if (!s.test(a)) throw new n(u.Configuration, "Illegal characters in scope " + a);
+          throw new n(h.Configuration, "protected endpoints must be absolute paths without the protocol and hostname");
+        t.scope && t.scope.forEach((i) => {
+          if (!s.test(i)) throw new n(h.Configuration, "Illegal characters in scope " + i);
         });
       }
       this.protectedEndpoints = { ...o.protectedEndpoints };
@@ -2473,48 +2473,48 @@ class ge extends se {
     o.protectedEndpoints && (this.hook = async ({ event: s }) => {
       var c, d;
       const e = s.url.pathname;
-      let t = !1, a = "";
+      let t = !1, i = "";
       if (e in this.protectedEndpoints)
-        t = !0, a = e;
+        t = !0, i = e;
       else
-        for (let h of this.protectedEndpointPrefixes)
-          e.startsWith(h) && (t = !0), a = h;
+        for (let u of this.protectedEndpointPrefixes)
+          e.startsWith(u) && (t = !0), i = u;
       if (!t) return;
-      const i = await this.authorized(s);
-      if (!(s.locals.user && s.locals.authType == "cookie" && this.protectedEndpoints[a].acceptSessionAuthorization != !0)) {
-        if (!i) {
+      const a = await this.authorized(s);
+      if (!(s.locals.user && s.locals.authType == "cookie" && this.protectedEndpoints[i].acceptSessionAuthorization != !0)) {
+        if (!a) {
           s.locals.authError = "access_denied", s.locals.authErrorDescription = "No access token";
-          const h = this.authenticateHeader(s);
+          const u = this.authenticateHeader(s);
           return new Response(JSON.stringify(this.errorBody), {
             headers: {
               "content-type": "application/json",
-              "WWW-Authenticate": h
+              "WWW-Authenticate": u
             },
             status: 401
           });
         }
-        if (!i.authorized) {
-          const h = this.authenticateHeader(s);
+        if (!a.authorized) {
+          const u = this.authenticateHeader(s);
           return new Response(JSON.stringify(this.errorBody), {
             headers: {
               "content-type": "application/json",
-              "WWW-Authenticate": h
+              "WWW-Authenticate": u
             },
             status: 401
           });
         }
       }
-      if (i) {
-        if (s.locals.accessTokenPayload = i.tokenPayload, s.locals.user = i.user, (c = i.tokenPayload) != null && c.scope)
-          if (Array.isArray(i.tokenPayload.scope)) {
-            let h = [];
-            for (let g of i.tokenPayload.scope)
-              typeof g == "string" && h.push(g);
-            s.locals.scope = h;
-          } else typeof i.tokenPayload.scope == "string" && (s.locals.scope = i.tokenPayload.scope.split(" "));
-        if (this.protectedEndpoints[a].scope) {
-          for (let h of this.protectedEndpoints[a].scope ?? [])
-            if (!s.locals.scope || !s.locals.scope.includes(h) && this.protectedEndpoints[a].acceptSessionAuthorization != !0) {
+      if (a) {
+        if (s.locals.accessTokenPayload = a.tokenPayload, s.locals.user = a.user, (c = a.tokenPayload) != null && c.scope)
+          if (Array.isArray(a.tokenPayload.scope)) {
+            let u = [];
+            for (let g of a.tokenPayload.scope)
+              typeof g == "string" && u.push(g);
+            s.locals.scope = u;
+          } else typeof a.tokenPayload.scope == "string" && (s.locals.scope = a.tokenPayload.scope.split(" "));
+        if (this.protectedEndpoints[i].scope) {
+          for (let u of this.protectedEndpoints[i].scope ?? [])
+            if (!s.locals.scope || !s.locals.scope.includes(u) && this.protectedEndpoints[i].acceptSessionAuthorization != !0) {
               l.logger.warn(f({
                 msg: "Access token does not have sufficient scope",
                 username: (d = s.locals.user) == null ? void 0 : d.username,
@@ -2530,23 +2530,23 @@ class ge extends se {
               });
             }
         }
-        if (s.locals.authType = "oauth", s.locals.authError = i == null ? void 0 : i.error, (i == null ? void 0 : i.error) == "access_denied") {
-          const h = this.authenticateHeader(s);
+        if (s.locals.authType = "oauth", s.locals.authError = a == null ? void 0 : a.error, (a == null ? void 0 : a.error) == "access_denied") {
+          const u = this.authenticateHeader(s);
           return new Response(JSON.stringify(this.errorBody), {
             headers: {
               "content-type": "application/json",
-              "WWW-Authenticate": h
+              "WWW-Authenticate": u
             },
             status: 401
           });
-        } else if (i != null && i.error)
+        } else if (a != null && a.error)
           return new Response(JSON.stringify(this.errorBody), {
             headers: {
               "content-type": "application/json"
             },
             status: 500
           });
-        s.locals.authErrorDescription = i == null ? void 0 : i.error_description, l.logger.debug(f({ msg: "Resource server url", url: s.request.url, authorized: s.locals.accessTokenPayload != null }));
+        s.locals.authErrorDescription = a == null ? void 0 : a.error_description, l.logger.debug(f({ msg: "Resource server url", url: s.request.url, authorized: s.locals.accessTokenPayload != null }));
       }
     });
   }
@@ -2617,7 +2617,7 @@ class ge extends se {
   }
   async tokenFromSession(r) {
     if (!this.sessionAdapter) throw new n(
-      u.Configuration,
+      h.Configuration,
       "Cannot get session data if sessions not enabled"
     );
     const o = await this.sessionAdapter.getSessionData(r, this.sessionDataName);
@@ -2672,22 +2672,22 @@ const D = class D {
     apiKey: s,
     oAuthAuthServer: e,
     oAuthClient: t,
-    oAuthClients: a,
-    oAuthResServer: i,
+    oAuthClients: i,
+    oAuthResServer: a,
     options: c
   }) {
-    this.loginUrl = "/login", this.audience = "", this.dummyLoad = async (h) => ({}), this.dummyActions = {}, this.dummyBff = async (h) => ({ status: 500, body: { error: "Unimplemented" } }), c || (c = {}), y("loginUrl", E.String, this, c, "LOGIN_URL", !1), c.isAdminFn && (D.isAdminFn = c.isAdminFn);
+    this.loginUrl = "/login", this.audience = "", this.dummyLoad = async (u) => ({}), this.dummyActions = {}, this.dummyBff = async (u) => ({ status: 500, body: { error: "Unimplemented" } }), c || (c = {}), y("loginUrl", E.String, this, c, "LOGIN_URL", !1), c.isAdminFn && (D.isAdminFn = c.isAdminFn);
     let d = {};
     if (c.authenticators && (d = c.authenticators), this.userStorage = c.userStorage, r) {
       if (!d)
         throw new n(
-          u.Configuration,
+          h.Configuration,
           "If using session management, must supply authenticators"
         );
       this.sessionServer = new H(r.keyStorage, d, { ...r.options, ...c }), this.sessionAdapter = this.sessionServer;
     } else o && (this.sessionAdapter = o);
     if (s) {
-      if (!this.userStorage) throw new n(u.Configuration, "Must define a user storage if using API keys");
+      if (!this.userStorage) throw new n(h.Configuration, "Must define a user storage if using API keys");
       this.apiKeyServer = new ne(
         this.userStorage,
         s.keyStorage,
@@ -2695,61 +2695,67 @@ const D = class D {
       );
     }
     if (e) {
-      let h = {};
-      this.loginUrl && (h.loginUrl = this.loginUrl), this.oAuthAuthServer = new ce(
+      let u = {};
+      this.loginUrl && (u.loginUrl = this.loginUrl), this.oAuthAuthServer = new ce(
         this,
         e.clientStorage,
         e.keyStorage,
         d,
-        { ...h, ...c, ...e.options }
+        { ...u, ...c, ...e.options }
       );
     }
-    if (t && a)
-      throw new n(u.Configuration, "Cannot specify both oAuthClient and oAuthClients");
+    if (t && i)
+      throw new n(h.Configuration, "Cannot specify both oAuthClient and oAuthClients");
     if (t && (this.oAuthClient = new G(
       this,
       t.authServerBaseUrl,
       { ...c, ...t.options }
-    )), a) {
+    )), i) {
       this.oAuthClients = [];
-      for (let h of a)
+      for (let u of i)
         this.oAuthClients.push(
           new G(
             this,
-            h.authServerBaseUrl,
-            { ...c, ...h.options }
+            u.authServerBaseUrl,
+            { ...c, ...u.options }
           )
         );
     }
-    i && (y("audience", E.String, this, c, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new ge(
+    a && (y("audience", E.String, this, c, "OAUTH_AUDIENCE", !0), this.oAuthResServer = new ge(
       [new te(this.audience, c)],
-      { sessionAdapter: this.sessionAdapter, ...i.options, ...c }
-    )), this.hooks = async ({ event: h, resolve: g }) => {
-      const p = await this.unresolvedHooks(h);
-      return p instanceof Response ? p : await g(p);
+      { sessionAdapter: this.sessionAdapter, ...a.options, ...c }
+    )), this.hooks = async ({ event: u, resolve: g }) => {
+      const w = await this.unresolvedHooks(u);
+      return w instanceof Response ? w : await g(w);
     };
   }
   async unresolvedHooks(r) {
     var o;
     if (r.locals.user = void 0, r.locals.sessionId = void 0, r.locals.csrfToken = void 0, r.locals.authType = void 0, r.locals.scope = void 0, this.sessionServer) {
-      await this.sessionServer.sessionHook({ event: r });
-      const s = this.userStorage ? await this.sessionServer.twoFAHook({ event: r }) : void 0;
-      if (!(s && s.twofa) && !r.locals.user) {
+      let s = await this.sessionServer.sessionHook({ event: r });
+      if (s.status == 302) {
+        let t;
+        for (let i of s.headers)
+          i.name == "location" && (t = i.value);
+        t && await this.sessionServer.redirect(302, t);
+      }
+      const e = this.userStorage ? await this.sessionServer.twoFAHook({ event: r }) : void 0;
+      if (!(e && e.twofa) && !r.locals.user) {
         if (this.sessionServer.isLoginPageProtected(r)) {
           if (this.loginUrl) {
-            let e = encodeURIComponent(r.request.url);
-            return new Response(null, { status: 302, headers: { location: this.loginUrl + "?next=" + e } });
+            let t = encodeURIComponent(r.request.url);
+            return new Response(null, { status: 302, headers: { location: this.loginUrl + "?next=" + t } });
           }
           return this.sessionServer.error(401, "Unauthorized");
         }
         if (this.sessionServer.isLoginApiProtected(r))
           return this.sessionServer.error(401, "Unauthorized");
       }
-      if (!(s && s.twofa) && this.sessionServer.isAdminPageEndpoint(r) && (!r.locals.user || !D.isAdminFn(r.locals.user)))
+      if (!(e && e.twofa) && this.sessionServer.isAdminPageEndpoint(r) && (!r.locals.user || !D.isAdminFn(r.locals.user)))
         return this.sessionServer.unauthorizedUrl ? new Response(null, { status: 302, headers: { location: this.sessionServer.unauthorizedUrl } }) : this.sessionServer.error(401, "Unauthorized");
-      if (!(s && s.twofa) && this.sessionServer.isAdminApiEndpoint(r) && (!r.locals.user || !D.isAdminFn(r.locals.user)))
+      if (!(e && e.twofa) && this.sessionServer.isAdminApiEndpoint(r) && (!r.locals.user || !D.isAdminFn(r.locals.user)))
         return this.sessionServer.error(401, "Unauthorized");
-      if (s != null && s.response) return s.response;
+      if (e != null && e.response) return e.response;
     }
     if (this.apiKeyServer && await this.apiKeyServer.hook({ event: r }), this.oAuthClient && await this.oAuthClient.hook({ event: r }), (o = this.oAuthResServer) != null && o.hook) {
       const s = await this.oAuthResServer.hook({ event: r });
@@ -2782,7 +2788,7 @@ D.isAdminFn = pe;
 let m = D;
 class we {
   constructor(r, o) {
-    this.changePasswordUrl = "/changepassword", this.changeFactor2Url = "/changefactor2", this.loginRedirectUrl = "/", this.loginUrl = "/login", this.signupEndpoint = {
+    if (this.changePasswordUrl = void 0, this.changeFactor2Url = void 0, this.configureFactor2Url = void 0, this.requestPasswordResetUrl = void 0, this.loginRedirectUrl = "/", this.loginUrl = "/login", this.signupEndpoint = {
       load: async (s) => {
         var t;
         return {
@@ -2802,7 +2808,7 @@ class we {
         login: async (s) => {
           var t;
           const e = await this.login(s);
-          return (e == null ? void 0 : e.ok) == !0 && !(e != null && e.factor2Required) && this.sessionServer.redirect(302, ((t = e.formData) == null ? void 0 : t.next) ?? this.loginRedirectUrl), e && ((e == null ? void 0 : e.errorCode) == u.UserNotExist || (e == null ? void 0 : e.errorCode) == u.PasswordInvalid) && (e.error = "Username or password is invalid"), e;
+          return (e == null ? void 0 : e.ok) == !0 && !(e != null && e.factor2Required) && this.sessionServer.redirect(302, ((t = e.formData) == null ? void 0 : t.next) ?? this.loginRedirectUrl), e && ((e == null ? void 0 : e.errorCode) == h.UserNotExist || (e == null ? void 0 : e.errorCode) == h.PasswordInvalid) && (e.error = "Username or password is invalid"), e;
         },
         factor2: async (s) => {
           var t;
@@ -2828,18 +2834,18 @@ class we {
         reconfigure: async (s) => await this.reconfigureFactor2(s)
       },
       load: async (s) => {
-        var h;
-        let e = (h = s.locals.user) == null ? void 0 : h.username;
+        var u;
+        let e = (u = s.locals.user) == null ? void 0 : u.username;
         if (!this.isSessionUser(s) || !s.locals.user) {
           const g = await this.sessionServer.getSessionData(s, "factor2change");
           g != null && g.username || this.isSessionUser(s) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), e = g == null ? void 0 : g.username;
         }
-        let t = this.sessionServer.allowedFactor2 ?? [{ name: "none", friendlyName: "None", configurable: !1 }], a = {}, i = s.url.searchParams.get("required"), c;
-        i && (i = i.toLowerCase(), c = i == "true" || i == "1", c == !0 && (a.required = !0));
+        let t = this.sessionServer.allowedFactor2 ?? [{ name: "none", friendlyName: "None", configurable: !1 }], i = {}, a = s.url.searchParams.get("required"), c;
+        a && (a = a.toLowerCase(), c = a == "true" || a == "1", c == !0 && (i.required = !0));
         let d = s.url.searchParams.get("next");
-        return d && (a.next = d), {
+        return d && (i.next = d), {
           allowedFactor2: t,
-          ...a,
+          ...i,
           username: e,
           ...this.baseEndpoint(s)
         };
@@ -2849,12 +2855,12 @@ class we {
         default: async (s) => await this.changePassword(s)
       },
       load: async (s) => {
-        let e = {}, t = s.url.searchParams.get("required"), a, i = s.locals.user != null;
-        if (!i) {
+        let e = {}, t = s.url.searchParams.get("required"), i, a = s.locals.user != null;
+        if (!a) {
           const d = await this.sessionServer.getSessionData(s, "passwordchange");
-          d != null && d.username && (i = !0);
+          d != null && d.username && (a = !0);
         }
-        i || this.sessionServer.redirect(302, this.loginUrl), t && (t = t.toLowerCase(), a = t == "true" || t == "1", a == !0 && (e.required = !0));
+        a || this.sessionServer.redirect(302, this.loginUrl), t && (t = t.toLowerCase(), i = t == "true" || t == "1", i == !0 && (e.required = !0));
         let c = s.url.searchParams.get("next");
         return c && (e.next = c), {
           ...e,
@@ -2880,8 +2886,8 @@ class we {
         default: async (s) => await this.requestPasswordReset(s)
       },
       load: async (s) => {
-        let e = {}, t = s.url.searchParams.get("required"), a;
-        return t && (t = t.toLowerCase(), a = t == "true" || t == "1", a == !0 && (e.required = !0)), {
+        let e = {}, t = s.url.searchParams.get("required"), i;
+        return t && (t = t.toLowerCase(), i = t == "true" || t == "1", i == !0 && (e.required = !0)), {
           ...e,
           ...this.baseEndpoint(s)
         };
@@ -2890,7 +2896,7 @@ class we {
       actions: {
         default: async (s) => {
           let e = await this.validatePasswordResetToken(s);
-          if (!(e != null && e.user)) throw new n(u.InvalidToken, "The password reset token is invalid");
+          if (!(e != null && e.user)) throw new n(h.InvalidToken, "The password reset token is invalid");
           if (e.user.factor2 != "" && !s.locals.sessionId && await this.sessionServer.createAnonymousSession(s, { user: { username: e.user.username } }), e != null && e.error)
             return {
               ok: !1,
@@ -2901,14 +2907,14 @@ class we {
           try {
             return e = await this.resetPassword(s), e;
           } catch (t) {
-            const a = n.asCrossauthError(t);
+            const i = n.asCrossauthError(t);
             if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-            return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
+            return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
               ok: !1,
               tokenValidated: !1,
               error: e == null ? void 0 : e.error,
-              errorCode: a.code,
-              errorCodeName: a.codeName,
+              errorCode: i.code,
+              errorCodeName: i.codeName,
               ...this.baseEndpoint(s)
             };
           }
@@ -2918,7 +2924,7 @@ class we {
         try {
           if (s.request.method != "POST") {
             const e = await this.validatePasswordResetToken(s);
-            if (!(e != null && e.user)) throw new n(u.InvalidToken, "The password reset token is invalid");
+            if (!(e != null && e.user)) throw new n(h.InvalidToken, "The password reset token is invalid");
             return e.user.factor2 != "" && !s.locals.sessionId && await this.sessionServer.createAnonymousSession(s, { user: { username: e.user.username } }), {
               tokenValidated: (e == null ? void 0 : e.ok) ?? !1,
               error: e == null ? void 0 : e.error,
@@ -2956,7 +2962,16 @@ class we {
           ...e
         };
       }
-    }, this.sessionServer = r, y("changePasswordUrl", E.String, this, o, "CHANGE_PASSWORD_URL"), y("requestPasswordResetUrl", E.String, this, o, "REQUEST_PASSWORD_RESET_URL"), y("changeFactor2Url", E.String, this, o, "CHANGE_FACTOR2_URL"), y("loginRedirectUrl", E.JsonArray, this, o, "LOGIN_REDIRECT_URL"), y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.addToSession && (this.addToSession = o.addToSession);
+    }, this.sessionServer = r, y("changePasswordUrl", E.String, this, o, "CHANGE_PASSWORD_URL"), y("requestPasswordResetUrl", E.String, this, o, "REQUEST_PASSWORD_RESET_URL"), y("changeFactor2Url", E.String, this, o, "CHANGE_FACTOR2_URL"), y("configureFactor2Url", E.String, this, o, "CONFIGURE_FACTOR2_URL"), y("loginRedirectUrl", E.JsonArray, this, o, "LOGIN_REDIRECT_URL"), y("loginUrl", E.JsonArray, this, o, "LOGIN_URL"), o.addToSession && (this.addToSession = o.addToSession), this.changePasswordUrl && !this.changePasswordUrl.startsWith("/"))
+      throw new n(h.Configuration, "changePasswordUrl must be an absolute path");
+    if (this.requestPasswordResetUrl && !this.requestPasswordResetUrl.startsWith("/"))
+      throw new n(h.Configuration, "requestPasswordResetUrl must be an absolute path");
+    if (this.changeFactor2Url && !this.changeFactor2Url.startsWith("/"))
+      throw new n(h.Configuration, "changeFactor2Url must be an absolute path");
+    if (this.configureFactor2Url && !this.configureFactor2Url.startsWith("/"))
+      throw new n(h.Configuration, "configureFactor2Url must be an absolute path");
+    if (!this.loginUrl.startsWith("/"))
+      throw new n(h.Configuration, "loginUrl must be an absolute path");
   }
   /** Returns whether there is a user logged in with a cookie-based session
    */
@@ -3010,49 +3025,56 @@ class we {
       await s.loadData(r), o = s.toObject();
       const e = s.get("username") ?? "", t = s.getAsBoolean("persist") ?? !1;
       o.next.includes("/__data.json") && (o.next = o.next.substring(0, o.next.indexOf("/__data.json")));
-      let a = o.next ?? this.loginRedirectUrl;
-      if (e == "") throw new n(u.InvalidUsername, "Username field may not be empty");
-      let i = this.addToSession ? this.addToSession(r, o) : {};
-      if (this.sessionServer.enableCsrfProtection && !r.locals.csrfToken) throw new n(u.InvalidCsrf);
+      let i = o.next ?? this.loginRedirectUrl;
+      if (e == "") throw new n(h.InvalidUsername, "Username field may not be empty");
+      let a = this.addToSession ? this.addToSession(r, o) : {};
+      if (this.sessionServer.enableCsrfProtection && !r.locals.csrfToken) throw new n(h.InvalidCsrf);
       const c = this.sessionServer.getSessionCookieValue(r);
-      let { sessionCookie: d, csrfCookie: h, user: g } = await this.sessionServer.sessionManager.login(e, s.toObject(), i, t);
+      let { sessionCookie: d, csrfCookie: u, user: g } = await this.sessionServer.sessionManager.login(e, s.toObject(), a, t);
       if (l.logger.debug(f({
         msg: "Login: set session cookie " + d.name + " opts " + JSON.stringify(d.options),
         user: e
       })), r.cookies.set(
         d.name,
         d.value,
-        R(d.options)
+        P(d.options)
       ), l.logger.debug(f({
-        msg: "Login: set csrf cookie " + h.name + " opts " + JSON.stringify(d.options),
+        msg: "Login: set csrf cookie " + u.name + " opts " + JSON.stringify(d.options),
         user: e
       })), this.sessionServer.enableCsrfProtection && (r.cookies.set(
-        h.name,
-        h.value,
-        R(h.options)
-      ), r.locals.csrfToken = await this.sessionServer.sessionManager.createCsrfFormOrHeaderValue(h.value)), c)
+        u.name,
+        u.value,
+        P(u.options)
+      ), r.locals.csrfToken = await this.sessionServer.sessionManager.createCsrfFormOrHeaderValue(u.value)), c)
         try {
           await this.sessionServer.sessionManager.deleteSession(c);
-        } catch (p) {
+        } catch (w) {
           l.logger.warn(f({
             msg: "Couldn't delete session ID from database",
             hashOfSessionId: this.sessionServer.getHashOfSessionId(r)
-          })), l.logger.debug(f({ err: p }));
+          })), l.logger.debug(f({ err: w }));
         }
-      if (g.state == N.passwordChangeNeeded)
-        this.sessionServer.redirect(302, this.changePasswordUrl + "?required=true&next=" + encodeURIComponent("login?next=" + a));
-      else {
-        if (g.state == N.passwordResetNeeded)
-          throw new n(u.PasswordResetNeeded, "Please click on the link we sent you to reset your password");
-        if (g.state == N.passwordAndFactor2ResetNeeded)
-          throw new n(u.PasswordResetNeeded, "Please click on the link we sent you to reset your password");
-        this.sessionServer.allowedFactor2.length > 0 && g.state == N.factor2ResetNeeded || !this.sessionServer.allowedFactor2Names.includes(g.factor2 ? g.factor2 : "none") ? this.sessionServer.redirect(302, this.changeFactor2Url + "?required=true&next=" + encodeURIComponent("login?next=" + a)) : (!g.factor2 || g.factor2 == "") && (r.locals.user = g);
+      if (g.state == I.passwordChangeNeeded) {
+        if (!this.changePasswordUrl)
+          throw new n(h.Configuration, "Must set changePasswordUrl in session server");
+        this.sessionServer.redirect(302, this.changePasswordUrl + "?required=true&next=" + encodeURIComponent("login?next=" + i));
+      } else {
+        if (g.state == I.passwordResetNeeded)
+          throw new n(h.PasswordResetNeeded, "Please click on the link we sent you to reset your password");
+        if (g.state == I.passwordAndFactor2ResetNeeded)
+          throw new n(h.PasswordResetNeeded, "Please click on the link we sent you to reset your password");
+        if (this.sessionServer.allowedFactor2.length > 0 && g.state == I.factor2ResetNeeded || !this.sessionServer.allowedFactor2Names.includes(g.factor2 ? g.factor2 : "none")) {
+          if (!this.changeFactor2Url)
+            throw new n(h.Configuration, "Must set changeFactor2Url in session server");
+          this.sessionServer.redirect(302, this.changeFactor2Url + "?required=true&next=" + encodeURIComponent("login?next=" + i));
+        } else
+          (!g.factor2 || g.factor2 == "") && (r.locals.user = g);
       }
       return {
         user: g,
         formData: o,
         factor2Required: g.factor2 && g.factor2 != "",
-        next: a,
+        next: i,
         ok: !0
       };
     } catch (e) {
@@ -3073,29 +3095,29 @@ class we {
   async loginWithUser(r, o, s) {
     const e = s.locals.sessionId, t = new b();
     await t.loadData(s);
-    let a = this.addToSession ? this.addToSession(s, t.toObject()) : {}, { sessionCookie: i, csrfCookie: c, csrfFormOrHeaderValue: d } = await this.sessionServer.sessionManager.login("", {}, a, void 0, r, o);
+    let i = this.addToSession ? this.addToSession(s, t.toObject()) : {}, { sessionCookie: a, csrfCookie: c, csrfFormOrHeaderValue: d } = await this.sessionServer.sessionManager.login("", {}, i, void 0, r, o);
     if (l.logger.debug(f({
-      msg: "Login: set session cookie " + i.name + " opts " + JSON.stringify(i.options),
+      msg: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
       user: r.username
     })), s.cookies.set(
-      i.name,
-      i.value,
-      R(i.options)
+      a.name,
+      a.value,
+      P(a.options)
     ), l.logger.debug(f({
-      msg: "Login: set csrf cookie " + c.name + " opts " + JSON.stringify(i.options),
+      msg: "Login: set csrf cookie " + c.name + " opts " + JSON.stringify(a.options),
       user: r.username
     })), this.sessionServer.enableCsrfProtection && s.cookies.set(
       c.name,
       c.value,
-      R(c.options)
-    ), s.locals.user = r, s.locals.csrfToken = d, s.locals.sessionId = this.sessionServer.sessionManager.getSessionId(i.value), e)
+      P(c.options)
+    ), s.locals.user = r, s.locals.csrfToken = d, s.locals.sessionId = this.sessionServer.sessionManager.getSessionId(a.value), e)
       try {
         await this.sessionServer.sessionManager.deleteSession(e);
-      } catch (h) {
+      } catch (u) {
         l.logger.warn(f({
           msg: "Couldn't delete session ID from database",
           hashOfSessionId: this.sessionServer.getHashOfSessionId(s)
-        })), l.logger.debug(f({ err: h }));
+        })), l.logger.debug(f({ err: u }));
       }
     return {
       user: r,
@@ -3192,38 +3214,38 @@ class we {
   async signup(r) {
     let o;
     try {
-      if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
+      if (!this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
       var s = new b();
       await s.loadData(r), o = s.toObject();
       const e = s.get("username") ?? "";
       let t;
       if (this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
-      if (e == "") throw new n(u.InvalidUsername, "Username field may not be empty");
+        throw new n(h.InvalidCsrf);
+      if (e == "") throw new n(h.InvalidUsername, "Username field may not be empty");
       if (o.factor2 || (o.factor2 = this.sessionServer.allowedFactor2Names[0]), o.factor2 && !this.sessionServer.allowedFactor2Names.includes(o.factor2 ?? "none"))
         throw new n(
-          u.Forbidden,
+          h.Forbidden,
           "Illegal second factor " + o.factor2 + " requested"
         );
-      (o.factor2 == "none" || o.factor2 == "") && (o.factor2 = void 0), t = this.sessionServer.createUserFn(r, o, this.sessionServer.userStorage.userEditableFields);
-      let a = this.sessionServer.authenticators[t.factor1].validateSecrets(o);
-      const i = this.sessionServer.authenticators[t.factor1].secretNames();
+      (o.factor2 == "none" || o.factor2 == "") && (o.factor2 = void 0), t = this.sessionServer.createUserFn(r, o, this.sessionServer.userStorage.userEditableFields, this.sessionServer.userAllowedFactor1);
+      let i = this.sessionServer.authenticators[t.factor1].validateSecrets(o);
+      const a = this.sessionServer.authenticators[t.factor1].secretNames();
       let c = {};
-      for (let p in o)
-        if (p.startsWith("repeat_")) {
-          const w = p.replace(/^repeat_/, "");
-          i.includes(w) && (c[w] = o[p]);
+      for (let w in o)
+        if (w.startsWith("repeat_")) {
+          const p = w.replace(/^repeat_/, "");
+          a.includes(p) && (c[p] = o[w]);
         }
       Object.keys(c).length === 0 && (c = void 0), t.state = "active", o.factor2 && o.factor2 != "none" ? t.state = "awaitingtwofactor" : this.sessionServer.enableEmailVerification && (t.state = "awaitingemailverification");
-      let h = [...this.sessionServer.validateUserFn(t), ...a];
-      if (h.length > 0)
-        throw new n(u.FormEntry, h);
+      let u = [...this.sessionServer.validateUserFn(t), ...i];
+      if (u.length > 0)
+        throw new n(h.FormEntry, u);
       let g = !1;
       try {
-        const { user: p, secrets: w } = await this.sessionServer.userStorage.getUserByUsername(e);
-        await this.sessionServer.sessionManager.authenticators[t.factor1].authenticateUser(p, w, o);
-      } catch (p) {
-        n.asCrossauthError(p).code == u.TwoFactorIncomplete && (g = !0);
+        const { user: w, secrets: p } = await this.sessionServer.userStorage.getUserByUsername(e);
+        await this.sessionServer.sessionManager.authenticators[t.factor1].authenticateUser(w, p, o);
+      } catch (w) {
+        n.asCrossauthError(w).code == h.TwoFactorIncomplete && (g = !0);
       }
       if (!o.factor2 && !g)
         return await this.sessionServer.sessionManager.createUser(
@@ -3232,13 +3254,13 @@ class we {
           c
         ), this.sessionServer.enableEmailVerification ? { emailVerificationRequired: !0, user: t, ok: !0, formData: o } : { ...await this.login(r), formData: o };
       {
-        let p;
+        let w;
         if (g) {
-          if (!r.locals.sessionId) throw new n(u.Unauthorized);
-          p = (await this.sessionServer.sessionManager.repeatTwoFactorSignup(r.locals.sessionId)).userData;
+          if (!r.locals.sessionId) throw new n(h.Unauthorized);
+          w = (await this.sessionServer.sessionManager.repeatTwoFactorSignup(r.locals.sessionId)).userData;
         } else {
-          const w = await this.sessionServer.createAnonymousSession(r), S = this.sessionServer.sessionManager.getSessionId(w);
-          p = (await this.sessionServer.sessionManager.initiateTwoFactorSignup(
+          const p = await this.sessionServer.createAnonymousSession(r), S = this.sessionServer.sessionManager.getSessionId(p);
+          w = (await this.sessionServer.sessionManager.initiateTwoFactorSignup(
             t,
             o,
             S,
@@ -3246,14 +3268,14 @@ class we {
           )).userData;
         }
         try {
-          let w = {
-            userData: p,
+          let p = {
+            userData: w,
             username: e,
             factor2: o.factor2 ?? "none"
           };
-          return this.sessionServer.enableCsrfProtection && (w.csrfToken = r.locals.csrfToken), { factor2Data: w, ok: !0, factor2Required: !0, formData: o };
-        } catch (w) {
-          l.logger.error(f({ err: w }));
+          return this.sessionServer.enableCsrfProtection && (p.csrfToken = r.locals.csrfToken), { factor2Data: p, ok: !0, factor2Required: !0, formData: o };
+        } catch (p) {
+          l.logger.error(f({ err: p }));
           try {
             this.sessionServer.sessionManager.deleteUserByUsername(e);
           } catch (S) {
@@ -3301,9 +3323,9 @@ class we {
   async verifyEmail(r) {
     var o;
     try {
-      if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
+      if (!this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
       const s = r.params.token;
-      if (!s) throw new n(u.InvalidToken, "Invalid email verification token");
+      if (!s) throw new n(h.InvalidToken, "Invalid email verification token");
       const e = await this.sessionServer.sessionManager.applyEmailVerificationToken(s);
       if (await this.loginWithUser(e, !0, r), r.locals.user) {
         const t = await this.sessionServer.userStorage.getUserById((o = r.locals.user) == null ? void 0 : o.id);
@@ -3349,41 +3371,46 @@ class we {
     try {
       var t = new b();
       await t.loadData(r), o = t.toObject();
-      const a = await this.sessionServer.getSessionData(r, "2fa");
-      if (a != null && a.factor2) e = a == null ? void 0 : a.factor2;
-      else throw new n(u.BadRequest, "Two factor authentication was not started");
+      const i = await this.sessionServer.getSessionData(r, "2fa");
+      if (i != null && i.factor2) e = i == null ? void 0 : i.factor2;
+      else throw new n(h.BadRequest, "Two factor authentication was not started");
       if (this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
+        throw new n(h.InvalidCsrf);
       if (!r.locals.sessionId) throw new n(
-        u.Unauthorized,
+        h.Unauthorized,
         "No session active while enabling 2FA.  Please enable cookies"
       );
-      let i = await this.sessionServer.sessionManager.completeTwoFactorSetup(
+      let a = await this.sessionServer.sessionManager.completeTwoFactorSetup(
         o,
         r.locals.sessionId
       );
-      return this.sessionServer.enableEmailVerification || await this.loginWithUser(i, !0, r), r.locals.user ? {
+      return this.sessionServer.enableEmailVerification || await this.loginWithUser(a, !0, r), r.locals.user ? {
         ok: !0,
-        user: i,
+        user: a,
         emailVerificationRequired: this.sessionServer.enableEmailVerification
-      } : await this.loginWithUser(i, !0, r);
-    } catch (a) {
-      const i = n.asCrossauthError(a);
+      } : await this.loginWithUser(a, !0, r);
+    } catch (i) {
+      const a = n.asCrossauthError(i);
       let c;
       try {
         c = (await this.sessionServer.sessionManager.repeatTwoFactorSignup(r.locals.sessionId ?? "")).userData;
       } catch {
       }
-      return c && (s = {
+      return c ? s = {
         userData: c,
         csrfToken: r.locals.csrfToken,
         username: c.username ?? "",
         factor2: e
-      }), l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
+      } : s = {
+        userData: {},
+        csrfToken: r.locals.csrfToken,
+        username: "",
+        factor2: e
+      }, l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
         ok: !1,
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         formData: o,
         factor2Data: s,
         emailVerificationRequired: this.sessionServer.enableEmailVerification
@@ -3416,30 +3443,30 @@ class we {
       var s = new b();
       await s.loadData(r), o = s.toObject();
       const e = s.getAsBoolean("persist") ?? !1, t = r.locals.sessionId;
-      if (!t) throw new n(u.Unauthorized);
+      if (!t) throw new n(h.Unauthorized);
       if (this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
-      let a = this.addToSession ? this.addToSession(r, o) : {};
-      const { sessionCookie: i, csrfCookie: c, user: d } = await this.sessionServer.sessionManager.completeTwoFactorLogin(
+        throw new n(h.InvalidCsrf);
+      let i = this.addToSession ? this.addToSession(r, o) : {};
+      const { sessionCookie: a, csrfCookie: c, user: d } = await this.sessionServer.sessionManager.completeTwoFactorLogin(
         o,
         t,
-        a,
+        i,
         e
       );
       return l.logger.debug(f({
-        msg: "Login: set session cookie " + i.name + " opts " + JSON.stringify(i.options),
+        msg: "Login: set session cookie " + a.name + " opts " + JSON.stringify(a.options),
         user: d == null ? void 0 : d.username
       })), r.cookies.set(
-        i.name,
-        i.value,
-        R(i.options)
+        a.name,
+        a.value,
+        P(a.options)
       ), l.logger.debug(f({
-        msg: "Login: set csrf cookie " + c.name + " opts " + JSON.stringify(i.options),
+        msg: "Login: set csrf cookie " + c.name + " opts " + JSON.stringify(a.options),
         user: d == null ? void 0 : d.username
       })), r.cookies.set(
         c.name,
         c.value,
-        R(c.options)
+        P(c.options)
       ), this.sessionServer.enableCsrfProtection && (r.locals.csrfToken = await this.sessionServer.sessionManager.createCsrfFormOrHeaderValue(c.value)), r.locals.user = d, {
         user: d,
         ok: !0,
@@ -3462,12 +3489,12 @@ class we {
       var s = new b();
       await s.loadData(r), o = s.toObject();
       const e = s.get("email") ?? "";
-      if (e == "") throw new n(u.InvalidUsername, "Email field may not be empty");
+      if (e == "") throw new n(h.InvalidUsername, "Email field may not be empty");
       if (this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
+        throw new n(h.InvalidCsrf);
       if (!this.sessionServer.enablePasswordReset)
         throw new n(
-          u.Configuration,
+          h.Configuration,
           "Password reset not enabled"
         );
       return await this.sessionServer.sessionManager.requestPasswordReset(e), { formData: o, ok: !0 };
@@ -3504,7 +3531,7 @@ class we {
     l.logger.debug(f({ msg: "validatePasswordResetToken " + r.request.method }));
     try {
       const o = r.params.token;
-      if (!o) throw new n(u.InvalidToken, "Invalid email verification token");
+      if (!o) throw new n(h.InvalidToken, "Invalid email verification token");
       return {
         ok: !0,
         user: await this.sessionServer.sessionManager.userForPasswordResetToken(o),
@@ -3545,32 +3572,34 @@ class we {
     try {
       var s = new b();
       if (await s.loadData(r), o = s.toObject(), this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
+        throw new n(h.InvalidCsrf);
       if (!this.sessionServer.enablePasswordReset)
         throw new n(
-          u.Configuration,
+          h.Configuration,
           "Password reset not enabled"
         );
       const e = r.params.token ?? "";
-      if (e == "") throw new n(u.InvalidUsername, "No token provided");
-      const t = await this.sessionServer.sessionManager.userForPasswordResetToken(e), a = this.sessionServer.authenticators[t.factor1], i = a.secretNames();
+      if (e == "") throw new n(h.InvalidUsername, "No token provided");
+      const t = await this.sessionServer.sessionManager.userForPasswordResetToken(e), i = this.sessionServer.authenticators[t.factor1], a = i.secretNames();
       let c = {}, d = {};
-      for (let p in o)
-        if (p.startsWith("new_")) {
-          const w = p.replace(/^new_/, "");
-          i.includes(w) && (c[w] = o[p]);
-        } else if (p.startsWith("repeat_")) {
-          const w = p.replace(/^repeat_/, "");
-          i.includes(w) && (d[w] = o[p]);
+      for (let w in o)
+        if (w.startsWith("new_")) {
+          const p = w.replace(/^new_/, "");
+          a.includes(p) && (c[p] = o[w]);
+        } else if (w.startsWith("repeat_")) {
+          const p = w.replace(/^repeat_/, "");
+          a.includes(p) && (d[p] = o[w]);
         }
-      if (Object.keys(d).length === 0 && (d = void 0), a.validateSecrets(c).length > 0)
-        throw new n(u.PasswordFormat);
+      if (Object.keys(d).length === 0 && (d = void 0), i.validateSecrets(c).length > 0)
+        throw new n(h.PasswordFormat);
       const g = await this.sessionServer.sessionManager.resetSecret(e, 1, c, d);
-      if (g.state == N.active)
+      if (g.state == I.active)
         return await this.loginWithUser(g, !0, r);
       {
-        const p = this.sessionServer.getSessionCookieValue(r), w = this.sessionServer.sessionManager.getSessionId(p ?? "");
-        throw await this.sessionServer.sessionManager.updateSessionData(w, "factor2change", { username: t.username }), this.sessionServer.redirect(302, this.changeFactor2Url + "?required=true");
+        if (!this.changeFactor2Url)
+          throw new n(h.Configuration, "Must set changeFactor2Url in session server");
+        const w = this.sessionServer.getSessionCookieValue(r), p = this.sessionServer.sessionManager.getSessionId(w ?? "");
+        throw await this.sessionServer.sessionManager.updateSessionData(p, "factor2change", { username: t.username }), this.sessionServer.redirect(302, this.changeFactor2Url + "?required=true");
       }
     } catch (e) {
       if (m.isSvelteKitRedirect(e)) throw e;
@@ -3609,12 +3638,12 @@ class we {
   async requestFactor2(r) {
     try {
       if (!r.locals.sessionId) throw new n(
-        u.Unauthorized,
+        h.Unauthorized,
         "No session cookie present"
       );
       const o = this.sessionServer.getSessionCookieValue(r), s = this.sessionServer.sessionManager.getSessionId(o ?? ""), e = await this.sessionServer.sessionManager.dataForSessionId(s);
       if (!(e != null && e.pre2fa)) throw new n(
-        u.Unauthorized,
+        h.Unauthorized,
         "2FA not initiated"
       );
       return {
@@ -3655,58 +3684,58 @@ class we {
     l.logger.debug(f({ msg: "changePassword" }));
     let o;
     try {
-      if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
+      if (!this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
       var s = new b();
       await s.loadData(r), o = s.toObject();
       let e, t = !1;
       if (!this.isSessionUser(r) || !r.locals.user) {
-        const w = await this.sessionServer.getSessionData(r, "passwordchange");
-        if (w != null && w.username) {
+        const p = await this.sessionServer.getSessionData(r, "passwordchange");
+        if (p != null && p.username) {
           if (e = (await this.sessionServer.userStorage.getUserByUsername(
-            w == null ? void 0 : w.username,
+            p == null ? void 0 : p.username,
             {
               skipActiveCheck: !0,
               skipEmailVerifiedCheck: !0
             }
           )).user, t = !0, this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-            throw new n(u.InvalidCsrf);
+            throw new n(h.InvalidCsrf);
         } else
-          throw new n(u.Unauthorized);
+          throw new n(h.Unauthorized);
       } else if (this.canEditUser(r)) {
         if (this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-          throw new n(u.InvalidCsrf);
+          throw new n(h.InvalidCsrf);
         e = r.locals.user;
       } else
-        throw new n(u.InsufficientPriviledges);
-      const a = this.sessionServer.authenticators[e.factor1], i = a.secretNames();
-      let c = {}, d = {}, h = {};
-      for (let w in o)
-        if (w.startsWith("new_")) {
-          const S = w.replace(/^new_/, "");
-          i.includes(S) && (d[S] = o[w]);
-        } else if (w.startsWith("old_")) {
-          const S = w.replace(/^old_/, "");
-          i.includes(S) && (c[S] = o[w]);
-        } else if (w.startsWith("repeat_")) {
-          const S = w.replace(/^repeat_/, "");
-          i.includes(S) && (h[S] = o[w]);
+        throw new n(h.InsufficientPriviledges);
+      const i = this.sessionServer.authenticators[e.factor1], a = i.secretNames();
+      let c = {}, d = {}, u = {};
+      for (let p in o)
+        if (p.startsWith("new_")) {
+          const S = p.replace(/^new_/, "");
+          a.includes(S) && (d[S] = o[p]);
+        } else if (p.startsWith("old_")) {
+          const S = p.replace(/^old_/, "");
+          a.includes(S) && (c[S] = o[p]);
+        } else if (p.startsWith("repeat_")) {
+          const S = p.replace(/^repeat_/, "");
+          a.includes(S) && (u[S] = o[p]);
         }
-      if (Object.keys(h).length === 0 && (h = void 0), a.validateSecrets(d).length > 0)
-        throw new n(u.PasswordFormat);
-      const p = e.state;
+      if (Object.keys(u).length === 0 && (u = void 0), i.validateSecrets(d).length > 0)
+        throw new n(h.PasswordFormat);
+      const w = e.state;
       try {
         t && (e.state = "active", await this.sessionServer.userStorage.updateUser({ id: e.id, state: e.state })), await this.sessionServer.sessionManager.changeSecrets(
           e.username,
           1,
           d,
-          h,
+          u,
           c
         );
-      } catch (w) {
-        const S = n.asCrossauthError(w);
-        if (l.logger.debug(f({ err: w })), t)
+      } catch (p) {
+        const S = n.asCrossauthError(p);
+        if (l.logger.debug(f({ err: p })), t)
           try {
-            await this.sessionServer.userStorage.updateUser({ id: e.id, state: p });
+            await this.sessionServer.userStorage.updateUser({ id: e.id, state: w });
           } catch (C) {
             l.logger.debug(f({ err: C }));
           }
@@ -3743,11 +3772,11 @@ class we {
   async deleteUser(r) {
     l.logger.debug(f({ msg: "deleteUser" }));
     try {
-      if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
+      if (!this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
       if (this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
+        throw new n(h.InvalidCsrf);
       if (!r.locals.user)
-        throw new n(u.InsufficientPriviledges);
+        throw new n(h.InsufficientPriviledges);
       return await this.sessionServer.userStorage.deleteUserById(r.locals.user.id), r.cookies.delete(this.sessionServer.sessionManager.sessionCookieName, { path: "/" }), r.locals.sessionId = void 0, r.locals.user = void 0, {
         ok: !0
       };
@@ -3789,12 +3818,12 @@ class we {
     l.logger.debug(f({ msg: "updateUser" }));
     let o;
     try {
-      if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
+      if (!this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
       var s = new b();
       if (await s.loadData(r), o = s.toObject(), this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
+        throw new n(h.InvalidCsrf);
       if (!r.locals.user)
-        throw new n(u.InsufficientPriviledges);
+        throw new n(h.InsufficientPriviledges);
       let e = {
         id: r.locals.user.id,
         username: r.locals.user.username,
@@ -3808,16 +3837,16 @@ class we {
       );
       let t = this.sessionServer.validateUserFn(e);
       if (t.length > 0)
-        throw new n(u.FormEntry, t);
-      let { emailVerificationTokenSent: a } = await this.sessionServer.sessionManager.updateUser(r.locals.user, e);
-      if (!a) {
-        const i = await this.sessionServer.userStorage.getUserById(r.locals.user.id);
-        r.locals.user = i.user;
+        throw new n(h.FormEntry, t);
+      let { emailVerificationTokenSent: i } = await this.sessionServer.sessionManager.updateUser(r.locals.user, e);
+      if (!i) {
+        const a = await this.sessionServer.userStorage.getUserById(r.locals.user.id);
+        r.locals.user = a.user;
       }
       return {
         ok: !0,
         formData: o,
-        emailVerificationNeeded: a
+        emailVerificationNeeded: i
       };
     } catch (e) {
       let t = n.asCrossauthError(e, "Couldn't update account");
@@ -3856,41 +3885,41 @@ class we {
     l.logger.debug(f({ msg: "updateUser" }));
     let o;
     try {
-      if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
+      if (!this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
       var s = new b();
       if (await s.loadData(r), o = s.toObject(), this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
+        throw new n(h.InvalidCsrf);
       let t = (e = r.locals.user) == null ? void 0 : e.username;
       if (!this.isSessionUser(r) || !r.locals.user) {
         const d = await this.sessionServer.getSessionData(r, "factor2change");
         d != null && d.username || this.isSessionUser(r) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), t = d == null ? void 0 : d.username;
       }
-      let a = r.locals.user;
-      if (!a && t && (a = (await this.sessionServer.userStorage.getUserByUsername(
+      let i = r.locals.user;
+      if (!i && t && (i = (await this.sessionServer.userStorage.getUserByUsername(
         t,
         {
           skipActiveCheck: !0,
           skipEmailVerifiedCheck: !0
         }
-      )).user), !a)
-        throw new n(u.InsufficientPriviledges);
+      )).user), !i)
+        throw new n(h.InsufficientPriviledges);
       if (!r.locals.sessionId)
-        throw new n(u.Unauthorized);
-      let i = o.factor2;
+        throw new n(h.Unauthorized);
+      let a = o.factor2;
       if (o.factor2 && !this.sessionServer.allowedFactor2Names.includes(o.factor2))
         throw new n(
-          u.Forbidden,
+          h.Forbidden,
           "Illegal second factor " + o.factor2 + " requested"
         );
-      if ((o.factor2 == "none" || o.factor2 == "") && (i = void 0, !r.locals.user))
-        return await this.loginWithUser(a, !0, r);
-      const c = await this.sessionServer.sessionManager.initiateTwoFactorSetup(a, i, r.locals.sessionId);
-      return i ? {
+      if ((o.factor2 == "none" || o.factor2 == "") && (a = void 0, !r.locals.user))
+        return await this.loginWithUser(i, !0, r);
+      const c = await this.sessionServer.sessionManager.initiateTwoFactorSetup(i, a, r.locals.sessionId);
+      return a ? {
         ok: !0,
         formData: o,
         factor2Data: {
-          username: a.username,
-          factor2: i ?? "",
+          username: i.username,
+          factor2: a ?? "",
           userData: c,
           csrfToken: r.locals.csrfToken
         }
@@ -3899,11 +3928,11 @@ class we {
         formData: o
       };
     } catch (t) {
-      let a = n.asCrossauthError(t, "Couldn't update account");
-      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+      let i = n.asCrossauthError(t, "Couldn't update account");
+      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1,
         formData: o
       };
@@ -3932,56 +3961,56 @@ class we {
     l.logger.debug(f({ msg: "updateUser" }));
     let o;
     try {
-      if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
+      if (!this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
       var s = new b();
       if (await s.loadData(r), o = s.toObject(), this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
+        throw new n(h.InvalidCsrf);
       let t = (e = r.locals.user) == null ? void 0 : e.username;
       if (!this.isSessionUser(r) || !r.locals.user) {
-        const h = await this.sessionServer.getSessionData(r, "factor2change");
-        h != null && h.username || this.isSessionUser(r) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), t = h == null ? void 0 : h.username;
+        const u = await this.sessionServer.getSessionData(r, "factor2change");
+        u != null && u.username || this.isSessionUser(r) || (this.sessionServer.unauthorizedUrl && this.sessionServer.redirect(302, this.sessionServer.unauthorizedUrl), this.sessionServer.error(401, "Unauthorized")), t = u == null ? void 0 : u.username;
       }
-      let a = r.locals.user;
-      if (!a && t && (a = (await this.sessionServer.userStorage.getUserByUsername(
+      let i = r.locals.user;
+      if (!i && t && (i = (await this.sessionServer.userStorage.getUserByUsername(
         t,
         {
           skipActiveCheck: !0,
           skipEmailVerifiedCheck: !0
         }
-      )).user), !a)
-        throw new n(u.InsufficientPriviledges);
+      )).user), !i)
+        throw new n(h.InsufficientPriviledges);
       if (!r.locals.sessionId)
-        throw new n(u.Unauthorized);
+        throw new n(h.Unauthorized);
       if (!r.locals.sessionId)
-        throw new n(u.Unauthorized);
-      let i = a.factor2;
-      const c = this.sessionServer.authenticators[i];
+        throw new n(h.Unauthorized);
+      let a = i.factor2;
+      const c = this.sessionServer.authenticators[a];
       if (!c || c.secretNames().length == 0)
         throw new n(
-          u.BadRequest,
+          h.BadRequest,
           "Selected second factor does not have configuration"
         );
       const d = await this.sessionServer.sessionManager.initiateTwoFactorSetup(
-        a,
         i,
+        a,
         r.locals.sessionId
       );
       return {
         ok: !0,
         formData: o,
         factor2Data: {
-          username: a.username,
-          factor2: a.factor2 ?? "",
+          username: i.username,
+          factor2: i.factor2 ?? "",
           userData: d,
           csrfToken: r.locals.csrfToken
         }
       };
     } catch (t) {
-      let a = n.asCrossauthError(t, "Couldn't update account");
-      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+      let i = n.asCrossauthError(t, "Couldn't update account");
+      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1,
         formData: o
       };
@@ -4003,16 +4032,16 @@ async function me(k, r, o = 0, s = 10) {
     const { user: t } = await r.getUserByUsername(k);
     e.push(t);
   } catch (t) {
-    const a = n.asCrossauthError(t);
-    if (a.code != u.UserNotExist)
-      throw l.logger.debug(f({ err: a })), a;
+    const i = n.asCrossauthError(t);
+    if (i.code != h.UserNotExist)
+      throw l.logger.debug(f({ err: i })), i;
     try {
-      const { user: i } = await r.getUserByEmail(k);
-      e.push(i);
-    } catch (i) {
-      const c = n.asCrossauthError(i);
-      if (c.code != u.UserNotExist)
-        throw l.logger.debug(f({ err: c })), a;
+      const { user: a } = await r.getUserByEmail(k);
+      e.push(a);
+    } catch (a) {
+      const c = n.asCrossauthError(a);
+      if (c.code != h.UserNotExist)
+        throw l.logger.debug(f({ err: c })), i;
     }
   }
   return e;
@@ -4031,12 +4060,12 @@ class ke {
     }, this.updateUserEndpoint = {
       actions: {
         default: async (s) => {
-          var a, i, c;
+          var i, a, c;
           const e = await this.getUserFromParam(s);
           return e.exception || !e.user ? {
             ok: !1,
-            error: ((a = e.exception) == null ? void 0 : a.message) ?? "Couldn't get user",
-            errorCode: (i = e.exception) == null ? void 0 : i.code,
+            error: ((i = e.exception) == null ? void 0 : i.message) ?? "Couldn't get user",
+            errorCode: (a = e.exception) == null ? void 0 : a.code,
             errorCodeName: (c = e.exception) == null ? void 0 : c.codeName
           } : await this.updateUser(e.user, s);
         }
@@ -4058,12 +4087,12 @@ class ke {
     }, this.changePasswordEndpoint = {
       actions: {
         default: async (s) => {
-          var a, i, c;
+          var i, a, c;
           const e = await this.getUserFromParam(s);
           return e.exception || !e.user ? {
             ok: !1,
-            error: ((a = e.exception) == null ? void 0 : a.message) ?? "Couldn't get user",
-            errorCode: (i = e.exception) == null ? void 0 : i.code,
+            error: ((i = e.exception) == null ? void 0 : i.message) ?? "Couldn't get user",
+            errorCode: (a = e.exception) == null ? void 0 : a.code,
             errorCodeName: (c = e.exception) == null ? void 0 : c.codeName
           } : await this.changePassword(e.user, s);
         }
@@ -4076,8 +4105,8 @@ class ke {
             editUser: e.user,
             ...this.baseEndpoint(s)
           };
-        let t = {}, a = s.url.searchParams.get("next");
-        return a && (t.next = a), {
+        let t = {}, i = s.url.searchParams.get("next");
+        return i && (t.next = i), {
           ...t,
           editUser: e.user,
           ...this.baseEndpoint(s)
@@ -4099,15 +4128,15 @@ class ke {
         default: async (s) => await this.deleteUser(s)
       },
       load: async (s) => {
-        var t, a, i;
+        var t, i, a;
         const e = await this.getUserFromParam(s);
         return e.exception || !e.user ? {
           error: "User doesn't exist",
           errorCode: (t = e.exception) == null ? void 0 : t.code,
-          errorCodeName: (a = e.exception) == null ? void 0 : a.codeName,
+          errorCodeName: (i = e.exception) == null ? void 0 : i.codeName,
           ...this.baseEndpoint(s)
         } : {
-          username: (i = e.user) == null ? void 0 : i.username,
+          username: (a = e.user) == null ? void 0 : a.username,
           ...this.baseEndpoint(s)
         };
       }
@@ -4156,9 +4185,9 @@ class ke {
    */
   async searchUsers(r, o, s, e) {
     try {
-      if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
+      if (!this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
       (!r.locals.user || !m.isAdminFn(r.locals.user)) && this.sessionServer.error(401);
-      let t = [], a = [], i = [];
+      let t = [], i = [], a = [];
       if (!s)
         try {
           const d = r.url.searchParams.get("skip");
@@ -4180,7 +4209,7 @@ class ke {
         this.sessionServer.userStorage,
         s,
         e
-      ), s > 0 && (a = await this.userSearchFn(
+      ), s > 0 && (i = await this.userSearchFn(
         o,
         this.sessionServer.userStorage,
         s - 1,
@@ -4188,7 +4217,7 @@ class ke {
       ))) : (t = await this.sessionServer.userStorage.getUsers(
         s,
         e
-      ), t.length == e && (i = await this.sessionServer.userStorage.getUsers(
+      ), t.length == e && (a = await this.sessionServer.userStorage.getUsers(
         s + e,
         1
       ))), {
@@ -4196,17 +4225,17 @@ class ke {
         users: t,
         skip: s,
         take: e,
-        hasPrevious: a.length > 0,
-        hasNext: i.length > 0,
+        hasPrevious: i.length > 0,
+        hasNext: a.length > 0,
         search: o
       };
     } catch (t) {
-      const a = n.asCrossauthError(t);
-      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
+      const i = n.asCrossauthError(t);
+      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
         ok: !1,
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         hasPrevious: !1,
         hasNext: !1,
         skip: s ?? 0,
@@ -4249,10 +4278,10 @@ class ke {
   async updateUser(r, o) {
     let s;
     try {
-      if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
+      if (!this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
       var e = new b();
-      if (await e.loadData(o), s = e.toObject(), (!o.locals.user || !m.isAdminFn(o.locals.user)) && this.sessionServer.error(401), this.isSessionUser(o) && this.sessionServer.enableCsrfProtection && !o.locals.csrfToken) throw new n(u.InvalidCsrf);
-      const t = r.factor2, a = r.state;
+      if (await e.loadData(o), s = e.toObject(), (!o.locals.user || !m.isAdminFn(o.locals.user)) && this.sessionServer.error(401), this.isSessionUser(o) && this.sessionServer.enableCsrfProtection && !o.locals.csrfToken) throw new n(h.InvalidCsrf);
+      const t = r.factor2, i = r.state;
       r.state = s.state ?? "active", r = this.sessionServer.updateUserFn(
         r,
         o,
@@ -4262,30 +4291,30 @@ class ke {
           ...this.sessionServer.userStorage.adminEditableFields
         }
       );
-      const i = r.factor2 && r.factor2 != "none" && r.factor2 != t;
-      if (i && !(r.state == a || r.state == "factor2ResetNeeded"))
-        throw new n(u.BadRequest, "Cannot change both factor2 and state at the same time");
-      i && (r.state = N.factor2ResetNeeded, l.logger.warn(f({
-        msg: `Setting state for user to ${N.factor2ResetNeeded}`,
+      const a = r.factor2 && r.factor2 != "none" && r.factor2 != t;
+      if (a && !(r.state == i || r.state == "factor2ResetNeeded"))
+        throw new n(h.BadRequest, "Cannot change both factor2 and state at the same time");
+      a && (r.state = I.factor2ResetNeeded, l.logger.warn(f({
+        msg: `Setting state for user to ${I.factor2ResetNeeded}`,
         username: r.username
       })));
       let c = this.sessionServer.validateUserFn(r);
       if (c.length > 0)
-        throw new n(u.FormEntry, c);
+        throw new n(h.FormEntry, c);
       const d = await this.sessionServer.sessionManager.updateUser(r, r, !0, !0);
-      let h;
-      return d.emailVerificationTokenSent ? h = "An email verification token has been sent to the user" : d.passwordResetTokenSent && (h = "A password reset token has been sent to the user"), {
+      let u;
+      return d.emailVerificationTokenSent ? u = "An email verification token has been sent to the user" : d.passwordResetTokenSent && (u = "A password reset token has been sent to the user"), {
         ok: !0,
         formData: s,
-        info: h
+        info: u
       };
     } catch (t) {
       if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t, 401)) throw t;
-      let a = n.asCrossauthError(t, "Couldn't log in");
-      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+      let i = n.asCrossauthError(t, "Couldn't log in");
+      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1,
         formData: s
       };
@@ -4316,33 +4345,33 @@ class ke {
     try {
       var e = new b();
       if (await e.loadData(o), s = e.toObject(), (!o.locals.user || !m.isAdminFn(o.locals.user)) && this.sessionServer.error(401), this.isSessionUser(o) && this.sessionServer.enableCsrfProtection && !o.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
-      const t = this.sessionServer.authenticators[r.factor1], a = t.secretNames();
-      let i = {}, c = {}, d = {};
+        throw new n(h.InvalidCsrf);
+      const t = this.sessionServer.authenticators[r.factor1], i = t.secretNames();
+      let a = {}, c = {}, d = {};
       for (let g in s)
         if (g.startsWith("new_")) {
-          const p = g.replace(/^new_/, "");
-          a.includes(p) && (c[p] = s[g]);
+          const w = g.replace(/^new_/, "");
+          i.includes(w) && (c[w] = s[g]);
         } else if (g.startsWith("old_")) {
-          const p = g.replace(/^old_/, "");
-          a.includes(p) && (i[p] = s[g]);
+          const w = g.replace(/^old_/, "");
+          i.includes(w) && (a[w] = s[g]);
         } else if (g.startsWith("repeat_")) {
-          const p = g.replace(/^repeat_/, "");
-          a.includes(p) && (d[p] = s[g]);
+          const w = g.replace(/^repeat_/, "");
+          i.includes(w) && (d[w] = s[g]);
         }
-      if (Object.keys(d).length === 0 && (d = void 0), Object.keys(i).length === 0 && (i = void 0), t.validateSecrets(c).length > 0)
-        throw new n(u.PasswordFormat);
+      if (Object.keys(d).length === 0 && (d = void 0), Object.keys(a).length === 0 && (a = void 0), t.validateSecrets(c).length > 0)
+        throw new n(h.PasswordFormat);
       try {
         await this.sessionServer.sessionManager.changeSecrets(
           r.username,
           1,
           c,
           d,
-          i
+          a
         );
       } catch (g) {
-        const p = n.asCrossauthError(g);
-        throw l.logger.debug(f({ err: g })), p;
+        const w = n.asCrossauthError(g);
+        throw l.logger.debug(f({ err: g })), w;
       }
       return {
         ok: !0,
@@ -4350,11 +4379,11 @@ class ke {
       };
     } catch (t) {
       if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t, 401)) throw t;
-      let a = n.asCrossauthError(t, "Couldn't change password");
-      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+      let i = n.asCrossauthError(t, "Couldn't change password");
+      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1,
         formData: s
       };
@@ -4408,17 +4437,17 @@ class ke {
   async createUser(r) {
     let o;
     try {
-      if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
+      if (!this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
       var s = new b();
       await s.loadData(r), o = s.toObject();
       const e = s.get("username") ?? "";
       let t;
       if ((!r.locals.user || !m.isAdminFn(r.locals.user)) && this.sessionServer.error(401), this.isSessionUser(r) && this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
-      if (e == "") throw new n(u.InvalidUsername, "Username field may not be empty");
+        throw new n(h.InvalidCsrf);
+      if (e == "") throw new n(h.InvalidUsername, "Username field may not be empty");
       if (o.factor2 || (o.factor2 = this.sessionServer.allowedFactor2Names[0]), o.factor2 && !this.sessionServer.allowedFactor2Names.includes(o.factor2 ?? "none"))
         throw new n(
-          u.Forbidden,
+          h.Forbidden,
           "Illegal second factor " + o.factor2 + " requested"
         );
       (o.factor2 == "none" || o.factor2 == "") && (o.factor2 = void 0), t = this.sessionServer.createUserFn(
@@ -4427,39 +4456,40 @@ class ke {
         {
           ...this.sessionServer.userStorage.userEditableFields,
           ...this.sessionServer.userStorage.adminEditableFields
-        }
+        },
+        this.sessionServer.adminAllowedFactor1
       );
-      const a = this.sessionServer.authenticators[t.factor1].secretNames();
-      let i = !0;
-      for (let w of a)
-        !o[w] && !o["repeat_" + w] && (i = !1);
+      const i = this.sessionServer.authenticators[t.factor1].secretNames();
+      let a = !0;
+      for (let p of i)
+        !o[p] && !o["repeat_" + p] && (a = !1);
       let c = [], d = {};
-      if (i) {
+      if (a) {
         c = this.sessionServer.authenticators[t.factor1].validateSecrets(o);
-        for (let w in o)
-          if (w.startsWith("repeat_")) {
-            const S = w.replace(/^repeat_/, "");
-            a.includes(S) && (d[S] = o[w]);
+        for (let p in o)
+          if (p.startsWith("repeat_")) {
+            const S = p.replace(/^repeat_/, "");
+            i.includes(S) && (d[S] = o[p]);
           }
         Object.keys(d).length === 0 && (d = void 0);
       }
-      i ? o.factor2 != null && (t.state = N.factor2ResetNeeded) : o.factor2 == null ? t.state = N.passwordResetNeeded : t.state = N.passwordAndFactor2ResetNeeded;
+      a ? o.factor2 != null && (t.state = I.factor2ResetNeeded) : o.factor2 == null ? t.state = I.passwordResetNeeded : t.state = I.passwordAndFactor2ResetNeeded;
       let g = [...this.sessionServer.validateUserFn(t), ...c];
       if (g.length > 0)
-        throw new n(u.FormEntry, g);
-      const p = await this.sessionServer.sessionManager.createUser(
+        throw new n(h.FormEntry, g);
+      const w = await this.sessionServer.sessionManager.createUser(
         t,
         o,
         d,
         !0,
-        !i
+        !a
       );
-      if (!i) {
-        let w = o.username;
-        if ("user_email" in o && (w = o.user_email), oe.validateEmail(w), !w) throw new n(u.FormEntry, "No password given but no email address found either");
-        await this.sessionServer.sessionManager.requestPasswordReset(w);
+      if (!a) {
+        let p = o.username;
+        if ("user_email" in o && (p = o.user_email), oe.validateEmail(p), !p) throw new n(h.FormEntry, "No password given but no email address found either");
+        await this.sessionServer.sessionManager.requestPasswordReset(p);
       }
-      return { ok: !0, user: p, formData: o };
+      return { ok: !0, user: w, formData: o };
     } catch (e) {
       let t = n.asCrossauthError(e, "Couldn't create user");
       return l.logger.debug(f({ err: t })), l.logger.error(f({ cerr: t })), {
@@ -4485,12 +4515,12 @@ class ke {
        *     exception was raised
        */
   async deleteUser(r) {
-    if (l.logger.debug(f({ msg: "deleteUser" })), !this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
+    if (l.logger.debug(f({ msg: "deleteUser" })), !this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
     try {
       const o = r.params.id;
-      if (!o) throw new n(u.BadRequest, "User ID is undefined");
+      if (!o) throw new n(h.BadRequest, "User ID is undefined");
       if (this.sessionServer.enableCsrfProtection && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
+        throw new n(h.InvalidCsrf);
       return (!r.locals.user || !m.isAdminFn(r.locals.user)) && this.sessionServer.error(401), await this.sessionServer.userStorage.deleteUserById(o), {
         ok: !0
       };
@@ -4515,9 +4545,9 @@ class ke {
   async getUserFromParam(r, o = "id") {
     let s = r.params[o];
     if (!s)
-      return { exception: new n(u.BadRequest, "Must give user id") };
+      return { exception: new n(h.BadRequest, "Must give user id") };
     try {
-      if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
+      if (!this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
       return { user: (await this.sessionServer.userStorage.getUserById(s, { skipEmailVerifiedCheck: !0, skipActiveCheck: !0 })).user };
     } catch (e) {
       return { exception: n.asCrossauthError(e) };
@@ -4528,18 +4558,18 @@ async function Se(k, r, o, s, e) {
   let t = [];
   if (o > 0) return [];
   try {
-    const a = await r.getClientById(k);
-    t.push(a);
-  } catch (a) {
-    const i = n.asCrossauthError(a);
-    if (i.code != u.UserNotExist)
-      throw l.logger.debug(f({ err: i })), i;
+    const i = await r.getClientById(k);
+    t.push(i);
+  } catch (i) {
+    const a = n.asCrossauthError(i);
+    if (a.code != h.UserNotExist)
+      throw l.logger.debug(f({ err: a })), a;
     try {
       t = await r.getClientByName(k, e);
     } catch (c) {
       const d = n.asCrossauthError(c);
-      if (d.code != u.UserNotExist)
-        throw l.logger.debug(f({ err: d })), i;
+      if (d.code != h.UserNotExist)
+        throw l.logger.debug(f({ err: d })), a;
     }
   }
   return t;
@@ -4594,65 +4624,65 @@ class X {
    */
   async searchClients_internal(r, o, s, e, t) {
     try {
-      if (!this.sessionServer.userStorage) throw new n(u.Configuration, "Must provide user storage to use this function");
-      if (!this.sessionServer.clientStorage) throw new n(u.Configuration, "Must provide client storage to use this function");
+      if (!this.sessionServer.userStorage) throw new n(h.Configuration, "Must provide user storage to use this function");
+      if (!this.sessionServer.clientStorage) throw new n(h.Configuration, "Must provide client storage to use this function");
       if (!r.locals.user)
         throw this.redirect(302, this.loginUrl + "?next=" + encodeURIComponent(r.request.url));
-      let a = [], i = [], c = [];
+      let i = [], a = [], c = [];
       if (!s)
         try {
-          const h = r.url.searchParams.get("skip");
-          h && (s = parseInt(h));
-        } catch (h) {
-          l.logger.warn(f({ cerr: h, msg: "skip parameter is not an integer" }));
+          const u = r.url.searchParams.get("skip");
+          u && (s = parseInt(u));
+        } catch (u) {
+          l.logger.warn(f({ cerr: u, msg: "skip parameter is not an integer" }));
         }
       if (s || (s = 0), !e)
         try {
-          const h = r.url.searchParams.get("take");
-          h && (e = parseInt(h));
-        } catch (h) {
-          l.logger.warn(f({ cerr: h, msg: "take parameter is not an integer" }));
+          const u = r.url.searchParams.get("take");
+          u && (e = parseInt(u));
+        } catch (u) {
+          l.logger.warn(f({ cerr: u, msg: "take parameter is not an integer" }));
         }
       e || (e = 10);
       const d = r.url.searchParams.get("search");
-      return !o && d != null && d != "" && (o = d), o || (o = ""), o.length == 0 && (o = void 0), o ? (a = await this.clientSearchFn(
+      return !o && d != null && d != "" && (o = d), o || (o = ""), o.length == 0 && (o = void 0), o ? (i = await this.clientSearchFn(
         o,
         this.sessionServer.clientStorage,
         s,
         e
-      ), s > 0 && (i = await this.clientSearchFn(
+      ), s > 0 && (a = await this.clientSearchFn(
         o,
         this.sessionServer.clientStorage,
         s - 1,
         1,
         t
-      ))) : (a = await this.sessionServer.clientStorage.getClients(
+      ))) : (i = await this.sessionServer.clientStorage.getClients(
         s,
         e,
         t
-      ), a.length == e && (c = await this.sessionServer.clientStorage.getClients(
+      ), i.length == e && (c = await this.sessionServer.clientStorage.getClients(
         s + e,
         1,
         t
       ))), {
         ok: !0,
-        clients: a,
+        clients: i,
         skip: s,
         take: e,
-        hasPrevious: i.length > 0,
+        hasPrevious: a.length > 0,
         hasNext: c.length > 0,
         search: o,
         clientUserId: t
       };
-    } catch (a) {
-      if (m.isSvelteKitRedirect(a) || m.isSvelteKitRedirect(a))
-        throw a;
-      const i = n.asCrossauthError(a);
-      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
+    } catch (i) {
+      if (m.isSvelteKitRedirect(i) || m.isSvelteKitRedirect(i))
+        throw i;
+      const a = n.asCrossauthError(i);
+      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
         ok: !1,
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         hasPrevious: !1,
         hasNext: !1,
         skip: s ?? 0,
@@ -4673,23 +4703,23 @@ class X {
     var s, e, t;
     const o = r.params.client_id;
     try {
-      if (!o) throw new n(u.BadRequest, "No client ID specified");
-      if (!this.clientStorage) throw new n(u.Configuration, "No client storage specified");
-      const a = await this.clientStorage.getClientById(o), i = a.userid == null ? void 0 : await ((e = (s = this.sessionServer) == null ? void 0 : s.userStorage) == null ? void 0 : e.getUserById(a.userid)), c = (t = i == null ? void 0 : i.user) == null ? void 0 : t.username;
+      if (!o) throw new n(h.BadRequest, "No client ID specified");
+      if (!this.clientStorage) throw new n(h.Configuration, "No client storage specified");
+      const i = await this.clientStorage.getClientById(o), a = i.userid == null ? void 0 : await ((e = (s = this.sessionServer) == null ? void 0 : s.userStorage) == null ? void 0 : e.getUserById(i.userid)), c = (t = a == null ? void 0 : a.user) == null ? void 0 : t.username;
       return {
         ok: !0,
-        client: a,
+        client: i,
         validFlows: this.validFlows,
         valid_flowNames: this.valid_flowNames,
         client_id: o,
         clientUsername: c
       };
-    } catch (a) {
-      let i = n.asCrossauthError(a, "Couldn't load client");
-      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+    } catch (i) {
+      let a = n.asCrossauthError(i, "Couldn't load client");
+      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1,
         validFlows: this.validFlows,
         valid_flowNames: this.valid_flowNames,
@@ -4710,56 +4740,56 @@ class X {
    * @returns {@link UpdateClientFormData}.  If a new secret was created, it will be placed as plaintext in the client that is returned.
    */
   async updateClient_internal(r, o) {
-    var t, a;
+    var t, i;
     let s;
     try {
-      const i = r.params.client_id;
-      if (!i) throw new n(u.BadRequest, "No client ID given");
+      const a = r.params.client_id;
+      if (!a) throw new n(h.BadRequest, "No client ID given");
       var e = new b();
       if (await e.loadData(r), s = e.toObject(), this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
+        throw new n(h.InvalidCsrf);
       const c = !s.redirect_uri || s.redirect_uri.trim().length == 0 ? [] : s.redirect_uri.trim().split(/[, ][ \t\n]*/);
       let d = [];
       for (let C of c)
         try {
           B.validateUri(C);
-        } catch (T) {
-          l.logger.error(f({ err: T })), d.push("[" + C + "]");
+        } catch (U) {
+          l.logger.error(f({ err: U })), d.push("[" + C + "]");
         }
       if (d.length > 0)
         throw new n(
-          u.BadRequest,
+          h.BadRequest,
           "The following redirect URIs are invalid: " + d.join(" ")
         );
-      let h = [];
+      let u = [];
       for (let C of this.validFlows)
-        C in s && h.push(C);
+        C in s && u.push(C);
       const g = {};
-      if (g.client_name = s.client_name, g.confidential = e.getAsBoolean("confidential") ?? !1, g.valid_flow = h, g.redirect_uri = c, o) {
+      if (g.client_name = s.client_name, g.confidential = e.getAsBoolean("confidential") ?? !1, g.valid_flow = u, g.redirect_uri = c, o) {
         let C = s.userid ?? void 0;
         if (C && ((t = this.sessionServer) != null && t.userStorage)) {
-          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
-          C = T.id;
+          const { user: U } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
+          C = U.id;
         }
         g.userid = s.userid ? Number(s.userid) : null;
       }
-      const p = e.getAsBoolean("resetSecret");
-      if (!this.clientManager) throw new n(u.Configuration, "Cannot call this endpoint as you did not provide a clientStorage");
-      const { client: w, newSecret: S } = await this.clientManager.updateClient(
-        i,
+      const w = e.getAsBoolean("resetSecret");
+      if (!this.clientManager) throw new n(h.Configuration, "Cannot call this endpoint as you did not provide a clientStorage");
+      const { client: p, newSecret: S } = await this.clientManager.updateClient(
+        a,
         g,
-        p
+        w
       );
       return {
         ok: !0,
-        client: w,
+        client: p,
         formData: s,
         //plaintextSecret: resetSecret ? formData.client_secret : undefined,
-        plaintextSecret: S && w.client_secret ? w.client_secret : void 0
+        plaintextSecret: S && p.client_secret ? p.client_secret : void 0
       };
-    } catch (i) {
-      if (m.isSvelteKitRedirect(i) || m.isSvelteKitError(i)) throw i;
-      let c = n.asCrossauthError(i, "Couldn't update client");
+    } catch (a) {
+      if (m.isSvelteKitRedirect(a) || m.isSvelteKitError(a)) throw a;
+      let c = n.asCrossauthError(a, "Couldn't update client");
       return l.logger.debug(f({ err: c })), l.logger.error(f({ cerr: c })), {
         error: c.message,
         errorCode: c.code,
@@ -4778,7 +4808,7 @@ class X {
    * @returns {@link CreateClientPageData}.  
    */
   async emptyClient_internal(r, o) {
-    var e, t, a, i, c, d, h;
+    var e, t, i, a, c, d, u;
     try {
       var s = new b();
       await s.loadData(r);
@@ -4786,33 +4816,33 @@ class X {
       if (o) {
         const S = r.url.searchParams.get("userid");
         if (S && ((e = this.sessionServer) != null && e.userStorage)) {
-          const { user: T } = await ((t = this.sessionServer) == null ? void 0 : t.userStorage.getUserById(S));
-          g = T.id;
+          const { user: U } = await ((t = this.sessionServer) == null ? void 0 : t.userStorage.getUserById(S));
+          g = U.id;
         }
         const C = s.get("userid");
-        if (C && ((a = this.sessionServer) != null && a.userStorage)) {
-          const { user: T } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
-          g = T.id;
+        if (C && ((i = this.sessionServer) != null && i.userStorage)) {
+          const { user: U } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
+          g = U.id;
         }
       } else {
-        if (!r.locals.user) throw new n(u.Unauthorized);
+        if (!r.locals.user) throw new n(h.Unauthorized);
         g = r.locals.user.id;
       }
-      if (!this.clientStorage) throw new n(u.Configuration, "No client storage specified");
-      const p = g == null ? void 0 : await ((d = (c = this.sessionServer) == null ? void 0 : c.userStorage) == null ? void 0 : d.getUserById(g)), w = (h = p == null ? void 0 : p.user) == null ? void 0 : h.username;
+      if (!this.clientStorage) throw new n(h.Configuration, "No client storage specified");
+      const w = g == null ? void 0 : await ((d = (c = this.sessionServer) == null ? void 0 : c.userStorage) == null ? void 0 : d.getUserById(g)), p = (u = w == null ? void 0 : w.user) == null ? void 0 : u.username;
       return {
         ok: !0,
         validFlows: this.validFlows,
         valid_flowNames: this.valid_flowNames,
         clientUserId: g,
-        clientUsername: w
+        clientUsername: p
       };
     } catch (g) {
-      let p = n.asCrossauthError(g, "Couldn't initialize new client");
-      return l.logger.debug(f({ err: p })), l.logger.error(f({ cerr: p })), {
-        error: p.message,
-        errorCode: p.code,
-        errorCodeName: p.codeName,
+      let w = n.asCrossauthError(g, "Couldn't initialize new client");
+      return l.logger.debug(f({ err: w })), l.logger.error(f({ cerr: w })), {
+        error: w.message,
+        errorCode: w.code,
+        errorCodeName: w.codeName,
         ok: !1,
         validFlows: this.validFlows,
         valid_flowNames: this.valid_flowNames
@@ -4831,7 +4861,7 @@ class X {
    * @returns {@link UpdateClientFormData}.  If a secret was created, it will be placed as plaintext in the client that is returned.  A random `client_id` is created.
    */
   async createClient_internal(r, o) {
-    var t, a, i, c;
+    var t, i, a, c;
     let s;
     try {
       var e = new b();
@@ -4840,40 +4870,40 @@ class X {
       if (o) {
         const C = e.get("userid");
         if (C && ((t = this.sessionServer) != null && t.userStorage)) {
-          const { user: T } = await ((a = this.sessionServer) == null ? void 0 : a.userStorage.getUserById(C));
-          d = T.id;
+          const { user: U } = await ((i = this.sessionServer) == null ? void 0 : i.userStorage.getUserById(C));
+          d = U.id;
         }
       } else {
-        if (!r.locals.user) throw new n(u.Unauthorized);
+        if (!r.locals.user) throw new n(h.Unauthorized);
         d = r.locals.user.id;
       }
-      if (!this.clientStorage) throw new n(u.Configuration, "No client storage specified");
-      if (d && await ((c = (i = this.sessionServer) == null ? void 0 : i.userStorage) == null ? void 0 : c.getUserById(d)), this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
-      const h = !s.redirect_uri || s.redirect_uri.trim().length == 0 ? [] : s.redirect_uri.trim().split(/[, ][ \t\n]*/);
+      if (!this.clientStorage) throw new n(h.Configuration, "No client storage specified");
+      if (d && await ((c = (a = this.sessionServer) == null ? void 0 : a.userStorage) == null ? void 0 : c.getUserById(d)), this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
+        throw new n(h.InvalidCsrf);
+      const u = !s.redirect_uri || s.redirect_uri.trim().length == 0 ? [] : s.redirect_uri.trim().split(/[, ][ \t\n]*/);
       let g = [];
-      for (let C of h)
+      for (let C of u)
         try {
           B.validateUri(C);
-        } catch (T) {
-          l.logger.error(f({ err: T })), g.push("[" + C + "]");
+        } catch (U) {
+          l.logger.error(f({ err: U })), g.push("[" + C + "]");
         }
       if (g.length > 0)
         throw new n(
-          u.BadRequest,
+          h.BadRequest,
           "The following redirect URIs are invalid: " + g.join(" ")
         );
-      let p = [];
+      let w = [];
       for (let C of this.validFlows)
-        C in s && p.push(C);
-      const w = {};
-      if (w.client_name = s.client_name, w.confidential = e.getAsBoolean("confidential"), w.valid_flow = p, w.redirect_uri = h, o && (w.userid = s.userid ? Number(s.userid) : null), !this.clientManager) throw new n(u.Configuration, "Cannot call this endpoint as you did not provide a clientStorage");
+        C in s && w.push(C);
+      const p = {};
+      if (p.client_name = s.client_name, p.confidential = e.getAsBoolean("confidential"), p.valid_flow = w, p.redirect_uri = u, o && (p.userid = s.userid ? Number(s.userid) : null), !this.clientManager) throw new n(h.Configuration, "Cannot call this endpoint as you did not provide a clientStorage");
       return {
         ok: !0,
         client: await this.clientManager.createClient(
           s.client_name,
-          h,
-          p,
+          u,
+          w,
           e.getAsBoolean("confidential") ?? !1,
           d
         ),
@@ -4881,11 +4911,11 @@ class X {
       };
     } catch (d) {
       if (m.isSvelteKitRedirect(d) || m.isSvelteKitError(d)) throw d;
-      let h = n.asCrossauthError(d, "Couldn't create client");
-      return l.logger.debug(f({ err: h })), l.logger.error(f({ cerr: h })), {
-        error: h.message,
-        errorCode: h.code,
-        errorCodeName: h.codeName,
+      let u = n.asCrossauthError(d, "Couldn't create client");
+      return l.logger.debug(f({ err: u })), l.logger.error(f({ cerr: u })), {
+        error: u.message,
+        errorCode: u.code,
+        errorCodeName: u.codeName,
         ok: !1,
         formData: s
       };
@@ -4902,21 +4932,21 @@ class X {
     var s, e, t;
     const o = r.params.client_id;
     try {
-      if (!o) throw new n(u.BadRequest, "No client ID specified");
-      if (!this.clientStorage) throw new n(u.Configuration, "No client storage specified");
-      const a = await this.clientStorage.getClientById(o), i = a.userid == null ? void 0 : await ((e = (s = this.sessionServer) == null ? void 0 : s.userStorage) == null ? void 0 : e.getUserById(a.userid)), c = (t = i == null ? void 0 : i.user) == null ? void 0 : t.username;
+      if (!o) throw new n(h.BadRequest, "No client ID specified");
+      if (!this.clientStorage) throw new n(h.Configuration, "No client storage specified");
+      const i = await this.clientStorage.getClientById(o), a = i.userid == null ? void 0 : await ((e = (s = this.sessionServer) == null ? void 0 : s.userStorage) == null ? void 0 : e.getUserById(i.userid)), c = (t = a == null ? void 0 : a.user) == null ? void 0 : t.username;
       return {
         ok: !0,
-        client: a,
+        client: i,
         client_id: o,
         clientUsername: c
       };
-    } catch (a) {
-      let i = n.asCrossauthError(a, "Couldn't load client");
-      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
-        error: i.message,
-        errorCode: i.code,
-        errorCodeName: i.codeName,
+    } catch (i) {
+      let a = n.asCrossauthError(i, "Couldn't load client");
+      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
+        error: a.message,
+        errorCode: a.code,
+        errorCodeName: a.codeName,
         ok: !1,
         client_id: o
       };
@@ -4933,23 +4963,23 @@ class X {
     var s, e;
     try {
       if (this.sessionServer.enableCsrfProtection && r.locals.authType == "cookie" && !r.locals.csrfToken)
-        throw new n(u.InvalidCsrf);
+        throw new n(h.InvalidCsrf);
       const t = r.params.client_id;
-      if (!t) throw new n(u.BadRequest, "No client ID given");
-      if (!this.clientStorage) throw new n(u.Configuration, "No client storage specified");
-      const a = await ((s = this.clientStorage) == null ? void 0 : s.getClientById(t));
-      if (!o && a.userid != ((e = r.locals.user) == null ? void 0 : e.id))
+      if (!t) throw new n(h.BadRequest, "No client ID given");
+      if (!this.clientStorage) throw new n(h.Configuration, "No client storage specified");
+      const i = await ((s = this.clientStorage) == null ? void 0 : s.getClientById(t));
+      if (!o && i.userid != ((e = r.locals.user) == null ? void 0 : e.id))
         throw this.error(401, "Unauthorized");
       return await this.clientStorage.deleteClient(t), {
         ok: !0
       };
     } catch (t) {
       if (m.isSvelteKitRedirect(t) || m.isSvelteKitError(t)) throw t;
-      let a = n.asCrossauthError(t, "Couldn't delete client");
-      return l.logger.debug(f({ err: a })), l.logger.error(f({ cerr: a })), {
-        error: a.message,
-        errorCode: a.code,
-        errorCodeName: a.codeName,
+      let i = n.asCrossauthError(t, "Couldn't delete client");
+      return l.logger.debug(f({ err: i })), l.logger.error(f({ cerr: i })), {
+        error: i.message,
+        errorCode: i.code,
+        errorCodeName: i.codeName,
         ok: !1
       };
     }
@@ -5040,7 +5070,7 @@ class Ce extends X {
       throw this.redirect(302, this.loginUrl + "?next=" + encodeURIComponent(r.request.url));
     try {
       const s = r.params.client_id;
-      if (!s) throw new n(u.BadRequest, "No client ID given");
+      if (!s) throw new n(h.BadRequest, "No client ID given");
       const e = await ((o = this.clientStorage) == null ? void 0 : o.getClientById(s));
       if ((e == null ? void 0 : e.userid) != r.locals.user.id) return this.error(401, "Access denied");
     } catch (s) {
@@ -5066,7 +5096,7 @@ class Ce extends X {
       throw this.redirect(302, this.loginUrl + "?next=" + encodeURIComponent(r.request.url));
     try {
       const s = r.params.client_id;
-      if (!s) throw new n(u.BadRequest, "No client ID given");
+      if (!s) throw new n(h.BadRequest, "No client ID given");
       const e = await ((o = this.clientStorage) == null ? void 0 : o.getClientById(s));
       if ((e == null ? void 0 : e.userid) != r.locals.user.id) return this.error(401, "Access denied");
     } catch (s) {
@@ -5090,7 +5120,7 @@ class Ce extends X {
       throw this.redirect(302, this.loginUrl + "?next=" + encodeURIComponent(r.request.url));
     try {
       const s = r.params.client_id;
-      if (!s) throw new n(u.BadRequest, "No client ID given");
+      if (!s) throw new n(h.BadRequest, "No client ID given");
       const e = await ((o = this.clientStorage) == null ? void 0 : o.getClientById(s));
       if ((e == null ? void 0 : e.userid) != r.locals.user.id) return this.error(401, "Access denied");
     } catch (s) {
@@ -5114,7 +5144,7 @@ class Ce extends X {
       throw this.redirect(302, this.loginUrl + "?next=" + encodeURIComponent(r.request.url));
     try {
       const s = r.params.client_id;
-      if (!s) throw new n(u.BadRequest, "No client ID given");
+      if (!s) throw new n(h.BadRequest, "No client ID given");
       const e = await ((o = this.clientStorage) == null ? void 0 : o.getClientById(s));
       if ((e == null ? void 0 : e.userid) != r.locals.user.id) return this.error(401, "Access denied");
     } catch (s) {
@@ -5266,47 +5296,47 @@ function Ee(k) {
   let r = [];
   return k.username == null ? r.push("Username must be given") : k.username.length < 2 ? r.push("Username must be at least 2 characters") : k.username.length > 254 && r.push("Username must be no longer than 254 characters"), r;
 }
-function _e(k, r, o) {
+function _e(k, r, o, s = ["localpassword"]) {
   var a;
-  let e = {
+  let t = {
     username: r.username ?? "",
     state: "active"
   };
-  const t = k.locals.user && m.isAdminFn(k.locals.user);
-  for (let i in r) {
-    let c = i.replace(/^user_/, "");
-    if (i.startsWith("user_") && (t || o.includes(c)))
-      if ("type_" + c in r) {
-        if (r["type_" + c] == "string")
-          e[c] = r[i];
-        else if (r["type_" + c] == "number" || r["type_" + c] == "integer" || r["type_" + c] == "float")
-          e[c] = Number(r[i]);
-        else if (r["type_" + c] == "boolean") {
-          const d = (a = r[i]) == null ? void 0 : a.toLocaleLowerCase();
-          e[c] = d == "1" || d == "y" || d == "t" || d == "yes" || d == "true";
+  const i = k.locals.user && m.isAdminFn(k.locals.user);
+  for (let c in r) {
+    let d = c.replace(/^user_/, "");
+    if (c.startsWith("user_") && (i || o.includes(d)))
+      if ("type_" + d in r) {
+        if (r["type_" + d] == "string")
+          t[d] = r[c];
+        else if (r["type_" + d] == "number" || r["type_" + d] == "integer" || r["type_" + d] == "float")
+          t[d] = Number(r[c]);
+        else if (r["type_" + d] == "boolean") {
+          const u = (a = r[c]) == null ? void 0 : a.toLocaleLowerCase();
+          t[d] = u == "1" || u == "y" || u == "t" || u == "yes" || u == "true";
         }
       } else
-        e[c] = r[i];
+        t[d] = r[c];
   }
-  return e.factor1 = "localpassword", e.factor2 = r.factor2, e;
+  return t.factor1 = "localpassword", r.factor1 && s.includes(r.factor1) && (t.factor1 = r.factor1), t.factor2 = r.factor2, t;
 }
 function ve(k, r, o, s) {
   var t;
   const e = r.locals.user && m.isAdminFn(r.locals.user);
-  for (let a in o) {
-    let i = a.replace(/^user_/, "");
-    if (a.startsWith("user_") && (e || s.includes(i)))
-      if ("type_" + i in o) {
-        if (o["type_" + i] == "string")
-          k[i] = o[a];
-        else if (o["type_" + i] == "number" || o["type_" + i] == "integer" || o["type_" + i] == "float")
-          k[i] = Number(o[a]);
-        else if (o["type_" + i] == "boolean") {
-          const c = (t = o[a]) == null ? void 0 : t.toLocaleLowerCase();
-          k[i] = c == "1" || c == "y" || c == "t" || c == "yes" || c == "true";
+  for (let i in o) {
+    let a = i.replace(/^user_/, "");
+    if (i.startsWith("user_") && (e || s.includes(a)))
+      if ("type_" + a in o) {
+        if (o["type_" + a] == "string")
+          k[a] = o[i];
+        else if (o["type_" + a] == "number" || o["type_" + a] == "integer" || o["type_" + a] == "float")
+          k[a] = Number(o[i]);
+        else if (o["type_" + a] == "boolean") {
+          const c = (t = o[i]) == null ? void 0 : t.toLocaleLowerCase();
+          k[a] = c == "1" || c == "y" || c == "t" || c == "yes" || c == "true";
         }
       } else
-        k[i] = o[a];
+        k[a] = o[i];
   }
   return k;
 }
@@ -5319,7 +5349,7 @@ class H {
    * @param options See {@link SvelteKitSessionServerOptions}.
    */
   constructor(r, o, s = {}) {
-    this.validateUserFn = Ee, this.createUserFn = _e, this.updateUserFn = ve, this.allowedFactor2 = [], this.allowedFactor2Names = [], this.factor2ProtectedPageEndpoints = [], this.factor2ProtectedApiEndpoints = [], this.loginProtectedPageEndpoints = [], this.loginProtectedApiEndpoints = [], this.loginProtectedExceptionPageEndpoints = [], this.loginProtectedExceptionApiEndpoints = [], this.adminPageEndpoints = [], this.adminApiEndpoints = [], this.adminProtectedExceptionPageEndpoints = [], this.adminProtectedExceptionApiEndpoints = [], this.unauthorizedUrl = void 0, this.enableCsrfProtection = !0, this.enableEmailVerification = !1, this.enablePasswordReset = !1, this.factor2Url = "/factor2", this.loginUrl = "/login", this.keyStorage = r, this.userStorage = s.userStorage, this.clientStorage = s.clientStorage, this.authenticators = o, this.sessionManager = new ie(r, o, s), this.redirect = s.redirect ?? Q, this.error = s.error ?? Y, y("factor2Url", E.String, this, s, "FACTOR2_URL"), this.factor2Url.endsWith("/") || (this.factor2Url += "/"), y("factor2ProtectedPageEndpoints", E.JsonArray, this, s, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), y("factor2ProtectedApiEndpoints", E.JsonArray, this, s, "FACTOR2_PROTECTED_API_ENDPOINTS"), y("loginProtectedPageEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_PAGE_ENDPOINTS"), y("loginProtectedApiEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_API_ENDPOINTS"), y("loginProtectedExceptionPageEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("loginProtectedExceptionApiEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("adminPageEndpoints", E.JsonArray, this, s, "ADMIN_PAGE_ENDPOINTS"), y("adminApiEndpoints", E.JsonArray, this, s, "ADMIN_API_ENDPOINTS"), y("adminProtectedExceptionPageEndpoints", E.JsonArray, this, s, "ADMIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("adminProtectedExceptionApiEndpoints", E.JsonArray, this, s, "ADMIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("loginUrl", E.JsonArray, this, s, "LOGIN_URL"), y("unauthorizedUrl", E.JsonArray, this, s, "UNAUTHORIZED_PAGE");
+    this.validateUserFn = Ee, this.createUserFn = _e, this.updateUserFn = ve, this.allowedFactor2 = [], this.allowedFactor2Names = [], this.factor2ProtectedPageEndpoints = [], this.factor2ProtectedApiEndpoints = [], this.loginProtectedPageEndpoints = [], this.loginProtectedApiEndpoints = [], this.loginProtectedExceptionPageEndpoints = [], this.loginProtectedExceptionApiEndpoints = [], this.adminPageEndpoints = [], this.adminApiEndpoints = [], this.adminProtectedExceptionPageEndpoints = [], this.adminProtectedExceptionApiEndpoints = [], this.unauthorizedUrl = void 0, this.enableCsrfProtection = !0, this.enableEmailVerification = !1, this.enablePasswordReset = !1, this.factor2Url = "/factor2", this.loginUrl = "/login", this.logoutUrl = "/logout", this.userAllowedFactor1 = ["localpassword"], this.adminAllowedFactor1 = ["localpassword"], this.keyStorage = r, this.userStorage = s.userStorage, this.clientStorage = s.clientStorage, this.authenticators = o, this.sessionManager = new ie(r, o, s), this.redirect = s.redirect ?? Q, this.error = s.error ?? Y, y("factor2Url", E.String, this, s, "FACTOR2_URL"), this.factor2Url.endsWith("/") || (this.factor2Url += "/"), y("factor2ProtectedPageEndpoints", E.JsonArray, this, s, "FACTOR2_PROTECTED_PAGE_ENDPOINTS"), y("factor2ProtectedApiEndpoints", E.JsonArray, this, s, "FACTOR2_PROTECTED_API_ENDPOINTS"), y("loginProtectedPageEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_PAGE_ENDPOINTS"), y("loginProtectedApiEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_API_ENDPOINTS"), y("loginProtectedExceptionPageEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("loginProtectedExceptionApiEndpoints", E.JsonArray, this, s, "LOGIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("adminPageEndpoints", E.JsonArray, this, s, "ADMIN_PAGE_ENDPOINTS"), y("adminApiEndpoints", E.JsonArray, this, s, "ADMIN_API_ENDPOINTS"), y("adminProtectedExceptionPageEndpoints", E.JsonArray, this, s, "ADMIN_PROTECTED_EXCEPTION_PAGE_ENDPOINTS"), y("adminProtectedExceptionApiEndpoints", E.JsonArray, this, s, "ADMIN_PROTECTED_EXCEPTION_API_ENDPOINTS"), y("loginUrl", E.JsonArray, this, s, "LOGIN_URL"), y("logoutUrl", E.JsonArray, this, s, "LOGOUT_URL"), y("unauthorizedUrl", E.JsonArray, this, s, "UNAUTHORIZED_PAGE"), y("userAllowedFactor1", E.JsonArray, this, s, "USER_ALLOWED_FACTOR1"), y("adminAllowedFactor1", E.JsonArray, this, s, "ADMIN_ALLOWED_FACTOR1");
     let e = {};
     if (y("allowedFactor2", E.JsonArray, e, s, "ALLOWED_FACTOR2"), this.allowedFactor2Names = s.allowedFactor2 ?? ["none"], e.allowedFactor2)
       for (let t of e.allowedFactor2)
@@ -5333,21 +5363,21 @@ class H {
           configurable: !1
         });
     y("enableEmailVerification", E.Boolean, this, s, "ENABLE_EMAIL_VERIFICATION"), y("enablePasswordReset", E.Boolean, this, s, "ENABLE_PASSWORD_RESET"), y("enableCsrfProtection", E.Boolean, this, s, "ENABLE_CSRF_PROTECTION"), y("editUserScope", E.String, this, s, "EDIT_USER_SCOPE"), s.validateUserFn && (this.validateUserFn = s.validateUserFn), s.createUserFn && (this.createUserFn = s.createUserFn), s.updateUserFn && (this.updateUserFn = s.updateUserFn), s.addToSession && (this.addToSession = s.addToSession), s.validateSession && (this.validateSession = s.validateSession), this.userEndpoints = new we(this, s), this.adminEndpoints = new ke(this, s), this.userClientEndpoints = new Ce(this, s), this.adminClientEndpoints = new ye(this, s), this.sessionHook = async ({ event: t }) => {
-      var h, g;
+      var g, w;
       l.logger.debug("Session hook");
-      let a = [];
-      const i = this.sessionManager.csrfCookieName, c = this.sessionManager.sessionCookieName;
+      let i = [], a;
+      const c = this.sessionManager.csrfCookieName, d = this.sessionManager.sessionCookieName;
       if (this.enableCsrfProtection) {
         l.logger.debug(f({ msg: "Getting csrf cookie" }));
         let p;
         try {
           p = this.getCsrfCookieValue(t), p && this.sessionManager.validateCsrfCookie(p);
-        } catch (w) {
-          l.logger.warn(f({ msg: "Invalid csrf cookie received", cerr: w, hashedCsrfCookie: this.getHashOfCsrfCookie(t) }));
+        } catch (S) {
+          l.logger.warn(f({ msg: "Invalid csrf cookie received", cerr: S, hashedCsrfCookie: this.getHashOfCsrfCookie(t) }));
           try {
-            this.clearCookie(i, this.sessionManager.csrfCookiePath, t);
-          } catch (S) {
-            l.logger.debug(f({ err: S })), l.logger.error(f({ cerr: S, msg: "Couldn't delete CSRF cookie", ip: t.request.referrer, hashedCsrfCookie: this.getHashOfCsrfCookie(t) }));
+            this.clearCookie(c, this.sessionManager.csrfCookiePath, t);
+          } catch (C) {
+            l.logger.debug(f({ err: C })), l.logger.error(f({ cerr: C, msg: "Couldn't delete CSRF cookie", ip: t.request.referrer, hashedCsrfCookie: this.getHashOfCsrfCookie(t) }));
           }
           p = void 0, t.locals.csrfToken = void 0;
         }
@@ -5355,56 +5385,67 @@ class H {
           try {
             if (p) {
               l.logger.debug(f({ msg: "Valid CSRF cookie - creating token" }));
-              const w = await this.sessionManager.createCsrfFormOrHeaderValue(p);
-              t.locals.csrfToken = w;
+              const S = await this.sessionManager.createCsrfFormOrHeaderValue(p);
+              t.locals.csrfToken = S;
             } else {
               l.logger.debug(f({ msg: "Invalid CSRF cookie - recreating" }));
-              const { csrfCookie: w, csrfFormOrHeaderValue: S } = await this.sessionManager.createCsrfToken();
-              this.setCsrfCookie(w, t), t.locals.csrfToken = S;
+              const { csrfCookie: S, csrfFormOrHeaderValue: C } = await this.sessionManager.createCsrfToken();
+              this.setCsrfCookie(S, t), t.locals.csrfToken = C;
             }
-            this.setHeader(x, t.locals.csrfToken, a);
-          } catch (w) {
-            l.logger.error(f({ msg: "Couldn't create CSRF token", cerr: w, user: (h = t.locals.user) == null ? void 0 : h.username, hashedSessionCookie: this.getHashOfSessionCookie(t) })), l.logger.debug(f({ err: w })), this.clearCookie(i, this.sessionManager.csrfCookiePath, t), t.locals.csrfToken = void 0;
+            this.setHeader(x, t.locals.csrfToken, i);
+          } catch (S) {
+            l.logger.error(f({ msg: "Couldn't create CSRF token", cerr: S, user: (g = t.locals.user) == null ? void 0 : g.username, hashedSessionCookie: this.getHashOfSessionCookie(t) })), l.logger.debug(f({ err: S })), this.clearCookie(c, this.sessionManager.csrfCookiePath, t), t.locals.csrfToken = void 0;
           }
         else if (p)
           try {
-            await this.csrfToken(t, a);
-          } catch (w) {
-            l.logger.error(f({ msg: "Couldn't create CSRF token", cerr: w, user: (g = t.locals.user) == null ? void 0 : g.username, hashedSessionCookie: this.getHashOfSessionCookie(t) })), l.logger.debug(f({ err: w }));
+            await this.csrfToken(t, i);
+          } catch (S) {
+            l.logger.error(f({ msg: "Couldn't create CSRF token", cerr: S, user: (w = t.locals.user) == null ? void 0 : w.username, hashedSessionCookie: this.getHashOfSessionCookie(t) })), l.logger.debug(f({ err: S }));
           }
       }
       t.locals.user = void 0, t.locals.authType = void 0;
-      const d = this.getSessionCookieValue(t);
-      if (l.logger.debug(f({ msg: "Getting session cookie" })), d)
+      const u = this.getSessionCookieValue(t);
+      if (l.logger.debug(f({ msg: "Getting session cookie" })), u)
         try {
-          const p = this.sessionManager.getSessionId(d);
-          let { key: w, user: S } = await this.sessionManager.userForSessionId(p);
-          this.validateSession && this.validateSession(w, S, t), t.locals.sessionId = p, t.locals.user = S, t.locals.authType = "cookie", l.logger.debug(f({ msg: "Valid session id", user: S == null ? void 0 : S.username }));
+          const p = this.sessionManager.getSessionId(u);
+          let { key: S, user: C } = await this.sessionManager.userForSessionId(p);
+          this.validateSession && this.validateSession(S, C, t);
+          const U = t.url.pathname;
+          if (C && this.allowedFactor2.length > 0 && (C.state == I.factor2ResetNeeded || !this.allowedFactor2Names.includes(C.factor2 ? C.factor2 : "none"))) {
+            if (!this.userEndpoints.configureFactor2Url)
+              throw new n(h.Configuration, "Must set configureFactor2Url in session server");
+            if (!this.userEndpoints.changeFactor2Url)
+              throw new n(h.Configuration, "Must set changeFactor2Url in session server");
+            if (!this.logoutUrl)
+              throw new n(h.Configuration, "Must set logoutUrl in session server");
+            [this.userEndpoints.changeFactor2Url, this.userEndpoints.configureFactor2Url, this.loginUrl, this.logoutUrl].includes(U) || (a = 302, i.push({ name: "location", value: this.userEndpoints.changeFactor2Url + "?required=true&next=" + encodeURIComponent("login?next=" + t.url) }));
+          }
+          t.locals.sessionId = p, t.locals.user = C, t.locals.authType = "cookie", l.logger.debug(f({ msg: "Valid session id", user: C == null ? void 0 : C.username }));
         } catch {
-          l.logger.warn(f({ msg: "Invalid session cookie received", hashedSessionCookie: this.getHashOfSessionCookie(t) })), this.clearCookie(c, this.sessionManager.sessionCookiePath, t);
+          l.logger.warn(f({ msg: "Invalid session cookie received", hashedSessionCookie: this.getHashOfSessionCookie(t) })), this.clearCookie(d, this.sessionManager.sessionCookiePath, t);
         }
-      return { headers: a };
+      return { headers: i, status: a };
     }, this.twoFAHook = async ({ event: t }) => {
-      var h;
-      if (l.logger.debug(f({ msg: "twoFAHook", username: (h = t.locals.user) == null ? void 0 : h.username })), !this.userStorage) throw this.error(500, "No user storage defined");
-      const a = this.getSessionCookieValue(t), i = this.isFactor2PageProtected(t), c = this.isFactor2ApiProtected(t);
+      var u;
+      if (l.logger.debug(f({ msg: "twoFAHook", username: (u = t.locals.user) == null ? void 0 : u.username })), !this.userStorage) throw this.error(500, "No user storage defined");
+      const i = this.getSessionCookieValue(t), a = this.isFactor2PageProtected(t), c = this.isFactor2ApiProtected(t);
       let d;
-      if (a)
+      if (i)
         if (t.locals.user) d = t.locals.user;
         else {
           const g = await this.getSessionData(t, "user");
           if (g) {
-            const p = await this.userStorage.getUserByUsername(g.username, { skipActiveCheck: !0 });
-            (p.user.status == N.active || p.user.state == N.factor2ResetNeeded) && (d = p.user);
+            const w = await this.userStorage.getUserByUsername(g.username, { skipActiveCheck: !0 });
+            (w.user.status == I.active || w.user.state == I.factor2ResetNeeded) && (d = w.user);
           }
         }
-      if (d && a && d.factor2 != "" && (i || c))
+      if (d && i && d.factor2 != "" && (a || c))
         if (l.logger.debug(f({ msg: "Factor2-protected endpoint visited" })), ["GET", "OPTIONS", "HEAD"].includes(t.request.method)) {
           l.logger.debug(f({ msg: "Factor2-protected GET endpoint - cancelling 2FA" }));
           const g = this.getSessionCookieValue(t);
           if (g) {
-            const p = this.sessionManager.getSessionId(g);
-            if ("pre2fa" in await this.sessionManager.dataForSessionId(p)) {
+            const w = this.sessionManager.getSessionId(g);
+            if ("pre2fa" in await this.sessionManager.dataForSessionId(w)) {
               l.logger.debug(f({ msg: "Cancelling 2FA" }));
               try {
                 await this.sessionManager.cancelTwoFactorPageVisit(g);
@@ -5414,62 +5455,62 @@ class H {
             }
           }
         } else {
-          const g = this.sessionManager.getSessionId(a), p = await this.sessionManager.dataForSessionId(g);
-          if ("pre2fa" in p) {
+          const g = this.sessionManager.getSessionId(i), w = await this.sessionManager.dataForSessionId(g);
+          if ("pre2fa" in w) {
             l.logger.debug(f({ msg: "Completing 2FA" }));
-            const w = this.authenticators[p.pre2fa.factor2], S = [...w.secretNames(), ...w.transientSecretNames()];
+            const p = this.authenticators[w.pre2fa.factor2], S = [...p.secretNames(), ...p.transientSecretNames()];
             let C = {};
-            const T = new b();
-            await T.loadData(t);
-            for (let A of T.keys())
-              S.includes(A) && (C[A] = T.get(A) ?? "");
-            const P = this.getSessionCookieValue(t);
-            if (!P) throw new n(u.Unauthorized, "No session cookie found");
-            let U;
+            const U = new b();
+            await U.loadData(t);
+            for (let T of U.keys())
+              S.includes(T) && (C[T] = U.get(T) ?? "");
+            const R = this.getSessionCookieValue(t);
+            if (!R) throw new n(h.Unauthorized, "No session cookie found");
+            let F;
             try {
               await this.sessionManager.completeTwoFactorPageVisit(C, t.locals.sessionId ?? "");
-            } catch (A) {
-              U = n.asCrossauthError(A), l.logger.debug(f({ err: A }));
-              const z = n.asCrossauthError(A);
-              l.logger.error(f({ msg: U.message, cerr: A, user: T.get("username"), errorCode: z.code, errorCodeName: z.codeName }));
+            } catch (T) {
+              F = n.asCrossauthError(T), l.logger.debug(f({ err: T }));
+              const z = n.asCrossauthError(T);
+              l.logger.error(f({ msg: F.message, cerr: T, user: U.get("username"), errorCode: z.code, errorCodeName: z.codeName }));
             }
-            if (U)
-              if (U.code == u.Expired) {
+            if (F)
+              if (F.code == h.Expired) {
                 l.logger.debug(f({ msg: "Error - cancelling 2FA" }));
                 try {
-                  await this.sessionManager.cancelTwoFactorPageVisit(P);
-                } catch (A) {
-                  l.logger.error(f({ msg: "Failed cancelling 2FA", cerr: A, user: d.username, hashedSessionCookie: this.getHashOfSessionCookie(t) })), l.logger.debug(f({ err: A }));
+                  await this.sessionManager.cancelTwoFactorPageVisit(R);
+                } catch (T) {
+                  l.logger.error(f({ msg: "Failed cancelling 2FA", cerr: T, user: d.username, hashedSessionCookie: this.getHashOfSessionCookie(t) })), l.logger.debug(f({ err: T }));
                 }
                 return this.error(401, { message: "Sorry, your code has expired" }), { ok: !1, twofa: !0 };
               } else
-                return i ? {
+                return a ? {
                   twofa: !0,
                   ok: !1,
                   response: new Response("", {
                     status: 302,
-                    statusText: q(302),
-                    headers: { Location: this.factor2Url + "?error=" + u[U.code] }
+                    statusText: K(302),
+                    headers: { Location: this.factor2Url + "?error=" + h[F.code] }
                   })
                 } : {
                   twofa: !0,
                   ok: !1,
                   response: new Response(JSON.stringify({
                     ok: !1,
-                    errorMessage: U.message,
-                    errorMessages: U.messages,
-                    errorCode: U.code,
-                    errorCodeName: u[U.code]
+                    errorMessage: F.message,
+                    errorMessages: F.messages,
+                    errorCode: F.code,
+                    errorCodeName: h[F.code]
                   }), {
-                    status: U.httpStatus,
-                    statusText: q(U.httpStatus),
+                    status: F.httpStatus,
+                    statusText: K(F.httpStatus),
                     headers: { "content-tyoe": "application/json" }
                   })
                 };
-            return H.updateRequest(t, p.pre2fa.body, p.pre2fa["content-type"]), { twofa: !0, ok: !0 };
+            return H.updateRequest(t, w.pre2fa.body, w.pre2fa["content-type"]), { twofa: !0, ok: !0 };
           } else {
             if (l.logger.debug(f({ msg: "Starting 2FA", username: d.username })), this.enableCsrfProtection && !t.locals.csrfToken) {
-              const C = new n(u.Forbidden, "CSRF token missing");
+              const C = new n(h.Forbidden, "CSRF token missing");
               return {
                 twofa: !0,
                 ok: !1,
@@ -5478,25 +5519,25 @@ class H {
                   errorMessage: C.message,
                   errorMessages: C.messages,
                   errorCode: C.code,
-                  errorCodeName: u[C.code]
+                  errorCodeName: h[C.code]
                 }), {
                   status: C.httpStatus,
-                  statusText: q(C.httpStatus),
+                  statusText: K(C.httpStatus),
                   headers: {
                     "content-tyoe": "application/json"
                   }
                 })
               };
             }
-            const w = new b();
-            await w.loadData(t);
+            const p = new b();
+            await p.loadData(t);
             let S = t.request.headers.get("content-type");
-            return await this.sessionManager.initiateTwoFactorPageVisit(d, t.locals.sessionId ?? "", w.toObject(), t.request.url.replace(/\?.*$/, ""), S || void 0), i ? {
+            return await this.sessionManager.initiateTwoFactorPageVisit(d, t.locals.sessionId ?? "", p.toObject(), t.request.url.replace(/\?.*$/, ""), S || void 0), a ? {
               twofa: !0,
               ok: !0,
               response: new Response("", {
                 status: 302,
-                statusText: q(302),
+                statusText: K(302),
                 headers: { Location: this.factor2Url }
               })
             } : {
@@ -5560,7 +5601,7 @@ class H {
    * @param event the request event
    */
   setCsrfCookie(r, o) {
-    o.cookies.set(r.name, r.value, R(r.options));
+    o.cookies.set(r.name, r.value, P(r.options));
   }
   setHeader(r, o, s) {
     s.push({
@@ -5580,7 +5621,7 @@ class H {
     const o = this.getSessionCookieValue(r);
     if (!o) return "";
     try {
-      return F.hash(o);
+      return A.hash(o);
     } catch {
     }
     return "";
@@ -5597,7 +5638,7 @@ class H {
     const o = this.getCsrfCookieValue(r);
     if (!o) return "";
     try {
-      return F.hash(o);
+      return A.hash(o);
     } catch {
     }
     return "";
@@ -5614,21 +5655,21 @@ class H {
    * @returns the string CSRF token for inclusion in forms
    */
   async csrfToken(r, o) {
-    var e, t, a;
+    var e, t, i;
     let s;
     if (r.request.headers && r.request.headers.has(x.toLowerCase())) {
-      const i = r.request.headers.get(x.toLowerCase());
-      Array.isArray(i) ? s = i[0] : i && (s = i);
+      const a = r.request.headers.get(x.toLowerCase());
+      Array.isArray(a) ? s = a[0] : a && (s = a);
     }
     if (!s) {
       if (!((e = r.request) != null && e.body)) {
         l.logger.warn(f({ msg: "Received CSRF header but not token", ip: r.request.referrerPolicy, hashedCsrfCookie: this.getHashOfCsrfCookie(r) }));
         return;
       }
-      const i = r.request.headers.get("content-type");
-      if (i == "application/json")
-        s = (await ((a = (t = r.request) == null ? void 0 : t.clone()) == null ? void 0 : a.json())).csrfToken;
-      else if (i == "application/x-www-form-urlencoded" || i == "multipart/form-data") {
+      const a = r.request.headers.get("content-type");
+      if (a == "application/json")
+        s = (await ((i = (t = r.request) == null ? void 0 : t.clone()) == null ? void 0 : i.json())).csrfToken;
+      else if (a == "application/x-www-form-urlencoded" || a == "multipart/form-data") {
         const d = (await r.request.clone().formData()).get("csrfToken");
         d && typeof d == "string" && (s = d);
       }
@@ -5661,8 +5702,8 @@ class H {
     else {
       e = "";
       for (let t in o) {
-        const a = o[t];
-        e.length > 0 && (e += "&"), e += encodeURIComponent(t) + "=" + encodeURIComponent(a);
+        const i = o[t];
+        e.length > 0 && (e += "&"), e += encodeURIComponent(t) + "=" + encodeURIComponent(i);
       }
     }
     return r.request = new Request(r.request.url, {
@@ -5680,7 +5721,7 @@ class H {
   getHashOfSessionId(r) {
     if (!r.locals.sessionId) return "";
     try {
-      return F.hash(r.locals.sessionId);
+      return A.hash(r.locals.sessionId);
     } catch {
     }
     return "";
@@ -5716,10 +5757,10 @@ class H {
     if (o.pathname == this.loginUrl) return !1;
     let s = !1;
     return s = this.loginProtectedExceptionPageEndpoints.reduce(
-      (t, a) => t || I(o.pathname, a),
+      (t, i) => t || N(o.pathname, i),
       s
     ), s ? !1 : this.loginProtectedPageEndpoints.reduce(
-      (t, a) => t || I(o.pathname, a),
+      (t, i) => t || N(o.pathname, i),
       !1
     );
   }
@@ -5737,10 +5778,10 @@ class H {
     if (o.pathname == this.loginUrl) return !1;
     let s = !1;
     return s = this.loginProtectedExceptionApiEndpoints.reduce(
-      (t, a) => t || I(o.pathname, a),
+      (t, i) => t || N(o.pathname, i),
       s
     ), s ? !1 : this.loginProtectedApiEndpoints.reduce(
-      (t, a) => t || I(o.pathname, a),
+      (t, i) => t || N(o.pathname, i),
       !1
     );
   }
@@ -5756,7 +5797,7 @@ class H {
   isFactor2PageProtected(r) {
     const o = new URL(typeof r == "string" ? r : r.request.url);
     return this.factor2ProtectedPageEndpoints.reduce(
-      (e, t) => e || I(o.pathname, t),
+      (e, t) => e || N(o.pathname, t),
       !1
     );
   }
@@ -5772,7 +5813,7 @@ class H {
   isFactor2ApiProtected(r) {
     const o = new URL(typeof r == "string" ? r : r.request.url);
     return this.factor2ProtectedApiEndpoints.reduce(
-      (e, t) => e || I(o.pathname, t),
+      (e, t) => e || N(o.pathname, t),
       !1
     );
   }
@@ -5789,13 +5830,13 @@ class H {
     const o = new URL(typeof r == "string" ? r : r.request.url);
     let s = !1;
     return s = this.adminProtectedExceptionPageEndpoints.reduce(
-      (t, a) => t || I(o.pathname, a),
+      (t, i) => t || N(o.pathname, i),
       s
     ), s || (s = this.loginProtectedExceptionPageEndpoints.reduce(
-      (t, a) => t || I(o.pathname, a),
+      (t, i) => t || N(o.pathname, i),
       s
     ), s) ? !1 : this.adminPageEndpoints.reduce(
-      (t, a) => t || I(o.pathname, a),
+      (t, i) => t || N(o.pathname, i),
       !1
     );
   }
@@ -5812,13 +5853,13 @@ class H {
     const o = new URL(typeof r == "string" ? r : r.request.url);
     let s = !1;
     return s = this.adminProtectedExceptionApiEndpoints.reduce(
-      (t, a) => t || I(o.pathname, a),
+      (t, i) => t || N(o.pathname, i),
       s
     ), s || (s = this.loginProtectedExceptionApiEndpoints.reduce(
-      (t, a) => t || I(o.pathname, a),
+      (t, i) => t || N(o.pathname, i),
       s
     ), s) ? !1 : this.adminApiEndpoints.reduce(
-      (t, a) => t || I(o.pathname, a),
+      (t, i) => t || N(o.pathname, i),
       !1
     );
   }
@@ -5840,15 +5881,15 @@ class H {
     await s.loadData(r);
     let e = this.addToSession ? this.addToSession(r, s.toObject()) : {};
     o && (e.data = JSON.stringify(o));
-    let { sessionCookie: t, csrfCookie: a, csrfFormOrHeaderValue: i } = await this.sessionManager.createAnonymousSession(e);
+    let { sessionCookie: t, csrfCookie: i, csrfFormOrHeaderValue: a } = await this.sessionManager.createAnonymousSession(e);
     r.cookies.set(
       t.name,
       t.value,
-      R(t.options)
-    ), this.enableCsrfProtection && (r.locals.csrfToken = i, r.cookies.set(
-      a.name,
-      a.value,
-      R(a.options)
+      P(t.options)
+    ), this.enableCsrfProtection && (r.locals.csrfToken = a, r.cookies.set(
+      i.name,
+      i.value,
+      P(i.options)
     )), r.locals.user = void 0;
     const c = this.sessionManager.getSessionId(t.value);
     return r.locals.sessionId = c, t.value;
@@ -5916,14 +5957,14 @@ class H {
    */
   async updateSessionData(r, o, s) {
     if (!r.locals.sessionId) throw new n(
-      u.Unauthorized,
+      h.Unauthorized,
       "No session present"
     );
     await this.sessionManager.updateSessionData(r.locals.sessionId, o, s);
   }
   async updateManySessionData(r, o) {
     if (!r.locals.sessionId) throw new n(
-      u.Unauthorized,
+      h.Unauthorized,
       "No session present"
     );
     await this.sessionManager.updateManySessionData(r.locals.sessionId, o);
@@ -5949,7 +5990,7 @@ export {
   G as SvelteKitOAuthClient,
   ge as SvelteKitOAuthResourceServer,
   m as SvelteKitServer,
-  Pe as SvelteKitSessionAdapter,
+  Re as SvelteKitSessionAdapter,
   H as SvelteKitSessionServer,
   X as SvelteKitSharedClientEndpoints,
   Ce as SvelteKitUserClientEndpoints,