mulguard 1.0.1 → 1.1.1

package/dist/index/index.mjs

@@ -1,39 +1,38 @@
-var B = Object.defineProperty;
-var H = (r, e, n) => e in r ? B(r, e, { enumerable: !0, configurable: !0, writable: !0, value: n }) : r[e] = n;
-var C = (r, e, n) => H(r, typeof e != "symbol" ? e + "" : e, n);
-import { A as E, e as q, c as K, g as X, d as Y } from "../actions-DeCfLtHA.mjs";
-import { a as Je, s as Qe, b as Ze, v as er } from "../actions-DeCfLtHA.mjs";
-import { s as tr } from "../signin-unified-BS2gxaG1.mjs";
-import { v as F } from "../oauth-state-LE-qeq-K.mjs";
-import { c as nr, p as or, k as ir, n as ar, m as cr, j as lr, l as ur, e as fr, g as dr, b as hr, i as gr, a as wr, o as pr, f as mr, h as yr, r as Er, d as kr, s as vr } from "../oauth-state-LE-qeq-K.mjs";
-import { NextResponse as u } from "next/server";
-const x = typeof globalThis == "object" && "crypto" in globalThis ? globalThis.crypto : void 0;
+var H = Object.defineProperty;
+var K = (r, e, s) => e in r ? H(r, e, { enumerable: !0, configurable: !0, writable: !0, value: s }) : r[e] = s;
+var F = (r, e, s) => K(r, typeof e != "symbol" ? e + "" : e, s);
+import { A as y, e as X, c as Y, g as G, d as J } from "../actions-DeCfLtHA.mjs";
+import { a as Qe, s as Ze, b as er, v as rr } from "../actions-DeCfLtHA.mjs";
+import { v as x } from "../oauth-state-LE-qeq-K.mjs";
+import { c as sr, p as nr, k as or, n as ir, m as ar, j as cr, l as lr, e as ur, g as fr, b as dr, i as gr, a as hr, o as wr, f as pr, h as mr, r as yr, d as Er, s as kr } from "../oauth-state-LE-qeq-K.mjs";
+import { NextResponse as f } from "next/server";
+const j = typeof globalThis == "object" && "crypto" in globalThis ? globalThis.crypto : void 0;
 /*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-function G(r = 32) {
-  if (x && typeof x.getRandomValues == "function")
-    return x.getRandomValues(new Uint8Array(r));
-  if (x && typeof x.randomBytes == "function")
-    return Uint8Array.from(x.randomBytes(r));
+function Q(r = 32) {
+  if (j && typeof j.getRandomValues == "function")
+    return j.getRandomValues(new Uint8Array(r));
+  if (j && typeof j.randomBytes == "function")
+    return Uint8Array.from(j.randomBytes(r));
   throw new Error("crypto.getRandomValues must be defined");
 }
-class J {
+class Z {
   constructor(e) {
-    C(this, "attempts", /* @__PURE__ */ new Map());
-    C(this, "config");
+    F(this, "attempts", /* @__PURE__ */ new Map());
+    F(this, "config");
     this.config = e;
   }
   /**
    * Check if request is allowed
    */
   check(e) {
-    const n = Date.now(), t = this.attempts.get(e);
-    return !t || t.resetAt < n ? (this.attempts.set(e, {
+    const s = Date.now(), t = this.attempts.get(e);
+    return !t || t.resetAt < s ? (this.attempts.set(e, {
       count: 1,
-      resetAt: n + this.config.windowMs
+      resetAt: s + this.config.windowMs
     }), {
       allowed: !0,
       remaining: this.config.maxAttempts - 1,
-      resetAt: new Date(n + this.config.windowMs)
+      resetAt: new Date(s + this.config.windowMs)
     }) : t.count >= this.config.maxAttempts ? {
       allowed: !1,
       remaining: 0,
@@ -57,10 +56,10 @@ class J {
     this.attempts.clear();
   }
 }
-function Ee(r) {
-  return new J(r);
+function ve(r) {
+  return new Z(r);
 }
-const Q = {
+const ee = {
   "X-Content-Type-Options": "nosniff",
   "X-Frame-Options": "DENY",
   "X-XSS-Protection": "1; mode=block",
@@ -69,24 +68,24 @@ const Q = {
   "Referrer-Policy": "strict-origin-when-cross-origin",
   "Permissions-Policy": "geolocation=(), microphone=(), camera=()"
 };
-function z(r) {
+function q(r) {
   return {
-    ...Q,
+    ...ee,
     ...r
   };
 }
-function ke(r, e) {
-  const n = z(e);
-  for (const [t, i] of Object.entries(n))
+function Re(r, e) {
+  const s = q(e);
+  for (const [t, i] of Object.entries(s))
     i && r.set(t, i);
 }
-function ve(r) {
+function M(r) {
   if (!r || typeof r != "string")
     return { valid: !1, error: "Email is required" };
   const e = r.trim().toLowerCase();
   return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e) ? e.length > 254 ? { valid: !1, error: "Email is too long" } : e.includes("..") || e.startsWith(".") || e.endsWith(".") ? { valid: !1, error: "Invalid email format" } : { valid: !0, sanitized: e } : { valid: !1, error: "Invalid email format" };
 }
-function Re(r, e = 8) {
+function Ae(r, e = 8) {
   if (!r || typeof r != "string")
     return { valid: !1, error: "Password is required" };
   if (r.length < e)
@@ -124,7 +123,7 @@ function Se(r) {
   const e = r.trim();
   return e.length < 1 ? { valid: !1, error: "Name cannot be empty" } : e.length > 100 ? { valid: !1, error: "Name is too long" } : { valid: !0, sanitized: e.replace(/[<>\"']/g, "") };
 }
-function Ae(r) {
+function Ie(r) {
   if (!r || typeof r != "string")
     return { valid: !1, error: "URL is required" };
   try {
@@ -134,29 +133,29 @@ function Ae(r) {
     return { valid: !1, error: "Invalid URL format" };
   }
 }
-function be(r, e = 16) {
+function Oe(r, e = 16) {
   return !r || typeof r != "string" ? { valid: !1, error: "Token is required" } : r.length < e ? { valid: !1, error: "Token is too short" } : r.length > 512 ? { valid: !1, error: "Token is too long" } : /^[A-Za-z0-9_-]+$/.test(r) ? /(.)\1{10,}/.test(r) ? { valid: !1, error: "Token contains suspicious pattern" } : { valid: !0 } : { valid: !1, error: "Invalid token format" };
 }
-function Oe(r, e) {
-  const { maxLength: n = 1e3, allowHtml: t = !1, required: i = !0 } = e || {};
+function z(r, e) {
+  const { maxLength: s = 1e3, allowHtml: t = !1, required: i = !0 } = e || {};
   if (i && (!r || typeof r != "string" || r.trim().length === 0))
     return { valid: !1, error: "Input is required" };
   if (!r || typeof r != "string")
     return { valid: !0, sanitized: "" };
-  let f = r.trim();
-  return f.length > n ? { valid: !1, error: `Input must be less than ${n} characters` } : (t || (f = f.replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;").replace(/\//g, "&#x2F;")), f = f.replace(/[\x00-\x1F\x7F]/g, ""), { valid: !0, sanitized: f });
+  let d = r.trim();
+  return d.length > s ? { valid: !1, error: `Input must be less than ${s} characters` } : (t || (d = d.replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;").replace(/\//g, "&#x2F;")), d = d.replace(/[\x00-\x1F\x7F]/g, ""), { valid: !0, sanitized: d });
 }
-class Z {
+class re {
   constructor() {
-    C(this, "tokens", /* @__PURE__ */ new Map());
+    F(this, "tokens", /* @__PURE__ */ new Map());
   }
   get(e) {
-    const n = this.tokens.get(e);
-    return n ? n.expiresAt < Date.now() ? (this.delete(e), null) : n.value : null;
+    const s = this.tokens.get(e);
+    return s ? s.expiresAt < Date.now() ? (this.delete(e), null) : s.value : null;
   }
-  set(e, n, t = 36e5) {
+  set(e, s, t = 36e5) {
     this.tokens.set(e, {
-      value: n,
+      value: s,
       expiresAt: Date.now() + t
     });
   }
@@ -167,27 +166,27 @@ class Z {
     this.tokens.clear();
   }
 }
-class ee {
-  constructor(e, n = 32) {
-    C(this, "store");
-    C(this, "tokenLength");
-    this.store = e || new Z(), this.tokenLength = n;
+class te {
+  constructor(e, s = 32) {
+    F(this, "store");
+    F(this, "tokenLength");
+    this.store = e || new re(), this.tokenLength = s;
   }
   /**
    * Generate CSRF token
    */
-  generateToken(e, n) {
-    const t = W(this.tokenLength);
-    return this.store.set(e, t, n), t;
+  generateToken(e, s) {
+    const t = B(this.tokenLength);
+    return this.store.set(e, t, s), t;
   }
   /**
    * Validate CSRF token
    */
-  validateToken(e, n) {
+  validateToken(e, s) {
     const t = this.store.get(e);
     if (!t)
       return !1;
-    const i = se(n, t);
+    const i = oe(s, t);
     return i && this.store.delete(e), i;
   }
   /**
@@ -203,10 +202,10 @@ class ee {
     this.store.delete(e);
   }
 }
-function _e(r) {
-  return new ee(r);
+function be(r) {
+  return new te(r);
 }
-function re(r) {
+function se(r) {
   if (typeof r != "string")
     return "";
   const e = {
@@ -216,13 +215,13 @@ function re(r) {
     '"': "&quot;",
     "'": "&#039;"
   };
-  return r.replace(/[&<>"']/g, (n) => e[n] || n);
+  return r.replace(/[&<>"']/g, (s) => e[s] || s);
 }
-function Ie(r) {
+function Te(r) {
   return typeof r != "string" ? "" : r.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "").replace(/on\w+\s*=\s*["'][^"']*["']/gi, "").replace(/javascript:/gi, "");
 }
-function Te(r) {
-  return typeof r != "string" ? "" : re(r.trim());
+function _e(r) {
+  return typeof r != "string" ? "" : se(r.trim());
 }
 function Pe(r) {
   return typeof r != "string" ? !1 : [
@@ -236,85 +235,88 @@ function Pe(r) {
     /<meta/i,
     /expression\s*\(/i,
     /vbscript:/i
-  ].some((n) => n.test(r));
+  ].some((s) => s.test(r));
 }
-function W(r = 32) {
-  const e = G(r);
+function B(r = 32) {
+  const e = Q(r);
   return Buffer.from(e).toString("base64url");
 }
-function te() {
-  return W(32);
+function ne() {
+  return B(32);
 }
-function se(r, e) {
+function oe(r, e) {
   if (!r || !e || r.length !== e.length)
     return !1;
-  let n = 0;
+  let s = 0;
   for (let t = 0; t < r.length; t++)
-    n |= r.charCodeAt(t) ^ e.charCodeAt(t);
-  return n === 0;
+    s |= r.charCodeAt(t) ^ e.charCodeAt(t);
+  return s === 0;
 }
-function Ue(r) {
+function Ce(r) {
   return r.trim().replace(/[<>]/g, "");
 }
-function Ce(r) {
+function Ue(r) {
   return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(r);
 }
-function ne(r) {
+function ie(r) {
   return !r.success && !!r.error;
 }
-function Fe(r) {
-  return r.requires2FA === !0 || r.errorCode === E.TWO_FA_REQUIRED;
+function Ne(r) {
+  return r.requires2FA === !0 || r.errorCode === y.TWO_FA_REQUIRED;
 }
-function Ne(r, e) {
+function Fe(r, e) {
   return r.error ? r.error : e || "Authentication failed";
 }
 function xe(r) {
   return r.errorCode;
 }
-function je(r) {
+function Le(r) {
   return r.success === !0 && !!r.user;
 }
-function De(r, e) {
+function je(r, e) {
   return r.errorCode === e;
 }
-function Le(r) {
-  if (!ne(r)) return !1;
+function De(r) {
+  if (!ie(r)) return !1;
   const e = [
-    E.NETWORK_ERROR,
-    E.RATE_LIMITED,
-    E.UNKNOWN_ERROR
+    y.NETWORK_ERROR,
+    y.RATE_LIMITED,
+    y.UNKNOWN_ERROR
   ];
   return r.errorCode ? e.includes(r.errorCode) : !1;
 }
-function $e(r) {
+function Ve(r) {
   if (r.error) return r.error;
   switch (r.errorCode) {
-    case E.INVALID_CREDENTIALS:
+    case y.INVALID_CREDENTIALS:
       return "Invalid email or password. Please try again.";
-    case E.ACCOUNT_LOCKED:
+    case y.ACCOUNT_LOCKED:
       return "Your account has been temporarily locked. Please try again later.";
-    case E.ACCOUNT_INACTIVE:
+    case y.ACCOUNT_INACTIVE:
       return "Your account is inactive. Please contact support.";
-    case E.TWO_FA_REQUIRED:
+    case y.TWO_FA_REQUIRED:
       return "Two-factor authentication is required. Please enter your code.";
-    case E.INVALID_TWO_FA_CODE:
+    case y.INVALID_TWO_FA_CODE:
       return "Invalid two-factor authentication code. Please try again.";
-    case E.SESSION_EXPIRED:
+    case y.SESSION_EXPIRED:
       return "Your session has expired. Please sign in again.";
-    case E.UNAUTHORIZED:
+    case y.UNAUTHORIZED:
       return "You are not authorized to perform this action.";
-    case E.NETWORK_ERROR:
+    case y.NETWORK_ERROR:
       return "Network error. Please check your connection and try again.";
-    case E.VALIDATION_ERROR:
+    case y.VALIDATION_ERROR:
       return "Please check your input and try again.";
-    case E.RATE_LIMITED:
+    case y.RATE_LIMITED:
       return "Too many attempts. Please try again later.";
-    case E.UNKNOWN_ERROR:
+    case y.UNKNOWN_ERROR:
     default:
       return "An unexpected error occurred. Please try again.";
   }
 }
-const oe = {
+async function $e(r, e, s) {
+  return r.signIn(e, s);
+}
+const ae = {
   google: {
     authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
     tokenUrl: "https://oauth2.googleapis.com/token",
@@ -345,62 +347,62 @@ const oe = {
   }
 };
 function $(r) {
-  return oe[r] || null;
+  return ae[r] || null;
 }
-function ie(r, e, n, t) {
+function ce(r, e, s, t) {
   const i = $(r);
   if (!i)
     throw new Error(`Unknown OAuth provider: ${r}`);
-  const f = e.redirectUri || `${n}/api/auth/callback/${r}`, l = e.scopes || i.defaultScopes, a = new URLSearchParams({
+  const d = e.redirectUri || `${s}/api/auth/callback/${r}`, c = e.scopes || i.defaultScopes, a = new URLSearchParams({
     client_id: e.clientId,
-    redirect_uri: f,
+    redirect_uri: d,
     response_type: "code",
-    scope: l.join(" "),
+    scope: c.join(" "),
     state: t,
     ...i.defaultParams,
     ...e.params
   });
   return `${i.authorizationUrl}?${a.toString()}`;
 }
-async function ae(r, e, n, t) {
+async function le(r, e, s, t) {
   const i = $(r);
   if (!i)
     throw new Error(`Unknown OAuth provider: ${r}`);
-  const f = new URLSearchParams({
+  const d = new URLSearchParams({
     client_id: e.clientId,
-    code: n,
+    code: s,
     redirect_uri: t,
     grant_type: "authorization_code"
   });
-  e.clientSecret && f.append("client_secret", e.clientSecret);
-  const l = await fetch(i.tokenUrl, {
+  e.clientSecret && d.append("client_secret", e.clientSecret);
+  const c = await fetch(i.tokenUrl, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded",
       Accept: "application/json"
     },
-    body: f.toString()
+    body: d.toString()
   });
-  if (!l.ok) {
-    const a = await l.text();
+  if (!c.ok) {
+    const a = await c.text();
     throw new Error(`Failed to exchange code for tokens: ${a}`);
   }
-  return await l.json();
+  return await c.json();
 }
-async function ce(r, e) {
-  var f, l, a, h;
-  const n = $(r);
-  if (!n)
+async function ue(r, e) {
+  var d, c, a, p;
+  const s = $(r);
+  if (!s)
     throw new Error(`Unknown OAuth provider: ${r}`);
-  const t = await fetch(n.userInfoUrl, {
+  const t = await fetch(s.userInfoUrl, {
     headers: {
       Authorization: `Bearer ${e}`,
       Accept: "application/json"
     }
   });
   if (!t.ok) {
-    const m = await t.text();
-    throw new Error(`Failed to fetch user info: ${m}`);
+    const v = await t.text();
+    throw new Error(`Failed to fetch user info: ${v}`);
   }
   const i = await t.json();
   switch (r) {
@@ -413,19 +415,19 @@ async function ce(r, e) {
         emailVerified: i.email_verified
       };
     case "github":
-      let m = i.email;
-      if (!m) {
-        const d = await (await fetch("https://api.github.com/user/emails", {
+      let v = i.email;
+      if (!v) {
+        const g = await (await fetch("https://api.github.com/user/emails", {
           headers: { Authorization: `Bearer ${e}` }
         })).json();
-        m = ((f = d.find((k) => k.primary)) == null ? void 0 : f.email) || ((l = d[0]) == null ? void 0 : l.email) || `${i.login}@users.noreply.github.com`;
+        v = ((d = g.find((A) => A.primary)) == null ? void 0 : d.email) || ((c = g[0]) == null ? void 0 : c.email) || `${i.login}@users.noreply.github.com`;
       }
       return {
         id: String(i.id),
-        email: m,
+        email: v,
         name: i.name || i.login,
         avatar: i.avatar_url,
-        emailVerified: !!m
+        emailVerified: !!v
       };
     case "apple":
       return {
@@ -439,7 +441,7 @@ async function ce(r, e) {
         id: i.id,
         email: i.email,
         name: i.name,
-        avatar: (h = (a = i.picture) == null ? void 0 : a.data) == null ? void 0 : h.url,
+        avatar: (p = (a = i.picture) == null ? void 0 : a.data) == null ? void 0 : p.url,
         emailVerified: !0
       };
     default:
@@ -452,141 +454,141 @@ async function ce(r, e) {
       };
   }
 }
-class le {
+class fe {
   constructor() {
-    C(this, "states", /* @__PURE__ */ new Map());
+    F(this, "states", /* @__PURE__ */ new Map());
   }
-  set(e, n, t) {
-    this.states.set(e, n), this.cleanup();
+  set(e, s, t) {
+    this.states.set(e, s), this.cleanup();
   }
   get(e) {
-    const n = this.states.get(e);
-    return n ? n.expiresAt < Date.now() ? (this.delete(e), null) : n : null;
+    const s = this.states.get(e);
+    return s ? s.expiresAt < Date.now() ? (this.delete(e), null) : s : null;
   }
   delete(e) {
     this.states.delete(e);
   }
   cleanup() {
     const e = Date.now();
-    for (const [n, t] of this.states.entries())
-      t.expiresAt < e && this.states.delete(n);
+    for (const [s, t] of this.states.entries())
+      t.expiresAt < e && this.states.delete(s);
   }
 }
-function ue() {
-  return new le();
+function de() {
+  return new fe();
 }
-function fe(r = process.env.NODE_ENV === "development") {
+function ge(r = process.env.NODE_ENV === "development") {
   const e = "[Mulguard]";
   return {
-    debug: r ? (n, t) => {
-      t !== void 0 ? console.debug(`${e} ${n}`, t) : console.debug(`${e} ${n}`);
+    debug: r ? (s, t) => {
+      t !== void 0 ? console.debug(`${e} ${s}`, t) : console.debug(`${e} ${s}`);
     } : () => {
     },
-    info: r ? (n, t) => {
-      t !== void 0 ? console.info(`${e} ${n}`, t) : console.info(`${e} ${n}`);
+    info: r ? (s, t) => {
+      t !== void 0 ? console.info(`${e} ${s}`, t) : console.info(`${e} ${s}`);
     } : () => {
     },
-    warn: r ? (n, t) => {
-      t !== void 0 ? console.warn(`${e} ${n}`, t) : console.warn(`${e} ${n}`);
+    warn: r ? (s, t) => {
+      t !== void 0 ? console.warn(`${e} ${s}`, t) : console.warn(`${e} ${s}`);
     } : () => {
     },
-    error: r ? (n, t) => {
-      t !== void 0 ? console.error(`${e} ${n}`, t) : console.error(`${e} ${n}`);
+    error: r ? (s, t) => {
+      t !== void 0 ? console.error(`${e} ${s}`, t) : console.error(`${e} ${s}`);
     } : () => {
     }
   };
 }
-const j = fe();
-function de(r, e, n, t = {}) {
+const P = ge();
+function he(r, e, s, t = {}) {
   const {
     enabled: i = !0,
-    maxRetries: f = 1,
-    retryDelay: l = 1e3,
+    maxRetries: d = 1,
+    retryDelay: c = 1e3,
     rateLimit: a = 3,
-    autoSignOutOnFailure: h = !0,
-    redirectToLogin: m = "/login",
-    autoRedirectOnFailure: v = !0
+    autoSignOutOnFailure: p = !0,
+    redirectToLogin: v = "/login",
+    autoRedirectOnFailure: S = !0
   } = t;
-  let d = null, k = !1;
-  const R = [], S = [], _ = 60 * 1e3;
-  let A = 0, b = !1, T = null;
-  const L = 2, o = 60 * 1e3;
-  function s() {
-    const p = Date.now();
-    if (b && T) {
-      if (p < T)
+  let g = null, A = !1;
+  const b = [], T = [], U = 60 * 1e3;
+  let _ = 0, I = !1, C = null;
+  const D = 2, V = 60 * 1e3;
+  function n() {
+    const l = Date.now();
+    if (I && C) {
+      if (l < C)
         return !1;
-      b = !1, T = null, A = 0;
+      I = !1, C = null, _ = 0;
     }
-    for (; S.length > 0; ) {
-      const g = S[0];
-      if (g !== void 0 && g < p - _)
-        S.shift();
+    for (; T.length > 0; ) {
+      const w = T[0];
+      if (w !== void 0 && w < l - U)
+        T.shift();
       else
         break;
     }
-    return S.length >= a ? !1 : (S.push(p), !0);
+    return T.length >= a ? !1 : (T.push(l), !0);
   }
-  function c() {
-    A++, A >= L && (b = !0, T = Date.now() + o, process.env.NODE_ENV === "development" && console.warn("[TokenRefreshManager] Circuit breaker opened - too many consecutive failures"));
+  function o() {
+    _++, _ >= D && (I = !0, C = Date.now() + V, process.env.NODE_ENV === "development" && console.warn("[TokenRefreshManager] Circuit breaker opened - too many consecutive failures"));
   }
-  function w() {
-    A = 0, b = !1, T = null;
+  function u() {
+    _ = 0, I = !1, C = null;
   }
-  async function y(p = 1) {
+  async function m(l = 1) {
     if (!i)
       return null;
-    if (!s())
+    if (!n())
       throw new Error("Rate limit exceeded for token refresh");
     try {
-      const g = await r();
-      if (g)
-        return w(), D(g), t.onTokenRefreshed && await Promise.resolve(t.onTokenRefreshed(g)), g;
-      if (c(), p < f)
-        return await I(l * p), y(p + 1);
+      const w = await r();
+      if (w)
+        return u(), O(w), t.onTokenRefreshed && await Promise.resolve(t.onTokenRefreshed(w)), w;
+      if (o(), l < d)
+        return await h(c * l), m(l + 1);
       throw new Error("Token refresh failed: refresh function returned null");
-    } catch (g) {
-      if (c(), p < f && O(g))
-        return await I(l * p), y(p + 1);
-      throw g;
+    } catch (w) {
+      if (o(), l < d && R(w))
+        return await h(c * l), m(l + 1);
+      throw w;
     }
   }
-  function O(p) {
-    if (p instanceof Error) {
-      const g = p.message.toLowerCase();
-      if (g.includes("rate limit") || g.includes("too many requests") || g.includes("429") || g.includes("limit:") || g.includes("requests per minute") || g.includes("token_blacklisted") || g.includes("blacklisted") || g.includes("invalid") || g.includes("401") || g.includes("unauthorized") || g.includes("session has been revoked") || g.includes("session expired"))
+  function R(l) {
+    if (l instanceof Error) {
+      const w = l.message.toLowerCase();
+      if (w.includes("rate limit") || w.includes("too many requests") || w.includes("429") || w.includes("limit:") || w.includes("requests per minute") || w.includes("token_blacklisted") || w.includes("blacklisted") || w.includes("invalid") || w.includes("401") || w.includes("unauthorized") || w.includes("session has been revoked") || w.includes("session expired"))
         return !1;
-      if (g.includes("network") || g.includes("fetch") || g.includes("timeout"))
+      if (w.includes("network") || w.includes("fetch") || w.includes("timeout"))
         return !0;
     }
     return !1;
   }
-  function D(p) {
-    const g = [...R];
-    R.length = 0;
-    for (const { resolve: U } of g)
-      U(p);
+  function O(l) {
+    const w = [...b];
+    b.length = 0;
+    for (const { resolve: N } of w)
+      N(l);
   }
-  function P(p) {
-    const g = [...R];
-    R.length = 0;
-    for (const { reject: U } of g)
-      U(p);
+  function E(l) {
+    const w = [...b];
+    b.length = 0;
+    for (const { reject: N } of w)
+      N(l);
   }
-  function I(p) {
-    return new Promise((g) => setTimeout(g, p));
+  function h(l) {
+    return new Promise((w) => setTimeout(w, l));
   }
-  async function M(p) {
+  async function k(l) {
     try {
-      if (t.onTokenRefreshFailed && await Promise.resolve(t.onTokenRefreshFailed(p)), h && (await n(), await e(), v && typeof window < "u")) {
-        let g = !0;
-        if (t.onBeforeRedirect && (g = await Promise.resolve(t.onBeforeRedirect(p))), g) {
-          const U = new URL(m, window.location.origin);
-          U.searchParams.set("reason", "session_expired"), U.searchParams.set("redirect", window.location.pathname + window.location.search), window.location.href = U.toString();
+      if (t.onTokenRefreshFailed && await Promise.resolve(t.onTokenRefreshFailed(l)), p && (await s(), await e(), S && typeof window < "u")) {
+        let w = !0;
+        if (t.onBeforeRedirect && (w = await Promise.resolve(t.onBeforeRedirect(l))), w) {
+          const N = new URL(v, window.location.origin);
+          N.searchParams.set("reason", "session_expired"), N.searchParams.set("redirect", window.location.pathname + window.location.search), window.location.href = N.toString();
         }
       }
-    } catch (g) {
-      process.env.NODE_ENV === "development" && console.error("[TokenRefreshManager] Error in handleRefreshFailure:", g);
+    } catch (w) {
+      process.env.NODE_ENV === "development" && console.error("[TokenRefreshManager] Error in handleRefreshFailure:", w);
     }
   }
   return {
@@ -594,40 +596,40 @@ function de(r, e, n, t = {}) {
      * Refresh token with single refresh queue
      */
     async refreshToken() {
-      return i ? d || (k = !0, d = y().then((p) => (k = !1, d = null, p)).catch((p) => {
-        throw k = !1, d = null, P(p), M(p).catch(() => {
-        }), p;
-      }), d) : null;
+      return i ? g || (A = !0, g = m().then((l) => (A = !1, g = null, l)).catch((l) => {
+        throw A = !1, g = null, E(l), k(l).catch(() => {
+        }), l;
+      }), g) : null;
     },
     /**
      * Check if refresh is in progress
      */
     isRefreshing() {
-      return k;
+      return A;
     },
     /**
      * Wait for current refresh to complete
      */
     async waitForRefresh() {
-      return d ? new Promise((p, g) => {
-        R.push({ resolve: p, reject: g });
+      return g ? new Promise((l, w) => {
+        b.push({ resolve: l, reject: w });
       }) : null;
     },
     /**
      * Clear state
      */
     clear() {
-      d = null, k = !1, S.length = 0, w(), P(new Error("Token refresh manager cleared"));
+      g = null, A = !1, T.length = 0, u(), E(new Error("Token refresh manager cleared"));
     },
     /**
      * Handle token refresh failure
      */
-    async handleRefreshFailure(p) {
-      return M(p);
+    async handleRefreshFailure(l) {
+      return k(l);
     }
   };
 }
-function he() {
+function we() {
   const r = process.env.NODE_ENV === "production";
   return {
     cookieName: "__mulguard_session",
@@ -640,7 +642,7 @@ function he() {
     path: "/"
   };
 }
-function ge() {
+function pe() {
   return {
     enabled: !0,
     refreshThreshold: 300,
@@ -656,47 +658,47 @@ function ge() {
   };
 }
 function Me(r) {
-  var T, L;
+  var D, V;
   const e = {
-    ...he(),
+    ...we(),
     ...r.session
-  }, n = r.actions, t = r.callbacks || {}, i = ((T = r.providers) == null ? void 0 : T.oauth) || {}, f = process.env.NEXT_PUBLIC_URL || (process.env.VERCEL_URL ? `https://${process.env.VERCEL_URL}` : "http://localhost:3000"), l = {
-    ...ge(),
+  }, s = r.actions, t = r.callbacks || {}, i = ((D = r.providers) == null ? void 0 : D.oauth) || {}, d = process.env.NEXT_PUBLIC_URL || (process.env.VERCEL_URL ? `https://${process.env.VERCEL_URL}` : "http://localhost:3000"), c = {
+    ...pe(),
     ...r.tokenRefresh
-  }, a = { ...n };
-  if (Object.keys(i).length > 0 && !a.signIn.oauth && (a.signIn.oauth = async (o) => {
-    const s = i[o];
-    if (!s)
-      throw new Error(`OAuth provider "${o}" is not configured. Add it to providers.oauth in config.`);
-    if (!s.clientId)
-      throw new Error(`OAuth provider "${o}" is missing clientId`);
-    const c = te();
-    return { url: ie(o, s, f, c), state: c };
-  }), Object.keys(i).length > 0 && !a.oauthCallback && (a.oauthCallback = async (o, s, c) => {
-    const w = i[o];
-    if (!w)
+  }, a = { ...s };
+  if (Object.keys(i).length > 0 && !a.signIn.oauth && (a.signIn.oauth = async (n) => {
+    const o = i[n];
+    if (!o)
+      throw new Error(`OAuth provider "${n}" is not configured. Add it to providers.oauth in config.`);
+    if (!o.clientId)
+      throw new Error(`OAuth provider "${n}" is missing clientId`);
+    const u = ne();
+    return { url: ce(n, o, d, u), state: u };
+  }), Object.keys(i).length > 0 && !a.oauthCallback && (a.oauthCallback = async (n, o, u) => {
+    const m = i[n];
+    if (!m)
       return {
         success: !1,
-        error: `OAuth provider "${o}" is not configured`,
-        errorCode: E.VALIDATION_ERROR
+        error: `OAuth provider "${n}" is not configured`,
+        errorCode: y.VALIDATION_ERROR
       };
     try {
-      const y = w.redirectUri || `${f}/api/auth/callback/${o}`, O = await ae(o, w, s, y), D = await ce(o, O.access_token);
+      const R = m.redirectUri || `${d}/api/auth/callback/${n}`, O = await le(n, m, o, R), E = await ue(n, O.access_token);
       if (t.onOAuthUser) {
-        const P = await d(t.onOAuthUser, D, o);
-        if (!P)
+        const h = await g(t.onOAuthUser, E, n);
+        if (!h)
           return {
             success: !1,
             error: "Failed to create or retrieve user",
-            errorCode: E.VALIDATION_ERROR
+            errorCode: y.VALIDATION_ERROR
           };
-        const I = {
+        const k = {
           user: {
-            id: P.id,
-            email: P.email,
-            name: P.name,
-            avatar: D.avatar,
-            emailVerified: D.emailVerified
+            id: h.id,
+            email: h.email,
+            name: h.name,
+            avatar: E.avatar,
+            emailVerified: E.emailVerified
           },
           expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1e3),
           accessToken: O.access_token,
@@ -704,87 +706,89 @@ function Me(r) {
           tokenType: "Bearer",
           expiresIn: O.expires_in
         };
-        return await S(I), h = { session: I, timestamp: Date.now() }, t.onSignIn && await d(t.onSignIn, I.user, I), { success: !0, user: I.user, session: I };
+        return await T(k), p = { session: k, timestamp: Date.now() }, t.onSignIn && await g(t.onSignIn, k.user, k), { success: !0, user: k.user, session: k };
       }
       return {
         success: !1,
         error: "OAuth user callback not implemented. Provide onOAuthUser callback or implement oauthCallback action.",
-        errorCode: E.VALIDATION_ERROR
+        errorCode: y.VALIDATION_ERROR
       };
-    } catch (y) {
-      return j.error("OAuth callback failed", { provider: o, error: y }), {
+    } catch (R) {
+      return P.error("OAuth callback failed", { provider: n, error: R }), {
         success: !1,
-        error: y instanceof Error ? y.message : "OAuth callback failed",
-        errorCode: E.NETWORK_ERROR
+        error: R instanceof Error ? R.message : "OAuth callback failed",
+        errorCode: y.NETWORK_ERROR
       };
     }
   }), !a.signIn || !a.signIn.email)
     throw new Error("mulguard: signIn.email action is required");
-  let h = null;
-  const m = ((L = r.session) == null ? void 0 : L.cacheTtl) ?? r.sessionCacheTtl ?? 5e3, v = r.oauthStateStore || ue(), d = async (o, ...s) => {
-    if (o)
+  let p = null;
+  const v = ((V = r.session) == null ? void 0 : V.cacheTtl) ?? r.sessionCacheTtl ?? 5e3, S = r.oauthStateStore || de(), g = async (n, ...o) => {
+    if (n)
       try {
-        return await o(...s);
-      } catch (c) {
-        throw t.onError && await t.onError(c instanceof Error ? c : new Error(String(c)), "callback"), c;
+        return await n(...o);
+      } catch (u) {
+        throw t.onError && await t.onError(u instanceof Error ? u : new Error(String(u)), "callback"), u;
       }
-  }, k = async (o, s) => {
-    const c = {
-      provider: s,
+  }, A = async (n, o) => {
+    const u = {
+      provider: o,
       expiresAt: Date.now() + 6e5
       // 10 minutes
     };
-    await Promise.resolve(v.set(o, c, 10 * 60 * 1e3)), v.cleanup && await Promise.resolve(v.cleanup());
-  }, R = async (o, s) => {
-    const c = await Promise.resolve(v.get(o));
-    return c ? c.expiresAt < Date.now() ? (await Promise.resolve(v.delete(o)), !1) : c.provider !== s ? !1 : (await Promise.resolve(v.delete(o)), !0) : !1;
-  }, S = async (o) => {
-    const s = e.cookieName || "__mulguard_session", c = typeof o == "object" && "token" in o ? String(o.token) : JSON.stringify(o), w = q(s, c, e);
-    return await K(w);
-  }, _ = async (o) => {
-    if (!o.success || !o.session)
+    await Promise.resolve(S.set(n, u, 10 * 60 * 1e3)), S.cleanup && await Promise.resolve(S.cleanup());
+  }, b = async (n, o) => {
+    const u = await Promise.resolve(S.get(n));
+    return u ? u.expiresAt < Date.now() ? (await Promise.resolve(S.delete(n)), !1) : u.provider !== o ? !1 : (await Promise.resolve(S.delete(n)), !0) : !1;
+  }, T = async (n) => {
+    const o = e.cookieName || "__mulguard_session", u = typeof n == "object" && "token" in n ? String(n.token) : JSON.stringify(n), m = X(o, u, e);
+    return await Y(m);
+  }, U = async (n) => {
+    if (!n.success || !n.session)
       return { success: !0 };
-    const s = await S(o.session);
-    return h = { session: o.session, timestamp: Date.now() }, o.user && t.onSignIn && await d(t.onSignIn, o.user, o.session), s;
-  }, A = async () => {
-    const o = e.cookieName || "__mulguard_session";
-    await Y(o, {
+    const o = await T(n.session);
+    return p = { session: n.session, timestamp: Date.now() }, n.user && t.onSignIn && await g(t.onSignIn, n.user, n.session), o;
+  }, _ = async () => {
+    const n = e.cookieName || "__mulguard_session";
+    await J(n, {
       path: e.path,
       domain: e.domain
     });
-  }, b = {
+  };
+  let I = null;
+  const C = {
     /**
      * Get current session
      * Uses custom getSession action if provided, otherwise falls back to reading from cookie
      * ✅ IMPROVEMENT: Added session caching for better performance
      */
     async getSession() {
-      const o = Date.now();
-      if (h && o - h.timestamp < m)
-        return h.session;
-      if (n.getSession)
+      const n = Date.now();
+      if (p && n - p.timestamp < v)
+        return p.session;
+      if (s.getSession)
         try {
-          const s = await n.getSession();
-          if (s && F(s))
-            return h = { session: s, timestamp: o }, s;
-          s && !F(s) && (await A(), h = null);
-        } catch (s) {
-          j.debug("getSession error", { error: s }), t.onError && await d(t.onError, s instanceof Error ? s : new Error(String(s)), "getSession"), h = null;
+          const o = await s.getSession();
+          if (o && x(o))
+            return p = { session: o, timestamp: n }, o;
+          o && !x(o) && (await _(), p = null);
+        } catch (o) {
+          P.debug("getSession error", { error: o }), t.onError && await g(t.onError, o instanceof Error ? o : new Error(String(o)), "getSession"), p = null;
         }
       try {
-        const s = e.cookieName || "__mulguard_session", c = await X(s);
-        if (c)
+        const o = e.cookieName || "__mulguard_session", u = await G(o);
+        if (u)
           try {
-            const w = JSON.parse(c);
-            if (F(w))
-              return w.expiresAt && new Date(w.expiresAt) < /* @__PURE__ */ new Date() ? (t.onSessionExpired && await d(t.onSessionExpired, w), await A(), h = null, null) : (h = { session: w, timestamp: o }, w);
-            await A(), h = null;
+            const m = JSON.parse(u);
+            if (x(m))
+              return m.expiresAt && new Date(m.expiresAt) < /* @__PURE__ */ new Date() ? (t.onSessionExpired && await g(t.onSessionExpired, m), await _(), p = null, null) : (p = { session: m, timestamp: n }, m);
+            await _(), p = null;
           } catch {
-            await A(), h = null;
+            await _(), p = null;
           }
-      } catch (s) {
-        const c = s instanceof Error ? s.message : String(s);
-        !c.includes("request scope") && !c.includes("cookies") && (j.warn("getSession cookie error", { error: s }), t.onError && await d(t.onError, s instanceof Error ? s : new Error(String(s)), "getSession.cookie"));
+      } catch (o) {
+        const u = o instanceof Error ? o.message : String(o);
+        !u.includes("request scope") && !u.includes("cookies") && (P.warn("getSession cookie error", { error: o }), t.onError && await g(t.onError, o instanceof Error ? o : new Error(String(o)), "getSession.cookie"));
       }
       return null;
     },
@@ -792,15 +796,15 @@ function Me(r) {
      * Get access token from current session
      */
     async getAccessToken() {
-      const o = await this.getSession();
-      return o != null && o.accessToken && typeof o.accessToken == "string" ? o.accessToken : null;
+      const n = await this.getSession();
+      return n != null && n.accessToken && typeof n.accessToken == "string" ? n.accessToken : null;
     },
     /**
      * Get refresh token from current session
      */
     async getRefreshToken() {
-      const o = await this.getSession();
-      return o != null && o.refreshToken && typeof o.refreshToken == "string" ? o.refreshToken : null;
+      const n = await this.getSession();
+      return n != null && n.refreshToken && typeof n.refreshToken == "string" ? n.refreshToken : null;
     },
     /**
      * Check if session has valid tokens
@@ -809,99 +813,172 @@ function Me(r) {
       return !!await this.getAccessToken();
     },
     /**
-     * Sign in methods - uses custom actions from config
+     * Unified sign in method - supports both unified and direct method calls
+     * ✅ IMPROVEMENT: Single unified logic for all sign-in methods
      */
-    signIn: {
-      /**
-       * Sign in with email/password
-       */
-      async email(o) {
+    signIn: (() => {
+      const n = async (E) => {
         try {
-          const s = await a.signIn.email(o);
-          return s.success && s.session && await _(s), s;
-        } catch (s) {
-          return t.onError && await d(t.onError, s instanceof Error ? s : new Error(String(s)), "signIn.email"), {
+          if (!E || typeof E != "object")
+            return {
+              success: !1,
+              error: "Invalid credentials",
+              errorCode: y.VALIDATION_ERROR
+            };
+          if (!E.email || typeof E.email != "string")
+            return {
+              success: !1,
+              error: "Email is required",
+              errorCode: y.VALIDATION_ERROR
+            };
+          const h = M(E.email);
+          if (!h.valid)
+            return {
+              success: !1,
+              error: h.error || "Invalid email format",
+              errorCode: y.VALIDATION_ERROR
+            };
+          if (!E.password || typeof E.password != "string")
+            return {
+              success: !1,
+              error: "Password is required",
+              errorCode: y.VALIDATION_ERROR
+            };
+          if (E.password.length > 128)
+            return {
+              success: !1,
+              error: "Invalid credentials",
+              errorCode: y.VALIDATION_ERROR
+            };
+          const k = {
+            email: h.sanitized,
+            password: E.password
+            // Don't sanitize password (needed for hashing)
+          }, l = await a.signIn.email(k);
+          return l.success && l.session && await U(l), l.success ? P.info("Sign in successful", { email: k.email.substring(0, 3) + "***" }) : P.warn("Sign in failed", { email: k.email.substring(0, 3) + "***", errorCode: l.errorCode }), l;
+        } catch (h) {
+          const k = h instanceof Error ? h.message : "Sign in failed";
+          return P.error("Sign in error", { error: k, context: "signIn.email" }), t.onError && await g(t.onError, h instanceof Error ? h : new Error(String(h)), "signIn.email"), {
             success: !1,
-            error: s instanceof Error ? s.message : "Sign in failed"
+            error: "Sign in failed. Please try again.",
+            errorCode: y.UNKNOWN_ERROR
           };
         }
-      },
-      /**
-       * Initiate OAuth sign in
-       * ✅ Auto-generated if providers.oauth is configured in config
-       */
-      async oauth(o) {
+      }, o = async (E) => {
+        if (!E || typeof E != "string")
+          throw new Error("Provider is required");
+        const h = z(E, { maxLength: 50, allowHtml: !1, required: !0 });
+        if (!h.valid || !h.sanitized)
+          throw new Error("Invalid provider");
+        const k = h.sanitized.toLowerCase();
         if (!a.signIn.oauth)
           throw new Error(
             "OAuth sign in is not configured. Either provide oauth action in signIn, or configure providers.oauth in config."
           );
-        const s = await a.signIn.oauth(o);
-        return await k(s.state, o), s;
-      },
-      /**
-       * Sign in with PassKey
-       */
-      async passkey(o) {
+        const l = await a.signIn.oauth(k);
+        return await A(l.state, k), P.info("OAuth sign in initiated", { provider: k }), l;
+      }, u = async (E) => {
         if (!a.signIn.passkey)
           throw new Error("PassKey sign in is not configured. Provide passkey action in signIn.");
         try {
-          const s = await a.signIn.passkey(o);
-          return s.success && s.session && await _(s), s;
-        } catch (s) {
-          return t.onError && await d(t.onError, s instanceof Error ? s : new Error(String(s)), "signIn.passkey"), {
+          const h = await a.signIn.passkey(E);
+          return h.success && h.session && await U(h), h;
+        } catch (h) {
+          return t.onError && await g(t.onError, h instanceof Error ? h : new Error(String(h)), "signIn.passkey"), {
             success: !1,
-            error: s instanceof Error ? s.message : "PassKey sign in failed"
+            error: h instanceof Error ? h.message : "PassKey sign in failed"
           };
         }
-      },
-      /**
-       * Sign in with OTP
-       */
-      async otp(o, s) {
+      }, m = async (E, h) => {
+        if (!E || typeof E != "string")
+          return {
+            success: !1,
+            error: "Email is required",
+            errorCode: y.VALIDATION_ERROR
+          };
+        const k = M(E);
+        if (!k.valid)
+          return {
+            success: !1,
+            error: k.error || "Invalid email format",
+            errorCode: y.VALIDATION_ERROR
+          };
+        if (h !== void 0 && (typeof h != "string" || h.length < 4 || h.length > 10))
+          return {
+            success: !1,
+            error: "Invalid OTP code format",
+            errorCode: y.VALIDATION_ERROR
+          };
         if (!a.signIn.otp)
-          throw new Error("OTP sign in is not configured. Provide otp action in signIn.");
+          return {
+            success: !1,
+            error: "OTP sign in is not configured",
+            errorCode: y.VALIDATION_ERROR
+          };
         try {
-          const c = await a.signIn.otp(o, s);
-          return c.success && c.session && await _(c), c;
-        } catch (c) {
-          return t.onError && await d(t.onError, c instanceof Error ? c : new Error(String(c)), "signIn.otp"), {
+          const l = await a.signIn.otp(k.sanitized, h);
+          return l.success && l.session && await U(l), l.success ? P.info("OTP sign in successful", { email: k.sanitized.substring(0, 3) + "***" }) : P.warn("OTP sign in failed", { email: k.sanitized.substring(0, 3) + "***" }), l;
+        } catch (l) {
+          return P.error("OTP sign in error", { error: l instanceof Error ? l.message : "Unknown error", context: "signIn.otp" }), t.onError && await g(t.onError, l instanceof Error ? l : new Error(String(l)), "signIn.otp"), {
             success: !1,
-            error: c instanceof Error ? c.message : "OTP sign in failed"
+            error: "OTP sign in failed. Please try again.",
+            errorCode: y.UNKNOWN_ERROR
           };
         }
-      }
-    },
-    /**
-     * Sign in methods - alias for signIn (for backward compatibility)
-     */
-    signInMethods: {
-      email: (o) => b.signIn.email(o),
-      oauth: (o) => {
-        var s, c;
-        return ((c = (s = b.signIn).oauth) == null ? void 0 : c.call(s, o)) || Promise.reject(new Error("OAuth not configured"));
-      },
-      passkey: (o) => {
-        var s, c;
-        return ((c = (s = b.signIn).passkey) == null ? void 0 : c.call(s, o)) || Promise.reject(new Error("Passkey not configured"));
-      },
-      otp: (o, s) => {
-        var c, w;
-        return ((w = (c = b.signIn).otp) == null ? void 0 : w.call(c, o, s)) || Promise.reject(new Error("OTP not configured"));
-      }
-    },
+      }, O = Object.assign(
+        async (E, h) => {
+          if (!E || typeof E != "string")
+            throw new Error("Provider is required");
+          const k = z(E, { maxLength: 50, allowHtml: !1, required: !0 });
+          if (!k.valid || !k.sanitized)
+            throw new Error("Invalid provider");
+          const l = k.sanitized.toLowerCase();
+          if (l === "google" || l === "github" || l === "apple" || l === "facebook" || typeof l == "string" && !["credentials", "otp", "passkey"].includes(l))
+            return o(l);
+          if (l === "credentials")
+            return !h || !("email" in h) || !("password" in h) ? {
+              success: !1,
+              error: "Credentials are required",
+              errorCode: y.VALIDATION_ERROR
+            } : n(h);
+          if (l === "otp") {
+            if (!h || !("email" in h))
+              return {
+                success: !1,
+                error: "Email is required",
+                errorCode: y.VALIDATION_ERROR
+              };
+            const w = h;
+            return m(w.email, w.code);
+          }
+          return l === "passkey" ? u(h) : {
+            success: !1,
+            error: "Invalid provider",
+            errorCode: y.VALIDATION_ERROR
+          };
+        },
+        {
+          email: n,
+          oauth: a.signIn.oauth ? o : void 0,
+          passkey: a.signIn.passkey ? u : void 0,
+          otp: a.signIn.otp ? m : void 0
+        }
+      );
+      return I = O, O;
+    })(),
     /**
      * Sign up new user
      */
-    async signUp(o) {
+    async signUp(n) {
       if (!a.signUp)
         throw new Error("Sign up is not configured. Provide signUp action in config.");
       try {
-        const s = await a.signUp(o);
-        return s.success && s.session && await _(s), s;
-      } catch (s) {
-        return t.onError && await d(t.onError, s instanceof Error ? s : new Error(String(s)), "signUp"), {
+        const o = await a.signUp(n);
+        return o.success && o.session && await U(o), o;
+      } catch (o) {
+        return t.onError && await g(t.onError, o instanceof Error ? o : new Error(String(o)), "signUp"), {
           success: !1,
-          error: s instanceof Error ? s.message : "Sign up failed"
+          error: o instanceof Error ? o.message : "Sign up failed"
         };
       }
     },
@@ -910,42 +987,42 @@ function Me(r) {
      */
     async signOut() {
       try {
-        const o = await this.getSession(), s = o == null ? void 0 : o.user;
-        return n.signOut && await n.signOut(), await A(), h = null, s && t.onSignOut && await d(t.onSignOut, s), { success: !0 };
-      } catch (o) {
-        return await A(), t.onError && await d(t.onError, o instanceof Error ? o : new Error(String(o)), "signOut"), {
+        const n = await this.getSession(), o = n == null ? void 0 : n.user;
+        return s.signOut && await s.signOut(), await _(), p = null, o && t.onSignOut && await g(t.onSignOut, o), { success: !0 };
+      } catch (n) {
+        return await _(), t.onError && await g(t.onError, n instanceof Error ? n : new Error(String(n)), "signOut"), {
           success: !1,
-          error: o instanceof Error ? o.message : "Sign out failed"
+          error: n instanceof Error ? n.message : "Sign out failed"
         };
       }
     },
     /**
      * Request password reset
      */
-    async resetPassword(o) {
-      if (!n.resetPassword)
+    async resetPassword(n) {
+      if (!s.resetPassword)
         throw new Error("Password reset is not configured. Provide resetPassword action in config.");
       try {
-        return await n.resetPassword(o);
-      } catch (s) {
-        return t.onError && await d(t.onError, s instanceof Error ? s : new Error(String(s)), "resetPassword"), {
+        return await s.resetPassword(n);
+      } catch (o) {
+        return t.onError && await g(t.onError, o instanceof Error ? o : new Error(String(o)), "resetPassword"), {
           success: !1,
-          error: s instanceof Error ? s.message : "Password reset failed"
+          error: o instanceof Error ? o.message : "Password reset failed"
         };
       }
     },
     /**
      * Verify email address
      */
-    async verifyEmail(o) {
-      if (!n.verifyEmail)
+    async verifyEmail(n) {
+      if (!s.verifyEmail)
         throw new Error("Email verification is not configured. Provide verifyEmail action in config.");
       try {
-        return await n.verifyEmail(o);
-      } catch (s) {
-        return t.onError && await d(t.onError, s instanceof Error ? s : new Error(String(s)), "verifyEmail"), {
+        return await s.verifyEmail(n);
+      } catch (o) {
+        return t.onError && await g(t.onError, o instanceof Error ? o : new Error(String(o)), "verifyEmail"), {
           success: !1,
-          error: s instanceof Error ? s.message : "Email verification failed"
+          error: o instanceof Error ? o.message : "Email verification failed"
         };
       }
     },
@@ -954,73 +1031,73 @@ function Me(r) {
      * Executes custom refreshSession action with improved error handling and callbacks
      */
     async refreshSession() {
-      if (!n.refreshSession)
+      if (!s.refreshSession)
         return this.getSession();
       try {
-        const o = await n.refreshSession();
-        if (o && F(o)) {
-          if (await S(o), h = { session: o, timestamp: Date.now() }, t.onSessionUpdate) {
-            const s = await d(t.onSessionUpdate, o);
-            if (s && F(s)) {
-              if (await S(s), t.onTokenRefresh) {
-                const c = await this.getSession();
-                c && await d(t.onTokenRefresh, c, s);
+        const n = await s.refreshSession();
+        if (n && x(n)) {
+          if (await T(n), p = { session: n, timestamp: Date.now() }, t.onSessionUpdate) {
+            const o = await g(t.onSessionUpdate, n);
+            if (o && x(o)) {
+              if (await T(o), t.onTokenRefresh) {
+                const u = await this.getSession();
+                u && await g(t.onTokenRefresh, u, o);
               }
-              return s;
+              return o;
             }
           }
           if (t.onTokenRefresh) {
-            const s = await this.getSession();
-            s && await d(t.onTokenRefresh, s, o);
+            const o = await this.getSession();
+            o && await g(t.onTokenRefresh, o, n);
           }
-          return o;
-        } else if (o && !F(o))
-          return await A(), null;
+          return n;
+        } else if (n && !x(n))
+          return await _(), null;
         return null;
-      } catch (o) {
-        return await A(), t.onError && await d(t.onError, o instanceof Error ? o : new Error(String(o)), "refreshSession"), null;
+      } catch (n) {
+        return await _(), t.onError && await g(t.onError, n instanceof Error ? n : new Error(String(n)), "refreshSession"), null;
       }
     },
     /**
      * OAuth callback handler
      * ✅ Auto-generated if providers.oauth is configured in config
      */
-    async oauthCallback(o, s, c) {
+    async oauthCallback(n, o, u) {
       if (!a.oauthCallback)
         throw new Error(
           "OAuth callback is not configured. Either provide oauthCallback action, or configure providers.oauth in config."
         );
-      if (!o || !s || !c)
+      if (!n || !o || !u)
         return {
           success: !1,
           error: "Missing required OAuth parameters (provider, code, or state)",
-          errorCode: E.VALIDATION_ERROR
+          errorCode: y.VALIDATION_ERROR
         };
-      if (!await R(c, o))
+      if (!await b(u, n))
         return {
           success: !1,
           error: "Invalid or expired state parameter",
-          errorCode: E.VALIDATION_ERROR
+          errorCode: y.VALIDATION_ERROR
         };
       try {
-        const y = await a.oauthCallback(o, s, c);
-        if (y.success && y.session) {
-          const O = await _(y);
-          O.success || (process.env.NODE_ENV === "development" && j.debug("Failed to save session cookie after oauthCallback", {
+        const R = await a.oauthCallback(n, o, u);
+        if (R.success && R.session) {
+          const O = await U(R);
+          O.success || (process.env.NODE_ENV === "development" && P.debug("Failed to save session cookie after oauthCallback", {
             error: O.error,
             warning: O.warning
-          }), t.onError && await d(
+          }), t.onError && await g(
             t.onError,
             new Error(O.warning || O.error || "Failed to save session cookie"),
             "oauthCallback.setSession"
           ));
         }
-        return y;
-      } catch (y) {
-        return t.onError && await d(t.onError, y instanceof Error ? y : new Error(String(y)), "oauthCallback"), {
+        return R;
+      } catch (R) {
+        return t.onError && await g(t.onError, R instanceof Error ? R : new Error(String(R)), "oauthCallback"), {
           success: !1,
-          error: y instanceof Error ? y.message : "OAuth callback failed",
-          errorCode: E.NETWORK_ERROR
+          error: R instanceof Error ? R.message : "OAuth callback failed",
+          errorCode: y.NETWORK_ERROR
         };
       }
     },
@@ -1028,28 +1105,28 @@ function Me(r) {
      * Verify 2FA code after initial sign in
      * Used when signIn returns requires2FA: true
      */
-    async verify2FA(o, s) {
-      if (!n.verify2FA)
+    async verify2FA(n, o) {
+      if (!s.verify2FA)
         throw new Error("2FA verification is not configured. Provide verify2FA action in config.");
       try {
-        const c = await n.verify2FA(o);
-        if (c.success && c.session && !(s != null && s.skipCookieSave)) {
-          const w = await _(c);
-          w.success || (process.env.NODE_ENV === "development" && j.debug("Failed to save session cookie after verify2FA", {
-            error: w.error,
-            warning: w.warning
-          }), t.onError && await d(
+        const u = await s.verify2FA(n);
+        if (u.success && u.session && !(o != null && o.skipCookieSave)) {
+          const m = await U(u);
+          m.success || (process.env.NODE_ENV === "development" && P.debug("Failed to save session cookie after verify2FA", {
+            error: m.error,
+            warning: m.warning
+          }), t.onError && await g(
             t.onError,
-            new Error(w.warning || w.error || "Failed to save session cookie"),
+            new Error(m.warning || m.error || "Failed to save session cookie"),
             "verify2FA.setSession"
           ));
         }
-        return c;
-      } catch (c) {
-        return t.onError && await d(t.onError, c instanceof Error ? c : new Error(String(c)), "verify2FA"), {
+        return u;
+      } catch (u) {
+        return t.onError && await g(t.onError, u instanceof Error ? u : new Error(String(u)), "verify2FA"), {
           success: !1,
-          error: c instanceof Error ? c.message : "2FA verification failed",
-          errorCode: E.TWO_FA_REQUIRED
+          error: u instanceof Error ? u.message : "2FA verification failed",
+          errorCode: y.TWO_FA_REQUIRED
         };
       }
     },
@@ -1057,8 +1134,8 @@ function Me(r) {
      * Set session directly
      * Useful for Server Actions that need to save session manually
      */
-    async setSession(o) {
-      return F(o) ? await S(o) : {
+    async setSession(n) {
+      return x(n) ? await T(n) : {
         success: !1,
         error: "Invalid session structure"
       };
@@ -1080,249 +1157,268 @@ function Me(r) {
     /**
      * PassKey methods
      */
-    passkey: n.passkey ? {
-      register: n.passkey.register,
-      authenticate: async (o) => {
-        var s;
-        if (!((s = n.passkey) != null && s.authenticate))
+    passkey: s.passkey ? {
+      register: s.passkey.register,
+      authenticate: async (n) => {
+        var o;
+        if (!((o = s.passkey) != null && o.authenticate))
           throw new Error("PassKey authenticate is not configured.");
         try {
-          const c = await n.passkey.authenticate(o);
-          return c.success && c.session && await _(c), c;
-        } catch (c) {
-          return t.onError && await d(t.onError, c instanceof Error ? c : new Error(String(c)), "passkey.authenticate"), {
+          const u = await s.passkey.authenticate(n);
+          return u.success && u.session && await U(u), u;
+        } catch (u) {
+          return t.onError && await g(t.onError, u instanceof Error ? u : new Error(String(u)), "passkey.authenticate"), {
             success: !1,
-            error: c instanceof Error ? c.message : "PassKey authentication failed"
+            error: u instanceof Error ? u.message : "PassKey authentication failed"
           };
         }
       },
-      list: n.passkey.list,
-      remove: n.passkey.remove
+      list: s.passkey.list,
+      remove: s.passkey.remove
     } : void 0,
     /**
      * Two-Factor Authentication methods
      */
-    twoFactor: n.twoFactor ? {
-      enable: n.twoFactor.enable,
-      verify: n.twoFactor.verify,
-      disable: n.twoFactor.disable,
-      generateBackupCodes: n.twoFactor.generateBackupCodes,
-      isEnabled: n.twoFactor.isEnabled,
-      verify2FA: async (o) => {
-        var c;
-        const s = ((c = n.twoFactor) == null ? void 0 : c.verify2FA) || n.verify2FA;
-        if (!s)
+    twoFactor: s.twoFactor ? {
+      enable: s.twoFactor.enable,
+      verify: s.twoFactor.verify,
+      disable: s.twoFactor.disable,
+      generateBackupCodes: s.twoFactor.generateBackupCodes,
+      isEnabled: s.twoFactor.isEnabled,
+      verify2FA: async (n) => {
+        var u;
+        const o = ((u = s.twoFactor) == null ? void 0 : u.verify2FA) || s.verify2FA;
+        if (!o)
           throw new Error("2FA verification is not configured. Provide verify2FA action in config.");
         try {
-          const w = await s(o);
-          if (w.success && w.session) {
-            const y = await _(w);
-            y.success || (process.env.NODE_ENV === "development" && j.debug("Failed to save session cookie after twoFactor.verify2FA", {
-              error: y.error,
-              warning: y.warning
-            }), t.onError && await d(
+          const m = await o(n);
+          if (m.success && m.session) {
+            const R = await U(m);
+            R.success || (process.env.NODE_ENV === "development" && P.debug("Failed to save session cookie after twoFactor.verify2FA", {
+              error: R.error,
+              warning: R.warning
+            }), t.onError && await g(
               t.onError,
-              new Error(y.warning || y.error || "Failed to save session cookie"),
+              new Error(R.warning || R.error || "Failed to save session cookie"),
               "twoFactor.verify2FA.setSession"
             ));
           }
-          return w;
-        } catch (w) {
-          return t.onError && await d(t.onError, w instanceof Error ? w : new Error(String(w)), "twoFactor.verify2FA"), {
+          return m;
+        } catch (m) {
+          return t.onError && await g(t.onError, m instanceof Error ? m : new Error(String(m)), "twoFactor.verify2FA"), {
             success: !1,
-            error: w instanceof Error ? w.message : "2FA verification failed",
-            errorCode: E.UNKNOWN_ERROR
+            error: m instanceof Error ? m.message : "2FA verification failed",
+            errorCode: y.UNKNOWN_ERROR
           };
         }
       }
-    } : void 0
+    } : void 0,
+    /**
+     * Sign in methods - alias for signIn (for backward compatibility)
+     * ✅ IMPROVEMENT: Uses unified signIn logic
+     */
+    signInMethods: {
+      email: (n) => I.email(n),
+      oauth: (n) => {
+        var o;
+        return ((o = I.oauth) == null ? void 0 : o.call(I, n)) || Promise.reject(new Error("OAuth not configured"));
+      },
+      passkey: (n) => {
+        var o;
+        return ((o = I.passkey) == null ? void 0 : o.call(I, n)) || Promise.reject(new Error("Passkey not configured"));
+      },
+      otp: (n, o) => {
+        var u;
+        return ((u = I.otp) == null ? void 0 : u.call(I, n, o)) || Promise.reject(new Error("OTP not configured"));
+      }
+    }
   };
-  if (n.refreshSession) {
-    const o = de(
-      async () => await b.refreshSession(),
-      async () => await b.signOut(),
+  if (s.refreshSession) {
+    const n = he(
+      async () => await C.refreshSession(),
+      async () => await C.signOut(),
       async () => {
-        await A();
+        await _();
       },
       {
-        ...l,
-        onTokenRefreshed: l.onTokenRefreshed,
-        onTokenRefreshFailed: l.onTokenRefreshFailed,
-        onBeforeRedirect: l.onBeforeRedirect
+        ...c,
+        onTokenRefreshed: c.onTokenRefreshed,
+        onTokenRefreshFailed: c.onTokenRefreshFailed,
+        onBeforeRedirect: c.onBeforeRedirect
       }
     );
-    b._tokenRefreshManager = o, b._getTokenRefreshManager = () => o;
+    C._tokenRefreshManager = n, C._getTokenRefreshManager = () => n;
   }
-  return b;
+  return C;
 }
-function Ve(r) {
+function ze(r) {
   return {
-    GET: async (e) => V(e, r, "GET"),
-    POST: async (e) => V(e, r, "POST")
+    GET: async (e) => W(e, r, "GET"),
+    POST: async (e) => W(e, r, "POST")
   };
 }
-async function V(r, e, n) {
-  const t = new URL(r.url), i = t.pathname.replace(/^\/api\/auth/, "") || "/session", f = i.split("/").filter(Boolean);
+async function W(r, e, s) {
+  const t = new URL(r.url), i = t.pathname.replace(/^\/api\/auth/, "") || "/session", d = i.split("/").filter(Boolean);
   try {
-    if (n === "GET") {
+    if (s === "GET") {
       if (i === "/session" || i === "/") {
-        const l = await e.getSession();
-        return u.json({ session: l });
+        const c = await e.getSession();
+        return f.json({ session: c });
       }
       if (i === "/providers")
-        return u.json({
+        return f.json({
           providers: {
             email: !!e.signIn.email,
             oauth: !!e.signIn.oauth,
             passkey: !!e.signIn.passkey
           }
         });
-      if (i.startsWith("/oauth/callback") || f[0] === "oauth" && f[1] === "callback") {
+      if (i.startsWith("/oauth/callback") || d[0] === "oauth" && d[1] === "callback") {
         if (!e.oauthCallback)
-          return u.redirect(new URL("/login?error=oauth_not_configured", r.url));
-        const l = f[2] || t.searchParams.get("provider"), a = t.searchParams.get("code"), h = t.searchParams.get("state");
-        if (!l || !a || !h)
-          return u.redirect(new URL("/login?error=oauth_missing_params", r.url));
+          return f.redirect(new URL("/login?error=oauth_not_configured", r.url));
+        const c = d[2] || t.searchParams.get("provider"), a = t.searchParams.get("code"), p = t.searchParams.get("state");
+        if (!c || !a || !p)
+          return f.redirect(new URL("/login?error=oauth_missing_params", r.url));
         try {
-          const m = await e.oauthCallback(l, a, h);
-          if (m.success) {
-            const v = t.searchParams.get("callbackUrl") || "/";
-            return u.redirect(new URL(v, r.url));
+          const v = await e.oauthCallback(c, a, p);
+          if (v.success) {
+            const S = t.searchParams.get("callbackUrl") || "/";
+            return f.redirect(new URL(S, r.url));
           } else
-            return u.redirect(
-              new URL(`/login?error=${encodeURIComponent(m.error || "oauth_failed")}`, r.url)
+            return f.redirect(
+              new URL(`/login?error=${encodeURIComponent(v.error || "oauth_failed")}`, r.url)
             );
-        } catch (m) {
-          return u.redirect(
+        } catch (v) {
+          return f.redirect(
             new URL(
-              `/login?error=${encodeURIComponent(m instanceof Error ? m.message : "oauth_error")}`,
+              `/login?error=${encodeURIComponent(v instanceof Error ? v.message : "oauth_error")}`,
               r.url
             )
           );
         }
       }
-      return u.json(
+      return f.json(
         { error: "Not found" },
         { status: 404 }
       );
     }
-    if (n === "POST") {
-      const l = await r.json().catch(() => ({}));
-      if (i === "/sign-in" || f[0] === "sign-in") {
-        if (l.provider === "email" && l.email && l.password) {
+    if (s === "POST") {
+      const c = await r.json().catch(() => ({}));
+      if (i === "/sign-in" || d[0] === "sign-in") {
+        if (c.provider === "email" && c.email && c.password) {
           const a = await e.signIn.email({
-            email: l.email,
-            password: l.password
+            email: c.email,
+            password: c.password
           });
-          return u.json(a);
+          return f.json(a);
         }
-        if (l.provider === "oauth" && l.providerName) {
+        if (c.provider === "oauth" && c.providerName) {
           if (!e.signIn.oauth)
-            return u.json(
+            return f.json(
               { success: !1, error: "OAuth is not configured" },
               { status: 400 }
             );
-          const a = await e.signIn.oauth(l.providerName);
-          return u.json(a);
+          const a = await e.signIn.oauth(c.providerName);
+          return f.json(a);
         }
-        if (l.provider === "passkey") {
+        if (c.provider === "passkey") {
           if (!e.signIn.passkey)
-            return u.json(
+            return f.json(
               { success: !1, error: "PassKey is not configured" },
               { status: 400 }
             );
-          const a = await e.signIn.passkey(l.options);
-          return u.json(a);
+          const a = await e.signIn.passkey(c.options);
+          return f.json(a);
         }
-        return u.json(
+        return f.json(
           { success: !1, error: "Invalid sign in request" },
           { status: 400 }
         );
       }
-      if (i === "/sign-up" || f[0] === "sign-up") {
+      if (i === "/sign-up" || d[0] === "sign-up") {
         if (!e.signUp)
-          return u.json(
+          return f.json(
             { success: !1, error: "Sign up is not configured" },
             { status: 400 }
           );
-        const a = await e.signUp(l);
-        return u.json(a);
+        const a = await e.signUp(c);
+        return f.json(a);
       }
-      if (i === "/sign-out" || f[0] === "sign-out") {
+      if (i === "/sign-out" || d[0] === "sign-out") {
         const a = await e.signOut();
-        return u.json(a);
+        return f.json(a);
       }
-      if (i === "/reset-password" || f[0] === "reset-password") {
+      if (i === "/reset-password" || d[0] === "reset-password") {
         if (!e.resetPassword)
-          return u.json(
+          return f.json(
             { success: !1, error: "Password reset is not configured" },
             { status: 400 }
           );
-        const a = await e.resetPassword(l.email);
-        return u.json(a);
+        const a = await e.resetPassword(c.email);
+        return f.json(a);
       }
-      if (i === "/verify-email" || f[0] === "verify-email") {
+      if (i === "/verify-email" || d[0] === "verify-email") {
         if (!e.verifyEmail)
-          return u.json(
+          return f.json(
             { success: !1, error: "Email verification is not configured" },
             { status: 400 }
           );
-        const a = await e.verifyEmail(l.token);
-        return u.json(a);
+        const a = await e.verifyEmail(c.token);
+        return f.json(a);
       }
-      if (i === "/refresh" || f[0] === "refresh") {
+      if (i === "/refresh" || d[0] === "refresh") {
         if (!e.refreshSession) {
-          const h = await e.getSession();
-          return u.json({ session: h });
+          const p = await e.getSession();
+          return f.json({ session: p });
         }
         const a = await e.refreshSession();
-        return u.json({ session: a });
+        return f.json({ session: a });
       }
-      if (i.startsWith("/oauth/callback") || f[0] === "oauth" && f[1] === "callback") {
+      if (i.startsWith("/oauth/callback") || d[0] === "oauth" && d[1] === "callback") {
         if (!e.oauthCallback)
-          return u.json(
+          return f.json(
             { success: !1, error: "OAuth callback is not configured" },
             { status: 400 }
           );
-        const a = l.provider || f[2] || t.searchParams.get("provider"), h = l.code || t.searchParams.get("code"), m = l.state || t.searchParams.get("state");
-        if (!a || !h || !m)
-          return u.json(
+        const a = c.provider || d[2] || t.searchParams.get("provider"), p = c.code || t.searchParams.get("code"), v = c.state || t.searchParams.get("state");
+        if (!a || !p || !v)
+          return f.json(
             {
               success: !1,
               error: "Missing required OAuth parameters. Provider, code, and state are required."
             },
             { status: 400 }
           );
-        const v = await e.oauthCallback(a, h, m);
-        return u.json(v);
+        const S = await e.oauthCallback(a, p, v);
+        return f.json(S);
       }
       if (i.startsWith("/passkey")) {
         if (!e.passkey)
-          return u.json(
+          return f.json(
             { success: !1, error: "PassKey is not configured" },
             { status: 400 }
           );
-        if (f[1] === "register" && e.passkey.register) {
-          const a = await e.passkey.register(l.options);
-          return u.json(a);
+        if (d[1] === "register" && e.passkey.register) {
+          const a = await e.passkey.register(c.options);
+          return f.json(a);
         }
-        if (f[1] === "list" && e.passkey.list) {
+        if (d[1] === "list" && e.passkey.list) {
           const a = await e.passkey.list();
-          return u.json(a);
+          return f.json(a);
         }
-        if (f[1] === "remove" && e.passkey.remove) {
-          const a = await e.passkey.remove(l.passkeyId);
-          return u.json(a);
+        if (d[1] === "remove" && e.passkey.remove) {
+          const a = await e.passkey.remove(c.passkeyId);
+          return f.json(a);
         }
       }
-      if (i === "/verify-2fa" || f[0] === "verify-2fa") {
+      if (i === "/verify-2fa" || d[0] === "verify-2fa") {
         if (!e.verify2FA)
-          return u.json(
+          return f.json(
             { success: !1, error: "2FA verification is not configured" },
             { status: 400 }
           );
-        if (!l.email || !l.userId || !l.code)
-          return u.json(
+        if (!c.email || !c.userId || !c.code)
+          return f.json(
             {
               success: !1,
               error: "Missing required parameters. Email, userId, and code are required."
@@ -1330,304 +1426,304 @@ async function V(r, e, n) {
             { status: 400 }
           );
         const a = await e.verify2FA({
-          email: l.email,
-          userId: l.userId,
-          code: l.code
+          email: c.email,
+          userId: c.userId,
+          code: c.code
         });
-        return u.json(a);
+        return f.json(a);
       }
       if (i.startsWith("/two-factor")) {
         if (!e.twoFactor)
-          return u.json(
+          return f.json(
             { success: !1, error: "Two-Factor Authentication is not configured" },
             { status: 400 }
           );
-        if (f[1] === "enable" && e.twoFactor.enable) {
+        if (d[1] === "enable" && e.twoFactor.enable) {
           const a = await e.twoFactor.enable();
-          return u.json(a);
+          return f.json(a);
         }
-        if (f[1] === "verify" && e.twoFactor.verify) {
-          const a = await e.twoFactor.verify(l.code);
-          return u.json(a);
+        if (d[1] === "verify" && e.twoFactor.verify) {
+          const a = await e.twoFactor.verify(c.code);
+          return f.json(a);
         }
-        if (f[1] === "disable" && e.twoFactor.disable) {
+        if (d[1] === "disable" && e.twoFactor.disable) {
           const a = await e.twoFactor.disable();
-          return u.json(a);
+          return f.json(a);
         }
-        if (f[1] === "backup-codes" && e.twoFactor.generateBackupCodes) {
+        if (d[1] === "backup-codes" && e.twoFactor.generateBackupCodes) {
           const a = await e.twoFactor.generateBackupCodes();
-          return u.json(a);
+          return f.json(a);
         }
-        if (f[1] === "is-enabled" && e.twoFactor.isEnabled) {
+        if (d[1] === "is-enabled" && e.twoFactor.isEnabled) {
           const a = await e.twoFactor.isEnabled();
-          return u.json({ enabled: a });
+          return f.json({ enabled: a });
         }
       }
-      return u.json(
+      return f.json(
         { error: "Not found" },
         { status: 404 }
       );
     }
-    return u.json(
+    return f.json(
       { error: "Method not allowed" },
       { status: 405 }
     );
-  } catch (l) {
-    return u.json(
+  } catch (c) {
+    return f.json(
       {
         success: !1,
-        error: l instanceof Error ? l.message : "Request failed"
+        error: c instanceof Error ? c.message : "Request failed"
       },
       { status: 500 }
     );
   }
 }
-function ze(r) {
+function We(r) {
   return async (e) => {
-    const { method: n, nextUrl: t } = e, f = t.pathname.replace(/^\/api\/auth/, "") || "/";
+    const { method: s, nextUrl: t } = e, d = t.pathname.replace(/^\/api\/auth/, "") || "/";
     try {
-      let l;
-      if (n !== "GET" && n !== "HEAD")
+      let c;
+      if (s !== "GET" && s !== "HEAD")
         try {
-          l = await e.json();
+          c = await e.json();
         } catch {
         }
-      const a = Object.fromEntries(t.searchParams.entries()), h = await fetch(
-        `${process.env.NEXT_PUBLIC_API_URL || ""}/api/auth${f}${Object.keys(a).length > 0 ? `?${new URLSearchParams(a).toString()}` : ""}`,
+      const a = Object.fromEntries(t.searchParams.entries()), p = await fetch(
+        `${process.env.NEXT_PUBLIC_API_URL || ""}/api/auth${d}${Object.keys(a).length > 0 ? `?${new URLSearchParams(a).toString()}` : ""}`,
         {
-          method: n,
+          method: s,
           headers: {
             "Content-Type": "application/json",
             ...Object.fromEntries(e.headers.entries())
           },
-          body: l ? JSON.stringify(l) : void 0
+          body: c ? JSON.stringify(c) : void 0
         }
-      ), m = await h.json();
-      return u.json(m, {
-        status: h.status,
+      ), v = await p.json();
+      return f.json(v, {
+        status: p.status,
         headers: {
-          ...Object.fromEntries(h.headers.entries())
+          ...Object.fromEntries(p.headers.entries())
         }
       });
-    } catch (l) {
-      return console.error("API handler error:", l), u.json(
+    } catch (c) {
+      return console.error("API handler error:", c), f.json(
         {
           success: !1,
-          error: l instanceof Error ? l.message : "Internal server error"
+          error: c instanceof Error ? c.message : "Internal server error"
         },
         { status: 500 }
       );
     }
   };
 }
-function We(r) {
+function qe(r) {
   return async (e) => {
-    const { searchParams: n } = e.nextUrl, t = n.get("provider"), i = n.get("code"), f = n.get("state");
-    if (!t || !i || !f)
-      return u.redirect(
+    const { searchParams: s } = e.nextUrl, t = s.get("provider"), i = s.get("code"), d = s.get("state");
+    if (!t || !i || !d)
+      return f.redirect(
         new URL("/login?error=oauth_missing_params", e.url)
       );
     try {
       if (!r.oauthCallback)
-        return u.redirect(
+        return f.redirect(
           new URL("/login?error=oauth_not_configured", e.url)
         );
-      const l = await r.oauthCallback(t, i, f);
-      if (l.success) {
-        const a = n.get("callbackUrl") || "/";
-        return u.redirect(new URL(a, e.url));
+      const c = await r.oauthCallback(t, i, d);
+      if (c.success) {
+        const a = s.get("callbackUrl") || "/";
+        return f.redirect(new URL(a, e.url));
       } else {
-        const a = l.errorCode ? `${encodeURIComponent(l.error || "oauth_failed")}&code=${l.errorCode}` : encodeURIComponent(l.error || "oauth_failed");
-        return u.redirect(
+        const a = c.errorCode ? `${encodeURIComponent(c.error || "oauth_failed")}&code=${c.errorCode}` : encodeURIComponent(c.error || "oauth_failed");
+        return f.redirect(
           new URL(`/login?error=${a}`, e.url)
         );
       }
-    } catch (l) {
-      return process.env.NODE_ENV === "development" && console.error("[Mulguard] OAuth callback error:", l), u.redirect(
+    } catch (c) {
+      return process.env.NODE_ENV === "development" && console.error("[Mulguard] OAuth callback error:", c), f.redirect(
         new URL(
-          `/login?error=${encodeURIComponent(l instanceof Error ? l.message : "oauth_error")}`,
+          `/login?error=${encodeURIComponent(c instanceof Error ? c.message : "oauth_error")}`,
           e.url
         )
       );
     }
   };
 }
-function N(r, e) {
-  const n = z({
+function L(r, e) {
+  const s = q({
     // Customize headers if needed
     "X-Frame-Options": "SAMEORIGIN"
     // Allow same-origin framing
   });
-  for (const [t, i] of Object.entries(n))
+  for (const [t, i] of Object.entries(s))
     i && typeof i == "string" && e.headers.set(t, i);
   return e;
 }
 function Be() {
   return async (r) => {
-    const e = u.next();
-    return N(r, e);
+    const e = f.next();
+    return L(r, e);
   };
 }
 function He(r, e = {}) {
   const {
-    protectedRoutes: n = [],
+    protectedRoutes: s = [],
     publicRoutes: t = [],
     redirectTo: i = "/login",
-    redirectIfAuthenticated: f
+    redirectIfAuthenticated: d
   } = e;
-  return async (l) => {
-    const { pathname: a } = l.nextUrl, h = n.some((d) => a.startsWith(d));
-    let m = null;
+  return async (c) => {
+    const { pathname: a } = c.nextUrl, p = s.some((g) => a.startsWith(g));
+    let v = null;
     try {
-      m = await r.getSession();
-    } catch (d) {
-      console.error("Middleware: Failed to get session:", d);
+      v = await r.getSession();
+    } catch (g) {
+      console.error("Middleware: Failed to get session:", g);
     }
-    if (h && !m) {
-      const d = l.nextUrl.clone();
-      return d.pathname = i, d.searchParams.set("callbackUrl", a), u.redirect(d);
+    if (p && !v) {
+      const g = c.nextUrl.clone();
+      return g.pathname = i, g.searchParams.set("callbackUrl", a), f.redirect(g);
     }
-    if (f && m && (a.startsWith("/login") || a.startsWith("/register"))) {
-      const k = l.nextUrl.clone();
-      k.pathname = f;
-      const R = u.redirect(k);
-      return N(l, R);
+    if (d && v && (a.startsWith("/login") || a.startsWith("/register"))) {
+      const A = c.nextUrl.clone();
+      A.pathname = d;
+      const b = f.redirect(A);
+      return L(c, b);
     }
-    const v = u.next();
-    return N(l, v);
+    const S = f.next();
+    return L(c, S);
   };
 }
-async function qe(r, e) {
-  var n;
+async function Ke(r, e) {
+  var s;
   try {
     const t = await r.getSession();
-    return t ? ((n = t.user.roles) == null ? void 0 : n.includes(e)) ?? !1 : !1;
+    return t ? ((s = t.user.roles) == null ? void 0 : s.includes(e)) ?? !1 : !1;
   } catch {
     return !1;
   }
 }
-function Ke(r) {
+function Xe(r) {
   const {
     auth: e,
-    protectedRoutes: n = [],
+    protectedRoutes: s = [],
     publicRoutes: t = [],
     redirectTo: i = "/login",
-    redirectIfAuthenticated: f,
-    apiPrefix: l = "/api/auth"
+    redirectIfAuthenticated: d,
+    apiPrefix: c = "/api/auth"
   } = r;
   return async (a) => {
-    const { pathname: h } = a.nextUrl;
-    if (h.startsWith(l)) {
-      const k = u.next();
-      return N(a, k);
+    const { pathname: p } = a.nextUrl;
+    if (p.startsWith(c)) {
+      const A = f.next();
+      return L(a, A);
     }
-    const m = n.some((k) => h.startsWith(k));
-    let v = null;
-    if (m || f)
+    const v = s.some((A) => p.startsWith(A));
+    let S = null;
+    if (v || d)
       try {
-        v = await e.getSession();
-      } catch (k) {
-        console.error("Middleware: Failed to get session:", k);
+        S = await e.getSession();
+      } catch (A) {
+        console.error("Middleware: Failed to get session:", A);
       }
-    if (m && !v) {
-      const k = a.nextUrl.clone();
-      k.pathname = i, k.searchParams.set("callbackUrl", h);
-      const R = u.redirect(k);
-      return N(a, R);
+    if (v && !S) {
+      const A = a.nextUrl.clone();
+      A.pathname = i, A.searchParams.set("callbackUrl", p);
+      const b = f.redirect(A);
+      return L(a, b);
     }
-    if (f && v && (h.startsWith("/login") || h.startsWith("/register"))) {
-      const R = a.nextUrl.clone();
-      R.pathname = f;
-      const S = u.redirect(R);
-      return N(a, S);
+    if (d && S && (p.startsWith("/login") || p.startsWith("/register"))) {
+      const b = a.nextUrl.clone();
+      b.pathname = d;
+      const T = f.redirect(b);
+      return L(a, T);
     }
-    const d = u.next();
-    return N(a, d);
+    const g = f.next();
+    return L(a, g);
   };
 }
-async function Xe(r, e) {
-  var n;
+async function Ye(r, e) {
+  var s;
   try {
     const t = await r.getSession();
-    return t ? ((n = t.user.roles) == null ? void 0 : n.includes(e)) ?? !1 : !1;
+    return t ? ((s = t.user.roles) == null ? void 0 : s.includes(e)) ?? !1 : !1;
   } catch {
     return !1;
   }
 }
 export {
-  ee as CSRFProtection,
-  Q as DEFAULT_SECURITY_HEADERS,
-  Z as MemoryCSRFStore,
-  le as MemoryOAuthStateStore,
-  J as RateLimiter,
-  ke as applySecurityHeaders,
-  q as buildCookieOptions,
-  ie as buildOAuthAuthorizationUrl,
-  qe as checkRole,
-  Xe as checkRoleProxy,
+  te as CSRFProtection,
+  ee as DEFAULT_SECURITY_HEADERS,
+  re as MemoryCSRFStore,
+  fe as MemoryOAuthStateStore,
+  Z as RateLimiter,
+  Re as applySecurityHeaders,
+  X as buildCookieOptions,
+  ce as buildOAuthAuthorizationUrl,
+  Ke as checkRole,
+  Ye as checkRoleProxy,
   Pe as containsXSSPattern,
-  ze as createApiHandler,
+  We as createApiHandler,
   He as createAuthMiddleware,
-  _e as createCSRFProtection,
-  ue as createMemoryOAuthStateStore,
-  We as createOAuthCallbackHandler,
-  Ke as createProxyMiddleware,
-  Ee as createRateLimiter,
+  be as createCSRFProtection,
+  de as createMemoryOAuthStateStore,
+  qe as createOAuthCallbackHandler,
+  Xe as createProxyMiddleware,
+  ve as createRateLimiter,
   Be as createSecurityMiddleware,
-  nr as createServerAuthMiddleware,
-  or as createServerHelpers,
-  ir as createServerUtils,
-  ar as createSessionManager,
-  Y as deleteCookie,
-  cr as deleteOAuthStateCookie,
-  re as escapeHTML,
-  ae as exchangeOAuthCode,
-  te as generateCSRFToken,
-  W as generateToken,
-  X as getCookie,
-  lr as getCurrentUser,
+  sr as createServerAuthMiddleware,
+  nr as createServerHelpers,
+  or as createServerUtils,
+  ir as createSessionManager,
+  J as deleteCookie,
+  ar as deleteOAuthStateCookie,
+  se as escapeHTML,
+  le as exchangeOAuthCode,
+  ne as generateCSRFToken,
+  B as generateToken,
+  G as getCookie,
+  cr as getCurrentUser,
   xe as getErrorCode,
-  Ne as getErrorMessage,
-  ur as getOAuthStateCookie,
-  ce as getOAuthUserInfo,
+  Fe as getErrorMessage,
+  lr as getOAuthStateCookie,
+  ue as getOAuthUserInfo,
   $ as getProviderMetadata,
-  z as getSecurityHeaders,
-  fr as getServerSession,
-  dr as getSessionTimeUntilExpiry,
-  $e as getUserFriendlyError,
-  De as hasErrorCode,
-  ne as isAuthError,
-  je as isAuthSuccess,
-  Le as isRetryableError,
-  hr as isSessionExpiredNullable,
+  q as getSecurityHeaders,
+  ur as getServerSession,
+  fr as getSessionTimeUntilExpiry,
+  Ve as getUserFriendlyError,
+  je as hasErrorCode,
+  ie as isAuthError,
+  Le as isAuthSuccess,
+  De as isRetryableError,
+  dr as isSessionExpiredNullable,
   gr as isSessionExpiringSoon,
-  wr as isSessionValid,
-  Fe as isTwoFactorRequired,
-  Ce as isValidEmail,
+  hr as isSessionValid,
+  Ne as isTwoFactorRequired,
+  Ue as isValidEmail,
   Me as mulguard,
-  pr as refreshSession,
-  mr as requireAuth,
-  yr as requireRole,
-  Er as requireServerAuthMiddleware,
-  kr as requireServerRoleMiddleware,
-  Ie as sanitizeHTML,
-  Ue as sanitizeInput,
-  Te as sanitizeUserInput,
-  K as setCookie,
-  tr as signIn,
-  Je as signInEmailAction,
-  Qe as signOutAction,
-  Ze as signUpAction,
-  vr as storeOAuthStateCookie,
-  Ve as toNextJsHandler,
-  ve as validateAndSanitizeEmail,
-  Oe as validateAndSanitizeInput,
+  wr as refreshSession,
+  pr as requireAuth,
+  mr as requireRole,
+  yr as requireServerAuthMiddleware,
+  Er as requireServerRoleMiddleware,
+  Te as sanitizeHTML,
+  Ce as sanitizeInput,
+  _e as sanitizeUserInput,
+  Y as setCookie,
+  $e as signIn,
+  Qe as signInEmailAction,
+  Ze as signOutAction,
+  er as signUpAction,
+  kr as storeOAuthStateCookie,
+  ze as toNextJsHandler,
+  M as validateAndSanitizeEmail,
+  z as validateAndSanitizeInput,
   Se as validateAndSanitizeName,
-  Re as validateAndSanitizePassword,
-  se as validateCSRFToken,
-  F as validateSessionStructure,
-  be as validateToken,
-  Ae as validateURL,
-  er as verify2FAAction,
-  N as withSecurityHeaders
+  Ae as validateAndSanitizePassword,
+  oe as validateCSRFToken,
+  x as validateSessionStructure,
+  Oe as validateToken,
+  Ie as validateURL,
+  rr as verify2FAAction,
+  L as withSecurityHeaders
 };