mulguard 1.1.0 → 1.1.2

package/dist/index/index.mjs

@@ -4,7 +4,7 @@ var F = (r, e, s) => K(r, typeof e != "symbol" ? e + "" : e, s);
 import { A as y, e as X, c as Y, g as G, d as J } from "../actions-DeCfLtHA.mjs";
 import { a as Qe, s as Ze, b as er, v as rr } from "../actions-DeCfLtHA.mjs";
 import { v as x } from "../oauth-state-LE-qeq-K.mjs";
-import { c as sr, p as nr, k as or, n as ir, m as ar, j as cr, l as lr, e as ur, g as fr, b as dr, i as gr, a as hr, o as wr, f as pr, h as mr, r as yr, d as Er, s as kr } from "../oauth-state-LE-qeq-K.mjs";
+import { c as sr, p as nr, k as or, n as ir, m as ar, j as cr, l as lr, e as ur, g as fr, b as dr, i as gr, a as hr, o as wr, f as mr, h as pr, r as yr, d as Er, s as kr } from "../oauth-state-LE-qeq-K.mjs";
 import { NextResponse as f } from "next/server";
 const j = typeof globalThis == "object" && "crypto" in globalThis ? globalThis.crypto : void 0;
 /*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */
@@ -76,8 +76,8 @@ function q(r) {
 }
 function Re(r, e) {
   const s = q(e);
-  for (const [t, i] of Object.entries(s))
-    i && r.set(t, i);
+  for (const [t, o] of Object.entries(s))
+    o && r.set(t, o);
 }
 function M(r) {
   if (!r || typeof r != "string")
@@ -114,8 +114,8 @@ function Ae(r, e = 8) {
     return { valid: !1, error: "Password contains too many repeated characters" };
   if (/012|123|234|345|456|567|678|789|abc|bcd|cde|def|efg|fgh|ghi|hij|ijk|jkl|klm|lmn|mno|nop|opq|pqr|qrs|rst|stu|tuv|uvw|vwx|wxy|xyz/i.test(r))
     return { valid: !1, error: "Password contains sequential characters" };
-  let t = "weak", i = 0;
-  return r.length >= 12 ? i += 2 : r.length >= 8 && (i += 1), /[a-z]/.test(r) && (i += 1), /[A-Z]/.test(r) && (i += 1), /[0-9]/.test(r) && (i += 1), /[^a-zA-Z0-9]/.test(r) && (i += 1), i >= 5 ? t = "strong" : i >= 3 && (t = "medium"), { valid: !0, strength: t };
+  let t = "weak", o = 0;
+  return r.length >= 12 ? o += 2 : r.length >= 8 && (o += 1), /[a-z]/.test(r) && (o += 1), /[A-Z]/.test(r) && (o += 1), /[0-9]/.test(r) && (o += 1), /[^a-zA-Z0-9]/.test(r) && (o += 1), o >= 5 ? t = "strong" : o >= 3 && (t = "medium"), { valid: !0, strength: t };
 }
 function Se(r) {
   if (!r || typeof r != "string")
@@ -133,12 +133,12 @@ function Ie(r) {
     return { valid: !1, error: "Invalid URL format" };
   }
 }
-function Oe(r, e = 16) {
+function _e(r, e = 16) {
   return !r || typeof r != "string" ? { valid: !1, error: "Token is required" } : r.length < e ? { valid: !1, error: "Token is too short" } : r.length > 512 ? { valid: !1, error: "Token is too long" } : /^[A-Za-z0-9_-]+$/.test(r) ? /(.)\1{10,}/.test(r) ? { valid: !1, error: "Token contains suspicious pattern" } : { valid: !0 } : { valid: !1, error: "Invalid token format" };
 }
 function z(r, e) {
-  const { maxLength: s = 1e3, allowHtml: t = !1, required: i = !0 } = e || {};
-  if (i && (!r || typeof r != "string" || r.trim().length === 0))
+  const { maxLength: s = 1e3, allowHtml: t = !1, required: o = !0 } = e || {};
+  if (o && (!r || typeof r != "string" || r.trim().length === 0))
     return { valid: !1, error: "Input is required" };
   if (!r || typeof r != "string")
     return { valid: !0, sanitized: "" };
@@ -186,8 +186,8 @@ class te {
     const t = this.store.get(e);
     if (!t)
       return !1;
-    const i = oe(s, t);
-    return i && this.store.delete(e), i;
+    const o = oe(s, t);
+    return o && this.store.delete(e), o;
   }
   /**
    * Get stored token without validating
@@ -202,7 +202,7 @@ class te {
     this.store.delete(e);
   }
 }
-function be(r) {
+function Oe(r) {
   return new te(r);
 }
 function se(r) {
@@ -217,10 +217,10 @@ function se(r) {
   };
   return r.replace(/[&<>"']/g, (s) => e[s] || s);
 }
-function Te(r) {
+function be(r) {
   return typeof r != "string" ? "" : r.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "").replace(/on\w+\s*=\s*["'][^"']*["']/gi, "").replace(/javascript:/gi, "");
 }
-function _e(r) {
+function Te(r) {
   return typeof r != "string" ? "" : se(r.trim());
 }
 function Pe(r) {
@@ -350,23 +350,23 @@ function $(r) {
   return ae[r] || null;
 }
 function ce(r, e, s, t) {
-  const i = $(r);
-  if (!i)
+  const o = $(r);
+  if (!o)
     throw new Error(`Unknown OAuth provider: ${r}`);
-  const d = e.redirectUri || `${s}/api/auth/callback/${r}`, c = e.scopes || i.defaultScopes, a = new URLSearchParams({
+  const d = e.redirectUri || `${s}/api/auth/callback/${r}`, c = e.scopes || o.defaultScopes, a = new URLSearchParams({
     client_id: e.clientId,
     redirect_uri: d,
     response_type: "code",
     scope: c.join(" "),
     state: t,
-    ...i.defaultParams,
+    ...o.defaultParams,
     ...e.params
   });
-  return `${i.authorizationUrl}?${a.toString()}`;
+  return `${o.authorizationUrl}?${a.toString()}`;
 }
 async function le(r, e, s, t) {
-  const i = $(r);
-  if (!i)
+  const o = $(r);
+  if (!o)
     throw new Error(`Unknown OAuth provider: ${r}`);
   const d = new URLSearchParams({
     client_id: e.clientId,
@@ -375,7 +375,7 @@ async function le(r, e, s, t) {
     grant_type: "authorization_code"
   });
   e.clientSecret && d.append("client_secret", e.clientSecret);
-  const c = await fetch(i.tokenUrl, {
+  const c = await fetch(o.tokenUrl, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded",
@@ -390,7 +390,7 @@ async function le(r, e, s, t) {
   return await c.json();
 }
 async function ue(r, e) {
-  var d, c, a, p;
+  var d, c, a, m;
   const s = $(r);
   if (!s)
     throw new Error(`Unknown OAuth provider: ${r}`);
@@ -401,56 +401,61 @@ async function ue(r, e) {
     }
   });
   if (!t.ok) {
-    const v = await t.text();
-    throw new Error(`Failed to fetch user info: ${v}`);
+    const k = await t.text();
+    throw new Error(`Failed to fetch user info: ${k}`);
   }
-  const i = await t.json();
+  const o = await t.json();
   switch (r) {
     case "google":
       return {
-        id: i.sub || i.id,
-        email: i.email,
-        name: i.name,
-        avatar: i.picture,
-        emailVerified: i.email_verified
+        id: o.sub || o.id,
+        email: o.email,
+        name: o.name,
+        avatar: o.picture,
+        emailVerified: o.email_verified,
+        rawProfile: o
       };
     case "github":
-      let v = i.email;
-      if (!v) {
-        const g = await (await fetch("https://api.github.com/user/emails", {
+      let k = o.email, I = { ...o };
+      if (!k) {
+        const A = await (await fetch("https://api.github.com/user/emails", {
           headers: { Authorization: `Bearer ${e}` }
         })).json();
-        v = ((d = g.find((A) => A.primary)) == null ? void 0 : d.email) || ((c = g[0]) == null ? void 0 : c.email) || `${i.login}@users.noreply.github.com`;
+        k = ((d = A.find((_) => _.primary)) == null ? void 0 : d.email) || ((c = A[0]) == null ? void 0 : c.email) || `${o.login}@users.noreply.github.com`, I = { ...o, emails: A };
       }
       return {
-        id: String(i.id),
-        email: v,
-        name: i.name || i.login,
-        avatar: i.avatar_url,
-        emailVerified: !!v
+        id: String(o.id),
+        email: k,
+        name: o.name || o.login,
+        avatar: o.avatar_url,
+        emailVerified: !!k,
+        rawProfile: I
       };
     case "apple":
       return {
-        id: i.sub,
-        email: i.email,
-        name: i.name ? `${i.name.firstName} ${i.name.lastName}` : "",
-        emailVerified: i.email_verified
+        id: o.sub,
+        email: o.email,
+        name: o.name ? `${o.name.firstName} ${o.name.lastName}` : "",
+        emailVerified: o.email_verified,
+        rawProfile: o
       };
     case "facebook":
       return {
-        id: i.id,
-        email: i.email,
-        name: i.name,
-        avatar: (p = (a = i.picture) == null ? void 0 : a.data) == null ? void 0 : p.url,
-        emailVerified: !0
+        id: o.id,
+        email: o.email,
+        name: o.name,
+        avatar: (m = (a = o.picture) == null ? void 0 : a.data) == null ? void 0 : m.url,
+        emailVerified: !0,
+        rawProfile: o
       };
     default:
       return {
-        id: String(i.id || i.sub),
-        email: i.email,
-        name: i.name || i.display_name || i.username,
-        avatar: i.avatar || i.picture || i.avatar_url,
-        emailVerified: i.email_verified || i.emailVerified || !1
+        id: String(o.id || o.sub),
+        email: o.email,
+        name: o.name || o.display_name || o.username,
+        avatar: o.avatar || o.picture || o.avatar_url,
+        emailVerified: o.email_verified || o.emailVerified || !1,
+        rawProfile: o
       };
   }
 }
@@ -501,55 +506,55 @@ function ge(r = process.env.NODE_ENV === "development") {
 const P = ge();
 function he(r, e, s, t = {}) {
   const {
-    enabled: i = !0,
+    enabled: o = !0,
     maxRetries: d = 1,
     retryDelay: c = 1e3,
     rateLimit: a = 3,
-    autoSignOutOnFailure: p = !0,
-    redirectToLogin: v = "/login",
-    autoRedirectOnFailure: S = !0
+    autoSignOutOnFailure: m = !0,
+    redirectToLogin: k = "/login",
+    autoRedirectOnFailure: I = !0
   } = t;
   let g = null, A = !1;
-  const b = [], T = [], U = 60 * 1e3;
-  let _ = 0, I = !1, C = null;
+  const _ = [], b = [], U = 60 * 1e3;
+  let T = 0, O = !1, C = null;
   const D = 2, V = 60 * 1e3;
   function n() {
     const l = Date.now();
-    if (I && C) {
+    if (O && C) {
       if (l < C)
         return !1;
-      I = !1, C = null, _ = 0;
+      O = !1, C = null, T = 0;
     }
-    for (; T.length > 0; ) {
-      const w = T[0];
+    for (; b.length > 0; ) {
+      const w = b[0];
       if (w !== void 0 && w < l - U)
-        T.shift();
+        b.shift();
       else
         break;
     }
-    return T.length >= a ? !1 : (T.push(l), !0);
+    return b.length >= a ? !1 : (b.push(l), !0);
   }
-  function o() {
-    _++, _ >= D && (I = !0, C = Date.now() + V, process.env.NODE_ENV === "development" && console.warn("[TokenRefreshManager] Circuit breaker opened - too many consecutive failures"));
+  function i() {
+    T++, T >= D && (O = !0, C = Date.now() + V, process.env.NODE_ENV === "development" && console.warn("[TokenRefreshManager] Circuit breaker opened - too many consecutive failures"));
   }
   function u() {
-    _ = 0, I = !1, C = null;
+    T = 0, O = !1, C = null;
   }
-  async function m(l = 1) {
-    if (!i)
+  async function p(l = 1) {
+    if (!o)
       return null;
     if (!n())
       throw new Error("Rate limit exceeded for token refresh");
     try {
       const w = await r();
       if (w)
-        return u(), O(w), t.onTokenRefreshed && await Promise.resolve(t.onTokenRefreshed(w)), w;
-      if (o(), l < d)
-        return await h(c * l), m(l + 1);
+        return u(), S(w), t.onTokenRefreshed && await Promise.resolve(t.onTokenRefreshed(w)), w;
+      if (i(), l < d)
+        return await h(c * l), p(l + 1);
       throw new Error("Token refresh failed: refresh function returned null");
     } catch (w) {
-      if (o(), l < d && R(w))
-        return await h(c * l), m(l + 1);
+      if (i(), l < d && R(w))
+        return await h(c * l), p(l + 1);
       throw w;
     }
   }
@@ -563,27 +568,27 @@ function he(r, e, s, t = {}) {
     }
     return !1;
   }
-  function O(l) {
-    const w = [...b];
-    b.length = 0;
+  function S(l) {
+    const w = [..._];
+    _.length = 0;
     for (const { resolve: N } of w)
       N(l);
   }
   function E(l) {
-    const w = [...b];
-    b.length = 0;
+    const w = [..._];
+    _.length = 0;
     for (const { reject: N } of w)
       N(l);
   }
   function h(l) {
     return new Promise((w) => setTimeout(w, l));
   }
-  async function k(l) {
+  async function v(l) {
     try {
-      if (t.onTokenRefreshFailed && await Promise.resolve(t.onTokenRefreshFailed(l)), p && (await s(), await e(), S && typeof window < "u")) {
+      if (t.onTokenRefreshFailed && await Promise.resolve(t.onTokenRefreshFailed(l)), m && (await s(), await e(), I && typeof window < "u")) {
         let w = !0;
         if (t.onBeforeRedirect && (w = await Promise.resolve(t.onBeforeRedirect(l))), w) {
-          const N = new URL(v, window.location.origin);
+          const N = new URL(k, window.location.origin);
           N.searchParams.set("reason", "session_expired"), N.searchParams.set("redirect", window.location.pathname + window.location.search), window.location.href = N.toString();
         }
       }
@@ -596,8 +601,8 @@ function he(r, e, s, t = {}) {
      * Refresh token with single refresh queue
      */
     async refreshToken() {
-      return i ? g || (A = !0, g = m().then((l) => (A = !1, g = null, l)).catch((l) => {
-        throw A = !1, g = null, E(l), k(l).catch(() => {
+      return o ? g || (A = !0, g = p().then((l) => (A = !1, g = null, l)).catch((l) => {
+        throw A = !1, g = null, E(l), v(l).catch(() => {
         }), l;
       }), g) : null;
     },
@@ -612,20 +617,20 @@ function he(r, e, s, t = {}) {
      */
     async waitForRefresh() {
       return g ? new Promise((l, w) => {
-        b.push({ resolve: l, reject: w });
+        _.push({ resolve: l, reject: w });
       }) : null;
     },
     /**
      * Clear state
      */
     clear() {
-      g = null, A = !1, T.length = 0, u(), E(new Error("Token refresh manager cleared"));
+      g = null, A = !1, b.length = 0, u(), E(new Error("Token refresh manager cleared"));
     },
     /**
      * Handle token refresh failure
      */
     async handleRefreshFailure(l) {
-      return k(l);
+      return v(l);
     }
   };
 }
@@ -642,7 +647,7 @@ function we() {
     path: "/"
   };
 }
-function pe() {
+function me() {
   return {
     enabled: !0,
     refreshThreshold: 300,
@@ -662,51 +667,73 @@ function Me(r) {
   const e = {
     ...we(),
     ...r.session
-  }, s = r.actions, t = r.callbacks || {}, i = ((D = r.providers) == null ? void 0 : D.oauth) || {}, d = process.env.NEXT_PUBLIC_URL || (process.env.VERCEL_URL ? `https://${process.env.VERCEL_URL}` : "http://localhost:3000"), c = {
-    ...pe(),
+  }, s = r.actions, t = r.callbacks || {}, o = ((D = r.providers) == null ? void 0 : D.oauth) || {}, d = process.env.NEXT_PUBLIC_URL || (process.env.VERCEL_URL ? `https://${process.env.VERCEL_URL}` : "http://localhost:3000"), c = {
+    ...me(),
     ...r.tokenRefresh
   }, a = { ...s };
-  if (Object.keys(i).length > 0 && !a.signIn.oauth && (a.signIn.oauth = async (n) => {
-    const o = i[n];
-    if (!o)
+  if (Object.keys(o).length > 0 && !a.signIn.oauth && (a.signIn.oauth = async (n) => {
+    const i = o[n];
+    if (!i)
       throw new Error(`OAuth provider "${n}" is not configured. Add it to providers.oauth in config.`);
-    if (!o.clientId)
+    if (!i.clientId)
       throw new Error(`OAuth provider "${n}" is missing clientId`);
     const u = ne();
-    return { url: ce(n, o, d, u), state: u };
-  }), Object.keys(i).length > 0 && !a.oauthCallback && (a.oauthCallback = async (n, o, u) => {
-    const m = i[n];
-    if (!m)
+    return { url: ce(n, i, d, u), state: u };
+  }), Object.keys(o).length > 0 && !a.oauthCallback && (a.oauthCallback = async (n, i, u) => {
+    const p = o[n];
+    if (!p)
       return {
         success: !1,
         error: `OAuth provider "${n}" is not configured`,
         errorCode: y.VALIDATION_ERROR
       };
     try {
-      const R = m.redirectUri || `${d}/api/auth/callback/${n}`, O = await le(n, m, o, R), E = await ue(n, O.access_token);
+      const R = p.redirectUri || `${d}/api/auth/callback/${n}`, S = await le(n, p, i, R), E = await ue(n, S.access_token), h = {
+        id: E.id,
+        email: E.email,
+        name: E.name,
+        avatar: E.avatar,
+        emailVerified: E.emailVerified,
+        // ✅ NEW: Add provider information
+        provider: n,
+        // ✅ NEW: Add access token (required for backend API integration)
+        accessToken: S.access_token,
+        // ✅ NEW: Add refresh token (optional, for token refresh)
+        refreshToken: S.refresh_token,
+        // ✅ NEW: Add complete tokens object
+        tokens: {
+          access_token: S.access_token,
+          refresh_token: S.refresh_token,
+          expires_in: S.expires_in,
+          token_type: S.token_type,
+          id_token: S.id_token
+        },
+        // ✅ NEW: Add raw profile data (for advanced use cases)
+        rawProfile: E.rawProfile
+      };
       if (t.onOAuthUser) {
-        const h = await g(t.onOAuthUser, E, n);
-        if (!h)
+        const v = await g(t.onOAuthUser, h, n);
+        if (!v)
           return {
             success: !1,
             error: "Failed to create or retrieve user",
             errorCode: y.VALIDATION_ERROR
           };
-        const k = {
+        const l = {
           user: {
-            id: h.id,
-            email: h.email,
-            name: h.name,
-            avatar: E.avatar,
-            emailVerified: E.emailVerified
+            id: v.id,
+            email: v.email,
+            name: v.name,
+            avatar: h.avatar,
+            emailVerified: h.emailVerified
           },
           expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1e3),
-          accessToken: O.access_token,
-          refreshToken: O.refresh_token,
+          accessToken: S.access_token,
+          refreshToken: S.refresh_token,
           tokenType: "Bearer",
-          expiresIn: O.expires_in
+          expiresIn: S.expires_in
         };
-        return await T(k), p = { session: k, timestamp: Date.now() }, t.onSignIn && await g(t.onSignIn, k.user, k), { success: !0, user: k.user, session: k };
+        return await b(l), m = { session: l, timestamp: Date.now() }, t.onSignIn && await g(t.onSignIn, l.user, l), { success: !0, user: l.user, session: l };
       }
       return {
         success: !1,
@@ -722,40 +749,40 @@ function Me(r) {
     }
   }), !a.signIn || !a.signIn.email)
     throw new Error("mulguard: signIn.email action is required");
-  let p = null;
-  const v = ((V = r.session) == null ? void 0 : V.cacheTtl) ?? r.sessionCacheTtl ?? 5e3, S = r.oauthStateStore || de(), g = async (n, ...o) => {
+  let m = null;
+  const k = ((V = r.session) == null ? void 0 : V.cacheTtl) ?? r.sessionCacheTtl ?? 5e3, I = r.oauthStateStore || de(), g = async (n, ...i) => {
     if (n)
       try {
-        return await n(...o);
+        return await n(...i);
       } catch (u) {
         throw t.onError && await t.onError(u instanceof Error ? u : new Error(String(u)), "callback"), u;
       }
-  }, A = async (n, o) => {
+  }, A = async (n, i) => {
     const u = {
-      provider: o,
+      provider: i,
       expiresAt: Date.now() + 6e5
       // 10 minutes
     };
-    await Promise.resolve(S.set(n, u, 10 * 60 * 1e3)), S.cleanup && await Promise.resolve(S.cleanup());
-  }, b = async (n, o) => {
-    const u = await Promise.resolve(S.get(n));
-    return u ? u.expiresAt < Date.now() ? (await Promise.resolve(S.delete(n)), !1) : u.provider !== o ? !1 : (await Promise.resolve(S.delete(n)), !0) : !1;
-  }, T = async (n) => {
-    const o = e.cookieName || "__mulguard_session", u = typeof n == "object" && "token" in n ? String(n.token) : JSON.stringify(n), m = X(o, u, e);
-    return await Y(m);
+    await Promise.resolve(I.set(n, u, 10 * 60 * 1e3)), I.cleanup && await Promise.resolve(I.cleanup());
+  }, _ = async (n, i) => {
+    const u = await Promise.resolve(I.get(n));
+    return u ? u.expiresAt < Date.now() ? (await Promise.resolve(I.delete(n)), !1) : u.provider !== i ? !1 : (await Promise.resolve(I.delete(n)), !0) : !1;
+  }, b = async (n) => {
+    const i = e.cookieName || "__mulguard_session", u = typeof n == "object" && "token" in n ? String(n.token) : JSON.stringify(n), p = X(i, u, e);
+    return await Y(p);
   }, U = async (n) => {
     if (!n.success || !n.session)
       return { success: !0 };
-    const o = await T(n.session);
-    return p = { session: n.session, timestamp: Date.now() }, n.user && t.onSignIn && await g(t.onSignIn, n.user, n.session), o;
-  }, _ = async () => {
+    const i = await b(n.session);
+    return m = { session: n.session, timestamp: Date.now() }, n.user && t.onSignIn && await g(t.onSignIn, n.user, n.session), i;
+  }, T = async () => {
     const n = e.cookieName || "__mulguard_session";
     await J(n, {
       path: e.path,
       domain: e.domain
     });
   };
-  let I = null;
+  let O = null;
   const C = {
     /**
      * Get current session
@@ -764,31 +791,31 @@ function Me(r) {
      */
     async getSession() {
       const n = Date.now();
-      if (p && n - p.timestamp < v)
-        return p.session;
+      if (m && n - m.timestamp < k)
+        return m.session;
       if (s.getSession)
         try {
-          const o = await s.getSession();
-          if (o && x(o))
-            return p = { session: o, timestamp: n }, o;
-          o && !x(o) && (await _(), p = null);
-        } catch (o) {
-          P.debug("getSession error", { error: o }), t.onError && await g(t.onError, o instanceof Error ? o : new Error(String(o)), "getSession"), p = null;
+          const i = await s.getSession();
+          if (i && x(i))
+            return m = { session: i, timestamp: n }, i;
+          i && !x(i) && (await T(), m = null);
+        } catch (i) {
+          P.debug("getSession error", { error: i }), t.onError && await g(t.onError, i instanceof Error ? i : new Error(String(i)), "getSession"), m = null;
         }
       try {
-        const o = e.cookieName || "__mulguard_session", u = await G(o);
+        const i = e.cookieName || "__mulguard_session", u = await G(i);
         if (u)
           try {
-            const m = JSON.parse(u);
-            if (x(m))
-              return m.expiresAt && new Date(m.expiresAt) < /* @__PURE__ */ new Date() ? (t.onSessionExpired && await g(t.onSessionExpired, m), await _(), p = null, null) : (p = { session: m, timestamp: n }, m);
-            await _(), p = null;
+            const p = JSON.parse(u);
+            if (x(p))
+              return p.expiresAt && new Date(p.expiresAt) < /* @__PURE__ */ new Date() ? (t.onSessionExpired && await g(t.onSessionExpired, p), await T(), m = null, null) : (m = { session: p, timestamp: n }, p);
+            await T(), m = null;
           } catch {
-            await _(), p = null;
+            await T(), m = null;
           }
-      } catch (o) {
-        const u = o instanceof Error ? o.message : String(o);
-        !u.includes("request scope") && !u.includes("cookies") && (P.warn("getSession cookie error", { error: o }), t.onError && await g(t.onError, o instanceof Error ? o : new Error(String(o)), "getSession.cookie"));
+      } catch (i) {
+        const u = i instanceof Error ? i.message : String(i);
+        !u.includes("request scope") && !u.includes("cookies") && (P.warn("getSession cookie error", { error: i }), t.onError && await g(t.onError, i instanceof Error ? i : new Error(String(i)), "getSession.cookie"));
       }
       return null;
     },
@@ -850,33 +877,33 @@ function Me(r) {
               error: "Invalid credentials",
               errorCode: y.VALIDATION_ERROR
             };
-          const k = {
+          const v = {
             email: h.sanitized,
             password: E.password
             // Don't sanitize password (needed for hashing)
-          }, l = await a.signIn.email(k);
-          return l.success && l.session && await U(l), l.success ? P.info("Sign in successful", { email: k.email.substring(0, 3) + "***" }) : P.warn("Sign in failed", { email: k.email.substring(0, 3) + "***", errorCode: l.errorCode }), l;
+          }, l = await a.signIn.email(v);
+          return l.success && l.session && await U(l), l.success ? P.info("Sign in successful", { email: v.email.substring(0, 3) + "***" }) : P.warn("Sign in failed", { email: v.email.substring(0, 3) + "***", errorCode: l.errorCode }), l;
         } catch (h) {
-          const k = h instanceof Error ? h.message : "Sign in failed";
-          return P.error("Sign in error", { error: k, context: "signIn.email" }), t.onError && await g(t.onError, h instanceof Error ? h : new Error(String(h)), "signIn.email"), {
+          const v = h instanceof Error ? h.message : "Sign in failed";
+          return P.error("Sign in error", { error: v, context: "signIn.email" }), t.onError && await g(t.onError, h instanceof Error ? h : new Error(String(h)), "signIn.email"), {
             success: !1,
             error: "Sign in failed. Please try again.",
             errorCode: y.UNKNOWN_ERROR
           };
         }
-      }, o = async (E) => {
+      }, i = async (E) => {
         if (!E || typeof E != "string")
           throw new Error("Provider is required");
         const h = z(E, { maxLength: 50, allowHtml: !1, required: !0 });
         if (!h.valid || !h.sanitized)
           throw new Error("Invalid provider");
-        const k = h.sanitized.toLowerCase();
+        const v = h.sanitized.toLowerCase();
         if (!a.signIn.oauth)
           throw new Error(
             "OAuth sign in is not configured. Either provide oauth action in signIn, or configure providers.oauth in config."
           );
-        const l = await a.signIn.oauth(k);
-        return await A(l.state, k), P.info("OAuth sign in initiated", { provider: k }), l;
+        const l = await a.signIn.oauth(v);
+        return await A(l.state, v), P.info("OAuth sign in initiated", { provider: v }), l;
       }, u = async (E) => {
         if (!a.signIn.passkey)
           throw new Error("PassKey sign in is not configured. Provide passkey action in signIn.");
@@ -889,18 +916,18 @@ function Me(r) {
             error: h instanceof Error ? h.message : "PassKey sign in failed"
           };
         }
-      }, m = async (E, h) => {
+      }, p = async (E, h) => {
         if (!E || typeof E != "string")
           return {
             success: !1,
             error: "Email is required",
             errorCode: y.VALIDATION_ERROR
           };
-        const k = M(E);
-        if (!k.valid)
+        const v = M(E);
+        if (!v.valid)
           return {
             success: !1,
-            error: k.error || "Invalid email format",
+            error: v.error || "Invalid email format",
             errorCode: y.VALIDATION_ERROR
           };
         if (h !== void 0 && (typeof h != "string" || h.length < 4 || h.length > 10))
@@ -916,8 +943,8 @@ function Me(r) {
             errorCode: y.VALIDATION_ERROR
           };
         try {
-          const l = await a.signIn.otp(k.sanitized, h);
-          return l.success && l.session && await U(l), l.success ? P.info("OTP sign in successful", { email: k.sanitized.substring(0, 3) + "***" }) : P.warn("OTP sign in failed", { email: k.sanitized.substring(0, 3) + "***" }), l;
+          const l = await a.signIn.otp(v.sanitized, h);
+          return l.success && l.session && await U(l), l.success ? P.info("OTP sign in successful", { email: v.sanitized.substring(0, 3) + "***" }) : P.warn("OTP sign in failed", { email: v.sanitized.substring(0, 3) + "***" }), l;
         } catch (l) {
           return P.error("OTP sign in error", { error: l instanceof Error ? l.message : "Unknown error", context: "signIn.otp" }), t.onError && await g(t.onError, l instanceof Error ? l : new Error(String(l)), "signIn.otp"), {
             success: !1,
@@ -925,16 +952,16 @@ function Me(r) {
             errorCode: y.UNKNOWN_ERROR
           };
         }
-      }, O = Object.assign(
+      }, S = Object.assign(
         async (E, h) => {
           if (!E || typeof E != "string")
             throw new Error("Provider is required");
-          const k = z(E, { maxLength: 50, allowHtml: !1, required: !0 });
-          if (!k.valid || !k.sanitized)
+          const v = z(E, { maxLength: 50, allowHtml: !1, required: !0 });
+          if (!v.valid || !v.sanitized)
             throw new Error("Invalid provider");
-          const l = k.sanitized.toLowerCase();
+          const l = v.sanitized.toLowerCase();
           if (l === "google" || l === "github" || l === "apple" || l === "facebook" || typeof l == "string" && !["credentials", "otp", "passkey"].includes(l))
-            return o(l);
+            return i(l);
           if (l === "credentials")
             return !h || !("email" in h) || !("password" in h) ? {
               success: !1,
@@ -949,7 +976,7 @@ function Me(r) {
                 errorCode: y.VALIDATION_ERROR
               };
             const w = h;
-            return m(w.email, w.code);
+            return p(w.email, w.code);
           }
           return l === "passkey" ? u(h) : {
             success: !1,
@@ -959,12 +986,12 @@ function Me(r) {
         },
         {
           email: n,
-          oauth: a.signIn.oauth ? o : void 0,
+          oauth: a.signIn.oauth ? i : void 0,
           passkey: a.signIn.passkey ? u : void 0,
-          otp: a.signIn.otp ? m : void 0
+          otp: a.signIn.otp ? p : void 0
         }
       );
-      return I = O, O;
+      return O = S, S;
     })(),
     /**
      * Sign up new user
@@ -973,12 +1000,12 @@ function Me(r) {
       if (!a.signUp)
         throw new Error("Sign up is not configured. Provide signUp action in config.");
       try {
-        const o = await a.signUp(n);
-        return o.success && o.session && await U(o), o;
-      } catch (o) {
-        return t.onError && await g(t.onError, o instanceof Error ? o : new Error(String(o)), "signUp"), {
+        const i = await a.signUp(n);
+        return i.success && i.session && await U(i), i;
+      } catch (i) {
+        return t.onError && await g(t.onError, i instanceof Error ? i : new Error(String(i)), "signUp"), {
           success: !1,
-          error: o instanceof Error ? o.message : "Sign up failed"
+          error: i instanceof Error ? i.message : "Sign up failed"
         };
       }
     },
@@ -987,10 +1014,10 @@ function Me(r) {
      */
     async signOut() {
       try {
-        const n = await this.getSession(), o = n == null ? void 0 : n.user;
-        return s.signOut && await s.signOut(), await _(), p = null, o && t.onSignOut && await g(t.onSignOut, o), { success: !0 };
+        const n = await this.getSession(), i = n == null ? void 0 : n.user;
+        return s.signOut && await s.signOut(), await T(), m = null, i && t.onSignOut && await g(t.onSignOut, i), { success: !0 };
       } catch (n) {
-        return await _(), t.onError && await g(t.onError, n instanceof Error ? n : new Error(String(n)), "signOut"), {
+        return await T(), t.onError && await g(t.onError, n instanceof Error ? n : new Error(String(n)), "signOut"), {
           success: !1,
           error: n instanceof Error ? n.message : "Sign out failed"
         };
@@ -1004,10 +1031,10 @@ function Me(r) {
         throw new Error("Password reset is not configured. Provide resetPassword action in config.");
       try {
         return await s.resetPassword(n);
-      } catch (o) {
-        return t.onError && await g(t.onError, o instanceof Error ? o : new Error(String(o)), "resetPassword"), {
+      } catch (i) {
+        return t.onError && await g(t.onError, i instanceof Error ? i : new Error(String(i)), "resetPassword"), {
           success: !1,
-          error: o instanceof Error ? o.message : "Password reset failed"
+          error: i instanceof Error ? i.message : "Password reset failed"
         };
       }
     },
@@ -1019,10 +1046,10 @@ function Me(r) {
         throw new Error("Email verification is not configured. Provide verifyEmail action in config.");
       try {
         return await s.verifyEmail(n);
-      } catch (o) {
-        return t.onError && await g(t.onError, o instanceof Error ? o : new Error(String(o)), "verifyEmail"), {
+      } catch (i) {
+        return t.onError && await g(t.onError, i instanceof Error ? i : new Error(String(i)), "verifyEmail"), {
           success: !1,
-          error: o instanceof Error ? o.message : "Email verification failed"
+          error: i instanceof Error ? i.message : "Email verification failed"
         };
       }
     },
@@ -1036,59 +1063,59 @@ function Me(r) {
       try {
         const n = await s.refreshSession();
         if (n && x(n)) {
-          if (await T(n), p = { session: n, timestamp: Date.now() }, t.onSessionUpdate) {
-            const o = await g(t.onSessionUpdate, n);
-            if (o && x(o)) {
-              if (await T(o), t.onTokenRefresh) {
+          if (await b(n), m = { session: n, timestamp: Date.now() }, t.onSessionUpdate) {
+            const i = await g(t.onSessionUpdate, n);
+            if (i && x(i)) {
+              if (await b(i), t.onTokenRefresh) {
                 const u = await this.getSession();
-                u && await g(t.onTokenRefresh, u, o);
+                u && await g(t.onTokenRefresh, u, i);
               }
-              return o;
+              return i;
             }
           }
           if (t.onTokenRefresh) {
-            const o = await this.getSession();
-            o && await g(t.onTokenRefresh, o, n);
+            const i = await this.getSession();
+            i && await g(t.onTokenRefresh, i, n);
           }
           return n;
         } else if (n && !x(n))
-          return await _(), null;
+          return await T(), null;
         return null;
       } catch (n) {
-        return await _(), t.onError && await g(t.onError, n instanceof Error ? n : new Error(String(n)), "refreshSession"), null;
+        return await T(), t.onError && await g(t.onError, n instanceof Error ? n : new Error(String(n)), "refreshSession"), null;
       }
     },
     /**
      * OAuth callback handler
      * ✅ Auto-generated if providers.oauth is configured in config
      */
-    async oauthCallback(n, o, u) {
+    async oauthCallback(n, i, u) {
       if (!a.oauthCallback)
         throw new Error(
           "OAuth callback is not configured. Either provide oauthCallback action, or configure providers.oauth in config."
         );
-      if (!n || !o || !u)
+      if (!n || !i || !u)
         return {
           success: !1,
           error: "Missing required OAuth parameters (provider, code, or state)",
           errorCode: y.VALIDATION_ERROR
         };
-      if (!await b(u, n))
+      if (!await _(u, n))
         return {
           success: !1,
           error: "Invalid or expired state parameter",
           errorCode: y.VALIDATION_ERROR
         };
       try {
-        const R = await a.oauthCallback(n, o, u);
+        const R = await a.oauthCallback(n, i, u);
         if (R.success && R.session) {
-          const O = await U(R);
-          O.success || (process.env.NODE_ENV === "development" && P.debug("Failed to save session cookie after oauthCallback", {
-            error: O.error,
-            warning: O.warning
+          const S = await U(R);
+          S.success || (process.env.NODE_ENV === "development" && P.debug("Failed to save session cookie after oauthCallback", {
+            error: S.error,
+            warning: S.warning
           }), t.onError && await g(
             t.onError,
-            new Error(O.warning || O.error || "Failed to save session cookie"),
+            new Error(S.warning || S.error || "Failed to save session cookie"),
             "oauthCallback.setSession"
           ));
         }
@@ -1105,19 +1132,19 @@ function Me(r) {
      * Verify 2FA code after initial sign in
      * Used when signIn returns requires2FA: true
      */
-    async verify2FA(n, o) {
+    async verify2FA(n, i) {
       if (!s.verify2FA)
         throw new Error("2FA verification is not configured. Provide verify2FA action in config.");
       try {
         const u = await s.verify2FA(n);
-        if (u.success && u.session && !(o != null && o.skipCookieSave)) {
-          const m = await U(u);
-          m.success || (process.env.NODE_ENV === "development" && P.debug("Failed to save session cookie after verify2FA", {
-            error: m.error,
-            warning: m.warning
+        if (u.success && u.session && !(i != null && i.skipCookieSave)) {
+          const p = await U(u);
+          p.success || (process.env.NODE_ENV === "development" && P.debug("Failed to save session cookie after verify2FA", {
+            error: p.error,
+            warning: p.warning
           }), t.onError && await g(
             t.onError,
-            new Error(m.warning || m.error || "Failed to save session cookie"),
+            new Error(p.warning || p.error || "Failed to save session cookie"),
             "verify2FA.setSession"
           ));
         }
@@ -1135,7 +1162,7 @@ function Me(r) {
      * Useful for Server Actions that need to save session manually
      */
     async setSession(n) {
-      return x(n) ? await T(n) : {
+      return x(n) ? await b(n) : {
         success: !1,
         error: "Invalid session structure"
       };
@@ -1160,8 +1187,8 @@ function Me(r) {
     passkey: s.passkey ? {
       register: s.passkey.register,
       authenticate: async (n) => {
-        var o;
-        if (!((o = s.passkey) != null && o.authenticate))
+        var i;
+        if (!((i = s.passkey) != null && i.authenticate))
           throw new Error("PassKey authenticate is not configured.");
         try {
           const u = await s.passkey.authenticate(n);
@@ -1187,13 +1214,13 @@ function Me(r) {
       isEnabled: s.twoFactor.isEnabled,
       verify2FA: async (n) => {
         var u;
-        const o = ((u = s.twoFactor) == null ? void 0 : u.verify2FA) || s.verify2FA;
-        if (!o)
+        const i = ((u = s.twoFactor) == null ? void 0 : u.verify2FA) || s.verify2FA;
+        if (!i)
           throw new Error("2FA verification is not configured. Provide verify2FA action in config.");
         try {
-          const m = await o(n);
-          if (m.success && m.session) {
-            const R = await U(m);
+          const p = await i(n);
+          if (p.success && p.session) {
+            const R = await U(p);
             R.success || (process.env.NODE_ENV === "development" && P.debug("Failed to save session cookie after twoFactor.verify2FA", {
               error: R.error,
               warning: R.warning
@@ -1203,11 +1230,11 @@ function Me(r) {
               "twoFactor.verify2FA.setSession"
             ));
           }
-          return m;
-        } catch (m) {
-          return t.onError && await g(t.onError, m instanceof Error ? m : new Error(String(m)), "twoFactor.verify2FA"), {
+          return p;
+        } catch (p) {
+          return t.onError && await g(t.onError, p instanceof Error ? p : new Error(String(p)), "twoFactor.verify2FA"), {
             success: !1,
-            error: m instanceof Error ? m.message : "2FA verification failed",
+            error: p instanceof Error ? p.message : "2FA verification failed",
             errorCode: y.UNKNOWN_ERROR
           };
         }
@@ -1218,18 +1245,18 @@ function Me(r) {
      * ✅ IMPROVEMENT: Uses unified signIn logic
      */
     signInMethods: {
-      email: (n) => I.email(n),
+      email: (n) => O.email(n),
       oauth: (n) => {
-        var o;
-        return ((o = I.oauth) == null ? void 0 : o.call(I, n)) || Promise.reject(new Error("OAuth not configured"));
+        var i;
+        return ((i = O.oauth) == null ? void 0 : i.call(O, n)) || Promise.reject(new Error("OAuth not configured"));
       },
       passkey: (n) => {
-        var o;
-        return ((o = I.passkey) == null ? void 0 : o.call(I, n)) || Promise.reject(new Error("Passkey not configured"));
+        var i;
+        return ((i = O.passkey) == null ? void 0 : i.call(O, n)) || Promise.reject(new Error("Passkey not configured"));
       },
-      otp: (n, o) => {
+      otp: (n, i) => {
         var u;
-        return ((u = I.otp) == null ? void 0 : u.call(I, n, o)) || Promise.reject(new Error("OTP not configured"));
+        return ((u = O.otp) == null ? void 0 : u.call(O, n, i)) || Promise.reject(new Error("OTP not configured"));
       }
     }
   };
@@ -1238,7 +1265,7 @@ function Me(r) {
       async () => await C.refreshSession(),
       async () => await C.signOut(),
       async () => {
-        await _();
+        await T();
       },
       {
         ...c,
@@ -1258,14 +1285,14 @@ function ze(r) {
   };
 }
 async function W(r, e, s) {
-  const t = new URL(r.url), i = t.pathname.replace(/^\/api\/auth/, "") || "/session", d = i.split("/").filter(Boolean);
+  const t = new URL(r.url), o = t.pathname.replace(/^\/api\/auth/, "") || "/session", d = o.split("/").filter(Boolean);
   try {
     if (s === "GET") {
-      if (i === "/session" || i === "/") {
+      if (o === "/session" || o === "/") {
         const c = await e.getSession();
         return f.json({ session: c });
       }
-      if (i === "/providers")
+      if (o === "/providers")
         return f.json({
           providers: {
             email: !!e.signIn.email,
@@ -1273,25 +1300,25 @@ async function W(r, e, s) {
             passkey: !!e.signIn.passkey
           }
         });
-      if (i.startsWith("/oauth/callback") || d[0] === "oauth" && d[1] === "callback") {
+      if (o.startsWith("/oauth/callback") || d[0] === "oauth" && d[1] === "callback") {
         if (!e.oauthCallback)
           return f.redirect(new URL("/login?error=oauth_not_configured", r.url));
-        const c = d[2] || t.searchParams.get("provider"), a = t.searchParams.get("code"), p = t.searchParams.get("state");
-        if (!c || !a || !p)
+        const c = d[2] || t.searchParams.get("provider"), a = t.searchParams.get("code"), m = t.searchParams.get("state");
+        if (!c || !a || !m)
           return f.redirect(new URL("/login?error=oauth_missing_params", r.url));
         try {
-          const v = await e.oauthCallback(c, a, p);
-          if (v.success) {
-            const S = t.searchParams.get("callbackUrl") || "/";
-            return f.redirect(new URL(S, r.url));
+          const k = await e.oauthCallback(c, a, m);
+          if (k.success) {
+            const I = t.searchParams.get("callbackUrl") || "/";
+            return f.redirect(new URL(I, r.url));
           } else
             return f.redirect(
-              new URL(`/login?error=${encodeURIComponent(v.error || "oauth_failed")}`, r.url)
+              new URL(`/login?error=${encodeURIComponent(k.error || "oauth_failed")}`, r.url)
             );
-        } catch (v) {
+        } catch (k) {
           return f.redirect(
             new URL(
-              `/login?error=${encodeURIComponent(v instanceof Error ? v.message : "oauth_error")}`,
+              `/login?error=${encodeURIComponent(k instanceof Error ? k.message : "oauth_error")}`,
               r.url
             )
           );
@@ -1304,7 +1331,7 @@ async function W(r, e, s) {
     }
     if (s === "POST") {
       const c = await r.json().catch(() => ({}));
-      if (i === "/sign-in" || d[0] === "sign-in") {
+      if (o === "/sign-in" || d[0] === "sign-in") {
         if (c.provider === "email" && c.email && c.password) {
           const a = await e.signIn.email({
             email: c.email,
@@ -1335,7 +1362,7 @@ async function W(r, e, s) {
           { status: 400 }
         );
       }
-      if (i === "/sign-up" || d[0] === "sign-up") {
+      if (o === "/sign-up" || d[0] === "sign-up") {
         if (!e.signUp)
           return f.json(
             { success: !1, error: "Sign up is not configured" },
@@ -1344,11 +1371,11 @@ async function W(r, e, s) {
         const a = await e.signUp(c);
         return f.json(a);
       }
-      if (i === "/sign-out" || d[0] === "sign-out") {
+      if (o === "/sign-out" || d[0] === "sign-out") {
         const a = await e.signOut();
         return f.json(a);
       }
-      if (i === "/reset-password" || d[0] === "reset-password") {
+      if (o === "/reset-password" || d[0] === "reset-password") {
         if (!e.resetPassword)
           return f.json(
             { success: !1, error: "Password reset is not configured" },
@@ -1357,7 +1384,7 @@ async function W(r, e, s) {
         const a = await e.resetPassword(c.email);
         return f.json(a);
       }
-      if (i === "/verify-email" || d[0] === "verify-email") {
+      if (o === "/verify-email" || d[0] === "verify-email") {
         if (!e.verifyEmail)
           return f.json(
             { success: !1, error: "Email verification is not configured" },
@@ -1366,22 +1393,22 @@ async function W(r, e, s) {
         const a = await e.verifyEmail(c.token);
         return f.json(a);
       }
-      if (i === "/refresh" || d[0] === "refresh") {
+      if (o === "/refresh" || d[0] === "refresh") {
         if (!e.refreshSession) {
-          const p = await e.getSession();
-          return f.json({ session: p });
+          const m = await e.getSession();
+          return f.json({ session: m });
         }
         const a = await e.refreshSession();
         return f.json({ session: a });
       }
-      if (i.startsWith("/oauth/callback") || d[0] === "oauth" && d[1] === "callback") {
+      if (o.startsWith("/oauth/callback") || d[0] === "oauth" && d[1] === "callback") {
         if (!e.oauthCallback)
           return f.json(
             { success: !1, error: "OAuth callback is not configured" },
             { status: 400 }
           );
-        const a = c.provider || d[2] || t.searchParams.get("provider"), p = c.code || t.searchParams.get("code"), v = c.state || t.searchParams.get("state");
-        if (!a || !p || !v)
+        const a = c.provider || d[2] || t.searchParams.get("provider"), m = c.code || t.searchParams.get("code"), k = c.state || t.searchParams.get("state");
+        if (!a || !m || !k)
           return f.json(
             {
               success: !1,
@@ -1389,10 +1416,10 @@ async function W(r, e, s) {
             },
             { status: 400 }
           );
-        const S = await e.oauthCallback(a, p, v);
-        return f.json(S);
+        const I = await e.oauthCallback(a, m, k);
+        return f.json(I);
       }
-      if (i.startsWith("/passkey")) {
+      if (o.startsWith("/passkey")) {
         if (!e.passkey)
           return f.json(
             { success: !1, error: "PassKey is not configured" },
@@ -1411,7 +1438,7 @@ async function W(r, e, s) {
           return f.json(a);
         }
       }
-      if (i === "/verify-2fa" || d[0] === "verify-2fa") {
+      if (o === "/verify-2fa" || d[0] === "verify-2fa") {
         if (!e.verify2FA)
           return f.json(
             { success: !1, error: "2FA verification is not configured" },
@@ -1432,7 +1459,7 @@ async function W(r, e, s) {
         });
         return f.json(a);
       }
-      if (i.startsWith("/two-factor")) {
+      if (o.startsWith("/two-factor")) {
         if (!e.twoFactor)
           return f.json(
             { success: !1, error: "Two-Factor Authentication is not configured" },
@@ -1488,7 +1515,7 @@ function We(r) {
           c = await e.json();
         } catch {
         }
-      const a = Object.fromEntries(t.searchParams.entries()), p = await fetch(
+      const a = Object.fromEntries(t.searchParams.entries()), m = await fetch(
         `${process.env.NEXT_PUBLIC_API_URL || ""}/api/auth${d}${Object.keys(a).length > 0 ? `?${new URLSearchParams(a).toString()}` : ""}`,
         {
           method: s,
@@ -1498,11 +1525,11 @@ function We(r) {
           },
           body: c ? JSON.stringify(c) : void 0
         }
-      ), v = await p.json();
-      return f.json(v, {
-        status: p.status,
+      ), k = await m.json();
+      return f.json(k, {
+        status: m.status,
         headers: {
-          ...Object.fromEntries(p.headers.entries())
+          ...Object.fromEntries(m.headers.entries())
         }
       });
     } catch (c) {
@@ -1518,8 +1545,8 @@ function We(r) {
 }
 function qe(r) {
   return async (e) => {
-    const { searchParams: s } = e.nextUrl, t = s.get("provider"), i = s.get("code"), d = s.get("state");
-    if (!t || !i || !d)
+    const { searchParams: s } = e.nextUrl, t = s.get("provider"), o = s.get("code"), d = s.get("state");
+    if (!t || !o || !d)
       return f.redirect(
         new URL("/login?error=oauth_missing_params", e.url)
       );
@@ -1528,7 +1555,7 @@ function qe(r) {
         return f.redirect(
           new URL("/login?error=oauth_not_configured", e.url)
         );
-      const c = await r.oauthCallback(t, i, d);
+      const c = await r.oauthCallback(t, o, d);
       if (c.success) {
         const a = s.get("callbackUrl") || "/";
         return f.redirect(new URL(a, e.url));
@@ -1554,8 +1581,8 @@ function L(r, e) {
     "X-Frame-Options": "SAMEORIGIN"
     // Allow same-origin framing
   });
-  for (const [t, i] of Object.entries(s))
-    i && typeof i == "string" && e.headers.set(t, i);
+  for (const [t, o] of Object.entries(s))
+    o && typeof o == "string" && e.headers.set(t, o);
   return e;
 }
 function Be() {
@@ -1568,29 +1595,29 @@ function He(r, e = {}) {
   const {
     protectedRoutes: s = [],
     publicRoutes: t = [],
-    redirectTo: i = "/login",
+    redirectTo: o = "/login",
     redirectIfAuthenticated: d
   } = e;
   return async (c) => {
-    const { pathname: a } = c.nextUrl, p = s.some((g) => a.startsWith(g));
-    let v = null;
+    const { pathname: a } = c.nextUrl, m = s.some((g) => a.startsWith(g));
+    let k = null;
     try {
-      v = await r.getSession();
+      k = await r.getSession();
     } catch (g) {
       console.error("Middleware: Failed to get session:", g);
     }
-    if (p && !v) {
+    if (m && !k) {
       const g = c.nextUrl.clone();
-      return g.pathname = i, g.searchParams.set("callbackUrl", a), f.redirect(g);
+      return g.pathname = o, g.searchParams.set("callbackUrl", a), f.redirect(g);
     }
-    if (d && v && (a.startsWith("/login") || a.startsWith("/register"))) {
+    if (d && k && (a.startsWith("/login") || a.startsWith("/register"))) {
       const A = c.nextUrl.clone();
       A.pathname = d;
-      const b = f.redirect(A);
-      return L(c, b);
+      const _ = f.redirect(A);
+      return L(c, _);
     }
-    const S = f.next();
-    return L(c, S);
+    const I = f.next();
+    return L(c, I);
   };
 }
 async function Ke(r, e) {
@@ -1607,35 +1634,35 @@ function Xe(r) {
     auth: e,
     protectedRoutes: s = [],
     publicRoutes: t = [],
-    redirectTo: i = "/login",
+    redirectTo: o = "/login",
     redirectIfAuthenticated: d,
     apiPrefix: c = "/api/auth"
   } = r;
   return async (a) => {
-    const { pathname: p } = a.nextUrl;
-    if (p.startsWith(c)) {
+    const { pathname: m } = a.nextUrl;
+    if (m.startsWith(c)) {
       const A = f.next();
       return L(a, A);
     }
-    const v = s.some((A) => p.startsWith(A));
-    let S = null;
-    if (v || d)
+    const k = s.some((A) => m.startsWith(A));
+    let I = null;
+    if (k || d)
       try {
-        S = await e.getSession();
+        I = await e.getSession();
       } catch (A) {
         console.error("Middleware: Failed to get session:", A);
       }
-    if (v && !S) {
+    if (k && !I) {
       const A = a.nextUrl.clone();
-      A.pathname = i, A.searchParams.set("callbackUrl", p);
-      const b = f.redirect(A);
-      return L(a, b);
+      A.pathname = o, A.searchParams.set("callbackUrl", m);
+      const _ = f.redirect(A);
+      return L(a, _);
     }
-    if (d && S && (p.startsWith("/login") || p.startsWith("/register"))) {
-      const b = a.nextUrl.clone();
-      b.pathname = d;
-      const T = f.redirect(b);
-      return L(a, T);
+    if (d && I && (m.startsWith("/login") || m.startsWith("/register"))) {
+      const _ = a.nextUrl.clone();
+      _.pathname = d;
+      const b = f.redirect(_);
+      return L(a, b);
     }
     const g = f.next();
     return L(a, g);
@@ -1664,7 +1691,7 @@ export {
   Pe as containsXSSPattern,
   We as createApiHandler,
   He as createAuthMiddleware,
-  be as createCSRFProtection,
+  Oe as createCSRFProtection,
   de as createMemoryOAuthStateStore,
   qe as createOAuthCallbackHandler,
   Xe as createProxyMiddleware,
@@ -1702,13 +1729,13 @@ export {
   Ue as isValidEmail,
   Me as mulguard,
   wr as refreshSession,
-  pr as requireAuth,
-  mr as requireRole,
+  mr as requireAuth,
+  pr as requireRole,
   yr as requireServerAuthMiddleware,
   Er as requireServerRoleMiddleware,
-  Te as sanitizeHTML,
+  be as sanitizeHTML,
   Ce as sanitizeInput,
-  _e as sanitizeUserInput,
+  Te as sanitizeUserInput,
   Y as setCookie,
   $e as signIn,
   Qe as signInEmailAction,
@@ -1722,7 +1749,7 @@ export {
   Ae as validateAndSanitizePassword,
   oe as validateCSRFToken,
   x as validateSessionStructure,
-  Oe as validateToken,
+  _e as validateToken,
   Ie as validateURL,
   rr as verify2FAAction,
   L as withSecurityHeaders