mulguard 1.1.6 → 1.1.7

package/dist/index/index.mjs

@@ -1,24 +1,69 @@
-var ne = Object.defineProperty;
-var se = (e, r, t) => r in e ? ne(e, r, { enumerable: !0, configurable: !0, writable: !0, value: t }) : e[r] = t;
-var b = (e, r, t) => se(e, typeof r != "symbol" ? r + "" : r, t);
-import { A as m, d as oe, e as ie, c as ae, g as ce } from "../actions-DeCfLtHA.mjs";
-import { a as wt, s as pt, b as mt, v as Et } from "../actions-DeCfLtHA.mjs";
-import { v as U } from "../oauth-state-DKle8eCr.mjs";
-import { c as kt, p as vt, k as St, n as At, m as Rt, j as Ot, l as Tt, e as It, g as _t, b as Pt, i as Ct, a as Nt, o as bt, f as Ut, h as Ft, r as xt, d as Dt, s as Lt } from "../oauth-state-DKle8eCr.mjs";
-import { NextResponse as E } from "next/server";
-const x = typeof globalThis == "object" && "crypto" in globalThis ? globalThis.crypto : void 0;
+var ve = Object.defineProperty;
+var Se = (e, r, t) => r in e ? ve(e, r, { enumerable: !0, configurable: !0, writable: !0, value: t }) : e[r] = t;
+var x = (e, r, t) => Se(e, typeof r != "symbol" ? r + "" : r, t);
+import { A as m, d as Ae, e as Re, c as Oe, g as Te } from "../actions-CjQUKaXF.mjs";
+import { a as Gt, s as Kt, b as Xt, v as Jt } from "../actions-CjQUKaXF.mjs";
+import { v as F } from "../oauth-state-pdypStuS.mjs";
+import { S as Qt, e as Zt, d as en, m as rn, g as tn, l as nn, b as sn, c as on, j as an, i as cn, f as un, h as ln, k as fn, r as dn, a as hn, s as gn } from "../oauth-state-pdypStuS.mjs";
+import { NextResponse as A } from "next/server";
+const L = typeof globalThis == "object" && "crypto" in globalThis ? globalThis.crypto : void 0;
 /*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-function ue(e = 32) {
-  if (x && typeof x.getRandomValues == "function")
-    return x.getRandomValues(new Uint8Array(e));
-  if (x && typeof x.randomBytes == "function")
-    return Uint8Array.from(x.randomBytes(e));
+function _e(e) {
+  return e instanceof Uint8Array || ArrayBuffer.isView(e) && e.constructor.name === "Uint8Array";
+}
+function G(e, ...r) {
+  if (!_e(e))
+    throw new Error("Uint8Array expected");
+  if (r.length > 0 && !r.includes(e.length))
+    throw new Error("Uint8Array expected of length " + r + ", got length=" + e.length);
+}
+function Q(e, r = !0) {
+  if (e.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (r && e.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function be(e, r) {
+  G(e);
+  const t = r.outputLen;
+  if (e.length < t)
+    throw new Error("digestInto() expects output buffer of length at least " + t);
+}
+function q(...e) {
+  for (let r = 0; r < e.length; r++)
+    e[r].fill(0);
+}
+function H(e) {
+  return new DataView(e.buffer, e.byteOffset, e.byteLength);
+}
+function P(e, r) {
+  return e << 32 - r | e >>> r;
+}
+function Ce(e) {
+  if (typeof e != "string")
+    throw new Error("string expected");
+  return new Uint8Array(new TextEncoder().encode(e));
+}
+function re(e) {
+  return typeof e == "string" && (e = Ce(e)), G(e), e;
+}
+class Ie {
+}
+function xe(e) {
+  const r = (n) => e().update(re(n)).digest(), t = e();
+  return r.outputLen = t.outputLen, r.blockLen = t.blockLen, r.create = () => e(), r;
+}
+function te(e = 32) {
+  if (L && typeof L.getRandomValues == "function")
+    return L.getRandomValues(new Uint8Array(e));
+  if (L && typeof L.randomBytes == "function")
+    return Uint8Array.from(L.randomBytes(e));
   throw new Error("crypto.getRandomValues must be defined");
 }
-class le {
+class Pe {
   constructor(r) {
-    b(this, "attempts", /* @__PURE__ */ new Map());
-    b(this, "config");
+    x(this, "attempts", /* @__PURE__ */ new Map());
+    x(this, "config");
     this.config = r;
   }
   /**
@@ -56,10 +101,10 @@ class le {
     this.attempts.clear();
   }
 }
-function _r(e) {
-  return new le(e);
+function ut(e) {
+  return new Pe(e);
 }
-const fe = {
+const Ne = {
   "X-Content-Type-Options": "nosniff",
   "X-Frame-Options": "DENY",
   "X-XSS-Protection": "1; mode=block",
@@ -68,29 +113,29 @@ const fe = {
   "Referrer-Policy": "strict-origin-when-cross-origin",
   "Permissions-Policy": "geolocation=(), microphone=(), camera=()"
 };
-function H(e) {
+function ne(e) {
   return {
-    ...fe,
+    ...Ne,
     ...e
   };
 }
-function Pr(e, r) {
-  const t = H(r);
+function lt(e, r) {
+  const t = ne(r);
   for (const [n, s] of Object.entries(t))
     s && e.set(n, s);
 }
-const de = /^[^\s@]+@[^\s@]+\.[^\s@]+$/, he = 254;
-function G(e) {
+const Ue = /^[^\s@]+@[^\s@]+\.[^\s@]+$/, De = 254;
+function se(e) {
   var t;
   if (typeof e != "string" || !e)
     return { valid: !1, error: "Email is required" };
   const r = e.trim().toLowerCase();
-  return de.test(r) ? r.length > he ? { valid: !1, error: "Email is too long" } : r.includes("..") || r.startsWith(".") || r.endsWith(".") ? { valid: !1, error: "Invalid email format" } : (t = r.split("@")[1]) != null && t.includes("..") ? { valid: !1, error: "Invalid email format" } : { valid: !0, sanitized: r } : { valid: !1, error: "Invalid email format" };
+  return Ue.test(r) ? r.length > De ? { valid: !1, error: "Email is too long" } : r.includes("..") || r.startsWith(".") || r.endsWith(".") ? { valid: !1, error: "Invalid email format" } : (t = r.split("@")[1]) != null && t.includes("..") ? { valid: !1, error: "Invalid email format" } : { valid: !0, sanitized: r } : { valid: !1, error: "Invalid email format" };
 }
-function K(e) {
+function ie(e) {
   return e.valid === !0 && e.sanitized !== void 0;
 }
-const ge = /* @__PURE__ */ new Set([
+const Fe = /* @__PURE__ */ new Set([
   "password",
   "12345678",
   "qwerty",
@@ -111,83 +156,83 @@ const ge = /* @__PURE__ */ new Set([
   "test",
   "guest",
   "user"
-]), we = /012|123|234|345|456|567|678|789|abc|bcd|cde|def|efg|fgh|ghi|hij|ijk|jkl|klm|lmn|mno|nop|opq|pqr|qrs|rst|stu|tuv|uvw|vwx|wxy|xyz/i, pe = 8, me = 128;
-function Cr(e, r = pe) {
+]), Le = /012|123|234|345|456|567|678|789|abc|bcd|cde|def|efg|fgh|ghi|hij|ijk|jkl|klm|lmn|mno|nop|opq|pqr|qrs|rst|stu|tuv|uvw|vwx|wxy|xyz/i, Ve = 8, Me = 128;
+function ft(e, r = Ve) {
   if (typeof e != "string" || !e)
     return { valid: !1, error: "Password is required" };
   if (e.length < r)
     return { valid: !1, error: `Password must be at least ${r} characters` };
-  if (e.length > me)
+  if (e.length > Me)
     return { valid: !1, error: "Password is too long" };
   const t = e.toLowerCase();
-  if (ge.has(t))
+  if (Fe.has(t))
     return { valid: !1, error: "Password is too common" };
   if (/(.)\1{3,}/.test(e))
     return { valid: !1, error: "Password contains too many repeated characters" };
-  if (we.test(e))
+  if (Le.test(e))
     return { valid: !1, error: "Password contains sequential characters" };
-  const n = Ee(e);
+  const n = je(e);
   return { valid: !0, sanitized: e, strength: n };
 }
-function Ee(e) {
+function je(e) {
   let r = 0;
   return e.length >= 12 ? r += 2 : e.length >= 8 && (r += 1), /[a-z]/.test(e) && (r += 1), /[A-Z]/.test(e) && (r += 1), /[0-9]/.test(e) && (r += 1), /[^a-zA-Z0-9]/.test(e) && (r += 1), r >= 5 ? "strong" : r >= 3 ? "medium" : "weak";
 }
-function Nr(e) {
+function dt(e) {
   return e.valid === !0 && e.sanitized !== void 0;
 }
-const ye = 100;
-function br(e) {
+const ze = 100;
+function ht(e) {
   if (typeof e != "string" || !e)
     return { valid: !1, error: "Name is required" };
   const r = e.trim();
   if (r.length < 1)
     return { valid: !1, error: "Name cannot be empty" };
-  if (r.length > ye)
+  if (r.length > ze)
     return { valid: !1, error: "Name is too long" };
   const t = r.replace(/[<>"']/g, "");
   return t.length === 0 ? { valid: !1, error: "Name contains only invalid characters" } : { valid: !0, sanitized: t };
 }
-function Ur(e) {
+function gt(e) {
   return e.valid === !0 && e.sanitized !== void 0;
 }
-const ke = /* @__PURE__ */ new Set(["http:", "https:"]);
-function Fr(e) {
+const Be = /* @__PURE__ */ new Set(["http:", "https:"]);
+function wt(e) {
   if (typeof e != "string" || !e)
     return { valid: !1, error: "URL is required" };
   try {
     const r = new URL(e);
-    return ke.has(r.protocol) ? { valid: !0, sanitized: e } : { valid: !1, error: "URL must use http or https protocol" };
+    return Be.has(r.protocol) ? { valid: !0, sanitized: e } : { valid: !1, error: "URL must use http or https protocol" };
   } catch {
     return { valid: !1, error: "Invalid URL format" };
   }
 }
-function xr(e) {
+function pt(e) {
   return e.valid === !0 && e.sanitized !== void 0;
 }
-const ve = 16, Se = 512, Ae = /^[A-Za-z0-9_-]+$/;
-function Dr(e, r = ve) {
-  return typeof e != "string" || !e ? { valid: !1, error: "Token is required" } : e.length < r ? { valid: !1, error: "Token is too short" } : e.length > Se ? { valid: !1, error: "Token is too long" } : Ae.test(e) ? /(.)\1{10,}/.test(e) ? { valid: !1, error: "Token contains suspicious pattern" } : { valid: !0, sanitized: e } : { valid: !1, error: "Invalid token format" };
+const $e = 16, He = 512, qe = /^[A-Za-z0-9_-]+$/;
+function mt(e, r = $e) {
+  return typeof e != "string" || !e ? { valid: !1, error: "Token is required" } : e.length < r ? { valid: !1, error: "Token is too short" } : e.length > He ? { valid: !1, error: "Token is too long" } : qe.test(e) ? /(.)\1{10,}/.test(e) ? { valid: !1, error: "Token contains suspicious pattern" } : { valid: !0, sanitized: e } : { valid: !1, error: "Invalid token format" };
 }
-function Lr(e) {
+function Et(e) {
   return e.valid === !0 && e.sanitized !== void 0;
 }
-const Re = 1e3;
-function X(e, r) {
-  const { maxLength: t = Re, allowHtml: n = !1, required: s = !0 } = r ?? {};
+const We = 1e3;
+function oe(e, r) {
+  const { maxLength: t = We, allowHtml: n = !1, required: s = !0 } = r ?? {};
   if (s && (typeof e != "string" || !e || e.trim().length === 0))
     return { valid: !1, error: "Input is required" };
   if (typeof e != "string" || !e)
     return { valid: !0, sanitized: "" };
-  let o = e.trim();
-  return o.length > t ? { valid: !1, error: `Input must be less than ${t} characters` } : (n || (o = o.replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;").replace(/\//g, "&#x2F;")), o = o.replace(/[\x00-\x1F\x7F]/g, ""), { valid: !0, sanitized: o });
+  let i = e.trim();
+  return i.length > t ? { valid: !1, error: `Input must be less than ${t} characters` } : (n || (i = i.replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;").replace(/\//g, "&#x2F;")), i = i.replace(/[\x00-\x1F\x7F]/g, ""), { valid: !0, sanitized: i });
 }
-function Mr(e) {
+function yt(e) {
   return e.valid === !0 && e.sanitized !== void 0;
 }
-class Oe {
+class Ge {
   constructor() {
-    b(this, "tokens", /* @__PURE__ */ new Map());
+    x(this, "tokens", /* @__PURE__ */ new Map());
   }
   get(r) {
     const t = this.tokens.get(r);
@@ -206,17 +251,17 @@ class Oe {
     this.tokens.clear();
   }
 }
-class Te {
+class Ke {
   constructor(r, t = 32) {
-    b(this, "store");
-    b(this, "tokenLength");
-    this.store = r || new Oe(), this.tokenLength = t;
+    x(this, "store");
+    x(this, "tokenLength");
+    this.store = r || new Ge(), this.tokenLength = t;
   }
   /**
    * Generate CSRF token
    */
   generateToken(r, t) {
-    const n = Y(this.tokenLength);
+    const n = ce(this.tokenLength);
     return this.store.set(r, n, t), n;
   }
   /**
@@ -226,7 +271,7 @@ class Te {
     const n = this.store.get(r);
     if (!n)
       return !1;
-    const s = Q(t, n);
+    const s = le(t, n);
     return s && this.store.delete(r), s;
   }
   /**
@@ -242,10 +287,10 @@ class Te {
     this.store.delete(r);
   }
 }
-function Vr(e) {
-  return new Te(e);
+function kt(e) {
+  return new Ke(e);
 }
-function Ie(e) {
+function Xe(e) {
   if (typeof e != "string")
     return "";
   const r = {
@@ -257,13 +302,13 @@ function Ie(e) {
   };
   return e.replace(/[&<>"']/g, (t) => r[t] || t);
 }
-function jr(e) {
+function vt(e) {
   return typeof e != "string" ? "" : e.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "").replace(/on\w+\s*=\s*["'][^"']*["']/gi, "").replace(/javascript:/gi, "");
 }
-function zr(e) {
-  return typeof e != "string" ? "" : Ie(e.trim());
+function St(e) {
+  return typeof e != "string" ? "" : Xe(e.trim());
 }
-function $r(e) {
+function At(e) {
   return typeof e != "string" ? !1 : [
     /<script/i,
     /javascript:/i,
@@ -277,17 +322,17 @@ function $r(e) {
     /vbscript:/i
   ].some((t) => t.test(e));
 }
-const J = 32;
-function Y(e = J) {
+const ae = 32;
+function ce(e = ae) {
   if (e < 1 || e > 256)
     throw new Error("Token length must be between 1 and 256 bytes");
-  const r = ue(e);
+  const r = te(e);
   return Buffer.from(r).toString("base64url");
 }
-function _e() {
-  return Y(J);
+function ue() {
+  return ce(ae);
 }
-function Q(e, r) {
+function le(e, r) {
   if (typeof e != "string" || typeof r != "string" || !e || !r || e.length !== r.length)
     return !1;
   let t = 0;
@@ -295,36 +340,36 @@ function Q(e, r) {
     t |= e.charCodeAt(n) ^ r.charCodeAt(n);
   return t === 0;
 }
-function Wr(e, r) {
-  return Q(e, r);
+function Rt(e, r) {
+  return le(e, r);
 }
-function qr(e) {
+function Ot(e) {
   return typeof e != "string" ? "" : e.trim().replace(/[<>]/g, "");
 }
-const Pe = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-function Br(e) {
-  return typeof e == "string" && Pe.test(e);
+const Je = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function Tt(e) {
+  return typeof e == "string" && Je.test(e);
 }
-function Ce(e) {
+function Ye(e) {
   return !e.success && !!e.error;
 }
-function Hr(e) {
+function _t(e) {
   return e.requires2FA === !0 || e.errorCode === m.TWO_FA_REQUIRED;
 }
-function Gr(e, r) {
+function bt(e, r) {
   return e.error ? e.error : r || "Authentication failed";
 }
-function Kr(e) {
+function Ct(e) {
   return e.errorCode;
 }
-function Xr(e) {
+function It(e) {
   return e.success === !0 && !!e.user;
 }
-function Jr(e, r) {
+function xt(e, r) {
   return e.errorCode === r;
 }
-function Yr(e) {
-  if (!Ce(e)) return !1;
+function Pt(e) {
+  if (!Ye(e)) return !1;
   const r = [
     m.NETWORK_ERROR,
     m.RATE_LIMITED,
@@ -332,7 +377,7 @@ function Yr(e) {
   ];
   return e.errorCode ? r.includes(e.errorCode) : !1;
 }
-function Qr(e) {
+function Nt(e) {
   if (e.error) return e.error;
   switch (e.errorCode) {
     case m.INVALID_CREDENTIALS:
@@ -360,10 +405,16 @@ function Qr(e) {
       return "An unexpected error occurred. Please try again.";
   }
 }
-async function Zr(e, r, t) {
-  return e.signIn(r, t);
+async function Ut(e, r, t) {
+  return r === "credentials" ? !t || !("email" in t) || !("password" in t) ? {
+    success: !1,
+    error: "Credentials are required"
+  } : e.signIn("credentials", t) : r === "otp" ? !t || !("email" in t) ? {
+    success: !1,
+    error: "Email is required"
+  } : e.signIn("otp", t) : r === "passkey" ? e.signIn("passkey", t) : e.signIn(r);
 }
-const Z = {
+const fe = {
   google: {
     authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
     tokenUrl: "https://oauth2.googleapis.com/token",
@@ -393,36 +444,36 @@ const Z = {
     defaultScopes: ["email", "public_profile"]
   }
 };
-function j(e) {
-  return Z[e] ?? null;
+function K(e) {
+  return fe[e] ?? null;
 }
-function et(e) {
-  return e in Z;
+function Dt(e) {
+  return e in fe;
 }
-function Ne(e, r, t, n) {
-  const s = j(e);
+function de(e, r, t, n) {
+  const s = K(e);
   if (!s)
     throw new Error(`Unknown OAuth provider: ${e}`);
   if (!r.clientId)
     throw new Error(`OAuth provider "${e}" is missing clientId`);
-  const o = r.redirectUri ?? `${t}/api/auth/callback/${e}`, i = r.scopes ?? s.defaultScopes, a = new URLSearchParams({
+  const i = r.redirectUri ?? `${t}/api/auth/callback/${e}`, o = r.scopes ?? s.defaultScopes, a = new URLSearchParams({
     client_id: r.clientId,
-    redirect_uri: o,
+    redirect_uri: i,
     response_type: "code",
-    scope: Array.isArray(i) ? i.join(" ") : String(i),
+    scope: Array.isArray(o) ? o.join(" ") : String(o),
     state: n
   });
   if (s.defaultParams)
-    for (const [u, f] of Object.entries(s.defaultParams))
-      a.append(u, f);
+    for (const [c, u] of Object.entries(s.defaultParams))
+      a.append(c, u);
   if (r.params)
-    for (const [u, f] of Object.entries(r.params))
-      a.set(u, f);
+    for (const [c, u] of Object.entries(r.params))
+      a.set(c, u);
   return `${s.authorizationUrl}?${a.toString()}`;
 }
-async function be(e, r, t, n) {
-  const s = j(e);
-  if (!s)
+async function he(e, r, t, n, s) {
+  const i = K(e);
+  if (!i)
     throw new Error(`Unknown OAuth provider: ${e}`);
   if (!t || typeof t != "string")
     throw new Error("Authorization code is required");
@@ -434,9 +485,9 @@ async function be(e, r, t, n) {
     redirect_uri: n,
     grant_type: "authorization_code"
   });
-  r.clientSecret && o.append("client_secret", r.clientSecret);
+  s && o.append("code_verifier", s), r.clientSecret && o.append("client_secret", r.clientSecret);
   try {
-    const i = await fetch(s.tokenUrl, {
+    const a = await fetch(i.tokenUrl, {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
@@ -444,29 +495,29 @@ async function be(e, r, t, n) {
       },
       body: o.toString()
     });
-    if (!i.ok) {
-      const u = await i.text();
-      let f = `Failed to exchange code for tokens: ${u}`;
+    if (!a.ok) {
+      const u = await a.text();
+      let h = `Failed to exchange code for tokens: ${u}`;
       try {
-        const g = JSON.parse(u);
-        f = g.error_description ?? g.error ?? f;
+        const f = JSON.parse(u);
+        h = f.error_description ?? f.error ?? h;
       } catch {
       }
-      throw new Error(f);
+      throw new Error(h);
     }
-    const a = await i.json();
-    if (!Ue(a))
+    const c = await a.json();
+    if (!Qe(c))
       throw new Error("Invalid token exchange response format");
-    return a;
-  } catch (i) {
-    throw i instanceof Error ? i : new Error(`OAuth token exchange failed: ${String(i)}`);
+    return c;
+  } catch (a) {
+    throw a instanceof Error ? a : new Error(`OAuth token exchange failed: ${String(a)}`);
   }
 }
-function Ue(e) {
+function Qe(e) {
   return typeof e == "object" && e !== null && "access_token" in e && typeof e.access_token == "string";
 }
-async function Fe(e, r) {
-  const t = j(e);
+async function ge(e, r) {
+  const t = K(e);
   if (!t)
     throw new Error(`Unknown OAuth provider: ${e}`);
   if (!r || typeof r != "string")
@@ -479,36 +530,36 @@ async function Fe(e, r) {
       }
     });
     if (!n.ok) {
-      const o = await n.text();
-      let i = `Failed to fetch user info: ${o}`;
+      const i = await n.text();
+      let o = `Failed to fetch user info: ${i}`;
       try {
-        const a = JSON.parse(o);
-        i = a.error_description ?? a.error ?? i;
+        const a = JSON.parse(i);
+        o = a.error_description ?? a.error ?? o;
       } catch {
       }
-      throw new Error(i);
+      throw new Error(o);
     }
     const s = await n.json();
-    return xe(e, s, r);
+    return Ze(e, s, r);
   } catch (n) {
     throw n instanceof Error ? n : new Error(`OAuth user info retrieval failed: ${String(n)}`);
   }
 }
-async function xe(e, r, t) {
+async function Ze(e, r, t) {
   switch (e) {
     case "google":
-      return De(r);
+      return er(r);
     case "github":
-      return await Le(r, t);
+      return await rr(r, t);
     case "apple":
-      return Me(r);
+      return tr(r);
     case "facebook":
-      return Ve(r);
+      return nr(r);
     default:
-      return je(r);
+      return sr(r);
   }
 }
-function De(e) {
+function er(e) {
   return {
     id: String(e.sub ?? e.id ?? ""),
     email: String(e.email ?? ""),
@@ -518,7 +569,7 @@ function De(e) {
     rawProfile: e
   };
 }
-async function Le(e, r) {
+async function rr(e, r) {
   let t = typeof e.email == "string" ? e.email : void 0, n = { ...e };
   if (!t)
     try {
@@ -526,8 +577,8 @@ async function Le(e, r) {
         headers: { Authorization: `Bearer ${r}` }
       });
       if (s.ok) {
-        const o = await s.json(), i = o.find((a) => a.primary) ?? o[0];
-        t = (i == null ? void 0 : i.email) ?? `${String(e.login ?? "user")}@users.noreply.github.com`, n = { ...e, emails: o };
+        const i = await s.json(), o = i.find((a) => a.primary) ?? i[0];
+        t = (o == null ? void 0 : o.email) ?? `${String(e.login ?? "user")}@users.noreply.github.com`, n = { ...e, emails: i };
       } else
         t = `${String(e.login ?? "user")}@users.noreply.github.com`;
     } catch {
@@ -542,7 +593,7 @@ async function Le(e, r) {
     rawProfile: n
   };
 }
-function Me(e) {
+function tr(e) {
   const r = e.name, t = r ? `${r.firstName ?? ""} ${r.lastName ?? ""}`.trim() : "";
   return {
     id: String(e.sub ?? ""),
@@ -552,7 +603,7 @@ function Me(e) {
     rawProfile: e
   };
 }
-function Ve(e) {
+function nr(e) {
   var t;
   const r = e.picture;
   return {
@@ -564,7 +615,7 @@ function Ve(e) {
     rawProfile: e
   };
 }
-function je(e) {
+function sr(e) {
   return {
     id: String(e.id ?? e.sub ?? ""),
     email: String(e.email ?? ""),
@@ -574,59 +625,300 @@ function je(e) {
     rawProfile: e
   };
 }
-function rt(e) {
+function Ft(e) {
   return typeof e == "object" && e !== null && "clientId" in e && typeof e.clientId == "string";
 }
-const ze = "__mulguard_oauth_state", $e = 10 * 60 * 1e3;
-function We(e) {
-  const r = e.cookieName || ze, t = e.ttl || $e, n = process.env.NODE_ENV === "production", s = e.secure ?? n, o = e.sameSite || "strict", i = e.cookieHandler, a = (u) => ({
+function ir(e, r, t, n) {
+  if (typeof e.setBigUint64 == "function")
+    return e.setBigUint64(r, t, n);
+  const s = BigInt(32), i = BigInt(4294967295), o = Number(t >> s & i), a = Number(t & i), c = n ? 4 : 0, u = n ? 0 : 4;
+  e.setUint32(r + c, o, n), e.setUint32(r + u, a, n);
+}
+function or(e, r, t) {
+  return e & r ^ ~e & t;
+}
+function ar(e, r, t) {
+  return e & r ^ e & t ^ r & t;
+}
+class cr extends Ie {
+  constructor(r, t, n, s) {
+    super(), this.finished = !1, this.length = 0, this.pos = 0, this.destroyed = !1, this.blockLen = r, this.outputLen = t, this.padOffset = n, this.isLE = s, this.buffer = new Uint8Array(r), this.view = H(this.buffer);
+  }
+  update(r) {
+    Q(this), r = re(r), G(r);
+    const { view: t, buffer: n, blockLen: s } = this, i = r.length;
+    for (let o = 0; o < i; ) {
+      const a = Math.min(s - this.pos, i - o);
+      if (a === s) {
+        const c = H(r);
+        for (; s <= i - o; o += s)
+          this.process(c, o);
+        continue;
+      }
+      n.set(r.subarray(o, o + a), this.pos), this.pos += a, o += a, this.pos === s && (this.process(t, 0), this.pos = 0);
+    }
+    return this.length += r.length, this.roundClean(), this;
+  }
+  digestInto(r) {
+    Q(this), be(r, this), this.finished = !0;
+    const { buffer: t, view: n, blockLen: s, isLE: i } = this;
+    let { pos: o } = this;
+    t[o++] = 128, q(this.buffer.subarray(o)), this.padOffset > s - o && (this.process(n, 0), o = 0);
+    for (let f = o; f < s; f++)
+      t[f] = 0;
+    ir(n, s - 8, BigInt(this.length * 8), i), this.process(n, 0);
+    const a = H(r), c = this.outputLen;
+    if (c % 4)
+      throw new Error("_sha2: outputLen should be aligned to 32bit");
+    const u = c / 4, h = this.get();
+    if (u > h.length)
+      throw new Error("_sha2: outputLen bigger than state");
+    for (let f = 0; f < u; f++)
+      a.setUint32(4 * f, h[f], i);
+  }
+  digest() {
+    const { buffer: r, outputLen: t } = this;
+    this.digestInto(r);
+    const n = r.slice(0, t);
+    return this.destroy(), n;
+  }
+  _cloneInto(r) {
+    r || (r = new this.constructor()), r.set(...this.get());
+    const { blockLen: t, buffer: n, length: s, finished: i, destroyed: o, pos: a } = this;
+    return r.destroyed = o, r.finished = i, r.length = s, r.pos = a, s % t && r.buffer.set(n), r;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+}
+const N = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]), ur = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]), U = /* @__PURE__ */ new Uint32Array(64);
+class lr extends cr {
+  constructor(r = 32) {
+    super(64, r, 8, !1), this.A = N[0] | 0, this.B = N[1] | 0, this.C = N[2] | 0, this.D = N[3] | 0, this.E = N[4] | 0, this.F = N[5] | 0, this.G = N[6] | 0, this.H = N[7] | 0;
+  }
+  get() {
+    const { A: r, B: t, C: n, D: s, E: i, F: o, G: a, H: c } = this;
+    return [r, t, n, s, i, o, a, c];
+  }
+  // prettier-ignore
+  set(r, t, n, s, i, o, a, c) {
+    this.A = r | 0, this.B = t | 0, this.C = n | 0, this.D = s | 0, this.E = i | 0, this.F = o | 0, this.G = a | 0, this.H = c | 0;
+  }
+  process(r, t) {
+    for (let f = 0; f < 16; f++, t += 4)
+      U[f] = r.getUint32(t, !1);
+    for (let f = 16; f < 64; f++) {
+      const y = U[f - 15], E = U[f - 2], v = P(y, 7) ^ P(y, 18) ^ y >>> 3, p = P(E, 17) ^ P(E, 19) ^ E >>> 10;
+      U[f] = p + U[f - 7] + v + U[f - 16] | 0;
+    }
+    let { A: n, B: s, C: i, D: o, E: a, F: c, G: u, H: h } = this;
+    for (let f = 0; f < 64; f++) {
+      const y = P(a, 6) ^ P(a, 11) ^ P(a, 25), E = h + y + or(a, c, u) + ur[f] + U[f] | 0, p = (P(n, 2) ^ P(n, 13) ^ P(n, 22)) + ar(n, s, i) | 0;
+      h = u, u = c, c = a, a = o + E | 0, o = i, i = s, s = n, n = E + p | 0;
+    }
+    n = n + this.A | 0, s = s + this.B | 0, i = i + this.C | 0, o = o + this.D | 0, a = a + this.E | 0, c = c + this.F | 0, u = u + this.G | 0, h = h + this.H | 0, this.set(n, s, i, o, a, c, u, h);
+  }
+  roundClean() {
+    q(U);
+  }
+  destroy() {
+    this.set(0, 0, 0, 0, 0, 0, 0, 0), q(this.buffer);
+  }
+}
+const fr = /* @__PURE__ */ xe(() => new lr()), dr = fr, we = 43;
+function hr(e = we) {
+  if (e < 43 || e > 128)
+    throw new Error("Code verifier length must be between 43 and 128 characters");
+  const r = te(Math.ceil(e * 0.75));
+  return Buffer.from(r).toString("base64url").substring(0, e);
+}
+function pe(e) {
+  if (!e || e.length < 43 || e.length > 128)
+    throw new Error("Invalid code verifier");
+  const r = dr(e);
+  return Buffer.from(r).toString("base64url");
+}
+function gr(e = we, r = "S256") {
+  const t = hr(e), n = r === "S256" ? pe(t) : t;
+  return {
+    codeVerifier: t,
+    codeChallenge: n,
+    codeChallengeMethod: r
+  };
+}
+function Lt(e, r, t = "S256") {
+  if (!e || !r)
+    return {
+      valid: !1,
+      error: "Code verifier and challenge are required"
+    };
+  let n;
+  if (t === "S256")
+    try {
+      n = pe(e);
+    } catch (s) {
+      return {
+        valid: !1,
+        error: s instanceof Error ? s.message : "Failed to generate expected challenge"
+      };
+    }
+  else
+    n = e;
+  return wr(r, n) ? { valid: !0 } : {
+    valid: !1,
+    error: "Code challenge verification failed"
+  };
+}
+function wr(e, r) {
+  if (e.length !== r.length)
+    return !1;
+  let t = 0;
+  for (let n = 0; n < e.length; n++)
+    t |= e.charCodeAt(n) ^ r.charCodeAt(n);
+  return t === 0;
+}
+class pr {
+  constructor() {
+    x(this, "storage", /* @__PURE__ */ new Map());
+  }
+  async set(r, t, n) {
+    this.storage.set(r, {
+      codeVerifier: t,
+      expiresAt: Date.now() + n
+    });
+  }
+  async get(r) {
+    const t = this.storage.get(r);
+    return t ? t.expiresAt < Date.now() ? (this.storage.delete(r), null) : t.codeVerifier : null;
+  }
+  async delete(r) {
+    this.storage.delete(r);
+  }
+}
+const mr = "__mulguard_oauth_state", Er = 10 * 60 * 1e3;
+function yr(e) {
+  const r = e.cookieName || mr, t = e.ttl || Er, n = process.env.NODE_ENV === "production", s = e.secure ?? n, i = e.sameSite || "strict", o = e.cookieHandler, a = (c) => ({
     httpOnly: !0,
     secure: s,
-    sameSite: o,
-    maxAge: Math.floor(u / 1e3),
+    sameSite: i,
+    maxAge: Math.floor(c / 1e3),
     // Convert to seconds
     path: "/"
   });
   return {
-    async set(u, f, g) {
-      const w = JSON.stringify({
-        state: u,
-        provider: f.provider,
-        expiresAt: f.expiresAt
+    async set(c, u, h) {
+      const f = JSON.stringify({
+        state: c,
+        provider: u.provider,
+        expiresAt: u.expiresAt
       });
       await Promise.resolve(
-        i.setCookie(r, w, a(t))
+        o.setCookie(r, f, a(t))
       );
     },
-    async get(u) {
-      const f = await Promise.resolve(i.getCookie(r));
-      if (!f)
+    async get(c) {
+      const u = await Promise.resolve(o.getCookie(r));
+      if (!u)
         return null;
       try {
-        const g = JSON.parse(f);
-        return g.state !== u ? null : g.expiresAt < Date.now() ? (await Promise.resolve(
-          i.deleteCookie(r, { path: "/" })
+        const h = JSON.parse(u);
+        return h.state !== c ? null : h.expiresAt < Date.now() ? (await Promise.resolve(
+          o.deleteCookie(r, { path: "/" })
         ), null) : {
-          provider: g.provider,
-          expiresAt: g.expiresAt
+          provider: h.provider,
+          expiresAt: h.expiresAt
         };
       } catch {
         return await Promise.resolve(
-          i.deleteCookie(r, { path: "/" })
+          o.deleteCookie(r, { path: "/" })
         ), null;
       }
     },
-    async delete(u) {
-      await this.get(u) && await Promise.resolve(
-        i.deleteCookie(r, { path: "/" })
+    async delete(c) {
+      await this.get(c) && await Promise.resolve(
+        o.deleteCookie(r, { path: "/" })
       );
     },
     async cleanup() {
     }
   };
 }
-function tt() {
-  return We({
+function Vt() {
+  return yr({
     cookieHandler: {
       async getCookie(e) {
         var r;
@@ -665,45 +957,22 @@ function tt() {
     }
   });
 }
-class qe {
-  constructor() {
-    b(this, "states", /* @__PURE__ */ new Map());
-  }
-  set(r, t, n) {
-    this.states.set(r, t), this.cleanup();
-  }
-  get(r) {
-    const t = this.states.get(r);
-    return t ? t.expiresAt < Date.now() ? (this.delete(r), null) : t : null;
-  }
-  delete(r) {
-    this.states.delete(r);
-  }
-  cleanup() {
-    const r = Date.now();
-    for (const [t, n] of this.states.entries())
-      n.expiresAt < r && this.states.delete(t);
-  }
-}
-function Be() {
-  return new qe();
-}
-function nt(e, r = "mulguard:oauth:state:") {
+function Mt(e, r = "mulguard:oauth:state:") {
   const t = (s) => `${r}${s}`, n = async (s) => {
-    const o = t(s);
-    await e.del(o);
+    const i = t(s);
+    await e.del(i);
   };
   return {
-    async set(s, o, i) {
-      const a = t(s), u = JSON.stringify(o);
-      await e.set(a, u, "EX", Math.floor(i / 1e3));
+    async set(s, i, o) {
+      const a = t(s), c = JSON.stringify(i);
+      await e.set(a, c, "EX", Math.floor(o / 1e3));
     },
     async get(s) {
-      const o = t(s), i = await e.get(o);
-      if (!i)
+      const i = t(s), o = await e.get(i);
+      if (!o)
         return null;
       try {
-        const a = JSON.parse(i);
+        const a = JSON.parse(o);
         return a.expiresAt < Date.now() ? (await n(s), null) : a;
       } catch {
         return await n(s), null;
@@ -714,14 +983,14 @@ function nt(e, r = "mulguard:oauth:state:") {
     },
     async cleanup() {
       try {
-        const s = await e.keys(`${r}*`), o = Date.now();
-        for (const i of s) {
-          const a = await e.get(i);
+        const s = await e.keys(`${r}*`), i = Date.now();
+        for (const o of s) {
+          const a = await e.get(o);
           if (a)
             try {
-              JSON.parse(a).expiresAt < o && await e.del(i);
+              JSON.parse(a).expiresAt < i && await e.del(o);
             } catch {
-              await e.del(i);
+              await e.del(o);
             }
         }
       } catch (s) {
@@ -730,175 +999,458 @@ function nt(e, r = "mulguard:oauth:state:") {
     }
   };
 }
-function D(e) {
+class kr {
+  constructor() {
+    x(this, "states", /* @__PURE__ */ new Map());
+  }
+  set(r, t, n) {
+    this.states.set(r, t), this.cleanup();
+  }
+  get(r) {
+    const t = this.states.get(r);
+    return t ? t.expiresAt < Date.now() ? (this.delete(r), null) : t : null;
+  }
+  delete(r) {
+    this.states.delete(r);
+  }
+  cleanup() {
+    const r = Date.now();
+    for (const [t, n] of this.states.entries())
+      n.expiresAt < r && this.states.delete(t);
+  }
+}
+function vr() {
+  return new kr();
+}
+class Sr {
+  constructor(r) {
+    x(this, "config");
+    x(this, "pkceStorage");
+    var t, n;
+    this.config = {
+      ...r,
+      pkce: {
+        enabled: ((t = r.pkce) == null ? void 0 : t.enabled) ?? !0,
+        // PKCE enabled by default
+        storage: (n = r.pkce) == null ? void 0 : n.storage
+      },
+      stateStore: r.stateStore,
+      logger: r.logger
+    }, this.pkceStorage = this.config.pkce.enabled ? this.config.pkce.storage || new pr() : null;
+  }
+  /**
+   * Initiates OAuth authentication flow.
+   * 
+   * Generates authorization URL with PKCE (if enabled) and CSRF state token.
+   * 
+   * @param providerId - OAuth provider identifier
+   * @returns OAuth initiation result with authorization URL and state
+   * 
+   * @example
+   * ```typescript
+   * const { url, state, codeVerifier } = await handler.initiate('google')
+   * // Store state and codeVerifier securely
+   * // Redirect user to url
+   * ```
+   */
+  async initiate(r) {
+    const t = this.config.providers[r];
+    if (!t)
+      throw new Error(`OAuth provider "${r}" is not configured`);
+    const n = ue();
+    let s, i;
+    if (this.config.pkce.enabled && this.pkceStorage) {
+      const a = gr();
+      s = a.codeVerifier, i = a.codeChallenge, await this.pkceStorage.set(n, s, 10 * 60 * 1e3);
+    }
+    const o = de(
+      r,
+      {
+        ...t,
+        params: {
+          ...t.params,
+          ...i && {
+            code_challenge: i,
+            code_challenge_method: "S256"
+          }
+        }
+      },
+      this.config.baseUrl,
+      n
+    );
+    return this.config.stateStore && await this.config.stateStore.set(n, {
+      provider: r,
+      expiresAt: Date.now() + 10 * 60 * 1e3
+      // 10 minutes
+    }, 10 * 60 * 1e3), {
+      url: o,
+      state: n,
+      ...s && { codeVerifier: s }
+    };
+  }
+  /**
+   * Handles OAuth callback and completes authentication.
+   * 
+   * Validates state token, verifies PKCE (if enabled), exchanges code for tokens,
+   * retrieves user profile, and creates session.
+   * 
+   * @template TUser - User type
+   * @template TSession - Session type
+   * @param providerId - OAuth provider identifier
+   * @param code - Authorization code from OAuth callback
+   * @param state - CSRF state token
+   * @param codeVerifier - PKCE code verifier (required if PKCE is enabled)
+   * @param userLookup - Function to lookup/create user from OAuth profile
+   * @param createSession - Function to create session (optional)
+   * @returns Authentication result
+   * 
+   * @example
+   * ```typescript
+   * const result = await handler.handleCallback(
+   *   'google',
+   *   code,
+   *   state,
+   *   storedCodeVerifier,
+   *   async (userInfo) => {
+   *     // Lookup or create user
+   *     return await db.user.findOrCreate({ email: userInfo.email })
+   *   }
+   * )
+   * ```
+   */
+  async handleCallback(r, t, n, s, i, o) {
+    try {
+      if (!t || !n)
+        return {
+          success: !1,
+          error: "Authorization code and state are required",
+          errorCode: m.VALIDATION_ERROR
+        };
+      if (!await this.validateState(n, r))
+        return {
+          success: !1,
+          error: "Invalid or expired state token",
+          errorCode: m.VALIDATION_ERROR
+        };
+      const c = this.config.providers[r];
+      if (!c)
+        return {
+          success: !1,
+          error: `OAuth provider "${r}" is not configured`,
+          errorCode: m.VALIDATION_ERROR
+        };
+      if (this.config.pkce.enabled && this.pkceStorage) {
+        const p = s || await this.pkceStorage.get(n);
+        if (!p)
+          return {
+            success: !1,
+            error: "PKCE code verifier not found",
+            errorCode: m.VALIDATION_ERROR
+          };
+        s = p;
+      }
+      const u = c.redirectUri || `${this.config.baseUrl}/api/auth/callback/${r}`;
+      let h;
+      try {
+        h = await he(r, c, t, u, s);
+      } catch (p) {
+        return this.config.logger && this.config.logger.error("OAuth token exchange failed", p), {
+          success: !1,
+          error: p instanceof Error ? p.message : "Token exchange failed",
+          errorCode: m.NETWORK_ERROR
+        };
+      }
+      let f;
+      try {
+        f = await ge(r, h.access_token);
+      } catch (p) {
+        return this.config.logger && this.config.logger.error("OAuth user profile retrieval failed", p), {
+          success: !1,
+          error: "Failed to retrieve user profile",
+          errorCode: m.NETWORK_ERROR
+        };
+      }
+      const y = {
+        id: f.id,
+        email: f.email,
+        name: f.name,
+        avatar: f.avatar,
+        emailVerified: f.emailVerified,
+        provider: r,
+        accessToken: h.access_token,
+        refreshToken: h.refresh_token,
+        tokens: h,
+        rawProfile: f.rawProfile
+      };
+      let E;
+      i ? E = await i(y) : E = {
+        id: y.id,
+        email: y.email,
+        name: y.name,
+        avatar: y.avatar,
+        emailVerified: y.emailVerified
+      };
+      const v = o ? await o(E, y) : {
+        user: E,
+        expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1e3),
+        // 7 days
+        accessToken: h.access_token,
+        refreshToken: h.refresh_token,
+        tokenType: h.token_type || "Bearer",
+        expiresIn: h.expires_in
+      };
+      return this.config.pkce.enabled && this.pkceStorage && await this.pkceStorage.delete(n), {
+        success: !0,
+        user: E,
+        session: v
+      };
+    } catch (a) {
+      return this.config.logger && this.config.logger.error("OAuth callback error", a), {
+        success: !1,
+        error: a instanceof Error ? a.message : "OAuth callback failed",
+        errorCode: m.UNKNOWN_ERROR
+      };
+    }
+  }
+  // ============================================================================
+  // State Validation
+  // ============================================================================
+  /**
+   * Validates OAuth state token.
+   * 
+   * @param state - State token
+   * @param providerId - Provider identifier
+   * @returns True if state is valid
+   */
+  async validateState(r, t) {
+    if (this.config.stateStore) {
+      const n = await this.config.stateStore.get(r);
+      return n ? n.expiresAt < Date.now() ? (await this.config.stateStore.delete(r), !1) : n.provider !== t ? !1 : (await this.config.stateStore.delete(r), !0) : !1;
+    }
+    return !0;
+  }
+}
+function jt(e) {
+  return new Sr(e);
+}
+function M(e) {
   return e.success === !0 && e.user !== void 0 && e.session !== void 0;
 }
-var ee = /* @__PURE__ */ ((e) => (e[e.DEBUG = 0] = "DEBUG", e[e.INFO = 1] = "INFO", e[e.WARN = 2] = "WARN", e[e.ERROR = 3] = "ERROR", e))(ee || {});
-const He = process.env.NODE_ENV === "development" ? 0 : 1;
-function Ge(e = {}) {
+var V = /* @__PURE__ */ ((e) => (e[e.DEBUG = 0] = "DEBUG", e[e.INFO = 1] = "INFO", e[e.WARN = 2] = "WARN", e[e.ERROR = 3] = "ERROR", e))(V || {});
+const Ar = process.env.NODE_ENV === "development" ? 0 : 1;
+function me(e = {}) {
   const {
     enabled: r = process.env.NODE_ENV === "development",
-    level: t = He,
+    level: t = Ar,
     context: n,
-    formatter: s = Ke
-  } = e, o = (a) => r && a >= t, i = (a, u, f, g) => ({
+    formatter: s = Rr
+  } = e, i = (a) => r && a >= t, o = (a, c, u, h) => ({
     level: a,
-    message: u,
+    message: c,
     timestamp: /* @__PURE__ */ new Date(),
     context: n,
-    data: f ? Xe(f) : void 0,
-    error: g
+    data: u ? Or(u) : void 0,
+    error: h
   });
   return {
-    debug: (a, u) => {
-      if (o(
+    debug: (a, c) => {
+      if (i(
         0
         /* DEBUG */
       )) {
-        const f = i(0, a, u);
-        console.debug(s(f));
+        const u = o(0, a, c);
+        console.debug(s(u));
       }
     },
-    info: (a, u) => {
-      if (o(
+    info: (a, c) => {
+      if (i(
         1
         /* INFO */
       )) {
-        const f = i(1, a, u);
-        console.info(s(f));
+        const u = o(1, a, c);
+        console.info(s(u));
       }
     },
-    warn: (a, u) => {
-      if (o(
+    warn: (a, c) => {
+      if (i(
         2
         /* WARN */
       )) {
-        const f = i(2, a, u);
-        console.warn(s(f));
+        const u = o(2, a, c);
+        console.warn(s(u));
       }
     },
-    error: (a, u) => {
-      if (o(
+    error: (a, c) => {
+      if (i(
         3
         /* ERROR */
       )) {
-        const f = u instanceof Error ? u : void 0, g = u instanceof Error ? void 0 : u, w = i(3, a, g, f);
-        console.error(s(w)), f && console.error(f);
+        const u = c instanceof Error ? c : void 0, h = c instanceof Error ? void 0 : c, f = o(3, a, h, u);
+        console.error(s(f)), u && console.error(u);
       }
     }
   };
 }
-function Ke(e) {
-  const r = e.timestamp.toISOString(), t = ee[e.level], n = e.context ? `[${e.context}]` : "", s = e.data ? ` ${JSON.stringify(e.data)}` : "";
+function Rr(e) {
+  const r = e.timestamp.toISOString(), t = V[e.level], n = e.context ? `[${e.context}]` : "", s = e.data ? ` ${JSON.stringify(e.data)}` : "";
   return `${r} [${t}]${n} ${e.message}${s}`;
 }
-function Xe(e) {
+function Or(e) {
   const r = /* @__PURE__ */ new Set(["password", "token", "secret", "key", "accessToken", "refreshToken"]), t = {};
   for (const [n, s] of Object.entries(e))
     if (r.has(n.toLowerCase()))
       t[n] = "***REDACTED***";
     else if (typeof s == "string" && n.toLowerCase().includes("email")) {
-      const o = s.split("@");
-      if (o.length === 2 && o[0]) {
-        const i = o[0].substring(0, 3) + "***@" + o[1];
-        t[n] = i;
+      const i = s.split("@");
+      if (i.length === 2 && i[0]) {
+        const o = i[0].substring(0, 3) + "***@" + i[1];
+        t[n] = o;
       } else
         t[n] = s;
     } else
       t[n] = s;
   return t;
 }
-const I = Ge();
-function Je(e, r, t, n = {}) {
+me();
+function Ee(e = {}) {
+  return me(e);
+}
+function Tr(e = {}) {
+  try {
+    const r = require("pino"), t = {
+      level: e.level !== void 0 ? V[e.level].toLowerCase() : "info",
+      base: e.context ? { context: e.context } : void 0,
+      timestamp: !0
+    }, n = r(t);
+    return {
+      debug: (s, i) => {
+        n.debug(i || {}, s);
+      },
+      info: (s, i) => {
+        n.info(i || {}, s);
+      },
+      warn: (s, i) => {
+        n.warn(i || {}, s);
+      },
+      error: (s, i) => {
+        i instanceof Error ? n.error({ err: i }, s) : n.error(i || {}, s);
+      }
+    };
+  } catch {
+    return Ee(e);
+  }
+}
+function _r(e = {}) {
+  const { adapter: r = "console", ...t } = e;
+  let n;
+  if (typeof r == "string")
+    switch (r) {
+      case "pino":
+        n = Tr(t);
+        break;
+      case "console":
+      default:
+        n = Ee(t);
+        break;
+    }
+  else
+    n = r;
+  return n;
+}
+const _ = _r({
+  adapter: process.env.MULGUARD_LOGGER_ADAPTER || "console",
+  level: process.env.NODE_ENV === "production" ? V.WARN : V.DEBUG
+});
+function br(e, r, t, n = {}) {
   const {
     enabled: s = !0,
-    maxRetries: o = 1,
-    retryDelay: i = 1e3,
+    maxRetries: i = 1,
+    retryDelay: o = 1e3,
     rateLimit: a = 3,
-    autoSignOutOnFailure: u = !0,
-    redirectToLogin: f = "/login",
-    autoRedirectOnFailure: g = !0
+    autoSignOutOnFailure: c = !0,
+    redirectToLogin: u = "/login",
+    autoRedirectOnFailure: h = !0
   } = n;
-  let w = null, R = !1;
-  const A = [], S = [], y = 60 * 1e3;
-  let h = 0, T = !1, _ = null;
-  const L = 2, M = 60 * 1e3;
-  function c() {
-    const k = Date.now();
-    if (T && _) {
-      if (k < _)
+  let f = null, y = !1;
+  const E = [], v = [], p = 60 * 1e3;
+  let w = 0, T = !1, b = null;
+  const j = 2, z = 60 * 1e3;
+  function l() {
+    const S = Date.now();
+    if (T && b) {
+      if (S < b)
         return !1;
-      T = !1, _ = null, h = 0;
+      T = !1, b = null, w = 0;
     }
-    for (; S.length > 0; ) {
-      const p = S[0];
-      if (p !== void 0 && p < k - y)
-        S.shift();
+    for (; v.length > 0; ) {
+      const k = v[0];
+      if (k !== void 0 && k < S - p)
+        v.shift();
       else
         break;
     }
-    return S.length >= a ? !1 : (S.push(k), !0);
-  }
-  function l() {
-    h++, h >= L && (T = !0, _ = Date.now() + M, process.env.NODE_ENV === "development" && console.warn("[TokenRefreshManager] Circuit breaker opened - too many consecutive failures"));
+    return v.length >= a ? !1 : (v.push(S), !0);
   }
   function d() {
-    h = 0, T = !1, _ = null;
+    w++, w >= j && (T = !0, b = Date.now() + z, process.env.NODE_ENV === "development" && console.warn("[TokenRefreshManager] Circuit breaker opened - too many consecutive failures"));
+  }
+  function g() {
+    w = 0, T = !1, b = null;
   }
-  async function v(k = 1) {
+  async function R(S = 1) {
     if (!s)
       return null;
-    if (!c())
+    if (!l())
       throw new Error("Rate limit exceeded for token refresh");
     try {
-      const p = await e();
-      if (p)
-        return d(), P(p), n.onTokenRefreshed && await Promise.resolve(n.onTokenRefreshed(p)), p;
-      if (l(), k < o)
-        return await $(i * k), v(k + 1);
+      const k = await e();
+      if (k)
+        return g(), C(k), n.onTokenRefreshed && await Promise.resolve(n.onTokenRefreshed(k)), k;
+      if (d(), S < i)
+        return await J(o * S), R(S + 1);
       throw new Error("Token refresh failed: refresh function returned null");
-    } catch (p) {
-      if (l(), k < o && C(p))
-        return await $(i * k), v(k + 1);
-      throw p;
+    } catch (k) {
+      if (d(), S < i && I(k))
+        return await J(o * S), R(S + 1);
+      throw k;
     }
   }
-  function C(k) {
-    if (k instanceof Error) {
-      const p = k.message.toLowerCase();
-      if (p.includes("rate limit") || p.includes("too many requests") || p.includes("429") || p.includes("limit:") || p.includes("requests per minute") || p.includes("token_blacklisted") || p.includes("blacklisted") || p.includes("invalid") || p.includes("401") || p.includes("unauthorized") || p.includes("session has been revoked") || p.includes("session expired"))
+  function I(S) {
+    if (S instanceof Error) {
+      const k = S.message.toLowerCase();
+      if (k.includes("rate limit") || k.includes("too many requests") || k.includes("429") || k.includes("limit:") || k.includes("requests per minute") || k.includes("token_blacklisted") || k.includes("blacklisted") || k.includes("invalid") || k.includes("401") || k.includes("unauthorized") || k.includes("session has been revoked") || k.includes("session expired"))
         return !1;
-      if (p.includes("network") || p.includes("fetch") || p.includes("timeout"))
+      if (k.includes("network") || k.includes("fetch") || k.includes("timeout"))
         return !0;
     }
     return !1;
   }
-  function P(k) {
-    const p = [...A];
-    A.length = 0;
-    for (const { resolve: N } of p)
-      N(k);
+  function C(S) {
+    const k = [...E];
+    E.length = 0;
+    for (const { resolve: D } of k)
+      D(S);
   }
-  function z(k) {
-    const p = [...A];
-    A.length = 0;
-    for (const { reject: N } of p)
-      N(k);
+  function X(S) {
+    const k = [...E];
+    E.length = 0;
+    for (const { reject: D } of k)
+      D(S);
   }
-  function $(k) {
-    return new Promise((p) => setTimeout(p, k));
+  function J(S) {
+    return new Promise((k) => setTimeout(k, S));
   }
-  async function W(k) {
+  async function Y(S) {
     try {
-      if (n.onTokenRefreshFailed && await Promise.resolve(n.onTokenRefreshFailed(k)), u && (await t(), await r(), g && typeof window < "u")) {
-        let p = !0;
-        if (n.onBeforeRedirect && (p = await Promise.resolve(n.onBeforeRedirect(k))), p) {
-          const N = new URL(f, window.location.origin);
-          N.searchParams.set("reason", "session_expired"), N.searchParams.set("redirect", window.location.pathname + window.location.search), window.location.href = N.toString();
+      if (n.onTokenRefreshFailed && await Promise.resolve(n.onTokenRefreshFailed(S)), c && (await t(), await r(), h && typeof window < "u")) {
+        let k = !0;
+        if (n.onBeforeRedirect && (k = await Promise.resolve(n.onBeforeRedirect(S))), k) {
+          const D = new URL(u, window.location.origin);
+          D.searchParams.set("reason", "session_expired"), D.searchParams.set("redirect", window.location.pathname + window.location.search), window.location.href = D.toString();
         }
       }
-    } catch (p) {
-      process.env.NODE_ENV === "development" && console.error("[TokenRefreshManager] Error in handleRefreshFailure:", p);
+    } catch (k) {
+      process.env.NODE_ENV === "development" && console.error("[TokenRefreshManager] Error in handleRefreshFailure:", k);
     }
   }
   return {
@@ -906,40 +1458,40 @@ function Je(e, r, t, n = {}) {
      * Refresh token with single refresh queue
      */
     async refreshToken() {
-      return s ? w || (R = !0, w = v().then((k) => (R = !1, w = null, k)).catch((k) => {
-        throw R = !1, w = null, z(k), W(k).catch(() => {
-        }), k;
-      }), w) : null;
+      return s ? f || (y = !0, f = R().then((S) => (y = !1, f = null, S)).catch((S) => {
+        throw y = !1, f = null, X(S), Y(S).catch(() => {
+        }), S;
+      }), f) : null;
     },
     /**
      * Check if refresh is in progress
      */
     isRefreshing() {
-      return R;
+      return y;
     },
     /**
      * Wait for current refresh to complete
      */
     async waitForRefresh() {
-      return w ? new Promise((k, p) => {
-        A.push({ resolve: k, reject: p });
+      return f ? new Promise((S, k) => {
+        E.push({ resolve: S, reject: k });
       }) : null;
     },
     /**
      * Clear state
      */
     clear() {
-      w = null, R = !1, S.length = 0, d(), z(new Error("Token refresh manager cleared"));
+      f = null, y = !1, v.length = 0, g(), X(new Error("Token refresh manager cleared"));
     },
     /**
      * Handle token refresh failure
      */
-    async handleRefreshFailure(k) {
-      return W(k);
+    async handleRefreshFailure(S) {
+      return Y(S);
     }
   };
 }
-function Ye() {
+function Cr() {
   const e = process.env.NODE_ENV === "production";
   return {
     cookieName: "__mulguard_session",
@@ -952,7 +1504,7 @@ function Ye() {
     path: "/"
   };
 }
-function Qe() {
+function Ir() {
   return {
     enabled: !0,
     refreshThreshold: 300,
@@ -967,90 +1519,90 @@ function Qe() {
     autoRedirectOnFailure: !0
   };
 }
-function Ze() {
+function xr() {
   return process.env.NEXT_PUBLIC_URL ?? (process.env.VERCEL_URL ? `https://${process.env.VERCEL_URL}` : "http://localhost:3000");
 }
-function er(e) {
-  const { sessionConfig: r, cacheTtl: t, getSessionAction: n, onSessionExpired: s, onError: o } = e, i = r.cookieName ?? "__mulguard_session";
+function Pr(e) {
+  const { sessionConfig: r, cacheTtl: t, getSessionAction: n, onSessionExpired: s, onError: i } = e, o = r.cookieName ?? "__mulguard_session";
   let a = null;
-  const u = async () => {
-    const y = Date.now();
-    if (a && y - a.timestamp < t)
+  const c = async () => {
+    const p = Date.now();
+    if (a && p - a.timestamp < t)
       return a.session;
     if (n)
       try {
-        const h = await n();
-        if (h && U(h))
-          return a = { session: h, timestamp: y }, h;
-        h && !U(h) && (await g(), a = null);
-      } catch (h) {
-        I.debug("getSession error", { error: h }), o && await o(h instanceof Error ? h : new Error(String(h)), "getSession"), a = null;
+        const w = await n();
+        if (w && F(w))
+          return a = { session: w, timestamp: p }, w;
+        w && !F(w) && (await h(), a = null);
+      } catch (w) {
+        _.debug("getSession error", { error: w }), i && await i(w instanceof Error ? w : new Error(String(w)), "getSession"), a = null;
       }
     try {
-      const h = await ce(i);
-      if (h)
+      const w = await Te(o);
+      if (w)
         try {
-          const T = JSON.parse(h);
-          if (U(T))
-            return T.expiresAt && new Date(T.expiresAt) < /* @__PURE__ */ new Date() ? (s && await s(T), await g(), a = null, null) : (a = { session: T, timestamp: y }, T);
-          await g(), a = null;
+          const T = JSON.parse(w);
+          if (F(T))
+            return T.expiresAt && new Date(T.expiresAt) < /* @__PURE__ */ new Date() ? (s && await s(T), await h(), a = null, null) : (a = { session: T, timestamp: p }, T);
+          await h(), a = null;
         } catch {
-          await g(), a = null;
+          await h(), a = null;
         }
-    } catch (h) {
-      const T = h instanceof Error ? h.message : String(h);
-      !T.includes("request scope") && !T.includes("cookies") && (I.warn("getSession cookie error", { error: h }), o && await o(
-        h instanceof Error ? h : new Error(String(h)),
+    } catch (w) {
+      const T = w instanceof Error ? w.message : String(w);
+      !T.includes("request scope") && !T.includes("cookies") && (_.warn("getSession cookie error", { error: w }), i && await i(
+        w instanceof Error ? w : new Error(String(w)),
         "getSession.cookie"
       ));
     }
     return null;
-  }, f = async (y) => {
-    if (!U(y))
+  }, u = async (p) => {
+    if (!F(p))
       return {
         success: !1,
         error: "Invalid session structure"
       };
     try {
-      const h = typeof y == "object" && "token" in y ? String(y.token) : JSON.stringify(y), T = ie(i, h, r), _ = await ae(T);
-      return _.success && (a = { session: y, timestamp: Date.now() }), _;
-    } catch (h) {
-      const T = h instanceof Error ? h.message : "Failed to set session";
-      return I.error("setSession error", { error: h }), o && await o(h instanceof Error ? h : new Error(String(h)), "setSession"), {
+      const w = typeof p == "object" && "token" in p ? String(p.token) : JSON.stringify(p), T = Re(o, w, r), b = await Oe(T);
+      return b.success && (a = { session: p, timestamp: Date.now() }), b;
+    } catch (w) {
+      const T = w instanceof Error ? w.message : "Failed to set session";
+      return _.error("setSession error", { error: w }), i && await i(w instanceof Error ? w : new Error(String(w)), "setSession"), {
         success: !1,
         error: T
       };
     }
-  }, g = async () => {
+  }, h = async () => {
     try {
-      await oe(i, {
+      await Ae(o, {
         path: r.path,
         domain: r.domain
       }), a = null;
-    } catch (y) {
-      I.warn("clearSessionCookie error", { error: y });
+    } catch (p) {
+      _.warn("clearSessionCookie error", { error: p });
     }
-  }, w = async () => {
-    const y = await u();
-    return y != null && y.accessToken && typeof y.accessToken == "string" ? y.accessToken : null;
+  }, f = async () => {
+    const p = await c();
+    return p != null && p.accessToken && typeof p.accessToken == "string" ? p.accessToken : null;
   };
   return {
-    getSession: u,
-    setSession: f,
-    clearSessionCookie: g,
-    getAccessToken: w,
+    getSession: c,
+    setSession: u,
+    clearSessionCookie: h,
+    getAccessToken: f,
     getRefreshToken: async () => {
-      const y = await u();
-      return y != null && y.refreshToken && typeof y.refreshToken == "string" ? y.refreshToken : null;
+      const p = await c();
+      return p != null && p.refreshToken && typeof p.refreshToken == "string" ? p.refreshToken : null;
     },
-    hasValidTokens: async () => !!await w(),
+    hasValidTokens: async () => !!await f(),
     clearCache: () => {
       a = null;
     },
-    getSessionConfig: () => ({ cookieName: i, config: r })
+    getSessionConfig: () => ({ cookieName: o, config: r })
   };
 }
-function rr(e) {
+function Nr(e) {
   return async (r) => {
     try {
       if (!r || typeof r != "object")
@@ -1065,8 +1617,8 @@ function rr(e) {
           error: "Email is required",
           errorCode: m.VALIDATION_ERROR
         };
-      const t = G(r.email);
-      if (!K(t))
+      const t = se(r.email);
+      if (!ie(t))
         return {
           success: !1,
           error: t.error ?? "Invalid email format",
@@ -1089,19 +1641,19 @@ function rr(e) {
         password: r.password
         // Don't sanitize password (needed for hashing)
       }, s = await e.actions.signIn.email(n);
-      if (D(s)) {
-        const o = await e.saveSessionAfterAuth(s);
-        !o.success && o.warning && I.warn("Session save warning", { warning: o.warning });
+      if (M(s)) {
+        const i = await e.saveSessionAfterAuth(s);
+        !i.success && i.warning && _.warn("Session save warning", { warning: i.warning });
       }
-      return s.success ? I.info("Sign in successful", {
+      return s.success ? _.info("Sign in successful", {
         email: n.email.substring(0, 3) + "***"
-      }) : I.warn("Sign in failed", {
+      }) : _.warn("Sign in failed", {
         email: n.email.substring(0, 3) + "***",
         errorCode: s.errorCode
       }), s;
     } catch (t) {
       const n = t instanceof Error ? t.message : "Sign in failed";
-      return I.error("Sign in error", { error: n, context: "signIn.email" }), e.onError && await e.onError(
+      return _.error("Sign in error", { error: n, context: "signIn.email" }), e.onError && await e.onError(
         t instanceof Error ? t : new Error(String(t)),
         "signIn.email"
       ), {
@@ -1112,11 +1664,11 @@ function rr(e) {
     }
   };
 }
-function tr(e, r) {
+function Ur(e, r) {
   return async (t) => {
     if (!t || typeof t != "string")
       throw new Error("Provider is required");
-    const n = X(t, {
+    const n = oe(t, {
       maxLength: 50,
       allowHtml: !1,
       required: !0
@@ -1128,11 +1680,11 @@ function tr(e, r) {
       throw new Error(
         "OAuth sign in is not configured. Either provide oauth action in signIn, or configure providers.oauth in config."
       );
-    const o = await e.actions.signIn.oauth(s);
-    return await r(o.state, s), I.info("OAuth sign in initiated", { provider: s }), o;
+    const i = await e.actions.signIn.oauth(s);
+    return await r(i.state, s), _.info("OAuth sign in initiated", { provider: s }), i;
   };
 }
-function nr(e) {
+function Dr(e) {
   return async (r, t) => {
     if (!r || typeof r != "string")
       return {
@@ -1140,8 +1692,8 @@ function nr(e) {
         error: "Email is required",
         errorCode: m.VALIDATION_ERROR
       };
-    const n = G(r);
-    if (!K(n))
+    const n = se(r);
+    if (!ie(n))
       return {
         success: !1,
         error: n.error ?? "Invalid email format",
@@ -1161,17 +1713,17 @@ function nr(e) {
       };
     try {
       const s = await e.actions.signIn.otp(n.sanitized, t);
-      if (D(s)) {
-        const o = await e.saveSessionAfterAuth(s);
-        !o.success && o.warning && I.warn("Session save warning", { warning: o.warning });
+      if (M(s)) {
+        const i = await e.saveSessionAfterAuth(s);
+        !i.success && i.warning && _.warn("Session save warning", { warning: i.warning });
       }
-      return s.success ? I.info("OTP sign in successful", {
+      return s.success ? _.info("OTP sign in successful", {
         email: n.sanitized.substring(0, 3) + "***"
-      }) : I.warn("OTP sign in failed", {
+      }) : _.warn("OTP sign in failed", {
         email: n.sanitized.substring(0, 3) + "***"
       }), s;
     } catch (s) {
-      return I.error("OTP sign in error", {
+      return _.error("OTP sign in error", {
         error: s instanceof Error ? s.message : "Unknown error",
         context: "signIn.otp"
       }), e.onError && await e.onError(
@@ -1185,15 +1737,15 @@ function nr(e) {
     }
   };
 }
-function sr(e) {
+function Fr(e) {
   return async (r) => {
     if (!e.actions.signIn.passkey)
       throw new Error("PassKey sign in is not configured. Provide passkey action in signIn.");
     try {
       const t = await e.actions.signIn.passkey(r);
-      if (D(t)) {
+      if (M(t)) {
         const n = await e.saveSessionAfterAuth(t);
-        !n.success && n.warning && I.warn("Session save warning", { warning: n.warning });
+        !n.success && n.warning && _.warn("Session save warning", { warning: n.warning });
       }
       return t;
     } catch (t) {
@@ -1207,38 +1759,38 @@ function sr(e) {
     }
   };
 }
-function or(e, r) {
-  const t = rr(e), n = tr(e, r), s = nr(e), o = sr(e);
-  return Object.assign(async (u, f) => {
-    if (!u || typeof u != "string")
+function Lr(e, r) {
+  const t = Nr(e), n = Ur(e, r), s = Dr(e), i = Fr(e);
+  return Object.assign(async (c, u) => {
+    if (!c || typeof c != "string")
       throw new Error("Provider is required");
-    const g = X(u, {
+    const h = oe(c, {
       maxLength: 50,
       allowHtml: !1,
       required: !0
     });
-    if (!g.valid || !g.sanitized)
+    if (!h.valid || !h.sanitized)
       throw new Error("Invalid provider");
-    const w = g.sanitized.toLowerCase();
-    if (w === "google" || w === "github" || w === "apple" || w === "facebook" || typeof w == "string" && !["credentials", "otp", "passkey"].includes(w))
-      return n(w);
-    if (w === "credentials")
-      return !f || !("email" in f) || !("password" in f) ? {
+    const f = h.sanitized.toLowerCase();
+    if (f === "google" || f === "github" || f === "apple" || f === "facebook" || typeof f == "string" && !["credentials", "otp", "passkey"].includes(f))
+      return n(f);
+    if (f === "credentials")
+      return !u || !("email" in u) || !("password" in u) ? {
         success: !1,
         error: "Credentials are required",
         errorCode: m.VALIDATION_ERROR
-      } : t(f);
-    if (w === "otp") {
-      if (!f || !("email" in f))
+      } : t(u);
+    if (f === "otp") {
+      if (!u || !("email" in u))
         return {
           success: !1,
           error: "Email is required",
           errorCode: m.VALIDATION_ERROR
         };
-      const R = f;
-      return s(R.email, R.code);
+      const y = u;
+      return s(y.email, y.code);
     }
-    return w === "passkey" ? o(f) : {
+    return f === "passkey" ? i(u) : {
       success: !1,
       error: "Invalid provider",
       errorCode: m.VALIDATION_ERROR
@@ -1246,19 +1798,19 @@ function or(e, r) {
   }, {
     email: t,
     oauth: e.actions.signIn.oauth ? n : void 0,
-    passkey: e.actions.signIn.passkey ? o : void 0,
+    passkey: e.actions.signIn.passkey ? i : void 0,
     otp: e.actions.signIn.otp ? s : void 0
   });
 }
-function ir(e) {
+function Vr(e) {
   return async (r) => {
     if (!e.actions.signUp)
       throw new Error("Sign up is not configured. Provide signUp action in config.");
     try {
       const t = await e.actions.signUp(r);
-      if (D(t)) {
+      if (M(t)) {
         const n = await e.saveSessionAfterAuth(t);
-        !n.success && n.warning && I.warn("Session save warning", { warning: n.warning });
+        !n.success && n.warning && _.warn("Session save warning", { warning: n.warning });
       }
       return t;
     } catch (t) {
@@ -1272,22 +1824,22 @@ function ir(e) {
     }
   };
 }
-function ar(e, r) {
+function Mr(e, r) {
   return async (t, n, s) => {
-    const o = e.oauthProviders[t];
-    if (!o)
+    const i = e.oauthProviders[t];
+    if (!i)
       return {
         success: !1,
         error: `OAuth provider "${t}" is not configured`,
         errorCode: m.VALIDATION_ERROR
       };
     try {
-      const i = o.redirectUri ?? `${e.baseUrl}/api/auth/callback/${t}`, a = await be(t, o, n, i), u = await Fe(t, a.access_token), f = {
-        id: u.id,
-        email: u.email,
-        name: u.name,
-        avatar: u.avatar,
-        emailVerified: u.emailVerified,
+      const o = i.redirectUri ?? `${e.baseUrl}/api/auth/callback/${t}`, a = await he(t, i, n, o), c = await ge(t, a.access_token), u = {
+        id: c.id,
+        email: c.email,
+        name: c.name,
+        avatar: c.avatar,
+        emailVerified: c.emailVerified,
         provider: t,
         accessToken: a.access_token,
         refreshToken: a.refresh_token,
@@ -1298,42 +1850,42 @@ function ar(e, r) {
           token_type: a.token_type,
           id_token: a.id_token
         },
-        rawProfile: u.rawProfile
+        rawProfile: c.rawProfile
       };
       if (e.callbacks.onOAuthUser) {
-        const g = await q(
+        const h = await Z(
           e.callbacks.onOAuthUser,
-          [f, t],
+          [u, t],
           e.onError
         );
-        if (!g)
+        if (!h)
           return {
             success: !1,
             error: "Failed to create or retrieve user",
             errorCode: m.VALIDATION_ERROR
           };
-        const w = e.createSession(g, f, a);
-        return await e.saveSession(w), e.callbacks.onSignIn && await q(
+        const f = e.createSession(h, u, a);
+        return await e.saveSession(f), e.callbacks.onSignIn && await Z(
           e.callbacks.onSignIn,
-          [w.user, w],
+          [f.user, f],
           e.onError
-        ), { success: !0, user: w.user, session: w };
+        ), { success: !0, user: f.user, session: f };
       }
       return {
         success: !1,
         error: "OAuth user callback not implemented. Provide onOAuthUser callback or implement oauthCallback action.",
         errorCode: m.VALIDATION_ERROR
       };
-    } catch (i) {
-      return I.error("OAuth callback failed", { provider: t, error: i }), {
+    } catch (o) {
+      return _.error("OAuth callback failed", { provider: t, error: o }), {
         success: !1,
-        error: i instanceof Error ? i.message : "OAuth callback failed",
+        error: o instanceof Error ? o.message : "OAuth callback failed",
         errorCode: m.NETWORK_ERROR
       };
     }
   };
 }
-async function q(e, r, t) {
+async function Z(e, r, t) {
   if (e)
     try {
       return await e(...r);
@@ -1344,198 +1896,198 @@ async function q(e, r, t) {
       ), n;
     }
 }
-function cr(e, r, t, n) {
+function jr(e, r, t, n) {
   if (Object.keys(e).length !== 0)
     return async (s) => {
-      const o = e[s];
-      if (!o)
+      const i = e[s];
+      if (!i)
         throw new Error(`OAuth provider "${s}" is not configured. Add it to providers.oauth in config.`);
-      if (!o.clientId)
+      if (!i.clientId)
         throw new Error(`OAuth provider "${s}" is missing clientId`);
-      const i = t();
-      return { url: n(s, o, r, i), state: i };
+      const o = t();
+      return { url: n(s, i, r, o), state: o };
     };
 }
-function st(e) {
-  var L, M;
+function zt(e) {
+  var j, z;
   const r = {
-    ...Ye(),
+    ...Cr(),
     ...e.session
-  }, t = e.actions, n = e.callbacks || {}, s = ((L = e.providers) == null ? void 0 : L.oauth) || {}, o = Ze(), i = {
-    ...Qe(),
+  }, t = e.actions, n = e.callbacks || {}, s = ((j = e.providers) == null ? void 0 : j.oauth) || {}, i = xr(), o = {
+    ...Ir(),
     ...e.tokenRefresh
-  }, a = ((M = e.session) == null ? void 0 : M.cacheTtl) ?? e.sessionCacheTtl ?? 5e3, u = e.oauthStateStore || Be(), f = { ...t }, g = async (c, l) => {
-    const d = {
-      provider: l,
+  }, a = ((z = e.session) == null ? void 0 : z.cacheTtl) ?? e.sessionCacheTtl ?? 5e3, c = e.oauthStateStore || vr(), u = { ...t }, h = async (l, d) => {
+    const g = {
+      provider: d,
       expiresAt: Date.now() + 6e5
       // 10 minutes
     };
-    await Promise.resolve(u.set(c, d, 10 * 60 * 1e3)), u.cleanup && await Promise.resolve(u.cleanup());
-  }, w = async (c, l) => {
-    let d = await Promise.resolve(u.get(c));
-    if (!d)
+    await Promise.resolve(c.set(l, g, 10 * 60 * 1e3)), c.cleanup && await Promise.resolve(c.cleanup());
+  }, f = async (l, d) => {
+    let g = await Promise.resolve(c.get(l));
+    if (!g)
       try {
-        const { getOAuthStateCookie: v } = await import("../oauth-state-DKle8eCr.mjs").then((P) => P.q), C = await v();
-        if (C && C.state === c && C.provider === l)
+        const { getOAuthStateCookie: R } = await import("../oauth-state-pdypStuS.mjs").then((C) => C.o), I = await R();
+        if (I && I.state === l && I.provider === d)
           return !0;
       } catch {
       }
-    return d ? d.expiresAt < Date.now() ? (await Promise.resolve(u.delete(c)), !1) : d.provider !== l ? !1 : (await Promise.resolve(u.delete(c)), !0) : !1;
-  }, R = cr(
+    return g ? g.expiresAt < Date.now() ? (await Promise.resolve(c.delete(l)), !1) : g.provider !== d ? !1 : (await Promise.resolve(c.delete(l)), !0) : !1;
+  }, y = jr(
     s,
-    o,
-    _e,
-    Ne
+    i,
+    ue,
+    de
   );
-  if (R && !f.signIn.oauth) {
-    const c = f.signIn;
-    f.signIn = {
-      ...c,
-      oauth: async (l) => {
-        const d = await R(l);
-        return await g(d.state, l), d;
+  if (y && !u.signIn.oauth) {
+    const l = u.signIn;
+    u.signIn = {
+      ...l,
+      oauth: async (d) => {
+        const g = await y(d);
+        return await h(g.state, d), g;
       }
     };
   }
-  if (!f.signIn || !f.signIn.email)
+  if (!u.signIn || !u.signIn.email)
     throw new Error("mulguard: signIn.email action is required");
-  const A = async (c, ...l) => {
-    if (c)
+  const E = async (l, ...d) => {
+    if (l)
       try {
-        return await c(...l);
-      } catch (d) {
-        throw n.onError && await n.onError(d instanceof Error ? d : new Error(String(d)), "callback"), d;
+        return await l(...d);
+      } catch (g) {
+        throw n.onError && await n.onError(g instanceof Error ? g : new Error(String(g)), "callback"), g;
       }
-  }, S = er({
+  }, v = Pr({
     sessionConfig: r,
     cacheTtl: a,
     getSessionAction: t.getSession,
     onSessionExpired: n.onSessionExpired,
     onError: n.onError
-  }), y = async (c) => {
-    if (!D(c) || !c.session)
+  }), p = async (l) => {
+    if (!M(l) || !l.session)
       return { success: !0 };
-    const l = await S.setSession(c.session);
-    return c.user && n.onSignIn && await A(n.onSignIn, c.user, c.session), l;
+    const d = await v.setSession(l.session);
+    return l.user && n.onSignIn && await E(n.onSignIn, l.user, l.session), d;
   };
-  if (Object.keys(s).length > 0 && !f.oauthCallback) {
-    const c = ar(
+  if (Object.keys(s).length > 0 && !u.oauthCallback) {
+    const l = Mr(
       {
         oauthProviders: s,
-        baseUrl: o,
+        baseUrl: i,
         callbacks: n,
-        createSession: (l, d, v) => ({
+        createSession: (d, g, R) => ({
           user: {
-            ...l,
-            avatar: d.avatar,
-            emailVerified: d.emailVerified
+            ...d,
+            avatar: g.avatar,
+            emailVerified: g.emailVerified
           },
           expiresAt: new Date(Date.now() + (r.expiresIn || 604800) * 1e3),
-          accessToken: v.access_token,
-          refreshToken: v.refresh_token,
+          accessToken: R.access_token,
+          refreshToken: R.refresh_token,
           tokenType: "Bearer",
-          expiresIn: v.expires_in
+          expiresIn: R.expires_in
         }),
-        saveSession: async (l) => {
-          await S.setSession(l);
+        saveSession: async (d) => {
+          await v.setSession(d);
         },
         onError: n.onError
       }
     );
-    f.oauthCallback = c;
+    u.oauthCallback = l;
   }
-  const h = or(
+  const w = Lr(
     {
-      actions: f,
+      actions: u,
       callbacks: n,
-      saveSessionAfterAuth: y,
+      saveSessionAfterAuth: p,
       onError: n.onError
     },
-    g
-  ), T = ir({
-    actions: f,
+    h
+  ), T = Vr({
+    actions: u,
     callbacks: n,
-    saveSessionAfterAuth: y,
+    saveSessionAfterAuth: p,
     onError: n.onError
-  }), _ = {
+  }), b = {
     /**
      * Get current session
      * Uses custom getSession action if provided, otherwise falls back to reading from cookie
      */
     async getSession() {
-      return await S.getSession();
+      return await v.getSession();
     },
     /**
      * Get access token from current session
      */
     async getAccessToken() {
-      return await S.getAccessToken();
+      return await v.getAccessToken();
     },
     /**
      * Get refresh token from current session
      */
     async getRefreshToken() {
-      return await S.getRefreshToken();
+      return await v.getRefreshToken();
     },
     /**
      * Check if session has valid tokens
      */
     async hasValidTokens() {
-      return await S.hasValidTokens();
+      return await v.hasValidTokens();
     },
     /**
      * Unified sign in method - supports both unified and direct method calls
      */
-    signIn: h,
+    signIn: w,
     /**
      * Sign up new user
      */
-    async signUp(c) {
+    async signUp(l) {
       if (!T)
         throw new Error("Sign up is not configured. Provide signUp action in config.");
-      return await T(c);
+      return await T(l);
     },
     /**
      * Sign out
      */
     async signOut() {
       try {
-        const c = await this.getSession(), l = c == null ? void 0 : c.user;
-        return t.signOut && await t.signOut(), await S.clearSessionCookie(), S.clearCache(), l && n.onSignOut && await A(n.onSignOut, l), { success: !0 };
-      } catch (c) {
-        return await S.clearSessionCookie(), S.clearCache(), n.onError && await A(n.onError, c instanceof Error ? c : new Error(String(c)), "signOut"), {
+        const l = await this.getSession(), d = l == null ? void 0 : l.user;
+        return t.signOut && await t.signOut(), await v.clearSessionCookie(), v.clearCache(), d && n.onSignOut && await E(n.onSignOut, d), { success: !0 };
+      } catch (l) {
+        return await v.clearSessionCookie(), v.clearCache(), n.onError && await E(n.onError, l instanceof Error ? l : new Error(String(l)), "signOut"), {
           success: !1,
-          error: c instanceof Error ? c.message : "Sign out failed"
+          error: l instanceof Error ? l.message : "Sign out failed"
         };
       }
     },
     /**
      * Request password reset
      */
-    async resetPassword(c) {
+    async resetPassword(l) {
       if (!t.resetPassword)
         throw new Error("Password reset is not configured. Provide resetPassword action in config.");
       try {
-        return await t.resetPassword(c);
-      } catch (l) {
-        return n.onError && await A(n.onError, l instanceof Error ? l : new Error(String(l)), "resetPassword"), {
+        return await t.resetPassword(l);
+      } catch (d) {
+        return n.onError && await E(n.onError, d instanceof Error ? d : new Error(String(d)), "resetPassword"), {
           success: !1,
-          error: l instanceof Error ? l.message : "Password reset failed"
+          error: d instanceof Error ? d.message : "Password reset failed"
         };
       }
     },
     /**
      * Verify email address
      */
-    async verifyEmail(c) {
+    async verifyEmail(l) {
       if (!t.verifyEmail)
         throw new Error("Email verification is not configured. Provide verifyEmail action in config.");
       try {
-        return await t.verifyEmail(c);
-      } catch (l) {
-        return n.onError && await A(n.onError, l instanceof Error ? l : new Error(String(l)), "verifyEmail"), {
+        return await t.verifyEmail(l);
+      } catch (d) {
+        return n.onError && await E(n.onError, d instanceof Error ? d : new Error(String(d)), "verifyEmail"), {
           success: !1,
-          error: l instanceof Error ? l.message : "Email verification failed"
+          error: d instanceof Error ? d.message : "Email verification failed"
         };
       }
     },
@@ -1547,50 +2099,50 @@ function st(e) {
       if (!t.refreshSession)
         return this.getSession();
       try {
-        const c = await t.refreshSession();
-        if (c && U(c)) {
-          if (await S.setSession(c), n.onSessionUpdate) {
-            const l = await A(n.onSessionUpdate, c);
-            if (l && U(l)) {
-              if (await S.setSession(l), n.onTokenRefresh) {
-                const d = await this.getSession();
-                d && await A(n.onTokenRefresh, d, l);
+        const l = await t.refreshSession();
+        if (l && F(l)) {
+          if (await v.setSession(l), n.onSessionUpdate) {
+            const d = await E(n.onSessionUpdate, l);
+            if (d && F(d)) {
+              if (await v.setSession(d), n.onTokenRefresh) {
+                const g = await this.getSession();
+                g && await E(n.onTokenRefresh, g, d);
               }
-              return l;
+              return d;
             }
           }
           if (n.onTokenRefresh) {
-            const l = await this.getSession();
-            l && await A(n.onTokenRefresh, l, c);
+            const d = await this.getSession();
+            d && await E(n.onTokenRefresh, d, l);
           }
-          return c;
-        } else if (c && !U(c))
-          return await S.clearSessionCookie(), S.clearCache(), null;
+          return l;
+        } else if (l && !F(l))
+          return await v.clearSessionCookie(), v.clearCache(), null;
         return null;
-      } catch (c) {
-        return await S.clearSessionCookie(), S.clearCache(), n.onError && await A(n.onError, c instanceof Error ? c : new Error(String(c)), "refreshSession"), null;
+      } catch (l) {
+        return await v.clearSessionCookie(), v.clearCache(), n.onError && await E(n.onError, l instanceof Error ? l : new Error(String(l)), "refreshSession"), null;
       }
     },
     /**
      * OAuth callback handler
      * ✅ Auto-generated if providers.oauth is configured in config
      */
-    async oauthCallback(c, l, d) {
-      if (!f.oauthCallback)
+    async oauthCallback(l, d, g) {
+      if (!u.oauthCallback)
         throw new Error(
           "OAuth callback is not configured. Either provide oauthCallback action, or configure providers.oauth in config."
         );
-      if (!l || !d)
+      if (!d || !g)
         return {
           success: !1,
           error: "Missing required OAuth parameters (code or state)",
           errorCode: m.VALIDATION_ERROR
         };
-      let v = c;
-      if (!v) {
-        const P = await Promise.resolve(u.get(d));
-        if (P && P.provider)
-          v = P.provider;
+      let R = l;
+      if (!R) {
+        const C = await Promise.resolve(c.get(g));
+        if (C && C.provider)
+          R = C.provider;
         else
           return {
             success: !1,
@@ -1598,18 +2150,18 @@ function st(e) {
             errorCode: m.VALIDATION_ERROR
           };
       }
-      if (!await w(d, v))
+      if (!await f(g, R))
         return {
           success: !1,
           error: "Invalid or expired state parameter",
           errorCode: m.VALIDATION_ERROR
         };
       try {
-        return await f.oauthCallback(v, l, d);
-      } catch (P) {
-        return n.onError && await A(n.onError, P instanceof Error ? P : new Error(String(P)), "oauthCallback"), {
+        return await u.oauthCallback(R, d, g);
+      } catch (C) {
+        return n.onError && await E(n.onError, C instanceof Error ? C : new Error(String(C)), "oauthCallback"), {
           success: !1,
-          error: P instanceof Error ? P.message : "OAuth callback failed",
+          error: C instanceof Error ? C.message : "OAuth callback failed",
           errorCode: m.NETWORK_ERROR
         };
       }
@@ -1618,27 +2170,27 @@ function st(e) {
      * Verify 2FA code after initial sign in
      * Used when signIn returns requires2FA: true
      */
-    async verify2FA(c, l) {
+    async verify2FA(l, d) {
       if (!t.verify2FA)
         throw new Error("2FA verification is not configured. Provide verify2FA action in config.");
       try {
-        const d = await t.verify2FA(c);
-        if (d.success && d.session && !(l != null && l.skipCookieSave)) {
-          const v = await y(d);
-          v.success || (process.env.NODE_ENV === "development" && I.debug("Failed to save session cookie after verify2FA", {
-            error: v.error,
-            warning: v.warning
-          }), n.onError && await A(
+        const g = await t.verify2FA(l);
+        if (g.success && g.session && !(d != null && d.skipCookieSave)) {
+          const R = await p(g);
+          R.success || (process.env.NODE_ENV === "development" && _.debug("Failed to save session cookie after verify2FA", {
+            error: R.error,
+            warning: R.warning
+          }), n.onError && await E(
             n.onError,
-            new Error(v.warning || v.error || "Failed to save session cookie"),
+            new Error(R.warning || R.error || "Failed to save session cookie"),
             "verify2FA.setSession"
           ));
         }
-        return d;
-      } catch (d) {
-        return n.onError && await A(n.onError, d instanceof Error ? d : new Error(String(d)), "verify2FA"), {
+        return g;
+      } catch (g) {
+        return n.onError && await E(n.onError, g instanceof Error ? g : new Error(String(g)), "verify2FA"), {
           success: !1,
-          error: d instanceof Error ? d.message : "2FA verification failed",
+          error: g instanceof Error ? g.message : "2FA verification failed",
           errorCode: m.TWO_FA_REQUIRED
         };
       }
@@ -1647,8 +2199,8 @@ function st(e) {
      * Set session directly
      * Useful for Server Actions that need to save session manually
      */
-    async setSession(c) {
-      return await S.setSession(c);
+    async setSession(l) {
+      return await v.setSession(l);
     },
     /**
      * Internal method to get session config for Server Actions
@@ -1656,7 +2208,7 @@ function st(e) {
      * @internal
      */
     _getSessionConfig() {
-      return S.getSessionConfig();
+      return v.getSessionConfig();
     },
     _getCallbacks() {
       return n;
@@ -1668,31 +2220,31 @@ function st(e) {
      * @param state - OAuth state token
      * @param provider - OAuth provider name
      */
-    async storeOAuthState(c, l) {
-      await g(c, l);
+    async storeOAuthState(l, d) {
+      await h(l, d);
     },
     /**
      * PassKey methods
      */
     passkey: t.passkey ? {
       register: t.passkey.register,
-      authenticate: async (c) => {
-        var l;
-        if (!((l = t.passkey) != null && l.authenticate))
+      authenticate: async (l) => {
+        var d;
+        if (!((d = t.passkey) != null && d.authenticate))
           throw new Error("PassKey authenticate is not configured.");
         try {
-          const d = await t.passkey.authenticate(c);
-          return d.success && d.session && await y(d), d;
-        } catch (d) {
-          return n.onError && await A(n.onError, d instanceof Error ? d : new Error(String(d)), "passkey.authenticate"), {
+          const g = await t.passkey.authenticate(l);
+          return g.success && g.session && await p(g), g;
+        } catch (g) {
+          return n.onError && await E(n.onError, g instanceof Error ? g : new Error(String(g)), "passkey.authenticate"), {
             success: !1,
-            error: d instanceof Error ? d.message : "PassKey authentication failed"
+            error: g instanceof Error ? g.message : "PassKey authentication failed"
           };
         }
       },
       list: t.passkey.list ? async () => {
-        var l;
-        if (!((l = t.passkey) != null && l.list))
+        var d;
+        if (!((d = t.passkey) != null && d.list))
           throw new Error("PassKey list is not configured.");
         return [...await t.passkey.list()];
       } : void 0,
@@ -1707,29 +2259,29 @@ function st(e) {
       disable: t.twoFactor.disable,
       generateBackupCodes: t.twoFactor.generateBackupCodes,
       isEnabled: t.twoFactor.isEnabled,
-      verify2FA: async (c) => {
-        var d;
-        const l = ((d = t.twoFactor) == null ? void 0 : d.verify2FA) || t.verify2FA;
-        if (!l)
+      verify2FA: async (l) => {
+        var g;
+        const d = ((g = t.twoFactor) == null ? void 0 : g.verify2FA) || t.verify2FA;
+        if (!d)
           throw new Error("2FA verification is not configured. Provide verify2FA action in config.");
         try {
-          const v = await l(c);
-          if (v.success && v.session) {
-            const C = await y(v);
-            C.success || (process.env.NODE_ENV === "development" && I.debug("Failed to save session cookie after twoFactor.verify2FA", {
-              error: C.error,
-              warning: C.warning
-            }), n.onError && await A(
+          const R = await d(l);
+          if (R.success && R.session) {
+            const I = await p(R);
+            I.success || (process.env.NODE_ENV === "development" && _.debug("Failed to save session cookie after twoFactor.verify2FA", {
+              error: I.error,
+              warning: I.warning
+            }), n.onError && await E(
               n.onError,
-              new Error(C.warning || C.error || "Failed to save session cookie"),
+              new Error(I.warning || I.error || "Failed to save session cookie"),
               "twoFactor.verify2FA.setSession"
             ));
           }
-          return v;
-        } catch (v) {
-          return n.onError && await A(n.onError, v instanceof Error ? v : new Error(String(v)), "twoFactor.verify2FA"), {
+          return R;
+        } catch (R) {
+          return n.onError && await E(n.onError, R instanceof Error ? R : new Error(String(R)), "twoFactor.verify2FA"), {
             success: !1,
-            error: v instanceof Error ? v.message : "2FA verification failed",
+            error: R instanceof Error ? R.message : "2FA verification failed",
             errorCode: m.UNKNOWN_ERROR
           };
         }
@@ -1739,159 +2291,165 @@ function st(e) {
      * Sign in methods - alias for signIn (for backward compatibility)
      */
     signInMethods: {
-      email: (c) => h.email(c),
-      oauth: (c) => {
-        var l;
-        return ((l = h.oauth) == null ? void 0 : l.call(h, c)) || Promise.reject(new Error("OAuth not configured"));
-      },
-      passkey: (c) => {
-        var l;
-        return ((l = h.passkey) == null ? void 0 : l.call(h, c)) || Promise.reject(new Error("Passkey not configured"));
+      email: (l) => w.email(l),
+      oauth: (l) => {
+        var d;
+        return ((d = w.oauth) == null ? void 0 : d.call(w, l)) || Promise.reject(new Error("OAuth not configured"));
       },
-      otp: (c, l) => {
+      passkey: (l) => {
         var d;
-        return ((d = h.otp) == null ? void 0 : d.call(h, c, l)) || Promise.reject(new Error("OTP not configured"));
+        return ((d = w.passkey) == null ? void 0 : d.call(w, l)) || Promise.reject(new Error("Passkey not configured"));
+      },
+      otp: (l, d) => {
+        var g;
+        return ((g = w.otp) == null ? void 0 : g.call(w, l, d)) || Promise.reject(new Error("OTP not configured"));
       }
     }
   };
   if (t.refreshSession) {
-    const c = Je(
-      async () => await _.refreshSession(),
-      async () => await _.signOut(),
+    const l = br(
+      async () => await b.refreshSession(),
+      async () => await b.signOut(),
       async () => {
-        await S.clearSessionCookie(), S.clearCache();
+        await v.clearSessionCookie(), v.clearCache();
       },
       {
-        ...i,
-        onTokenRefreshed: i.onTokenRefreshed,
-        onTokenRefreshFailed: i.onTokenRefreshFailed,
-        onBeforeRedirect: i.onBeforeRedirect
+        ...o,
+        onTokenRefreshed: o.onTokenRefreshed,
+        onTokenRefreshFailed: o.onTokenRefreshFailed,
+        onBeforeRedirect: o.onBeforeRedirect
       }
     );
-    _._tokenRefreshManager = c, _._getTokenRefreshManager = () => c;
+    b._tokenRefreshManager = l, b._getTokenRefreshManager = () => l;
   }
-  return _;
+  return b;
 }
-function ot(e) {
+function W(e) {
+  if (!e)
+    return e;
+  const { accessToken: r, refreshToken: t, ...n } = e;
+  return n;
+}
+function Bt(e) {
   return {
-    GET: async (r) => B(r, e, "GET"),
-    POST: async (r) => B(r, e, "POST")
+    GET: async (r) => ee(r, e, "GET"),
+    POST: async (r) => ee(r, e, "POST")
   };
 }
-async function B(e, r, t) {
-  const n = new URL(e.url), s = ur(n.pathname), o = s.split("/").filter(Boolean);
+async function ee(e, r, t) {
+  const n = new URL(e.url), s = zr(n.pathname), i = s.split("/").filter(Boolean);
   try {
-    return t === "GET" ? await lr(e, r, s, o, n) : t === "POST" ? await fr(e, r, s, o, n) : O("Method not allowed", 405);
-  } catch (i) {
+    return t === "GET" ? await Br(e, r, s, i, n) : t === "POST" ? await $r(e, r, s, i, n) : O("Method not allowed", 405);
+  } catch (o) {
     return O(
-      i instanceof Error ? i.message : "Request failed",
+      o instanceof Error ? o.message : "Request failed",
       500
     );
   }
 }
-function ur(e) {
+function zr(e) {
   return e.replace(/^\/api\/auth/, "") || "/session";
 }
-async function lr(e, r, t, n, s) {
+async function Br(e, r, t, n, s) {
   if (t === "/session" || t === "/") {
-    const o = await r.getSession();
-    return E.json({ session: o });
+    const i = await r.getSession(), o = W(i);
+    return A.json({ session: o });
   }
-  return t === "/providers" ? E.json({
+  return t === "/providers" ? A.json({
     providers: {
       email: !!r.signIn.email,
       oauth: !!r.signIn.oauth,
       passkey: !!r.signIn.passkey
     }
-  }) : re(t, n) ? await te(e, r, t, n, s, "GET") : O("Not found", 404);
+  }) : ye(t, n) ? await ke(e, r, t, n, s, "GET") : O("Not found", 404);
 }
-async function fr(e, r, t, n, s) {
-  const o = await dr(e);
-  return t === "/sign-in" || n[0] === "sign-in" ? await gr(r, o) : t === "/sign-up" || n[0] === "sign-up" ? await wr(r, o) : t === "/sign-out" || n[0] === "sign-out" ? await pr(r) : t === "/reset-password" || n[0] === "reset-password" ? await mr(r, o) : t === "/verify-email" || n[0] === "verify-email" ? await Er(r, o) : t === "/refresh" || n[0] === "refresh" ? await yr(r) : re(t, n) ? await te(e, r, t, n, s, "POST", o) : t.startsWith("/passkey") ? await vr(r, t, n, o) : t === "/verify-2fa" || n[0] === "verify-2fa" ? await kr(r, o) : t.startsWith("/two-factor") ? await Sr(r, n, o) : O("Not found", 404);
+async function $r(e, r, t, n, s) {
+  const i = await Hr(e);
+  return t === "/sign-in" || n[0] === "sign-in" ? await Wr(r, i) : t === "/sign-up" || n[0] === "sign-up" ? await Gr(r, i) : t === "/sign-out" || n[0] === "sign-out" ? await Kr(r) : t === "/reset-password" || n[0] === "reset-password" ? await Xr(r, i) : t === "/verify-email" || n[0] === "verify-email" ? await Jr(r, i) : t === "/refresh" || n[0] === "refresh" ? await Yr(r) : ye(t, n) ? await ke(e, r, t, n, s, "POST", i) : t.startsWith("/passkey") ? await Zr(r, t, n, i) : t === "/verify-2fa" || n[0] === "verify-2fa" ? await Qr(r, i) : t.startsWith("/two-factor") ? await et(r, n, i) : O("Not found", 404);
 }
-async function dr(e) {
+async function Hr(e) {
   try {
     return await e.json();
   } catch {
     return {};
   }
 }
-function re(e, r) {
+function ye(e, r) {
   return e === "/callback" || e.startsWith("/oauth/callback") || r[0] === "oauth" && r[1] === "callback" || r[0] === "callback";
 }
-async function te(e, r, t, n, s, o, i) {
+async function ke(e, r, t, n, s, i, o) {
   if (!r.oauthCallback)
-    return o === "GET" ? V(e.url, "oauth_not_configured") : O("OAuth callback is not configured", 400);
-  const a = hr(n, s, i), u = (i == null ? void 0 : i.code) ?? s.searchParams.get("code"), f = (i == null ? void 0 : i.state) ?? s.searchParams.get("state");
-  if (!u || !f)
-    return o === "GET" ? V(e.url, "oauth_missing_params") : O("Missing required OAuth parameters. Code and state are required.", 400);
+    return i === "GET" ? B(e.url, "oauth_not_configured") : O("OAuth callback is not configured", 400);
+  const a = qr(n, s, o), c = (o == null ? void 0 : o.code) ?? s.searchParams.get("code"), u = (o == null ? void 0 : o.state) ?? s.searchParams.get("state");
+  if (!c || !u)
+    return i === "GET" ? B(e.url, "oauth_missing_params") : O("Missing required OAuth parameters. Code and state are required.", 400);
   try {
-    const g = await r.oauthCallback(a ?? "", u, f);
-    return o === "GET" ? g.success ? Ar(e.url, s.searchParams.get("callbackUrl")) : V(e.url, g.error ?? "oauth_failed") : E.json(g);
-  } catch (g) {
-    return o === "GET" ? V(e.url, g instanceof Error ? g.message : "oauth_error") : O(g instanceof Error ? g.message : "OAuth callback failed", 500);
+    const h = await r.oauthCallback(a ?? "", c, u);
+    return i === "GET" ? h.success ? tt(e.url, s.searchParams.get("callbackUrl")) : B(e.url, h.error ?? "oauth_failed") : A.json(h);
+  } catch (h) {
+    return i === "GET" ? B(e.url, h instanceof Error ? h.message : "oauth_error") : O(h instanceof Error ? h.message : "OAuth callback failed", 500);
   }
 }
-function hr(e, r, t) {
+function qr(e, r, t) {
   return t != null && t.provider ? t.provider : e[0] === "callback" && e[1] ? e[1] : e[0] === "oauth" && e[1] === "callback" && e[2] ? e[2] : r.searchParams.get("provider");
 }
-async function gr(e, r) {
+async function Wr(e, r) {
   if (r.provider === "email" && r.email && r.password) {
     const t = {
       email: r.email,
       password: r.password
     }, n = await e.signIn.email(t);
-    return E.json(n);
+    return A.json(n);
   }
   if (r.provider === "oauth" && r.providerName) {
     if (!e.signIn.oauth)
       return O("OAuth is not configured", 400);
     const t = await e.signIn.oauth(r.providerName);
-    return E.json(t);
+    return A.json(t);
   }
   if (r.provider === "passkey") {
     if (!e.signIn.passkey)
       return O("PassKey is not configured", 400);
     const t = await e.signIn.passkey(r.options);
-    return E.json(t);
+    return A.json(t);
   }
   return O("Invalid sign in request", 400);
 }
-async function wr(e, r) {
+async function Gr(e, r) {
   if (!e.signUp)
     return O("Sign up is not configured", 400);
   const t = await e.signUp(r);
-  return E.json(t);
+  return A.json(t);
 }
-async function pr(e) {
+async function Kr(e) {
   const r = await e.signOut();
-  return E.json(r);
+  return A.json(r);
 }
-async function mr(e, r) {
+async function Xr(e, r) {
   if (!e.resetPassword)
     return O("Password reset is not configured", 400);
   if (!r.email || typeof r.email != "string")
     return O("Email is required", 400);
   const t = await e.resetPassword(r.email);
-  return E.json(t);
+  return A.json(t);
 }
-async function Er(e, r) {
+async function Jr(e, r) {
   if (!e.verifyEmail)
     return O("Email verification is not configured", 400);
   if (!r.token || typeof r.token != "string")
     return O("Token is required", 400);
   const t = await e.verifyEmail(r.token);
-  return E.json(t);
+  return A.json(t);
 }
-async function yr(e) {
+async function Yr(e) {
   if (!e.refreshSession) {
-    const t = await e.getSession();
-    return E.json({ session: t });
+    const n = await e.getSession(), s = W(n);
+    return A.json({ session: s });
   }
-  const r = await e.refreshSession();
-  return E.json({ session: r });
+  const r = await e.refreshSession(), t = W(r);
+  return A.json({ session: t });
 }
-async function kr(e, r) {
+async function Qr(e, r) {
   if (!e.verify2FA)
     return O("2FA verification is not configured", 400);
   if (!r.email || !r.userId || !r.code)
@@ -1901,58 +2459,58 @@ async function kr(e, r) {
     userId: r.userId,
     code: r.code
   }, n = await e.verify2FA(t);
-  return E.json(n);
+  return A.json(n);
 }
-async function vr(e, r, t, n) {
+async function Zr(e, r, t, n) {
   if (!e.passkey)
     return O("PassKey is not configured", 400);
   const s = t[1];
   if (s === "register" && e.passkey.register) {
-    const o = await e.passkey.register(n.options);
-    return E.json(o);
+    const i = await e.passkey.register(n.options);
+    return A.json(i);
   }
   if (s === "list" && e.passkey.list) {
-    const o = await e.passkey.list();
-    return E.json(o);
+    const i = await e.passkey.list();
+    return A.json(i);
   }
   if (s === "remove" && e.passkey.remove) {
     if (!n.passkeyId || typeof n.passkeyId != "string")
       return O("Passkey ID is required", 400);
-    const o = await e.passkey.remove(n.passkeyId);
-    return E.json(o);
+    const i = await e.passkey.remove(n.passkeyId);
+    return A.json(i);
   }
   return O("Invalid Passkey request", 400);
 }
-async function Sr(e, r, t) {
+async function et(e, r, t) {
   if (!e.twoFactor)
     return O("Two-Factor Authentication is not configured", 400);
   const n = r[1];
   if (n === "enable" && e.twoFactor.enable) {
     const s = await e.twoFactor.enable();
-    return E.json(s);
+    return A.json(s);
   }
   if (n === "verify" && e.twoFactor.verify) {
     if (!t.code || typeof t.code != "string")
       return O("Code is required", 400);
     const s = await e.twoFactor.verify(t.code);
-    return E.json(s);
+    return A.json(s);
   }
   if (n === "disable" && e.twoFactor.disable) {
     const s = await e.twoFactor.disable();
-    return E.json(s);
+    return A.json(s);
   }
   if (n === "backup-codes" && e.twoFactor.generateBackupCodes) {
     const s = await e.twoFactor.generateBackupCodes();
-    return E.json(s);
+    return A.json(s);
   }
   if (n === "is-enabled" && e.twoFactor.isEnabled) {
     const s = await e.twoFactor.isEnabled();
-    return E.json({ enabled: s });
+    return A.json({ enabled: s });
   }
   return O("Invalid two-factor request", 400);
 }
 function O(e, r) {
-  return E.json(
+  return A.json(
     {
       success: !1,
       error: e
@@ -1960,85 +2518,63 @@ function O(e, r) {
     { status: r }
   );
 }
-function V(e, r) {
-  return E.redirect(new URL(`/login?error=${encodeURIComponent(r)}`, e));
+function B(e, r) {
+  return A.redirect(new URL(`/login?error=${encodeURIComponent(r)}`, e));
 }
-function Ar(e, r) {
-  const t = r ?? "/";
-  return E.redirect(new URL(t, e));
+function rt(e, r) {
+  if (!e)
+    return null;
+  try {
+    const t = new URL(e, r), n = new URL(r);
+    return t.protocol !== n.protocol || t.hostname !== n.hostname || t.port !== n.port ? (process.env.NODE_ENV === "development" && console.warn("[Mulguard] Blocked redirect to external URL:", e), null) : t.protocol === "javascript:" || t.protocol === "data:" ? (process.env.NODE_ENV === "development" && console.warn("[Mulguard] Blocked dangerous redirect URL:", e), null) : t.pathname + t.search + t.hash;
+  } catch {
+    return null;
+  }
 }
-function it(e) {
+function tt(e, r) {
+  const n = rt(r, e) ?? "/";
+  return A.redirect(new URL(n, e));
+}
+function $t(e) {
   return async (r) => {
-    const { method: t, nextUrl: n } = r, o = n.pathname.replace(/^\/api\/auth/, "") || "/";
+    const { method: t, nextUrl: n } = r, i = n.pathname.replace(/^\/api\/auth/, "") || "/";
     try {
-      let i;
+      let o;
       if (t !== "GET" && t !== "HEAD")
         try {
-          i = await r.json();
+          o = await r.json();
         } catch {
         }
-      const a = Object.fromEntries(n.searchParams.entries()), u = await fetch(
-        `${process.env.NEXT_PUBLIC_API_URL || ""}/api/auth${o}${Object.keys(a).length > 0 ? `?${new URLSearchParams(a).toString()}` : ""}`,
+      const a = Object.fromEntries(n.searchParams.entries()), c = await fetch(
+        `${process.env.NEXT_PUBLIC_API_URL || ""}/api/auth${i}${Object.keys(a).length > 0 ? `?${new URLSearchParams(a).toString()}` : ""}`,
         {
           method: t,
           headers: {
             "Content-Type": "application/json",
             ...Object.fromEntries(r.headers.entries())
           },
-          body: i ? JSON.stringify(i) : void 0
+          body: o ? JSON.stringify(o) : void 0
         }
-      ), f = await u.json();
-      return E.json(f, {
-        status: u.status,
+      ), u = await c.json();
+      return A.json(u, {
+        status: c.status,
         headers: {
-          ...Object.fromEntries(u.headers.entries())
+          ...Object.fromEntries(c.headers.entries())
         }
       });
-    } catch (i) {
-      return console.error("API handler error:", i), E.json(
+    } catch (o) {
+      return console.error("API handler error:", o), A.json(
         {
           success: !1,
-          error: i instanceof Error ? i.message : "Internal server error"
+          error: o instanceof Error ? o.message : "Internal server error"
         },
         { status: 500 }
       );
     }
   };
 }
-function at(e) {
-  return async (r) => {
-    const { searchParams: t } = r.nextUrl, n = t.get("provider"), s = t.get("code"), o = t.get("state");
-    if (!n || !s || !o)
-      return E.redirect(
-        new URL("/login?error=oauth_missing_params", r.url)
-      );
-    try {
-      if (!e.oauthCallback)
-        return E.redirect(
-          new URL("/login?error=oauth_not_configured", r.url)
-        );
-      const i = await e.oauthCallback(n, s, o);
-      if (i.success) {
-        const a = t.get("callbackUrl") || "/";
-        return E.redirect(new URL(a, r.url));
-      } else {
-        const a = i.errorCode ? `${encodeURIComponent(i.error || "oauth_failed")}&code=${i.errorCode}` : encodeURIComponent(i.error || "oauth_failed");
-        return E.redirect(
-          new URL(`/login?error=${a}`, r.url)
-        );
-      }
-    } catch (i) {
-      return process.env.NODE_ENV === "development" && console.error("[Mulguard] OAuth callback error:", i), E.redirect(
-        new URL(
-          `/login?error=${encodeURIComponent(i instanceof Error ? i.message : "oauth_error")}`,
-          r.url
-        )
-      );
-    }
-  };
-}
-function F(e, r) {
-  const t = H({
+function $(e, r) {
+  const t = ne({
     // Customize headers if needed
     "X-Frame-Options": "SAMEORIGIN"
     // Allow same-origin framing
@@ -2047,183 +2583,154 @@ function F(e, r) {
     s && typeof s == "string" && r.headers.set(n, s);
   return r;
 }
-function ct() {
-  return async (e) => {
-    const r = E.next();
-    return F(e, r);
-  };
-}
-function ut(e, r = {}) {
-  const {
-    protectedRoutes: t = [],
-    publicRoutes: n = [],
-    redirectTo: s = "/login",
-    redirectIfAuthenticated: o
-  } = r;
-  return async (i) => {
-    const { pathname: a } = i.nextUrl, u = t.some((w) => a.startsWith(w));
-    let f = null;
-    try {
-      f = await e.getSession();
-    } catch (w) {
-      console.error("Middleware: Failed to get session:", w);
-    }
-    if (u && !f) {
-      const w = i.nextUrl.clone();
-      return w.pathname = s, w.searchParams.set("callbackUrl", a), E.redirect(w);
-    }
-    if (o && f && (a.startsWith("/login") || a.startsWith("/register"))) {
-      const R = i.nextUrl.clone();
-      R.pathname = o;
-      const A = E.redirect(R);
-      return F(i, A);
-    }
-    const g = E.next();
-    return F(i, g);
-  };
-}
-async function lt(e, r) {
-  var t;
-  try {
-    const n = await e.getSession();
-    return n ? ((t = n.user.roles) == null ? void 0 : t.includes(r)) ?? !1 : !1;
-  } catch {
-    return !1;
-  }
-}
-function ft(e) {
+function nt(e) {
   const {
     auth: r,
     protectedRoutes: t = [],
-    publicRoutes: n = [],
-    redirectTo: s = "/login",
-    redirectIfAuthenticated: o,
-    apiPrefix: i = "/api/auth"
+    // publicRoutes is reserved for future use
+    redirectTo: n = "/login",
+    redirectIfAuthenticated: s,
+    apiPrefix: i = "/api/auth",
+    enableSecurityHeaders: o = !0
   } = e;
   return async (a) => {
-    const { pathname: u } = a.nextUrl;
-    if (u.startsWith(i)) {
-      const R = E.next();
-      return F(a, R);
+    const { pathname: c } = a.nextUrl;
+    if (c.startsWith(i)) {
+      const y = A.next();
+      return o ? $(a, y) : y;
     }
-    const f = t.some((R) => u.startsWith(R));
-    let g = null;
-    if (f || o)
+    if (c.startsWith("/_next/") || c.startsWith("/api/") || c.match(/\.(ico|png|jpg|jpeg|svg|gif|webp|css|js|woff|woff2|ttf|eot)$/))
+      return A.next();
+    const u = t.length > 0 ? t.some((y) => c.startsWith(y)) : !1;
+    let h = null;
+    if (u || s)
       try {
-        g = await r.getSession();
-      } catch (R) {
-        console.error("Middleware: Failed to get session:", R);
+        h = await r.getSession();
+      } catch (y) {
+        process.env.NODE_ENV === "development" && console.error("Proxy: Failed to get session:", y);
       }
-    if (f && !g) {
-      const R = a.nextUrl.clone();
-      R.pathname = s, R.searchParams.set("callbackUrl", u);
-      const A = E.redirect(R);
-      return F(a, A);
+    if (u && !h) {
+      const y = a.nextUrl.clone();
+      y.pathname = n, y.searchParams.set("callbackUrl", c);
+      const E = A.redirect(y);
+      return o ? $(a, E) : E;
     }
-    if (o && g && (u.startsWith("/login") || u.startsWith("/register"))) {
-      const A = a.nextUrl.clone();
-      A.pathname = o;
-      const S = E.redirect(A);
-      return F(a, S);
+    if (s && h && (c.startsWith("/login") || c.startsWith("/register") || c.startsWith("/signup") || c.startsWith("/sign-in"))) {
+      const E = a.nextUrl.clone();
+      E.pathname = s;
+      const v = A.redirect(E);
+      return o ? $(a, v) : v;
     }
-    const w = E.next();
-    return F(a, w);
+    const f = A.next();
+    return o ? $(a, f) : f;
   };
 }
-async function dt(e, r) {
-  var t;
+async function st(e, r) {
   try {
-    const n = await e.getSession();
-    return n ? ((t = n.user.roles) == null ? void 0 : t.includes(r)) ?? !1 : !1;
+    const t = await e.getSession();
+    return t ? (t.user.roles || []).includes(r) : !1;
   } catch {
     return !1;
   }
 }
+function Ht(e, r) {
+  const t = nt(e);
+  return async (n) => {
+    var o;
+    const { pathname: s } = n.nextUrl;
+    return ((o = e.protectedRoutes) == null ? void 0 : o.some(
+      (a) => s.startsWith(a)
+    )) && !await st(e.auth, r) ? A.json({ error: "Forbidden" }, { status: 403 }) : t(n);
+  };
+}
 export {
-  Te as CSRFProtection,
-  fe as DEFAULT_SECURITY_HEADERS,
-  Oe as MemoryCSRFStore,
-  qe as MemoryOAuthStateStore,
-  le as RateLimiter,
-  Pr as applySecurityHeaders,
-  ie as buildCookieOptions,
-  Ne as buildOAuthAuthorizationUrl,
-  lt as checkRole,
-  dt as checkRoleProxy,
-  $r as containsXSSPattern,
-  it as createApiHandler,
-  ut as createAuthMiddleware,
-  Vr as createCSRFProtection,
-  We as createCookieOAuthStateStore,
-  Be as createMemoryOAuthStateStore,
-  tt as createNextJsCookieOAuthStateStore,
-  at as createOAuthCallbackHandler,
-  ft as createProxyMiddleware,
-  _r as createRateLimiter,
-  nt as createRedisOAuthStateStore,
-  ct as createSecurityMiddleware,
-  kt as createServerAuthMiddleware,
-  vt as createServerHelpers,
-  St as createServerUtils,
-  At as createSessionManager,
-  oe as deleteCookie,
-  Rt as deleteOAuthStateCookie,
-  Ie as escapeHTML,
-  be as exchangeOAuthCode,
-  _e as generateCSRFToken,
-  Y as generateToken,
-  ce as getCookie,
-  Ot as getCurrentUser,
-  Kr as getErrorCode,
-  Gr as getErrorMessage,
-  Tt as getOAuthStateCookie,
-  Fe as getOAuthUserInfo,
-  j as getProviderMetadata,
-  H as getSecurityHeaders,
-  It as getServerSession,
-  _t as getSessionTimeUntilExpiry,
-  Qr as getUserFriendlyError,
-  Jr as hasErrorCode,
-  Ce as isAuthError,
-  Xr as isAuthSuccess,
-  rt as isOAuthProviderConfig,
-  Yr as isRetryableError,
-  Pt as isSessionExpiredNullable,
-  Ct as isSessionExpiringSoon,
-  Nt as isSessionValid,
-  et as isSupportedProvider,
-  Hr as isTwoFactorRequired,
-  Wr as isValidCSRFToken,
-  Br as isValidEmail,
-  Mr as isValidInput,
-  Ur as isValidName,
-  Nr as isValidPassword,
-  Lr as isValidToken,
-  xr as isValidURL,
-  st as mulguard,
-  bt as refreshSession,
-  Ut as requireAuth,
-  Ft as requireRole,
-  xt as requireServerAuthMiddleware,
-  Dt as requireServerRoleMiddleware,
-  jr as sanitizeHTML,
-  qr as sanitizeInput,
-  zr as sanitizeUserInput,
-  ae as setCookie,
-  Zr as signIn,
-  wt as signInEmailAction,
-  pt as signOutAction,
-  mt as signUpAction,
-  Lt as storeOAuthStateCookie,
-  ot as toNextJsHandler,
-  G as validateAndSanitizeEmail,
-  X as validateAndSanitizeInput,
-  br as validateAndSanitizeName,
-  Cr as validateAndSanitizePassword,
-  Q as validateCSRFToken,
-  U as validateSessionStructure,
-  Dr as validateToken,
-  Fr as validateURL,
-  Et as verify2FAAction,
-  F as withSecurityHeaders
+  Ke as CSRFProtection,
+  Ne as DEFAULT_SECURITY_HEADERS,
+  Ge as MemoryCSRFStore,
+  kr as MemoryOAuthStateStore,
+  pr as MemoryPKCEStorage,
+  Sr as OAuthHandler,
+  Pe as RateLimiter,
+  Qt as SessionExpiredError,
+  lt as applySecurityHeaders,
+  Re as buildCookieOptions,
+  de as buildOAuthAuthorizationUrl,
+  st as checkRole,
+  At as containsXSSPattern,
+  $t as createApiHandler,
+  Zt as createAuthenticatedAction,
+  kt as createCSRFProtection,
+  yr as createCookieOAuthStateStore,
+  vr as createMemoryOAuthStateStore,
+  Vt as createNextJsCookieOAuthStateStore,
+  jt as createOAuthHandler,
+  nt as createProxyMiddleware,
+  ut as createRateLimiter,
+  Mt as createRedisOAuthStateStore,
+  Ht as createRoleBasedProxy,
+  en as createServerAction,
+  Ae as deleteCookie,
+  rn as deleteOAuthStateCookie,
+  Xe as escapeHTML,
+  he as exchangeOAuthCode,
+  ue as generateCSRFToken,
+  pe as generateCodeChallenge,
+  hr as generateCodeVerifier,
+  gr as generatePKCECodePair,
+  ce as generateToken,
+  Te as getCookie,
+  tn as getCurrentUser,
+  Ct as getErrorCode,
+  bt as getErrorMessage,
+  nn as getOAuthStateCookie,
+  ge as getOAuthUserInfo,
+  K as getProviderMetadata,
+  ne as getSecurityHeaders,
+  sn as getServerSession,
+  on as getServerUser,
+  an as getSessionTimeUntilExpiry,
+  Nt as getUserFriendlyError,
+  ge as getUserProfile,
+  xt as hasErrorCode,
+  Ye as isAuthError,
+  It as isAuthSuccess,
+  cn as isAuthenticated,
+  Ft as isOAuthProviderConfig,
+  Pt as isRetryableError,
+  un as isSessionExpiredNullable,
+  ln as isSessionExpiringSoon,
+  fn as isSessionValid,
+  Dt as isSupportedProvider,
+  _t as isTwoFactorRequired,
+  Rt as isValidCSRFToken,
+  Tt as isValidEmail,
+  yt as isValidInput,
+  gt as isValidName,
+  dt as isValidPassword,
+  Et as isValidToken,
+  pt as isValidURL,
+  zt as mulguard,
+  dn as requireAuth,
+  hn as requireRole,
+  vt as sanitizeHTML,
+  Ot as sanitizeInput,
+  St as sanitizeUserInput,
+  Oe as setCookie,
+  Ut as signIn,
+  Gt as signInEmailAction,
+  Kt as signOutAction,
+  Xt as signUpAction,
+  gn as storeOAuthStateCookie,
+  Bt as toNextJsHandler,
+  se as validateAndSanitizeEmail,
+  oe as validateAndSanitizeInput,
+  ht as validateAndSanitizeName,
+  ft as validateAndSanitizePassword,
+  le as validateCSRFToken,
+  F as validateSessionStructure,
+  mt as validateToken,
+  wt as validateURL,
+  Jt as verify2FAAction,
+  Lt as verifyPKCECode,
+  $ as withSecurityHeaders
 };