@nauth-toolkit/core 0.2.7 → 0.3.1

package/dist/dto/api-key.dto.js

@@ -0,0 +1,198 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateApiKeyResponseDTO = exports.ApiKeyResponseDTO = exports.DeleteApiKeyDTO = exports.RevokeApiKeyDTO = exports.UpdateApiKeyDTO = exports.CreateApiKeyDTO = void 0;
+const class_validator_1 = require("class-validator");
+const class_transformer_1 = require("class-transformer");
+/**
+ * DTO for creating an API key (user self-service)
+ *
+ * Security:
+ * - Expiry is explicit and mandatory (enforced in the service layer):
+ *   provide a positive number of days, or `null` for a never-expiring key
+ *   (only allowed when `apiKeys.allowIndefinite` is true).
+ * - Optional per-key IP allowlist restricts which source IPs may use the key.
+ *
+ * Note: The owning user is derived from the authenticated request, never from the body.
+ */
+class CreateApiKeyDTO {
+    /**
+     * User-friendly label for the key (optional)
+     *
+     * Validation:
+     * - Max 255 characters
+     *
+     * Sanitization:
+     * - Trimmed
+     */
+    name;
+    /**
+     * Key expiry in days, or `null` for a key that never expires
+     *
+     * This field is mandatory at creation. The service rejects the request when it
+     * is omitted (`API_KEY_EXPIRY_REQUIRED`), when `null` is used but indefinite keys
+     * are disallowed (`API_KEY_INDEFINITE_NOT_ALLOWED`), or when it exceeds the
+     * configured maximum (`API_KEY_EXPIRY_TOO_LONG`).
+     *
+     * Validation:
+     * - When provided and not null: positive integer
+     */
+    expiresInDays;
+    /**
+     * Allowed source IPs / CIDR ranges for this key (optional)
+     *
+     * When omitted or empty, the key may be used from any IP. Each entry must be a
+     * valid IPv4/IPv6 address or CIDR range (validated in the service layer).
+     *
+     * Validation:
+     * - Array of strings, max 100 entries at the DTO layer (per-key cap enforced by config)
+     */
+    allowedIps;
+}
+exports.CreateApiKeyDTO = CreateApiKeyDTO;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)({ message: 'Name must be a string' }),
+    (0, class_validator_1.MaxLength)(255, { message: 'Name must not exceed 255 characters' }),
+    (0, class_transformer_1.Transform)(({ value }) => (typeof value === 'string' ? value.trim() : value)),
+    __metadata("design:type", String)
+], CreateApiKeyDTO.prototype, "name", void 0);
+__decorate([
+    (0, class_validator_1.ValidateIf)((o) => o.expiresInDays !== undefined && o.expiresInDays !== null),
+    (0, class_validator_1.IsInt)({ message: 'expiresInDays must be an integer number of days or null' }),
+    (0, class_validator_1.Min)(1, { message: 'expiresInDays must be at least 1' }),
+    __metadata("design:type", Object)
+], CreateApiKeyDTO.prototype, "expiresInDays", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)({ message: 'allowedIps must be an array of IP addresses or CIDR ranges' }),
+    (0, class_validator_1.ArrayMaxSize)(100, { message: 'allowedIps has too many entries' }),
+    (0, class_validator_1.IsString)({ each: true, message: 'Each allowedIps entry must be a string' }),
+    __metadata("design:type", Array)
+], CreateApiKeyDTO.prototype, "allowedIps", void 0);
+/**
+ * DTO for updating an API key (user self-service)
+ *
+ * Only the label and IP allowlist are mutable. The secret and expiry are immutable —
+ * to rotate or extend a key, delete it and create a new one.
+ */
+class UpdateApiKeyDTO {
+    /**
+     * External key identifier (UUID v4)
+     */
+    keyId;
+    /**
+     * New label for the key (optional)
+     */
+    name;
+    /**
+     * Replacement IP allowlist (optional)
+     *
+     * Pass an empty array to clear restrictions (open to any IP).
+     */
+    allowedIps;
+}
+exports.UpdateApiKeyDTO = UpdateApiKeyDTO;
+__decorate([
+    (0, class_validator_1.IsUUID)('4', { message: 'keyId must be a valid UUID v4' }),
+    __metadata("design:type", String)
+], UpdateApiKeyDTO.prototype, "keyId", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)({ message: 'Name must be a string' }),
+    (0, class_validator_1.MaxLength)(255, { message: 'Name must not exceed 255 characters' }),
+    (0, class_transformer_1.Transform)(({ value }) => (typeof value === 'string' ? value.trim() : value)),
+    __metadata("design:type", String)
+], UpdateApiKeyDTO.prototype, "name", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)({ message: 'allowedIps must be an array of IP addresses or CIDR ranges' }),
+    (0, class_validator_1.ArrayMaxSize)(100, { message: 'allowedIps has too many entries' }),
+    (0, class_validator_1.IsString)({ each: true, message: 'Each allowedIps entry must be a string' }),
+    __metadata("design:type", Array)
+], UpdateApiKeyDTO.prototype, "allowedIps", void 0);
+/**
+ * DTO for revoking an API key (soft delete)
+ */
+class RevokeApiKeyDTO {
+    /**
+     * External key identifier (UUID v4)
+     */
+    keyId;
+}
+exports.RevokeApiKeyDTO = RevokeApiKeyDTO;
+__decorate([
+    (0, class_validator_1.IsUUID)('4', { message: 'keyId must be a valid UUID v4' }),
+    __metadata("design:type", String)
+], RevokeApiKeyDTO.prototype, "keyId", void 0);
+/**
+ * DTO for permanently deleting an API key
+ */
+class DeleteApiKeyDTO {
+    /**
+     * External key identifier (UUID v4)
+     */
+    keyId;
+}
+exports.DeleteApiKeyDTO = DeleteApiKeyDTO;
+__decorate([
+    (0, class_validator_1.IsUUID)('4', { message: 'keyId must be a valid UUID v4' }),
+    __metadata("design:type", String)
+], DeleteApiKeyDTO.prototype, "keyId", void 0);
+/**
+ * Sanitized API key response
+ *
+ * Never includes the plaintext key or its hash. Returned by list and update operations.
+ */
+class ApiKeyResponseDTO {
+    /** External key identifier (UUID v4) */
+    keyId;
+    /** User-friendly label */
+    name;
+    /** Last few characters of the key (display hint) */
+    lastFour;
+    /** Allowed source IPs / CIDR ranges (empty/null = any IP) */
+    allowedIps;
+    /** Expiry timestamp, or null if the key never expires */
+    expiresAt;
+    /** Whether the key is active */
+    isActive;
+    /** Whether the key was created by an administrator */
+    createdByAdmin;
+    /** Last successful use timestamp, or null if never used */
+    lastUsedAt;
+    /** IP of the last successful use (only when usage IP tracking is enabled) */
+    lastUsedIp;
+    /** Total number of successful authentications with this key */
+    usageCount;
+    /** Creation timestamp */
+    createdAt;
+}
+exports.ApiKeyResponseDTO = ApiKeyResponseDTO;
+/**
+ * Response returned once when a key is created
+ *
+ * The plaintext `key` is shown only here and never again — the caller must store it securely.
+ */
+class CreateApiKeyResponseDTO {
+    /**
+     * The full plaintext API key (shown once)
+     *
+     * Security: Never stored in plaintext. Deliver securely to the consumer.
+     */
+    key;
+    /**
+     * Sanitized metadata for the created key
+     */
+    apiKey;
+}
+exports.CreateApiKeyResponseDTO = CreateApiKeyResponseDTO;
+//# sourceMappingURL=api-key.dto.js.map

package/dist/dto/api-key.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.dto.js","sourceRoot":"","sources":["../../src/dto/api-key.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAUyB;AACzB,yDAA8C;AAE9C;;;;;;;;;;GAUG;AACH,MAAa,eAAe;IAC1B;;;;;;;;OAQG;IAKH,IAAI,CAAU;IAEd;;;;;;;;;;OAUG;IAIH,aAAa,CAAiB;IAE9B;;;;;;;;OAQG;IAKH,UAAU,CAAY;CACvB;AA9CD,0CA8CC;AAhCC;IAJC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IAC9C,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;IAClE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;;6CAC/D;AAgBd;IAHC,IAAA,4BAAU,EAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC;IAC5E,IAAA,uBAAK,EAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC;IAC7E,IAAA,qBAAG,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;;sDAC1B;AAe9B;IAJC,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,EAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC;IAClF,IAAA,8BAAY,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;IACjE,IAAA,0BAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;;mDACtD;AAGxB;;;;;GAKG;AACH,MAAa,eAAe;IAC1B;;OAEG;IAEH,KAAK,CAAU;IAEf;;OAEG;IAKH,IAAI,CAAU;IAEd;;;;OAIG;IAKH,UAAU,CAAY;CACvB;AA1BD,0CA0BC;AArBC;IADC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;;8CAC3C;AASf;IAJC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IAC9C,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;IAClE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;;6CAC/D;AAWd;IAJC,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,EAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC;IAClF,IAAA,8BAAY,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;IACjE,IAAA,0BAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;;mDACtD;AAGxB;;GAEG;AACH,MAAa,eAAe;IAC1B;;OAEG;IAEH,KAAK,CAAU;CAChB;AAND,0CAMC;AADC;IADC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;;8CAC3C;AAGjB;;GAEG;AACH,MAAa,eAAe;IAC1B;;OAEG;IAEH,KAAK,CAAU;CAChB;AAND,0CAMC;AADC;IADC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;;8CAC3C;AAGjB;;;;GAIG;AACH,MAAa,iBAAiB;IAC5B,wCAAwC;IACxC,KAAK,CAAU;IAEf,0BAA0B;IAC1B,IAAI,CAAiB;IAErB,oDAAoD;IACpD,QAAQ,CAAiB;IAEzB,6DAA6D;IAC7D,UAAU,CAAmB;IAE7B,yDAAyD;IACzD,SAAS,CAAe;IAExB,gCAAgC;IAChC,QAAQ,CAAW;IAEnB,sDAAsD;IACtD,cAAc,CAAW;IAEzB,2DAA2D;IAC3D,UAAU,CAAe;IAEzB,6EAA6E;IAC7E,UAAU,CAAiB;IAE3B,+DAA+D;IAC/D,UAAU,CAAU;IAEpB,yBAAyB;IACzB,SAAS,CAAQ;CAClB;AAjCD,8CAiCC;AAED;;;;GAIG;AACH,MAAa,uBAAuB;IAClC;;;;OAIG;IACH,GAAG,CAAU;IAEb;;OAEG;IACH,MAAM,CAAqB;CAC5B;AAZD,0DAYC"}

package/dist/dto/change-password.dto.d.ts

@@ -8,7 +8,7 @@
  * - Old password verified before allowing change
  * - New password validated for minimum strength
  * - Password history checked (configurable)
- * - Max length prevents DoS via bcrypt
+ * - Max length prevents DoS via Argon2 hashing
  *
  * @example
  * ```typescript
@@ -36,7 +36,7 @@ export declare class ChangePasswordDTO {
      * Validation:
      * - Must be a string
      * - Min 8 characters (security requirement)
-     * - Max 128 characters (prevents DoS via bcrypt)
+     * - Max 128 characters (prevents DoS via Argon2 hashing)
      *
      * Note: NOT trimmed (passwords can have leading/trailing spaces)
      *

package/dist/dto/change-password.dto.js

@@ -9,7 +9,7 @@
  * - Old password verified before allowing change
  * - New password validated for minimum strength
  * - Password history checked (configurable)
- * - Max length prevents DoS via bcrypt
+ * - Max length prevents DoS via Argon2 hashing
  *
  * @example
  * ```typescript
@@ -49,7 +49,7 @@ class ChangePasswordDTO {
      * Validation:
      * - Must be a string
      * - Min 8 characters (security requirement)
-     * - Max 128 characters (prevents DoS via bcrypt)
+     * - Max 128 characters (prevents DoS via Argon2 hashing)
      *
      * Note: NOT trimmed (passwords can have leading/trailing spaces)
      *

package/dist/dto/index.d.ts

@@ -76,4 +76,6 @@ export * from './admin-get-user-auth-history.dto';
 export * from './admin-get-user-auth-history.dto';
 export * from './social-auth.dto';
 export * from './social-redirect.dto';
+export * from './api-key.dto';
+export * from './admin-api-key.dto';
 //# sourceMappingURL=index.d.ts.map

package/dist/dto/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dto/index.ts"],"names":[],"mappings":"AACA,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,sCAAsC,CAAC;AACrD,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kCAAkC,CAAC;AACjD,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAE3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sCAAsC,CAAC;AACrD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mCAAmC,CAAC;AAClD,cAAc,mCAAmC,CAAC;AAElD,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dto/index.ts"],"names":[],"mappings":"AACA,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,sCAAsC,CAAC;AACrD,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kCAAkC,CAAC;AACjD,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAE3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sCAAsC,CAAC;AACrD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mCAAmC,CAAC;AAClD,cAAc,mCAAmC,CAAC;AAElD,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AAGtC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC"}

package/dist/dto/index.js

@@ -94,6 +94,9 @@ __exportStar(require("./admin-get-user-auth-history.dto"), exports);
 __exportStar(require("./admin-get-user-auth-history.dto"), exports);
 __exportStar(require("./social-auth.dto"), exports);
 __exportStar(require("./social-redirect.dto"), exports);
+// API Key DTOs
+__exportStar(require("./api-key.dto"), exports);
+__exportStar(require("./admin-api-key.dto"), exports);
 // Note: Social and MFA DTOs moved to their respective packages
 // - social-login.dto → @nauth-toolkit/social-*
 // - mfa.dto → @nauth-toolkit/mfa-*

package/dist/dto/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/dto/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iBAAiB;AACjB,+CAA6B;AAC7B,qDAAmC;AACnC,4DAA0C;AAC1C,oDAAkC;AAClC,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,8CAA4B;AAC5B,wDAAsC;AACtC,iEAA+C;AAC/C,sDAAoC;AACpC,oDAAkC;AAClC,+DAA6C;AAC7C,qEAAmD;AACnD,uEAAqD;AACrD,qDAAmC;AACnC,qDAAmC;AACnC,4DAA0C;AAC1C,uDAAqC;AACrC,wDAAsC;AACtC,gEAA8C;AAC9C,sDAAoC;AACpC,sDAAoC;AACpC,uDAAqC;AACrC,2DAAyC;AACzC,0DAAwC;AACxC,uDAAqC;AACrC,gEAA8C;AAC9C,2DAAyC;AACzC,oEAAkD;AAClD,8DAA4C;AAC5C,uDAAqC;AACrC,6DAA2C;AAC3C,yDAAuC;AACvC,4DAA0C;AAC1C,qDAAmC;AACnC,gEAA8C;AAC9C,sDAAoC;AACpC,4DAA0C;AAC1C,0DAAwC;AACxC,6DAA2C;AAC3C,mEAAiD;AACjD,kDAAgC;AAChC,wDAAsC;AACtC,wDAAsC;AACtC,gEAA8C;AAC9C,gEAA8C;AAC9C,kEAAgD;AAChD,gEAA8C;AAC9C,oDAAkC;AAClC,6DAA2C;AAC3C,0DAAwC;AACxC,uDAAqC;AACrC,0DAAwC;AACxC,+CAA6B;AAC7B,wDAAsC;AACtC,mDAAiC;AACjC,4DAA0C;AAC1C,yDAAuC;AACvC,0DAAwC;AACxC,mEAAiD;AACjD,uDAAqC;AACrC,gEAA8C;AAC9C,kEAAgD;AAChD,6DAA2C;AAC3C,iEAA+C;AAC/C,0EAAwD;AACxD,2DAAyC;AACzC,6DAA2C;AAC3C,+EAA+E;AAC/E,8DAA4C;AAC5C,mEAAiD;AACjD,8DAA4C;AAC5C,uEAAqD;AACrD,8DAA4C;AAC5C,oEAAkD;AAClD,oEAAkD;AAElD,oDAAkC;AAClC,wDAAsC;AAEtC,+DAA+D;AAC/D,+CAA+C;AAC/C,mCAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/dto/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iBAAiB;AACjB,+CAA6B;AAC7B,qDAAmC;AACnC,4DAA0C;AAC1C,oDAAkC;AAClC,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,8CAA4B;AAC5B,wDAAsC;AACtC,iEAA+C;AAC/C,sDAAoC;AACpC,oDAAkC;AAClC,+DAA6C;AAC7C,qEAAmD;AACnD,uEAAqD;AACrD,qDAAmC;AACnC,qDAAmC;AACnC,4DAA0C;AAC1C,uDAAqC;AACrC,wDAAsC;AACtC,gEAA8C;AAC9C,sDAAoC;AACpC,sDAAoC;AACpC,uDAAqC;AACrC,2DAAyC;AACzC,0DAAwC;AACxC,uDAAqC;AACrC,gEAA8C;AAC9C,2DAAyC;AACzC,oEAAkD;AAClD,8DAA4C;AAC5C,uDAAqC;AACrC,6DAA2C;AAC3C,yDAAuC;AACvC,4DAA0C;AAC1C,qDAAmC;AACnC,gEAA8C;AAC9C,sDAAoC;AACpC,4DAA0C;AAC1C,0DAAwC;AACxC,6DAA2C;AAC3C,mEAAiD;AACjD,kDAAgC;AAChC,wDAAsC;AACtC,wDAAsC;AACtC,gEAA8C;AAC9C,gEAA8C;AAC9C,kEAAgD;AAChD,gEAA8C;AAC9C,oDAAkC;AAClC,6DAA2C;AAC3C,0DAAwC;AACxC,uDAAqC;AACrC,0DAAwC;AACxC,+CAA6B;AAC7B,wDAAsC;AACtC,mDAAiC;AACjC,4DAA0C;AAC1C,yDAAuC;AACvC,0DAAwC;AACxC,mEAAiD;AACjD,uDAAqC;AACrC,gEAA8C;AAC9C,kEAAgD;AAChD,6DAA2C;AAC3C,iEAA+C;AAC/C,0EAAwD;AACxD,2DAAyC;AACzC,6DAA2C;AAC3C,+EAA+E;AAC/E,8DAA4C;AAC5C,mEAAiD;AACjD,8DAA4C;AAC5C,uEAAqD;AACrD,8DAA4C;AAC5C,oEAAkD;AAClD,oEAAkD;AAElD,oDAAkC;AAClC,wDAAsC;AAEtC,eAAe;AACf,gDAA8B;AAC9B,sDAAoC;AAEpC,+DAA+D;AAC/D,+CAA+C;AAC/C,mCAAmC"}

package/dist/dto/reset-password.dto.d.ts

@@ -70,7 +70,7 @@ export declare class ResetPasswordDTO {
      * Validation:
      * - Must be a string
      * - Min 8 characters (security requirement)
-     * - Max 128 characters (prevents DoS via bcrypt)
+     * - Max 128 characters (prevents DoS via Argon2 hashing)
      *
      * Note: NOT trimmed (passwords can have leading/trailing spaces)
      * Additional checks in service layer:

package/dist/dto/reset-password.dto.js

@@ -103,7 +103,7 @@ class ResetPasswordDTO {
      * Validation:
      * - Must be a string
      * - Min 8 characters (security requirement)
-     * - Max 128 characters (prevents DoS via bcrypt)
+     * - Max 128 characters (prevents DoS via Argon2 hashing)
      *
      * Note: NOT trimmed (passwords can have leading/trailing spaces)
      * Additional checks in service layer:

package/dist/dto/respond-challenge.dto.d.ts

@@ -117,7 +117,7 @@ export declare class RespondChallengeDTO {
      * Validation:
      * - Must be a string
      * - Min 8 characters (security requirement)
-     * - Max 128 characters (prevents DoS via bcrypt)
+     * - Max 128 characters (prevents DoS via Argon2 hashing)
      *
      * Note: NOT trimmed (passwords can have leading/trailing spaces)
      */

package/dist/dto/respond-challenge.dto.js

@@ -142,7 +142,7 @@ class RespondChallengeDTO {
      * Validation:
      * - Must be a string
      * - Min 8 characters (security requirement)
-     * - Max 128 characters (prevents DoS via bcrypt)
+     * - Max 128 characters (prevents DoS via Argon2 hashing)
      *
      * Note: NOT trimmed (passwords can have leading/trailing spaces)
      */

package/dist/dto/signup.dto.d.ts

@@ -24,7 +24,7 @@ export declare class SignupDTO {
      *
      * Validation:
      * - Min 8 characters
-     * - Max 128 characters (prevents DoS via bcrypt)
+     * - Max 128 characters (prevents DoS via Argon2 hashing)
      * - Additional policy checks in service layer
      *
      * Note: NOT trimmed (passwords can have leading/trailing spaces)

package/dist/dto/signup.dto.js

@@ -38,7 +38,7 @@ class SignupDTO {
      *
      * Validation:
      * - Min 8 characters
-     * - Max 128 characters (prevents DoS via bcrypt)
+     * - Max 128 characters (prevents DoS via Argon2 hashing)
      * - Additional policy checks in service layer
      *
      * Note: NOT trimmed (passwords can have leading/trailing spaces)

package/dist/entities/api-key.entity.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Base API Key Entity
+ *
+ * Stores long-lived API keys that authenticate as their owning user.
+ * Only a hash of the secret is persisted; the plaintext key is shown once at creation.
+ * Database adapters extend this class and add ORM-specific decorators.
+ *
+ * @remarks
+ * This class is database-agnostic. TypeORM, Prisma, or other ORMs
+ * extend this class in their respective packages.
+ *
+ * Security:
+ * - The full key is never stored; only `keyHash` (SHA-256) is persisted.
+ * - `lookupId` is a non-secret, indexed identifier used for O(1) lookup.
+ * - `allowedIps` restricts which source IPs may use the key (empty/null = any IP).
+ */
+export declare class BaseApiKey {
+    /**
+     * Internal API key ID (auto-increment integer)
+     */
+    id: number;
+    /**
+     * External API key identifier (UUID v4)
+     * Exposed in API responses instead of the internal integer id.
+     */
+    keyId: string;
+    /**
+     * Internal user ID (foreign key to users table)
+     * The key authenticates as this user.
+     */
+    userId: number;
+    /**
+     * Non-secret lookup identifier (indexed, unique)
+     *
+     * Embedded in the plaintext key and used to locate the record without
+     * scanning every hash. Not a secret on its own.
+     */
+    lookupId: string;
+    /**
+     * SHA-256 hash of the full plaintext key
+     * The plaintext key is never stored.
+     */
+    keyHash: string;
+    /**
+     * User-friendly key label (optional)
+     * E.g. "CI pipeline", "Zapier integration".
+     */
+    name?: string | null;
+    /**
+     * Last few characters of the plaintext key (display hint)
+     * Helps users identify a key in listings without exposing the secret.
+     */
+    lastFour?: string | null;
+    /**
+     * Allowed source IPs / CIDR ranges for this key
+     *
+     * When empty or null, the key may be used from any IP.
+     * When populated, requests from IPs outside the list are rejected.
+     */
+    allowedIps?: string[] | null;
+    /**
+     * Key expiration timestamp
+     * NULL means the key never expires (only allowed when config permits).
+     */
+    expiresAt?: Date | null;
+    /**
+     * Whether the key is active
+     * Set to false on revoke (soft delete) to disable without removing history.
+     */
+    isActive: boolean;
+    /**
+     * When the key was revoked
+     * NULL if not revoked.
+     */
+    revokedAt?: Date | null;
+    /**
+     * Reason the key was revoked (optional)
+     */
+    revokeReason?: string | null;
+    /**
+     * Whether the key was created by an administrator on behalf of the user
+     */
+    createdByAdmin: boolean;
+    /**
+     * When the key was last used for authentication
+     * NULL if never used. Updated on a throttled basis (see config).
+     */
+    lastUsedAt?: Date | null;
+    /**
+     * IP address of the most recent successful use
+     * Only populated when usage IP tracking is enabled.
+     */
+    lastUsedIp?: string | null;
+    /**
+     * Total number of successful authentications with this key
+     */
+    usageCount: number;
+    /**
+     * Additional metadata (JSON)
+     */
+    metadata?: Record<string, unknown> | null;
+    /**
+     * Creation timestamp
+     */
+    createdAt: Date;
+    /**
+     * Last update timestamp
+     */
+    updatedAt: Date;
+    /**
+     * Check if the key is expired
+     *
+     * @returns true if the key has an expiry that is in the past
+     *
+     * @example
+     * ```typescript
+     * if (apiKey.isExpired()) {
+     *   throw new Error('API key has expired');
+     * }
+     * ```
+     */
+    isExpired(): boolean;
+    /**
+     * Check whether a given source IP is allowed to use this key
+     *
+     * An empty or null allowlist permits any IP. Otherwise the IP must match
+     * one of the configured entries (exact IPv4/IPv6 or CIDR range).
+     *
+     * @param ip - Source IP address of the request
+     * @param matcher - IP/CIDR match function (injected to keep this class dependency-free)
+     * @returns true if the IP is allowed
+     */
+    isIpAllowed(ip: string | null | undefined, matcher: (ip: string, allow: string) => boolean): boolean;
+}
+//# sourceMappingURL=api-key.entity.d.ts.map

package/dist/entities/api-key.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.entity.d.ts","sourceRoot":"","sources":["../../src/entities/api-key.entity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,UAAU;IACrB;;OAEG;IACH,EAAE,EAAG,MAAM,CAAC;IAEZ;;;OAGG;IACH,KAAK,EAAG,MAAM,CAAC;IAEf;;;OAGG;IACH,MAAM,EAAG,MAAM,CAAC;IAEhB;;;;;OAKG;IACH,QAAQ,EAAG,MAAM,CAAC;IAElB;;;OAGG;IACH,OAAO,EAAG,MAAM,CAAC;IAEjB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE7B;;;OAGG;IACH,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAExB;;;OAGG;IACH,QAAQ,EAAG,OAAO,CAAC;IAEnB;;;OAGG;IACH,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAExB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;OAEG;IACH,cAAc,EAAG,OAAO,CAAC;IAEzB;;;OAGG;IACH,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAEzB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B;;OAEG;IACH,UAAU,EAAG,MAAM,CAAC;IAEpB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE1C;;OAEG;IACH,SAAS,EAAG,IAAI,CAAC;IAEjB;;OAEG;IACH,SAAS,EAAG,IAAI,CAAC;IAEjB;;;;;;;;;;;OAWG;IACH,SAAS,IAAI,OAAO;IAIpB;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO;CASrG"}

package/dist/entities/api-key.entity.js

@@ -0,0 +1,149 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseApiKey = void 0;
+/**
+ * Base API Key Entity
+ *
+ * Stores long-lived API keys that authenticate as their owning user.
+ * Only a hash of the secret is persisted; the plaintext key is shown once at creation.
+ * Database adapters extend this class and add ORM-specific decorators.
+ *
+ * @remarks
+ * This class is database-agnostic. TypeORM, Prisma, or other ORMs
+ * extend this class in their respective packages.
+ *
+ * Security:
+ * - The full key is never stored; only `keyHash` (SHA-256) is persisted.
+ * - `lookupId` is a non-secret, indexed identifier used for O(1) lookup.
+ * - `allowedIps` restricts which source IPs may use the key (empty/null = any IP).
+ */
+class BaseApiKey {
+    /**
+     * Internal API key ID (auto-increment integer)
+     */
+    id;
+    /**
+     * External API key identifier (UUID v4)
+     * Exposed in API responses instead of the internal integer id.
+     */
+    keyId;
+    /**
+     * Internal user ID (foreign key to users table)
+     * The key authenticates as this user.
+     */
+    userId;
+    /**
+     * Non-secret lookup identifier (indexed, unique)
+     *
+     * Embedded in the plaintext key and used to locate the record without
+     * scanning every hash. Not a secret on its own.
+     */
+    lookupId;
+    /**
+     * SHA-256 hash of the full plaintext key
+     * The plaintext key is never stored.
+     */
+    keyHash;
+    /**
+     * User-friendly key label (optional)
+     * E.g. "CI pipeline", "Zapier integration".
+     */
+    name;
+    /**
+     * Last few characters of the plaintext key (display hint)
+     * Helps users identify a key in listings without exposing the secret.
+     */
+    lastFour;
+    /**
+     * Allowed source IPs / CIDR ranges for this key
+     *
+     * When empty or null, the key may be used from any IP.
+     * When populated, requests from IPs outside the list are rejected.
+     */
+    allowedIps;
+    /**
+     * Key expiration timestamp
+     * NULL means the key never expires (only allowed when config permits).
+     */
+    expiresAt;
+    /**
+     * Whether the key is active
+     * Set to false on revoke (soft delete) to disable without removing history.
+     */
+    isActive;
+    /**
+     * When the key was revoked
+     * NULL if not revoked.
+     */
+    revokedAt;
+    /**
+     * Reason the key was revoked (optional)
+     */
+    revokeReason;
+    /**
+     * Whether the key was created by an administrator on behalf of the user
+     */
+    createdByAdmin;
+    /**
+     * When the key was last used for authentication
+     * NULL if never used. Updated on a throttled basis (see config).
+     */
+    lastUsedAt;
+    /**
+     * IP address of the most recent successful use
+     * Only populated when usage IP tracking is enabled.
+     */
+    lastUsedIp;
+    /**
+     * Total number of successful authentications with this key
+     */
+    usageCount;
+    /**
+     * Additional metadata (JSON)
+     */
+    metadata;
+    /**
+     * Creation timestamp
+     */
+    createdAt;
+    /**
+     * Last update timestamp
+     */
+    updatedAt;
+    /**
+     * Check if the key is expired
+     *
+     * @returns true if the key has an expiry that is in the past
+     *
+     * @example
+     * ```typescript
+     * if (apiKey.isExpired()) {
+     *   throw new Error('API key has expired');
+     * }
+     * ```
+     */
+    isExpired() {
+        return this.expiresAt !== null && this.expiresAt !== undefined && new Date() > this.expiresAt;
+    }
+    /**
+     * Check whether a given source IP is allowed to use this key
+     *
+     * An empty or null allowlist permits any IP. Otherwise the IP must match
+     * one of the configured entries (exact IPv4/IPv6 or CIDR range).
+     *
+     * @param ip - Source IP address of the request
+     * @param matcher - IP/CIDR match function (injected to keep this class dependency-free)
+     * @returns true if the IP is allowed
+     */
+    isIpAllowed(ip, matcher) {
+        if (!this.allowedIps || this.allowedIps.length === 0) {
+            return true;
+        }
+        if (!ip) {
+            return false;
+        }
+        return this.allowedIps.some((entry) => matcher(ip, entry));
+    }
+}
+exports.BaseApiKey = BaseApiKey;
+//# sourceMappingURL=api-key.entity.js.map

package/dist/entities/api-key.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.entity.js","sourceRoot":"","sources":["../../src/entities/api-key.entity.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAa,UAAU;IACrB;;OAEG;IACH,EAAE,CAAU;IAEZ;;;OAGG;IACH,KAAK,CAAU;IAEf;;;OAGG;IACH,MAAM,CAAU;IAEhB;;;;;OAKG;IACH,QAAQ,CAAU;IAElB;;;OAGG;IACH,OAAO,CAAU;IAEjB;;;OAGG;IACH,IAAI,CAAiB;IAErB;;;OAGG;IACH,QAAQ,CAAiB;IAEzB;;;;;OAKG;IACH,UAAU,CAAmB;IAE7B;;;OAGG;IACH,SAAS,CAAe;IAExB;;;OAGG;IACH,QAAQ,CAAW;IAEnB;;;OAGG;IACH,SAAS,CAAe;IAExB;;OAEG;IACH,YAAY,CAAiB;IAE7B;;OAEG;IACH,cAAc,CAAW;IAEzB;;;OAGG;IACH,UAAU,CAAe;IAEzB;;;OAGG;IACH,UAAU,CAAiB;IAE3B;;OAEG;IACH,UAAU,CAAU;IAEpB;;OAEG;IACH,QAAQ,CAAkC;IAE1C;;OAEG;IACH,SAAS,CAAQ;IAEjB;;OAEG;IACH,SAAS,CAAQ;IAEjB;;;;;;;;;;;OAWG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAChG,CAAC;IAED;;;;;;;;;OASG;IACH,WAAW,CAAC,EAA6B,EAAE,OAA+C;QACxF,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF;AAnJD,gCAmJC"}

package/dist/entities/index.d.ts

@@ -28,4 +28,5 @@ export { BaseAuthAudit, type AuthAuditEventStatus } from './auth-audit.entity';
 export { BaseRateLimit } from './rate-limit.entity';
 export { BaseStorageLock } from './storage-lock.entity';
 export { BaseSocialProviderSecret } from './social-provider-secret.entity';
+export { BaseApiKey } from './api-key.entity';
 //# sourceMappingURL=index.d.ts.map

package/dist/entities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/entities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/entities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/entities/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BaseSocialProviderSecret = exports.BaseStorageLock = exports.BaseRateLimit = exports.BaseAuthAudit = exports.BaseMFADevice = exports.BaseChallengeSession = exports.BaseSocialAccount = exports.BaseVerificationToken = exports.BaseLoginAttempt = exports.BaseTrustedDevice = exports.BaseSession = exports.BaseUser = void 0;
+exports.BaseApiKey = exports.BaseSocialProviderSecret = exports.BaseStorageLock = exports.BaseRateLimit = exports.BaseAuthAudit = exports.BaseMFADevice = exports.BaseChallengeSession = exports.BaseSocialAccount = exports.BaseVerificationToken = exports.BaseLoginAttempt = exports.BaseTrustedDevice = exports.BaseSession = exports.BaseUser = void 0;
 /**
  * Base Entity Classes
  *
@@ -43,4 +43,6 @@ var storage_lock_entity_1 = require("./storage-lock.entity");
 Object.defineProperty(exports, "BaseStorageLock", { enumerable: true, get: function () { return storage_lock_entity_1.BaseStorageLock; } });
 var social_provider_secret_entity_1 = require("./social-provider-secret.entity");
 Object.defineProperty(exports, "BaseSocialProviderSecret", { enumerable: true, get: function () { return social_provider_secret_entity_1.BaseSocialProviderSecret; } });
+var api_key_entity_1 = require("./api-key.entity");
+Object.defineProperty(exports, "BaseApiKey", { enumerable: true, get: function () { return api_key_entity_1.BaseApiKey; } });
 //# sourceMappingURL=index.js.map