@usequota/nextjs 0.1.0

package/dist/server.js

@@ -0,0 +1,1068 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  QuotaError: () => QuotaError,
+  QuotaInsufficientCreditsError: () => QuotaInsufficientCreditsError,
+  QuotaNotConnectedError: () => QuotaNotConnectedError,
+  QuotaRateLimitError: () => QuotaRateLimitError,
+  QuotaTokenExpiredError: () => QuotaTokenExpiredError,
+  clearQuotaAuth: () => clearQuotaAuth,
+  createQuotaCheckout: () => createQuotaCheckout,
+  createQuotaRouteHandlers: () => createQuotaRouteHandlers,
+  errorFromResponse: () => errorFromResponse,
+  getQuotaPackages: () => getQuotaPackages,
+  getQuotaUser: () => getQuotaUser,
+  requireQuotaAuth: () => requireQuotaAuth,
+  withQuotaAuth: () => withQuotaAuth
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/errors.ts
+var QuotaError = class extends Error {
+  /** Machine-readable error code */
+  code;
+  /** HTTP status code associated with this error */
+  statusCode;
+  /** Optional hint for resolving the error */
+  hint;
+  constructor(message, code, statusCode, hint) {
+    super(message);
+    this.name = "QuotaError";
+    this.code = code;
+    this.statusCode = statusCode;
+    this.hint = hint;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var QuotaInsufficientCreditsError = class extends QuotaError {
+  /** Current balance (if available) */
+  balance;
+  /** Credits required for the operation (if available) */
+  required;
+  constructor(message, options) {
+    super(
+      message ?? "Insufficient credits to complete this operation",
+      "insufficient_credits",
+      402,
+      "Purchase more credits or reduce usage"
+    );
+    this.name = "QuotaInsufficientCreditsError";
+    this.balance = options?.balance;
+    this.required = options?.required;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var QuotaNotConnectedError = class extends QuotaError {
+  constructor(message) {
+    super(
+      message ?? "User has not connected a Quota account",
+      "not_connected",
+      401,
+      "Connect your Quota account to use this feature"
+    );
+    this.name = "QuotaNotConnectedError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var QuotaTokenExpiredError = class extends QuotaError {
+  constructor(message) {
+    super(
+      message ?? "Quota access token has expired and could not be refreshed",
+      "token_expired",
+      401,
+      "Reconnect your Quota account"
+    );
+    this.name = "QuotaTokenExpiredError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var QuotaRateLimitError = class extends QuotaError {
+  /** Seconds until the rate limit resets */
+  retryAfter;
+  constructor(message, retryAfter) {
+    super(
+      message ?? "Rate limit exceeded",
+      "rate_limit_exceeded",
+      429,
+      "Wait before retrying"
+    );
+    this.name = "QuotaRateLimitError";
+    this.retryAfter = retryAfter ?? 60;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+async function errorFromResponse(response) {
+  if (response.ok) {
+    return null;
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+  }
+  const message = body?.error?.message ?? response.statusText;
+  const code = body?.error?.code;
+  switch (response.status) {
+    case 402: {
+      const opts = {};
+      if (body?.error?.balance !== void 0) opts.balance = body.error.balance;
+      if (body?.error?.required !== void 0)
+        opts.required = body.error.required;
+      return new QuotaInsufficientCreditsError(message, opts);
+    }
+    case 429: {
+      const parsed = parseInt(response.headers.get("retry-after") ?? "60", 10);
+      const retryAfter = Number.isNaN(parsed) ? 60 : parsed;
+      return new QuotaRateLimitError(message, retryAfter);
+    }
+    case 401: {
+      if (code === "not_connected") {
+        return new QuotaNotConnectedError(message);
+      }
+      if (code === "token_expired") {
+        return new QuotaTokenExpiredError(message);
+      }
+      return new QuotaTokenExpiredError(message);
+    }
+    default:
+      return new QuotaError(message, code ?? "unknown", response.status);
+  }
+}
+
+// src/route-handlers.ts
+var import_headers = require("next/headers");
+
+// src/token-refresh.ts
+var FETCH_TIMEOUT_MS = 1e4;
+async function refreshAccessTokenWithCredentials(opts) {
+  try {
+    const response = await fetch(`${opts.baseUrl}/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "refresh_token",
+        refresh_token: opts.refreshToken,
+        client_id: opts.clientId,
+        client_secret: opts.clientSecret
+      }),
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      return null;
+    }
+    return await response.json();
+  } catch (error) {
+    console.error("Failed to refresh Quota access token:", error);
+    return null;
+  }
+}
+async function refreshAndPersistTokens(opts) {
+  const tokenData = await refreshAccessTokenWithCredentials({
+    refreshToken: opts.refreshToken,
+    clientId: opts.clientId,
+    clientSecret: opts.clientSecret,
+    baseUrl: opts.baseUrl
+  });
+  if (!tokenData) {
+    return null;
+  }
+  if (opts.tokenStorage && opts.request) {
+    await opts.tokenStorage.setTokens(
+      {
+        accessToken: tokenData.access_token,
+        refreshToken: tokenData.refresh_token,
+        expiresIn: tokenData.expires_in
+      },
+      opts.request
+    );
+  } else if (opts.writeCookies) {
+    await opts.writeCookies(tokenData);
+  }
+  return tokenData.access_token;
+}
+
+// src/route-handlers.ts
+var DEFAULT_BASE_URL = "https://api.usequota.app";
+var DEFAULT_COOKIE_PREFIX = "quota";
+var DEFAULT_COOKIE_MAX_AGE = 60 * 60 * 24 * 7;
+function createQuotaRouteHandlers(config) {
+  const baseUrl = config.baseUrl ?? DEFAULT_BASE_URL;
+  const cookiePrefix = config.cookiePrefix ?? DEFAULT_COOKIE_PREFIX;
+  const cookieMaxAge = config.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE;
+  const storageMode = config.storageMode ?? "client";
+  const callbackPath = config.callbackPath ?? "/api/quota/callback";
+  const successRedirect = config.successRedirect ?? "/";
+  const errorRedirect = config.errorRedirect ?? "/";
+  const tokenStorage = config.tokenStorage;
+  if (storageMode === "hosted" && !config.getExternalUserId && !tokenStorage?.getExternalUserId) {
+    throw new Error(
+      "getExternalUserId (or tokenStorage.getExternalUserId) is required when storageMode is 'hosted'"
+    );
+  }
+  function verifyCsrfOrigin(request) {
+    const origin = request.headers.get("origin");
+    const referer = request.headers.get("referer");
+    const source = origin ?? (referer ? new URL(referer).origin : null);
+    if (!source) {
+      return false;
+    }
+    try {
+      const requestOrigin = new URL(request.url).origin;
+      return source === requestOrigin;
+    } catch {
+      return false;
+    }
+  }
+  async function authorize(request) {
+    try {
+      const state = crypto.randomUUID();
+      const cookieStore = await (0, import_headers.cookies)();
+      cookieStore.set("quota_oauth_state", state, {
+        httpOnly: true,
+        secure: true,
+        sameSite: "lax",
+        maxAge: 60 * 10,
+        // 10 minutes
+        path: "/"
+      });
+      const url = new URL(request.url);
+      const redirectUri = new URL(callbackPath, url.origin).toString();
+      const authUrl = new URL("/oauth/authorize", baseUrl);
+      authUrl.searchParams.set("response_type", "code");
+      authUrl.searchParams.set("client_id", config.clientId);
+      authUrl.searchParams.set("redirect_uri", redirectUri);
+      authUrl.searchParams.set("state", state);
+      authUrl.searchParams.set("scope", "credits:use");
+      return Response.redirect(authUrl.toString(), 302);
+    } catch (error) {
+      console.error("Quota authorize error:", error);
+      const redirectUrl = new URL(errorRedirect, new URL(request.url).origin);
+      redirectUrl.searchParams.set("quota_error", "auth_failed");
+      return Response.redirect(redirectUrl.toString(), 302);
+    }
+  }
+  async function callback(request) {
+    const url = new URL(request.url);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    const error = url.searchParams.get("error");
+    const errorDescription = url.searchParams.get("error_description");
+    if (error) {
+      const redirectUrl = new URL(errorRedirect, url.origin);
+      redirectUrl.searchParams.set("quota_error", error);
+      if (errorDescription) {
+        redirectUrl.searchParams.set(
+          "quota_error_description",
+          errorDescription
+        );
+      }
+      return Response.redirect(redirectUrl.toString(), 302);
+    }
+    if (!code || !state) {
+      const redirectUrl = new URL(errorRedirect, url.origin);
+      redirectUrl.searchParams.set("quota_error", "invalid_callback");
+      return Response.redirect(redirectUrl.toString(), 302);
+    }
+    const cookieStore = await (0, import_headers.cookies)();
+    const storedState = cookieStore.get("quota_oauth_state")?.value;
+    if (!storedState || storedState !== state) {
+      const redirectUrl = new URL(errorRedirect, url.origin);
+      redirectUrl.searchParams.set("quota_error", "state_mismatch");
+      return Response.redirect(redirectUrl.toString(), 302);
+    }
+    cookieStore.delete("quota_oauth_state");
+    try {
+      const redirectUri = new URL(callbackPath, url.origin).toString();
+      const tokenBody = {
+        grant_type: "authorization_code",
+        code,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectUri
+      };
+      if (storageMode === "hosted") {
+        const externalUserId = await resolveExternalUserId(request);
+        if (!externalUserId) {
+          throw new Error(
+            "getExternalUserId is required for hosted storage mode"
+          );
+        }
+        tokenBody.storage_mode = "hosted";
+        tokenBody.external_user_id = externalUserId;
+      }
+      const tokenResponse = await fetch(`${baseUrl}/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(tokenBody),
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+      });
+      if (!tokenResponse.ok) {
+        const redirectUrl2 = new URL(errorRedirect, url.origin);
+        redirectUrl2.searchParams.set("quota_error", "token_exchange_failed");
+        return Response.redirect(redirectUrl2.toString(), 302);
+      }
+      const tokenData = await tokenResponse.json();
+      if ("access_token" in tokenData) {
+        if (tokenStorage) {
+          await tokenStorage.setTokens(
+            {
+              accessToken: tokenData.access_token,
+              refreshToken: tokenData.refresh_token,
+              expiresIn: tokenData.expires_in
+            },
+            request
+          );
+        } else {
+          cookieStore.set(
+            `${cookiePrefix}_access_token`,
+            tokenData.access_token,
+            {
+              httpOnly: true,
+              secure: true,
+              sameSite: "lax",
+              path: "/",
+              maxAge: cookieMaxAge
+            }
+          );
+          cookieStore.set(
+            `${cookiePrefix}_refresh_token`,
+            tokenData.refresh_token,
+            {
+              httpOnly: true,
+              secure: true,
+              sameSite: "lax",
+              path: "/",
+              maxAge: cookieMaxAge
+            }
+          );
+        }
+        if (config.callbacks?.onConnect) {
+          const userResponse = await fetch(`${baseUrl}/v1/me`, {
+            headers: { Authorization: `Bearer ${tokenData.access_token}` },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+          });
+          if (userResponse.ok) {
+            const user = await userResponse.json();
+            await config.callbacks.onConnect({
+              user,
+              accessToken: tokenData.access_token,
+              refreshToken: tokenData.refresh_token,
+              expiresIn: tokenData.expires_in,
+              request
+            });
+          }
+        }
+      }
+      if ("storage_mode" in tokenData && tokenData.storage_mode === "hosted") {
+        cookieStore.set(
+          `${cookiePrefix}_external_user_id`,
+          tokenData.external_user_id,
+          {
+            httpOnly: true,
+            secure: true,
+            sameSite: "lax",
+            path: "/",
+            maxAge: cookieMaxAge
+          }
+        );
+        if (config.callbacks?.onConnect) {
+          await config.callbacks.onConnect({
+            user: tokenData.user,
+            accessToken: "",
+            refreshToken: "",
+            expiresIn: 0,
+            request
+          });
+        }
+      }
+      const redirectUrl = new URL(successRedirect, url.origin);
+      redirectUrl.searchParams.set("quota_connected", "true");
+      return Response.redirect(redirectUrl.toString(), 302);
+    } catch (error2) {
+      console.error("Quota callback error:", error2);
+      const redirectUrl = new URL(errorRedirect, url.origin);
+      redirectUrl.searchParams.set("quota_error", "callback_failed");
+      return Response.redirect(redirectUrl.toString(), 302);
+    }
+  }
+  async function status(request) {
+    try {
+      const accessToken = await getAccessToken(request);
+      if (!accessToken) {
+        return Response.json({ connected: false });
+      }
+      const response = await fetch(`${baseUrl}/v1/me`, {
+        headers: { Authorization: `Bearer ${accessToken}` },
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+      });
+      if (!response.ok) {
+        if (response.status === 401) {
+          const refreshed = await refreshToken(request);
+          if (refreshed) {
+            const retryResponse = await fetch(`${baseUrl}/v1/me`, {
+              headers: { Authorization: `Bearer ${refreshed}` },
+              signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+            });
+            if (retryResponse.ok) {
+              const user2 = await retryResponse.json();
+              return Response.json({
+                connected: true,
+                email: user2.email,
+                balance: user2.balance
+              });
+            }
+          }
+        }
+        if (response.status >= 500) {
+          return Response.json(
+            { error: { code: "upstream_error", message: "Quota API error" } },
+            { status: 502 }
+          );
+        }
+        return Response.json({ connected: false });
+      }
+      const user = await response.json();
+      return Response.json({
+        connected: true,
+        email: user.email,
+        balance: user.balance
+      });
+    } catch (error) {
+      console.error("Quota status error:", error);
+      return Response.json({ connected: false });
+    }
+  }
+  async function packages(_request) {
+    try {
+      const response = await fetch(`${baseUrl}/v1/packages`, {
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+      });
+      if (!response.ok) {
+        return Response.json(
+          {
+            error: {
+              code: "upstream_error",
+              message: "Failed to fetch packages"
+            }
+          },
+          { status: 502 }
+        );
+      }
+      const data = await response.json();
+      const packageList = Array.isArray(data) ? data : data.packages;
+      return Response.json({ packages: packageList });
+    } catch (error) {
+      console.error("Quota packages error:", error);
+      return Response.json(
+        {
+          error: {
+            code: "internal_error",
+            message: "Failed to fetch packages"
+          }
+        },
+        { status: 500 }
+      );
+    }
+  }
+  async function checkout(request) {
+    if (!verifyCsrfOrigin(request)) {
+      return Response.json(
+        { error: { code: "csrf_rejected", message: "Origin mismatch" } },
+        { status: 403 }
+      );
+    }
+    try {
+      const accessToken = await getAccessToken(request);
+      if (!accessToken) {
+        return Response.json(
+          { error: { code: "not_connected", message: "Quota not connected" } },
+          { status: 401 }
+        );
+      }
+      const body = await request.json();
+      const packageId = body.packageId ?? body.package_id;
+      if (!packageId) {
+        return Response.json(
+          {
+            error: {
+              code: "bad_request",
+              message: "packageId is required"
+            }
+          },
+          { status: 400 }
+        );
+      }
+      const url = new URL(request.url);
+      const successUrl = `${url.origin}${successRedirect}?quota_purchase=success`;
+      const cancelUrl = `${url.origin}${errorRedirect}?quota_purchase=cancelled`;
+      const response = await fetch(`${baseUrl}/api/payments/checkout`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          package_id: packageId,
+          success_url: successUrl,
+          cancel_url: cancelUrl
+        }),
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+      });
+      if (!response.ok) {
+        return Response.json(
+          {
+            error: {
+              code: "checkout_failed",
+              message: "Failed to create checkout session"
+            }
+          },
+          { status: response.status }
+        );
+      }
+      const data = await response.json();
+      return Response.json({
+        checkout_url: data.url ?? data.checkout_url
+      });
+    } catch (error) {
+      console.error("Quota checkout error:", error);
+      return Response.json(
+        {
+          error: {
+            code: "internal_error",
+            message: "Failed to create checkout"
+          }
+        },
+        { status: 500 }
+      );
+    }
+  }
+  async function disconnect(request) {
+    if (!verifyCsrfOrigin(request)) {
+      return Response.json(
+        { error: { code: "csrf_rejected", message: "Origin mismatch" } },
+        { status: 403 }
+      );
+    }
+    try {
+      if (tokenStorage) {
+        await tokenStorage.deleteTokens(request);
+      } else {
+        const cookieStore = await (0, import_headers.cookies)();
+        cookieStore.delete(`${cookiePrefix}_access_token`);
+        cookieStore.delete(`${cookiePrefix}_refresh_token`);
+        cookieStore.delete(`${cookiePrefix}_external_user_id`);
+      }
+      if (config.callbacks?.onDisconnect) {
+        await config.callbacks.onDisconnect(request);
+      }
+      return Response.json({ success: true });
+    } catch (error) {
+      console.error("Quota disconnect error:", error);
+      return Response.json(
+        { error: { code: "internal_error", message: "Failed to disconnect" } },
+        { status: 500 }
+      );
+    }
+  }
+  async function resolveExternalUserId(request) {
+    if (tokenStorage?.getExternalUserId) {
+      return tokenStorage.getExternalUserId(request);
+    }
+    if (config.getExternalUserId) {
+      return config.getExternalUserId(request);
+    }
+    return null;
+  }
+  async function getAccessToken(request) {
+    if (storageMode === "hosted") {
+      return null;
+    }
+    if (tokenStorage) {
+      const tokens = await tokenStorage.getTokens(request);
+      return tokens?.accessToken ?? null;
+    }
+    const cookieStore = await (0, import_headers.cookies)();
+    return cookieStore.get(`${cookiePrefix}_access_token`)?.value ?? null;
+  }
+  async function getRefreshToken(request) {
+    if (tokenStorage) {
+      const tokens = await tokenStorage.getTokens(request);
+      return tokens?.refreshToken ?? null;
+    }
+    const cookieStore = await (0, import_headers.cookies)();
+    return cookieStore.get(`${cookiePrefix}_refresh_token`)?.value ?? null;
+  }
+  async function refreshToken(request) {
+    const refreshTokenValue = await getRefreshToken(request);
+    if (!refreshTokenValue) {
+      return null;
+    }
+    return refreshAndPersistTokens({
+      refreshToken: refreshTokenValue,
+      clientId: config.clientId,
+      clientSecret: config.clientSecret,
+      baseUrl,
+      tokenStorage,
+      request,
+      writeCookies: async (tokenData) => {
+        const cookieStore = await (0, import_headers.cookies)();
+        cookieStore.set(
+          `${cookiePrefix}_access_token`,
+          tokenData.access_token,
+          {
+            httpOnly: true,
+            secure: true,
+            sameSite: "lax",
+            path: "/",
+            maxAge: cookieMaxAge
+          }
+        );
+        cookieStore.set(
+          `${cookiePrefix}_refresh_token`,
+          tokenData.refresh_token,
+          {
+            httpOnly: true,
+            secure: true,
+            sameSite: "lax",
+            path: "/",
+            maxAge: cookieMaxAge
+          }
+        );
+      }
+    });
+  }
+  return {
+    authorize,
+    callback,
+    status,
+    packages,
+    checkout,
+    disconnect
+  };
+}
+
+// src/with-quota-auth.ts
+var import_headers2 = require("next/headers");
+var DEFAULT_BASE_URL2 = "https://api.usequota.app";
+var DEFAULT_COOKIE_PREFIX2 = "quota";
+var DEFAULT_COOKIE_MAX_AGE2 = 60 * 60 * 24 * 7;
+function withQuotaAuth(config, handler) {
+  const baseUrl = config.baseUrl ?? DEFAULT_BASE_URL2;
+  const cookiePrefix = config.cookiePrefix ?? DEFAULT_COOKIE_PREFIX2;
+  const cookieMaxAge = config.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE2;
+  const storageMode = config.storageMode ?? "client";
+  const tokenStorage = config.tokenStorage;
+  if (storageMode === "hosted" && !config.getExternalUserId && !tokenStorage?.getExternalUserId) {
+    throw new Error(
+      "getExternalUserId is required when storageMode is 'hosted'"
+    );
+  }
+  return async (request) => {
+    try {
+      let accessToken;
+      let user;
+      if (storageMode === "hosted") {
+        let externalUserId = null;
+        if (tokenStorage?.getExternalUserId) {
+          externalUserId = await tokenStorage.getExternalUserId(request);
+        } else if (config.getExternalUserId) {
+          externalUserId = await config.getExternalUserId(request);
+        }
+        if (!externalUserId) {
+          throw new QuotaError(
+            "getExternalUserId is required for hosted storage mode",
+            "configuration_error",
+            500
+          );
+        }
+        const response = await fetch(`${baseUrl}/v1/me`, {
+          headers: {
+            "X-Quota-Client-Id": config.clientId,
+            "X-Quota-Client-Secret": config.clientSecret,
+            "X-Quota-User": externalUserId
+          },
+          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+        });
+        if (!response.ok) {
+          if (response.status === 401 || response.status === 404) {
+            throw new QuotaNotConnectedError();
+          }
+          throw new QuotaError(
+            `Failed to fetch user: ${response.statusText}`,
+            "api_error",
+            response.status
+          );
+        }
+        user = await response.json();
+        accessToken = "";
+      } else {
+        let token;
+        let refreshTokenValue;
+        if (tokenStorage) {
+          const tokens = await tokenStorage.getTokens(request);
+          token = tokens?.accessToken ?? null;
+          refreshTokenValue = tokens?.refreshToken ?? null;
+        } else {
+          const cookieStore = await (0, import_headers2.cookies)();
+          token = cookieStore.get(`${cookiePrefix}_access_token`)?.value ?? null;
+          refreshTokenValue = cookieStore.get(`${cookiePrefix}_refresh_token`)?.value ?? null;
+        }
+        if (!token) {
+          throw new QuotaNotConnectedError();
+        }
+        let response = await fetch(`${baseUrl}/v1/me`, {
+          headers: { Authorization: `Bearer ${token}` },
+          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+        });
+        if (response.status === 401) {
+          if (!refreshTokenValue) {
+            throw new QuotaTokenExpiredError();
+          }
+          const newAccessToken = await refreshAndPersistTokens({
+            refreshToken: refreshTokenValue,
+            clientId: config.clientId,
+            clientSecret: config.clientSecret,
+            baseUrl,
+            tokenStorage,
+            request,
+            writeCookies: async (tokenData) => {
+              const cookieStore = await (0, import_headers2.cookies)();
+              cookieStore.set(
+                `${cookiePrefix}_access_token`,
+                tokenData.access_token,
+                {
+                  httpOnly: true,
+                  secure: true,
+                  sameSite: "lax",
+                  path: "/",
+                  maxAge: cookieMaxAge
+                }
+              );
+              cookieStore.set(
+                `${cookiePrefix}_refresh_token`,
+                tokenData.refresh_token,
+                {
+                  httpOnly: true,
+                  secure: true,
+                  sameSite: "lax",
+                  path: "/",
+                  maxAge: cookieMaxAge
+                }
+              );
+            }
+          });
+          if (!newAccessToken) {
+            throw new QuotaTokenExpiredError();
+          }
+          response = await fetch(`${baseUrl}/v1/me`, {
+            headers: { Authorization: `Bearer ${newAccessToken}` },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+          });
+          if (!response.ok) {
+            throw new QuotaTokenExpiredError();
+          }
+          accessToken = newAccessToken;
+        } else if (!response.ok) {
+          throw new QuotaError(
+            `Failed to fetch user: ${response.statusText}`,
+            "api_error",
+            response.status
+          );
+        } else {
+          accessToken = token;
+        }
+        user = await response.json();
+      }
+      return await handler(request, { user, accessToken });
+    } catch (error) {
+      if (error instanceof QuotaNotConnectedError) {
+        return Response.json(
+          { error: { code: error.code, message: error.message } },
+          { status: 401 }
+        );
+      }
+      if (error instanceof QuotaTokenExpiredError) {
+        return Response.json(
+          {
+            error: {
+              code: error.code,
+              message: error.message,
+              hint: error.hint
+            }
+          },
+          { status: 401 }
+        );
+      }
+      if (error instanceof QuotaInsufficientCreditsError) {
+        return Response.json(
+          {
+            error: {
+              code: error.code,
+              message: error.message,
+              hint: error.hint
+            }
+          },
+          { status: 402 }
+        );
+      }
+      if (error instanceof QuotaRateLimitError) {
+        return new Response(
+          JSON.stringify({
+            error: {
+              code: error.code,
+              message: error.message
+            }
+          }),
+          {
+            status: 429,
+            headers: {
+              "Content-Type": "application/json",
+              "Retry-After": String(error.retryAfter)
+            }
+          }
+        );
+      }
+      if (error instanceof QuotaError) {
+        return Response.json(
+          { error: { code: error.code, message: error.message } },
+          { status: error.statusCode }
+        );
+      }
+      console.error("withQuotaAuth unexpected error:", error);
+      return Response.json(
+        { error: { code: "internal_error", message: "Internal server error" } },
+        { status: 500 }
+      );
+    }
+  };
+}
+
+// src/server.ts
+var import_headers3 = require("next/headers");
+var DEFAULT_BASE_URL3 = "https://api.usequota.app";
+var DEFAULT_COOKIE_PREFIX3 = "quota";
+var DEFAULT_STORAGE_MODE = "client";
+var DEFAULT_COOKIE_MAX_AGE3 = 60 * 60 * 24 * 7;
+async function getQuotaUser(config) {
+  const baseUrl = config.baseUrl ?? DEFAULT_BASE_URL3;
+  const cookiePrefix = config.cookiePrefix ?? DEFAULT_COOKIE_PREFIX3;
+  const cookieMaxAge = config.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE3;
+  const storageMode = config.storageMode ?? DEFAULT_STORAGE_MODE;
+  try {
+    if (storageMode === "hosted") {
+      if (!config.getExternalUserId) {
+        throw new Error(
+          "getExternalUserId is required for hosted storage mode"
+        );
+      }
+      const externalUserId = await config.getExternalUserId();
+      const response2 = await fetch(`${baseUrl}/v1/me`, {
+        headers: {
+          "X-Quota-Client-Id": config.clientId,
+          "X-Quota-Client-Secret": config.clientSecret,
+          "X-Quota-User": externalUserId
+        },
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+      });
+      if (!response2.ok) {
+        if (response2.status === 401 || response2.status === 404) {
+          return null;
+        }
+        throw new Error(`Failed to fetch user: ${response2.statusText}`);
+      }
+      return await response2.json();
+    }
+    const cookieStore = await (0, import_headers3.cookies)();
+    const accessToken = cookieStore.get(`${cookiePrefix}_access_token`)?.value;
+    if (!accessToken) {
+      return null;
+    }
+    const response = await fetch(`${baseUrl}/v1/me`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`
+      },
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      if (response.status === 401) {
+        const refreshTokenValue = cookieStore.get(
+          `${cookiePrefix}_refresh_token`
+        )?.value;
+        if (refreshTokenValue) {
+          const refreshed = await refreshAccessTokenWithCredentials({
+            refreshToken: refreshTokenValue,
+            clientId: config.clientId,
+            clientSecret: config.clientSecret,
+            baseUrl
+          });
+          if (refreshed) {
+            cookieStore.set(
+              `${cookiePrefix}_access_token`,
+              refreshed.access_token,
+              {
+                httpOnly: true,
+                secure: true,
+                sameSite: "lax",
+                path: "/",
+                maxAge: cookieMaxAge
+              }
+            );
+            cookieStore.set(
+              `${cookiePrefix}_refresh_token`,
+              refreshed.refresh_token,
+              {
+                httpOnly: true,
+                secure: true,
+                sameSite: "lax",
+                path: "/",
+                maxAge: cookieMaxAge
+              }
+            );
+            const retryResponse = await fetch(`${baseUrl}/v1/me`, {
+              headers: {
+                Authorization: `Bearer ${refreshed.access_token}`
+              },
+              signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+            });
+            if (retryResponse.ok) {
+              return await retryResponse.json();
+            }
+          }
+        }
+      }
+      return null;
+    }
+    return await response.json();
+  } catch (error) {
+    console.error("Failed to get Quota user:", error);
+    return null;
+  }
+}
+async function requireQuotaAuth(config) {
+  const user = await getQuotaUser(config);
+  if (!user) {
+    const { redirect } = await import("next/navigation");
+    redirect("/");
+    throw new QuotaNotConnectedError("Redirecting to /");
+  }
+  return user;
+}
+async function getQuotaPackages(config) {
+  const baseUrl = config?.baseUrl ?? DEFAULT_BASE_URL3;
+  try {
+    const response = await fetch(`${baseUrl}/v1/packages`, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to fetch packages: ${response.statusText}`);
+    }
+    return await response.json();
+  } catch (error) {
+    console.error("Failed to get Quota packages:", error);
+    return [];
+  }
+}
+async function createQuotaCheckout(config) {
+  const baseUrl = config.baseUrl ?? DEFAULT_BASE_URL3;
+  const cookiePrefix = config.cookiePrefix ?? DEFAULT_COOKIE_PREFIX3;
+  const storageMode = config.storageMode ?? DEFAULT_STORAGE_MODE;
+  try {
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    if (storageMode === "hosted") {
+      if (!config.getExternalUserId) {
+        throw new Error(
+          "getExternalUserId is required for hosted storage mode"
+        );
+      }
+      const externalUserId = await config.getExternalUserId();
+      headers["X-Quota-Client-Id"] = config.clientId;
+      headers["X-Quota-Client-Secret"] = config.clientSecret;
+      headers["X-Quota-User"] = externalUserId;
+    } else {
+      const cookieStore = await (0, import_headers3.cookies)();
+      const accessToken = cookieStore.get(
+        `${cookiePrefix}_access_token`
+      )?.value;
+      if (!accessToken) {
+        throw new QuotaNotConnectedError("Not authenticated");
+      }
+      headers["Authorization"] = `Bearer ${accessToken}`;
+    }
+    const response = await fetch(`${baseUrl}/api/payments/checkout`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        package_id: config.packageId,
+        success_url: config.successUrl,
+        cancel_url: config.cancelUrl
+      }),
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to create checkout: ${response.statusText}`);
+    }
+    const data = await response.json();
+    return data.url;
+  } catch (error) {
+    console.error("Failed to create Quota checkout:", error);
+    throw error;
+  }
+}
+async function clearQuotaAuth(config) {
+  const cookiePrefix = config?.cookiePrefix ?? DEFAULT_COOKIE_PREFIX3;
+  try {
+    const cookieStore = await (0, import_headers3.cookies)();
+    cookieStore.delete(`${cookiePrefix}_access_token`);
+    cookieStore.delete(`${cookiePrefix}_refresh_token`);
+    cookieStore.delete(`${cookiePrefix}_external_user_id`);
+  } catch (error) {
+    console.error("Failed to clear Quota auth:", error);
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  QuotaError,
+  QuotaInsufficientCreditsError,
+  QuotaNotConnectedError,
+  QuotaRateLimitError,
+  QuotaTokenExpiredError,
+  clearQuotaAuth,
+  createQuotaCheckout,
+  createQuotaRouteHandlers,
+  errorFromResponse,
+  getQuotaPackages,
+  getQuotaUser,
+  requireQuotaAuth,
+  withQuotaAuth
+});