@withwiz/toolkit 0.9.3 → 0.11.0

package/dist/{chunk-XDB3K74B.js → chunk-2QO7YXTF.js}

@@ -1,7 +1,7 @@
 import {
   cache,
   geoCache
-} from "./chunk-BICSVLN7.js";
+} from "./chunk-NAFMJT62.js";
 
 // src/core/cache/cache-invalidation.ts
 var invalidateCache = {

package/dist/{chunk-ISP4MDKW.js → chunk-5MPMPXIR.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-5GWGARXI.js";
 import {
   getTokenDeliveryStrategy
-} from "./chunk-NERL6VYQ.js";
+} from "./chunk-HNFYO5XV.js";
 import {
   JWT_DEFAULTS,
   ROLE_DEFAULTS

package/dist/{chunk-KMUYO6YD.js → chunk-6E2Q27EN.js}

@@ -1,6 +1,6 @@
 import {
   clearTokenCookies
-} from "./chunk-BOABYFJ7.js";
+} from "./chunk-DTRXWS7G.js";
 
 // src/next/auth-handlers/logout.handler.ts
 import { NextResponse } from "next/server";

package/dist/chunk-6NFMRZWB.js

@@ -0,0 +1,8 @@
+// src/core/auth/cookie-names.ts
+var ACCESS_TOKEN_COOKIE = "access_token";
+var REFRESH_TOKEN_COOKIE = "refresh_token";
+
+export {
+  ACCESS_TOKEN_COOKIE,
+  REFRESH_TOKEN_COOKIE
+};

package/dist/{chunk-OXKVQGRH.js → chunk-7IOAGJMK.js}

@@ -1,15 +1,3 @@
-import {
-  errorHandlerMiddleware
-} from "./chunk-4Y5MRUMX.js";
-import {
-  initRequestMiddleware
-} from "./chunk-VC2E6KYQ.js";
-import {
-  MiddlewareChain
-} from "./chunk-WXOWI7BJ.js";
-import {
-  rateLimitMiddleware
-} from "./chunk-TRGFXIEF.js";
 import {
   responseLoggerMiddleware
 } from "./chunk-LCYDMYZS.js";
@@ -20,10 +8,22 @@ import {
   adminMiddleware,
   authMiddleware,
   optionalAuthMiddleware
-} from "./chunk-CNXK3SLK.js";
+} from "./chunk-MJOXTFIC.js";
 import {
   corsMiddleware
 } from "./chunk-37VGD4VX.js";
+import {
+  errorHandlerMiddleware
+} from "./chunk-4Y5MRUMX.js";
+import {
+  initRequestMiddleware
+} from "./chunk-VC2E6KYQ.js";
+import {
+  MiddlewareChain
+} from "./chunk-WXOWI7BJ.js";
+import {
+  rateLimitMiddleware
+} from "./chunk-TRGFXIEF.js";
 
 // src/next/middleware/wrappers.ts
 function withPublicApi(handler) {

package/dist/{chunk-ROMGYJFX.js → chunk-AWFP2KAU.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-LWHLB2Y6.js";
 import {
   getTokenDeliveryStrategy
-} from "./chunk-NERL6VYQ.js";
+} from "./chunk-HNFYO5XV.js";
 import {
   JWT_DEFAULTS
 } from "./chunk-7YWUKMZD.js";

package/dist/chunk-BTNM5YSU.js

@@ -0,0 +1,29 @@
+// src/core/api-key/validate.ts
+function validateApiKeyRecord(record, opts) {
+  var _a, _b;
+  if (!record) return { valid: false, error: "INVALID_API_KEY", message: "Invalid API key" };
+  if (!record.isActive) return { valid: false, error: "INACTIVE_API_KEY", message: "API key is inactive" };
+  if (record.expiresAt && record.expiresAt < /* @__PURE__ */ new Date())
+    return { valid: false, error: "EXPIRED_API_KEY", message: "API key has expired" };
+  if (!record.user.isActive) return { valid: false, error: "INACTIVE_USER", message: "User account is inactive" };
+  if (((_a = opts.freemiumPlans) != null ? _a : []).includes(record.user.plan))
+    return { valid: false, error: "PLAN_RESTRICTED", message: "API access is not available for this plan. Please upgrade." };
+  return {
+    valid: true,
+    apiKey: {
+      id: record.id,
+      userId: record.user.id,
+      permissions: record.permissions,
+      rateLimit: record.rateLimit,
+      endpointLimits: (_b = record.endpointLimits) != null ? _b : void 0,
+      ipWhitelist: record.ipWhitelist,
+      environment: record.environment,
+      expiresAt: record.expiresAt
+    },
+    user: { id: record.user.id, email: record.user.email, plan: record.user.plan }
+  };
+}
+
+export {
+  validateApiKeyRecord
+};

package/dist/{chunk-VQ47YRFC.js → chunk-DISEIUYD.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-MTZXWVW3.js";
 import {
   OAuthManager
-} from "./chunk-V3GEYUBG.js";
+} from "./chunk-UQ3Z3ZAF.js";
 import {
   OAUTH_STATE_COOKIE,
   clearOAuthStateCookie,
@@ -14,7 +14,7 @@ import {
 } from "./chunk-5GWGARXI.js";
 import {
   setTokenCookies
-} from "./chunk-BOABYFJ7.js";
+} from "./chunk-DTRXWS7G.js";
 
 // src/next/auth-handlers/oauth-callback.handler.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-BOABYFJ7.js → chunk-DTRXWS7G.js}

@@ -1,6 +1,6 @@
 import {
   getAuthConfig
-} from "./chunk-N3TCQ5BF.js";
+} from "./chunk-TQMQ5XXG.js";
 import {
   JWT_DEFAULTS
 } from "./chunk-7YWUKMZD.js";
@@ -8,6 +8,11 @@ import {
   durationToSeconds
 } from "./chunk-OVOBSYR4.js";
 import {
+  ACCESS_TOKEN_COOKIE,
+  REFRESH_TOKEN_COOKIE
+} from "./chunk-6NFMRZWB.js";
+import {
+  __spreadProps,
   __spreadValues
 } from "./chunk-N3ETBM74.js";
 
@@ -38,39 +43,43 @@ function setTokenCookies(response, tokenPair, options = {}) {
   var _a, _b, _c;
   const opts = __spreadValues(__spreadValues({}, getDefaultOptions()), options);
   const maxAge = resolveMaxAge();
-  response.cookies.set("access_token", tokenPair.accessToken, {
+  response.cookies.set(ACCESS_TOKEN_COOKIE, tokenPair.accessToken, __spreadProps(__spreadValues({
     httpOnly: true,
     secure: opts.secure,
     sameSite: opts.sameSite,
-    path: "/",
+    path: "/"
+  }, opts.domain ? { domain: opts.domain } : {}), {
     maxAge: (_a = opts.accessTokenMaxAge) != null ? _a : maxAge.access
-  });
-  response.cookies.set("refresh_token", tokenPair.refreshToken, {
+  }));
+  response.cookies.set(REFRESH_TOKEN_COOKIE, tokenPair.refreshToken, __spreadProps(__spreadValues({
     httpOnly: true,
     secure: opts.secure,
     sameSite: opts.sameSite,
-    path: (_b = opts.refreshTokenPath) != null ? _b : "/api/auth",
+    path: (_b = opts.refreshTokenPath) != null ? _b : "/api/auth"
+  }, opts.domain ? { domain: opts.domain } : {}), {
     maxAge: (_c = opts.refreshTokenMaxAge) != null ? _c : maxAge.refresh
-  });
+  }));
   return response;
 }
 function clearTokenCookies(response, options = {}) {
   var _a;
   const opts = __spreadValues(__spreadValues({}, getDefaultOptions()), options);
-  response.cookies.set("access_token", "", {
+  response.cookies.set(ACCESS_TOKEN_COOKIE, "", __spreadProps(__spreadValues({
     httpOnly: true,
     secure: opts.secure,
     sameSite: opts.sameSite,
-    path: "/",
+    path: "/"
+  }, opts.domain ? { domain: opts.domain } : {}), {
     maxAge: 0
-  });
-  response.cookies.set("refresh_token", "", {
+  }));
+  response.cookies.set(REFRESH_TOKEN_COOKIE, "", __spreadProps(__spreadValues({
     httpOnly: true,
     secure: opts.secure,
     sameSite: opts.sameSite,
-    path: (_a = opts.refreshTokenPath) != null ? _a : "/api/auth",
+    path: (_a = opts.refreshTokenPath) != null ? _a : "/api/auth"
+  }, opts.domain ? { domain: opts.domain } : {}), {
     maxAge: 0
-  });
+  }));
   return response;
 }
 

package/dist/{chunk-NERL6VYQ.js → chunk-HNFYO5XV.js}

@@ -1,9 +1,13 @@
 import {
   setTokenCookies
-} from "./chunk-BOABYFJ7.js";
+} from "./chunk-DTRXWS7G.js";
 import {
   getAuthConfig
-} from "./chunk-N3TCQ5BF.js";
+} from "./chunk-TQMQ5XXG.js";
+import {
+  ACCESS_TOKEN_COOKIE,
+  REFRESH_TOKEN_COOKIE
+} from "./chunk-6NFMRZWB.js";
 import {
   __spreadValues
 } from "./chunk-N3ETBM74.js";
@@ -21,11 +25,11 @@ async function readBodyRefreshToken(source) {
 var cookieStrategy = {
   extractAccessToken: (source) => {
     var _a, _b;
-    return (_b = (_a = source.cookies.get("access_token")) == null ? void 0 : _a.value) != null ? _b : null;
+    return (_b = (_a = source.cookies.get(ACCESS_TOKEN_COOKIE)) == null ? void 0 : _a.value) != null ? _b : null;
   },
   extractRefreshToken: async (source) => {
     var _a;
-    return (_a = source.cookies.get("refresh_token")) == null ? void 0 : _a.value;
+    return (_a = source.cookies.get(REFRESH_TOKEN_COOKIE)) == null ? void 0 : _a.value;
   },
   buildTokenResponse: (body) => body,
   attachCookies: (response, tokens, options) => setTokenCookies(response, tokens, options)
@@ -39,12 +43,12 @@ var headerStrategy = {
 var hybridStrategy = {
   extractAccessToken: (source, parseHeader) => {
     var _a, _b;
-    return (_b = (_a = source.cookies.get("access_token")) == null ? void 0 : _a.value) != null ? _b : parseHeader(source.headers.get("authorization"));
+    return (_b = (_a = source.cookies.get(ACCESS_TOKEN_COOKIE)) == null ? void 0 : _a.value) != null ? _b : parseHeader(source.headers.get("authorization"));
   },
   // 쿠키 우선 — 쿠키가 있으면 body 를 소비하지 않는다 (빈 body 요청 보호)
   extractRefreshToken: async (source) => {
     var _a, _b;
-    return (_b = (_a = source.cookies.get("refresh_token")) == null ? void 0 : _a.value) != null ? _b : await readBodyRefreshToken(source);
+    return (_b = (_a = source.cookies.get(REFRESH_TOKEN_COOKIE)) == null ? void 0 : _a.value) != null ? _b : await readBodyRefreshToken(source);
   },
   buildTokenResponse: (body, fragment) => __spreadValues(__spreadValues({}, body), fragment),
   attachCookies: (response, tokens, options) => setTokenCookies(response, tokens, options)

package/dist/{chunk-ZVGEGDYF.js → chunk-JRORMRVN.js}

@@ -1,6 +1,6 @@
 import {
   OAuthManager
-} from "./chunk-V3GEYUBG.js";
+} from "./chunk-UQ3Z3ZAF.js";
 import {
   generateOAuthState,
   setOAuthStateCookie

package/dist/chunk-L2A6NGW7.js

@@ -0,0 +1,21 @@
+// src/next/oapi/openapi-spec.ts
+function buildOpenApiSpec(input) {
+  var _a, _b;
+  return {
+    openapi: "3.0.3",
+    info: input.info,
+    servers: (_a = input.servers) != null ? _a : [],
+    paths: input.paths,
+    components: {
+      securitySchemes: {
+        ApiKeyAuth: { type: "apiKey", in: "header", name: "X-API-Key" }
+      },
+      schemas: (_b = input.schemas) != null ? _b : {}
+    },
+    security: [{ ApiKeyAuth: [] }]
+  };
+}
+
+export {
+  buildOpenApiSpec
+};

package/dist/{chunk-CNXK3SLK.js → chunk-MJOXTFIC.js}

@@ -12,10 +12,10 @@ import {
 } from "./chunk-LWHLB2Y6.js";
 import {
   getTokenDeliveryStrategy
-} from "./chunk-NERL6VYQ.js";
+} from "./chunk-HNFYO5XV.js";
 import {
   getAuthConfig
-} from "./chunk-N3TCQ5BF.js";
+} from "./chunk-TQMQ5XXG.js";
 import {
   ROLE_DEFAULTS
 } from "./chunk-7YWUKMZD.js";

package/dist/chunk-NUHSUAXG.js

@@ -0,0 +1,35 @@
+// src/core/api-key/ip-whitelist.ts
+function isIpInCidr(ip, cidr) {
+  try {
+    const [range, bits] = cidr.split("/");
+    const mask = parseInt(bits, 10);
+    if (Number.isNaN(mask) || mask < 0 || mask > 32) return false;
+    const ipParts = ip.split(".").map(Number);
+    const rangeParts = range.split(".").map(Number);
+    if (ipParts.length !== 4 || rangeParts.length !== 4) return false;
+    if (![...ipParts, ...rangeParts].every((o) => Number.isInteger(o) && o >= 0 && o <= 255)) return false;
+    const ipNum = ipParts[0] << 24 | ipParts[1] << 16 | ipParts[2] << 8 | ipParts[3];
+    const rangeNum = rangeParts[0] << 24 | rangeParts[1] << 16 | rangeParts[2] << 8 | rangeParts[3];
+    const maskNum = mask === 0 ? 0 : ~0 << 32 - mask >>> 0;
+    return (ipNum & maskNum) === (rangeNum & maskNum);
+  } catch (e) {
+    return false;
+  }
+}
+function isIpAllowed(clientIp, whitelist) {
+  if (!whitelist || whitelist.length === 0) return true;
+  const normalizedIp = clientIp.replace(/^::ffff:/, "");
+  for (const allowed of whitelist) {
+    if (allowed.includes("/")) {
+      if (isIpInCidr(normalizedIp, allowed)) return true;
+    } else if (normalizedIp === allowed.replace(/^::ffff:/, "")) {
+      return true;
+    }
+  }
+  return false;
+}
+
+export {
+  isIpInCidr,
+  isIpAllowed
+};

package/dist/{chunk-3P4TZM3O.js → chunk-QBXNL6QU.js}

@@ -1,7 +1,7 @@
 import {
   getCacheManager,
   getEffectiveCacheBackend
-} from "./chunk-BICSVLN7.js";
+} from "./chunk-NAFMJT62.js";
 import {
   logger
 } from "./chunk-QAIN3WNN.js";

package/dist/chunk-RWENSBNW.js

@@ -0,0 +1,162 @@
+import {
+  validateApiKeyRecord
+} from "./chunk-BTNM5YSU.js";
+import {
+  generateRawKey,
+  hashKey,
+  keyPreview
+} from "./chunk-ZZTBIA57.js";
+import {
+  __spreadProps,
+  __spreadValues
+} from "./chunk-N3ETBM74.js";
+
+// src/core/api-key/api-key.service.ts
+var ApiKeyService = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  prefix(env) {
+    return env === "production" ? this.deps.env.prefixProd : this.deps.env.prefixDev;
+  }
+  toInfo(r) {
+    var _a, _b, _c, _d, _e;
+    return {
+      id: r.id,
+      name: r.name,
+      description: (_a = r.description) != null ? _a : void 0,
+      keyPreview: keyPreview(r.key),
+      permissions: r.permissions,
+      environment: r.environment,
+      rateLimit: r.rateLimit,
+      endpointLimits: (_b = r.endpointLimits) != null ? _b : void 0,
+      ipWhitelist: r.ipWhitelist,
+      lastUsedAt: (_c = r.lastUsedAt) != null ? _c : void 0,
+      lastUsedIp: (_d = r.lastUsedIp) != null ? _d : void 0,
+      usageCount: r.usageCount,
+      isActive: r.isActive,
+      expiresAt: (_e = r.expiresAt) != null ? _e : void 0,
+      createdAt: r.createdAt,
+      updatedAt: r.updatedAt
+    };
+  }
+  async requireOwned(id, userId, isAdmin) {
+    const rec = await this.deps.repo.findById(id);
+    if (!rec) throw new Error("API key not found");
+    if (!isAdmin && rec.userId !== userId) throw new Error("Unauthorized");
+    return rec;
+  }
+  async generateApiKey(userId, options, plan) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    const { repo, planConfig, env } = this.deps;
+    if (env.restrictedPlans.includes(plan)) {
+      throw new Error(`API key is not available for the ${plan} plan. Please upgrade.`);
+    }
+    const maxKeys = await planConfig.getApiKeyLimit(plan);
+    const active = await repo.countActive(userId);
+    if (active >= maxKeys) throw new Error(`API key limit reached. Max ${maxKeys} keys.`);
+    const rawKey = generateRawKey(this.prefix(options.environment));
+    const planRate = await planConfig.getRateLimit(plan);
+    const rateLimit = options.customRateLimit ? Math.min(options.customRateLimit, planRate) : planRate;
+    const expiresAt = (_a = options.expiresAt) != null ? _a : new Date(Date.now() + env.defaultExpiryDays * 864e5);
+    const created = await repo.create({
+      userId,
+      key: hashKey(rawKey),
+      name: options.name,
+      description: (_b = options.description) != null ? _b : null,
+      permissions: options.permissions,
+      rateLimit,
+      endpointLimits: (_c = options.endpointLimits) != null ? _c : null,
+      environment: options.environment,
+      ipWhitelist: (_d = options.ipWhitelist) != null ? _d : [],
+      expiresAt
+    });
+    return {
+      id: created.id,
+      key: rawKey,
+      name: created.name,
+      description: (_e = created.description) != null ? _e : void 0,
+      permissions: created.permissions,
+      environment: created.environment,
+      rateLimit: created.rateLimit,
+      endpointLimits: (_f = created.endpointLimits) != null ? _f : void 0,
+      expiresAt: (_g = created.expiresAt) != null ? _g : void 0,
+      createdAt: created.createdAt
+    };
+  }
+  async validateApiKey(rawKey) {
+    var _a;
+    const { repo, cache, env } = this.deps;
+    const keyHash = hashKey(rawKey);
+    const cached = await cache.getValidation(keyHash);
+    if (cached) {
+      const exp = (_a = cached.apiKey) == null ? void 0 : _a.expiresAt;
+      if (!(exp && new Date(exp) < /* @__PURE__ */ new Date())) return cached;
+      await cache.invalidate(keyHash);
+    }
+    const record = await repo.findByHash(keyHash);
+    const result = validateApiKeyRecord(record, { freemiumPlans: env.restrictedPlans });
+    if (result.valid) await cache.setValidation(keyHash, result);
+    return result;
+  }
+  async getApiKey(id, userId, isAdmin = false) {
+    const rec = await this.requireOwned(id, userId, isAdmin);
+    return this.toInfo(rec);
+  }
+  async getApiKeys(filters, requesterId, isAdmin = false) {
+    var _a, _b;
+    const scoped = isAdmin ? filters : __spreadProps(__spreadValues({}, filters), { userId: requesterId });
+    const page = (_a = scoped.page) != null ? _a : 1, pageSize = (_b = scoped.pageSize) != null ? _b : 10;
+    const { items, total } = await this.deps.repo.findMany(__spreadProps(__spreadValues({}, scoped), { page, pageSize }));
+    return { keys: items.map((r) => this.toInfo(r)), total, page, pageSize, hasMore: total > page * pageSize };
+  }
+  async updateApiKey(id, userId, data, isAdmin = false) {
+    const rec = await this.requireOwned(id, userId, isAdmin);
+    const updated = await this.deps.repo.update(id, {
+      name: data.name,
+      description: data.description,
+      isActive: data.isActive,
+      permissions: data.permissions,
+      ipWhitelist: data.ipWhitelist,
+      rateLimit: data.customRateLimit,
+      endpointLimits: data.endpointLimits
+    });
+    await this.deps.cache.invalidate(rec.key);
+    return this.toInfo(updated);
+  }
+  async deleteApiKey(id, userId, isAdmin = false) {
+    const rec = await this.requireOwned(id, userId, isAdmin);
+    await this.deps.repo.delete(id);
+    await this.deps.cache.invalidate(rec.key);
+  }
+  async trackUsage(apiKeyId, ip) {
+    try {
+      await this.deps.repo.incrementUsage(apiKeyId, ip);
+    } catch (e) {
+    }
+  }
+  async regenerateApiKey(userId, apiKeyId, plan, options = {}) {
+    var _a, _b, _c, _d, _e;
+    const old = await this.requireOwned(apiKeyId, userId, false);
+    if (!options.keepOldKeyActive) {
+      const max = await this.deps.planConfig.getApiKeyLimit(plan);
+      if (await this.deps.repo.countActive(userId) >= max) throw new Error(`API key limit reached. Max ${max} keys.`);
+      await this.deps.repo.deactivate(apiKeyId);
+      await this.deps.cache.invalidate(old.key);
+    }
+    return this.generateApiKey(userId, {
+      name: (_a = options.name) != null ? _a : old.name,
+      description: (_c = (_b = options.description) != null ? _b : old.description) != null ? _c : void 0,
+      permissions: old.permissions,
+      environment: old.environment,
+      customRateLimit: old.rateLimit,
+      ipWhitelist: old.ipWhitelist,
+      endpointLimits: (_d = old.endpointLimits) != null ? _d : void 0,
+      expiresAt: (_e = old.expiresAt) != null ? _e : void 0
+    }, plan);
+  }
+};
+
+export {
+  ApiKeyService
+};

package/dist/{chunk-6SDUWMC3.js → chunk-RWN47K7J.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-5GWGARXI.js";
 import {
   getTokenDeliveryStrategy
-} from "./chunk-NERL6VYQ.js";
+} from "./chunk-HNFYO5XV.js";
 
 // src/next/auth-handlers/refresh.handler.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-N3TCQ5BF.js → chunk-TQMQ5XXG.js}

@@ -1,6 +1,9 @@
 import {
   JWT_DEFAULTS
 } from "./chunk-7YWUKMZD.js";
+import {
+  durationToSeconds
+} from "./chunk-OVOBSYR4.js";
 import {
   configWarn
 } from "./chunk-6J2EJVND.js";
@@ -9,6 +12,7 @@ import {
 } from "./chunk-F3R3UYBF.js";
 
 // src/core/auth/config.ts
+var LONG_ACCESS_WARN_THRESHOLD_SEC = 24 * 3600;
 function initializeAuth(config) {
   var _a, _b, _c, _d, _e;
   (_a = globalThis.__withwiz_config) != null ? _a : globalThis.__withwiz_config = {};
@@ -22,10 +26,21 @@ function initializeAuth(config) {
   if (!config.refreshTokenExpiry) {
     configWarn("Auth", `refreshTokenExpiry not provided, using default: ${JWT_DEFAULTS.DEFAULT_REFRESH_TOKEN_EXPIRES}`);
   }
+  const accessTokenExpiry = (_b = config.accessTokenExpiry) != null ? _b : JWT_DEFAULTS.DEFAULT_ACCESS_TOKEN_EXPIRES;
+  const refreshTokenExpiry = (_c = config.refreshTokenExpiry) != null ? _c : JWT_DEFAULTS.DEFAULT_REFRESH_TOKEN_EXPIRES;
+  try {
+    if (durationToSeconds(accessTokenExpiry) > LONG_ACCESS_WARN_THRESHOLD_SEC) {
+      configWarn(
+        "Auth",
+        `accessTokenExpiry(${accessTokenExpiry})\uAC00 24h\uB97C \uCD08\uACFC\uD569\uB2C8\uB2E4. refresh \uD1A0\uD070\uC774 \uC788\uB2E4\uBA74 \uC9E7\uC740 access(\uC608: 15m)\uB97C \uAD8C\uC7A5\uD569\uB2C8\uB2E4 \u2014 revoke/\uB9CC\uB8CC \uD6A8\uACFC \uADF9\uB300\uD654.`
+      );
+    }
+  } catch (e) {
+  }
   globalThis.__withwiz_config.auth = {
     jwtSecret: config.jwtSecret,
-    accessTokenExpiry: (_b = config.accessTokenExpiry) != null ? _b : JWT_DEFAULTS.DEFAULT_ACCESS_TOKEN_EXPIRES,
-    refreshTokenExpiry: (_c = config.refreshTokenExpiry) != null ? _c : JWT_DEFAULTS.DEFAULT_REFRESH_TOKEN_EXPIRES,
+    accessTokenExpiry,
+    refreshTokenExpiry,
     cookieSecure: (_d = config.cookieSecure) != null ? _d : false,
     tokenDelivery: (_e = config.tokenDelivery) != null ? _e : "hybrid"
   };

package/dist/chunk-XWHT53CZ.js

@@ -0,0 +1,38 @@
+import {
+  isIpAllowed
+} from "./chunk-NUHSUAXG.js";
+
+// src/next/oapi/api-key-auth.ts
+import { NextResponse } from "next/server";
+var err = (code, status, message) => ({ response: NextResponse.json({ success: false, error: { code, message } }, { status }) });
+function createApiKeyAuth(options) {
+  return async (req) => {
+    var _a;
+    try {
+      const apiKey = req.headers.get("x-api-key");
+      if (!apiKey) return err(40101, 401, "X-API-Key header is required");
+      const v = await options.service.validateApiKey(apiKey);
+      if (!v.valid || !v.apiKey || !v.user) return err(40101, 401, v.message || "Invalid API key");
+      const ip = options.extractClientIp(req.headers);
+      if (!isIpAllowed(ip, (_a = v.apiKey.ipWhitelist) != null ? _a : null)) return err(40301, 403, "Access denied: IP not in whitelist");
+      try {
+        const usage = await options.usage.canMakeApiCall(v.user.id, v.user.plan);
+        if (!usage.allowed) {
+          const t = usage.reason === "DAILY_LIMIT" ? "daily" : "monthly";
+          return err(40301, 403, `API ${t} usage limit exceeded. Please upgrade your plan or wait until reset.`);
+        }
+      } catch (e) {
+      }
+      options.service.trackUsage(v.apiKey.id, ip).catch(() => {
+      });
+      const role = await options.resolveRole(v.user.id);
+      return { user: { id: v.user.id, email: v.user.email, role, plan: v.user.plan, apiKeyId: v.apiKey.id } };
+    } catch (e) {
+      return err(50001, 500, "Internal authentication error");
+    }
+  };
+}
+
+export {
+  createApiKeyAuth
+};

package/dist/{chunk-7S2PCYNT.js → chunk-YBVZ5UVC.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-CRJUFA73.js";
 import {
   getAuthConfig
-} from "./chunk-N3TCQ5BF.js";
+} from "./chunk-TQMQ5XXG.js";
 import {
   getCommonConfig
 } from "./chunk-PX535BHW.js";

package/dist/chunk-Z4J452HD.js

@@ -0,0 +1,24 @@
+// src/next/oapi/helpers.ts
+import { NextResponse } from "next/server";
+function parsePaginationParams(sp) {
+  const page = Math.max(1, parseInt(sp.get("page") || "1", 10) || 1);
+  const pageSize = Math.min(100, Math.max(1, parseInt(sp.get("pageSize") || "10", 10) || 10));
+  return { page, pageSize };
+}
+function createPaginationMeta(total, page, pageSize) {
+  return { total, page, pageSize, hasMore: total > page * pageSize };
+}
+function parseSearchParams(sp) {
+  return { search: sp.get("search") || void 0 };
+}
+function requireParam(value, label) {
+  if (!value) return NextResponse.json({ success: false, error: { code: 40001, message: `${label} is required` } }, { status: 400 });
+  return null;
+}
+
+export {
+  parsePaginationParams,
+  createPaginationMeta,
+  parseSearchParams,
+  requireParam
+};

package/dist/chunk-ZZTBIA57.js

@@ -0,0 +1,18 @@
+// src/core/api-key/key-generator.ts
+import crypto from "crypto";
+function generateRawKey(prefix) {
+  return `${prefix}${crypto.randomBytes(32).toString("hex")}`;
+}
+function hashKey(rawKey) {
+  return crypto.createHash("sha256").update(rawKey).digest("hex");
+}
+function keyPreview(keyHash) {
+  if (keyHash.length < 14) return keyHash;
+  return `${keyHash.substring(0, 10)}...${keyHash.substring(keyHash.length - 4)}`;
+}
+
+export {
+  generateRawKey,
+  hashKey,
+  keyPreview
+};