@pafi-dev/issuer 0.33.0 → 0.35.0

package/dist/nestjs/index.d.cts

@@ -1,142 +0,0 @@
-import { ExceptionFilter, ArgumentsHost, DynamicModule, FactoryProvider } from '@nestjs/common';
-import { PafiErrorEnvelope } from '../http/index.cjs';
-import { a as IssuerPublicJwk } from '../types-CxVXRHLy.cjs';
-import '@pafi-dev/core';
-import 'jose';
-
-/**
- * NestJS global exception filter that emits the PAFI Stripe-style
- * envelope (see `@pafi-dev/issuer/http`).
- *
- * Wire it once in your bootstrap:
- *
- * ```ts
- * import { PafiHttpExceptionFilter } from "@pafi-dev/issuer/nestjs";
- *
- * app.useGlobalFilters(new PafiHttpExceptionFilter());
- * ```
- *
- * Catches every thrown value:
- *  - `PafiSdkError` (and subclasses) → typed envelope from `httpStatus`/
- *    `code`/`type`/`safeToRetry`/`param`/`metadata`.
- *  - `HttpException` (NestJS) → respected status; SDK-shaped body is
- *    passed through, plain bodies + ValidationPipe arrays normalized.
- *  - any other `Error` → `server_error` 500 with sanitized message.
- *
- * `@nestjs/common` is an optional peer dependency — only required when
- * importing this sub-export.
- */
-
-/** Customization knobs. None required — sensible defaults baked in. */
-interface PafiHttpExceptionFilterOptions {
-    /**
-     * Header to read for the request id, lowercase. Default `"x-request-id"`.
-     * If absent, a UUIDv4 is generated per request.
-     */
-    requestIdHeader?: string;
-    /**
-     * Override `Date` for deterministic tests.
-     */
-    now?: () => Date;
-    /**
-     * Hook to record/audit normalized errors before sending. Useful for
-     * Sentry / Datadog / Pino. Throws are swallowed so a logging bug
-     * never masks the real error response.
-     */
-    onError?: (envelope: PafiErrorEnvelope, raw: unknown) => void;
-}
-declare class PafiHttpExceptionFilter implements ExceptionFilter {
-    private readonly logger;
-    private readonly opts;
-    constructor(options?: PafiHttpExceptionFilterOptions);
-    catch(exception: unknown, host: ArgumentsHost): void;
-    private normalize;
-}
-
-interface WalletAuthJwksOptions {
-    /**
-     * One or more public JWKs to publish. During key rotation, include
-     * BOTH the active and previous keys so JWTs signed with the older
-     * kid can still be verified by the PAFI gateway until the rotation
-     * window closes.
-     */
-    keys: IssuerPublicJwk[];
-}
-interface WalletAuthJwksAsyncOptions {
-    /** Modules to import for the factory's DI. */
-    imports?: NonNullable<DynamicModule["imports"]>;
-    /** Providers to inject into useFactory — same shape as FactoryProvider.inject. */
-    inject?: FactoryProvider["inject"];
-    /** Builds options at runtime — read env, decrypt secrets, etc. */
-    useFactory: (...args: any[]) => Promise<WalletAuthJwksOptions> | WalletAuthJwksOptions;
-}
-/**
- * Drop-in NestJS module that publishes the issuer's public signing
- * key set at GET /.well-known/jwks.json.
- *
- * Every issuer backend integrating with the PAFI Wallet Auth Gateway
- * needs this endpoint so the gateway can fetch their public key and
- * verify issuer JWT signatures.
- *
- * @example  Sync registration
- *   import { WalletAuthJwksModule } from '@pafi-dev/issuer/nestjs';
- *
- *   @Module({
- *     imports: [
- *       WalletAuthJwksModule.forRoot({
- *         keys: [JSON.parse(process.env.ISSUER_PUBLIC_JWK_JSON!)],
- *       }),
- *     ],
- *   })
- *   export class AppModule {}
- *
- * @example  Async registration (read from ConfigService)
- *   import { ConfigModule, ConfigService } from '@nestjs/config';
- *   import { WalletAuthJwksModule } from '@pafi-dev/issuer/nestjs';
- *
- *   @Module({
- *     imports: [
- *       WalletAuthJwksModule.forRootAsync({
- *         imports: [ConfigModule],
- *         inject: [ConfigService],
- *         useFactory: (config: ConfigService) => ({
- *           keys: [JSON.parse(config.getOrThrow('ISSUER_PUBLIC_JWK_JSON'))],
- *         }),
- *       }),
- *     ],
- *   })
- *   export class AppModule {}
- *
- * @example  Rotation window — publish 2 keys simultaneously
- *   keys: [
- *     JSON.parse(process.env.ISSUER_PUBLIC_JWK_JSON_ACTIVE!),
- *     JSON.parse(process.env.ISSUER_PUBLIC_JWK_JSON_PREVIOUS!),
- *   ]
- */
-declare class WalletAuthJwksModule {
-    static forRoot(options: WalletAuthJwksOptions): DynamicModule;
-    static forRootAsync(options: WalletAuthJwksAsyncOptions): DynamicModule;
-}
-
-/**
- * Publishes the issuer's public signing key set as RFC 7517 JWKS.
- *
- * The PAFI Wallet Auth Gateway fetches this URL to verify signatures
- * on issuer JWTs that this backend mints (the JWT travelling in
- * /v1/token-exchange's `issuer_jwt` body field).
- *
- * Mounted at GET /.well-known/jwks.json — no auth, public by design.
- */
-declare class WalletAuthJwksController {
-    private readonly logger;
-    private readonly jwks;
-    constructor(keys: IssuerPublicJwk[]);
-    getJwks(): {
-        keys: IssuerPublicJwk[];
-    };
-}
-
-/** DI token: array of public JWKs to publish at /.well-known/jwks.json. */
-declare const WALLET_AUTH_JWKS_KEYS: unique symbol;
-
-export { PafiHttpExceptionFilter, type PafiHttpExceptionFilterOptions, WALLET_AUTH_JWKS_KEYS, type WalletAuthJwksAsyncOptions, WalletAuthJwksController, WalletAuthJwksModule, type WalletAuthJwksOptions };

package/dist/nestjs/index.d.ts

@@ -1,142 +0,0 @@
-import { ExceptionFilter, ArgumentsHost, DynamicModule, FactoryProvider } from '@nestjs/common';
-import { PafiErrorEnvelope } from '../http/index.js';
-import { a as IssuerPublicJwk } from '../types-CxVXRHLy.js';
-import '@pafi-dev/core';
-import 'jose';
-
-/**
- * NestJS global exception filter that emits the PAFI Stripe-style
- * envelope (see `@pafi-dev/issuer/http`).
- *
- * Wire it once in your bootstrap:
- *
- * ```ts
- * import { PafiHttpExceptionFilter } from "@pafi-dev/issuer/nestjs";
- *
- * app.useGlobalFilters(new PafiHttpExceptionFilter());
- * ```
- *
- * Catches every thrown value:
- *  - `PafiSdkError` (and subclasses) → typed envelope from `httpStatus`/
- *    `code`/`type`/`safeToRetry`/`param`/`metadata`.
- *  - `HttpException` (NestJS) → respected status; SDK-shaped body is
- *    passed through, plain bodies + ValidationPipe arrays normalized.
- *  - any other `Error` → `server_error` 500 with sanitized message.
- *
- * `@nestjs/common` is an optional peer dependency — only required when
- * importing this sub-export.
- */
-
-/** Customization knobs. None required — sensible defaults baked in. */
-interface PafiHttpExceptionFilterOptions {
-    /**
-     * Header to read for the request id, lowercase. Default `"x-request-id"`.
-     * If absent, a UUIDv4 is generated per request.
-     */
-    requestIdHeader?: string;
-    /**
-     * Override `Date` for deterministic tests.
-     */
-    now?: () => Date;
-    /**
-     * Hook to record/audit normalized errors before sending. Useful for
-     * Sentry / Datadog / Pino. Throws are swallowed so a logging bug
-     * never masks the real error response.
-     */
-    onError?: (envelope: PafiErrorEnvelope, raw: unknown) => void;
-}
-declare class PafiHttpExceptionFilter implements ExceptionFilter {
-    private readonly logger;
-    private readonly opts;
-    constructor(options?: PafiHttpExceptionFilterOptions);
-    catch(exception: unknown, host: ArgumentsHost): void;
-    private normalize;
-}
-
-interface WalletAuthJwksOptions {
-    /**
-     * One or more public JWKs to publish. During key rotation, include
-     * BOTH the active and previous keys so JWTs signed with the older
-     * kid can still be verified by the PAFI gateway until the rotation
-     * window closes.
-     */
-    keys: IssuerPublicJwk[];
-}
-interface WalletAuthJwksAsyncOptions {
-    /** Modules to import for the factory's DI. */
-    imports?: NonNullable<DynamicModule["imports"]>;
-    /** Providers to inject into useFactory — same shape as FactoryProvider.inject. */
-    inject?: FactoryProvider["inject"];
-    /** Builds options at runtime — read env, decrypt secrets, etc. */
-    useFactory: (...args: any[]) => Promise<WalletAuthJwksOptions> | WalletAuthJwksOptions;
-}
-/**
- * Drop-in NestJS module that publishes the issuer's public signing
- * key set at GET /.well-known/jwks.json.
- *
- * Every issuer backend integrating with the PAFI Wallet Auth Gateway
- * needs this endpoint so the gateway can fetch their public key and
- * verify issuer JWT signatures.
- *
- * @example  Sync registration
- *   import { WalletAuthJwksModule } from '@pafi-dev/issuer/nestjs';
- *
- *   @Module({
- *     imports: [
- *       WalletAuthJwksModule.forRoot({
- *         keys: [JSON.parse(process.env.ISSUER_PUBLIC_JWK_JSON!)],
- *       }),
- *     ],
- *   })
- *   export class AppModule {}
- *
- * @example  Async registration (read from ConfigService)
- *   import { ConfigModule, ConfigService } from '@nestjs/config';
- *   import { WalletAuthJwksModule } from '@pafi-dev/issuer/nestjs';
- *
- *   @Module({
- *     imports: [
- *       WalletAuthJwksModule.forRootAsync({
- *         imports: [ConfigModule],
- *         inject: [ConfigService],
- *         useFactory: (config: ConfigService) => ({
- *           keys: [JSON.parse(config.getOrThrow('ISSUER_PUBLIC_JWK_JSON'))],
- *         }),
- *       }),
- *     ],
- *   })
- *   export class AppModule {}
- *
- * @example  Rotation window — publish 2 keys simultaneously
- *   keys: [
- *     JSON.parse(process.env.ISSUER_PUBLIC_JWK_JSON_ACTIVE!),
- *     JSON.parse(process.env.ISSUER_PUBLIC_JWK_JSON_PREVIOUS!),
- *   ]
- */
-declare class WalletAuthJwksModule {
-    static forRoot(options: WalletAuthJwksOptions): DynamicModule;
-    static forRootAsync(options: WalletAuthJwksAsyncOptions): DynamicModule;
-}
-
-/**
- * Publishes the issuer's public signing key set as RFC 7517 JWKS.
- *
- * The PAFI Wallet Auth Gateway fetches this URL to verify signatures
- * on issuer JWTs that this backend mints (the JWT travelling in
- * /v1/token-exchange's `issuer_jwt` body field).
- *
- * Mounted at GET /.well-known/jwks.json — no auth, public by design.
- */
-declare class WalletAuthJwksController {
-    private readonly logger;
-    private readonly jwks;
-    constructor(keys: IssuerPublicJwk[]);
-    getJwks(): {
-        keys: IssuerPublicJwk[];
-    };
-}
-
-/** DI token: array of public JWKs to publish at /.well-known/jwks.json. */
-declare const WALLET_AUTH_JWKS_KEYS: unique symbol;
-
-export { PafiHttpExceptionFilter, type PafiHttpExceptionFilterOptions, WALLET_AUTH_JWKS_KEYS, type WalletAuthJwksAsyncOptions, WalletAuthJwksController, WalletAuthJwksModule, type WalletAuthJwksOptions };

package/dist/types-CxVXRHLy.d.cts

@@ -1,64 +0,0 @@
-import { JWK } from 'jose';
-
-/**
- * Public JWK shape — what an issuer publishes at /.well-known/jwks.json
- * for the PAFI Wallet Auth Gateway to fetch and verify signatures.
- *
- * Must include `kid` so the gateway can match it against the `kid`
- * header in inbound issuer JWTs (multiple keys can be published
- * simultaneously during a rotation window).
- */
-interface IssuerPublicJwk extends JWK {
-    kty: string;
-    kid: string;
-    alg?: string;
-    use?: string;
-}
-/**
- * Private JWK — held by the issuer backend, never published.
- * Used by `signIssuerJwt` to mint JWTs the gateway can verify.
- */
-interface IssuerPrivateJwk extends JWK {
-    kty: string;
-    kid: string;
-    alg?: string;
-}
-/**
- * Parameters for minting an issuer JWT to send to the PAFI gateway.
- */
-interface SignIssuerJwtParams {
-    /** Private signing key (ES256 / ES384 / RS256 / RS384 / RS512 / EdDSA). */
-    privateJwk: IssuerPrivateJwk;
-    /** Stable identifier for the user being attested (issuer's internal user id). */
-    sub: string;
-    /** This issuer backend's identity URL — must match `expected_iss` in PAFI's `issuers` row. */
-    iss: string;
-    /**
-     * Expected audience — PAFI gateway's per-env audience claim
-     * (e.g. `pafi-gateway-prod` / `pafi-gateway-staging` / `pafi-gateway-dev`).
-     * Provided by PAFI ops at onboarding time.
-     */
-    aud: string;
-    /**
-     * Optional algorithm override. Defaults to private JWK's `alg`, then `ES256`.
-     * Must match a value in PAFI gateway's algorithm whitelist.
-     */
-    alg?: "ES256" | "ES384" | "RS256" | "RS384" | "RS512" | "EdDSA";
-    /**
-     * Lifetime in seconds. Default 60 — keep short. PAFI gateway also
-     * enforces `max_token_age_sec` (default 60) regardless of `exp`.
-     */
-    expiresInSec?: number;
-    /**
-     * Optional unique JWT id. Defaults to a random UUID. PAFI gateway
-     * uses this for replay protection — must be unique per request.
-     */
-    jti?: string;
-    /**
-     * Optional additional claims merged into the payload. Use sparingly —
-     * PAFI gateway only reads `iss`, `sub`, `aud`, `iat`, `exp`, `jti`.
-     */
-    extra?: Record<string, unknown>;
-}
-
-export type { IssuerPrivateJwk as I, SignIssuerJwtParams as S, IssuerPublicJwk as a };

package/dist/types-CxVXRHLy.d.ts

@@ -1,64 +0,0 @@
-import { JWK } from 'jose';
-
-/**
- * Public JWK shape — what an issuer publishes at /.well-known/jwks.json
- * for the PAFI Wallet Auth Gateway to fetch and verify signatures.
- *
- * Must include `kid` so the gateway can match it against the `kid`
- * header in inbound issuer JWTs (multiple keys can be published
- * simultaneously during a rotation window).
- */
-interface IssuerPublicJwk extends JWK {
-    kty: string;
-    kid: string;
-    alg?: string;
-    use?: string;
-}
-/**
- * Private JWK — held by the issuer backend, never published.
- * Used by `signIssuerJwt` to mint JWTs the gateway can verify.
- */
-interface IssuerPrivateJwk extends JWK {
-    kty: string;
-    kid: string;
-    alg?: string;
-}
-/**
- * Parameters for minting an issuer JWT to send to the PAFI gateway.
- */
-interface SignIssuerJwtParams {
-    /** Private signing key (ES256 / ES384 / RS256 / RS384 / RS512 / EdDSA). */
-    privateJwk: IssuerPrivateJwk;
-    /** Stable identifier for the user being attested (issuer's internal user id). */
-    sub: string;
-    /** This issuer backend's identity URL — must match `expected_iss` in PAFI's `issuers` row. */
-    iss: string;
-    /**
-     * Expected audience — PAFI gateway's per-env audience claim
-     * (e.g. `pafi-gateway-prod` / `pafi-gateway-staging` / `pafi-gateway-dev`).
-     * Provided by PAFI ops at onboarding time.
-     */
-    aud: string;
-    /**
-     * Optional algorithm override. Defaults to private JWK's `alg`, then `ES256`.
-     * Must match a value in PAFI gateway's algorithm whitelist.
-     */
-    alg?: "ES256" | "ES384" | "RS256" | "RS384" | "RS512" | "EdDSA";
-    /**
-     * Lifetime in seconds. Default 60 — keep short. PAFI gateway also
-     * enforces `max_token_age_sec` (default 60) regardless of `exp`.
-     */
-    expiresInSec?: number;
-    /**
-     * Optional unique JWT id. Defaults to a random UUID. PAFI gateway
-     * uses this for replay protection — must be unique per request.
-     */
-    jti?: string;
-    /**
-     * Optional additional claims merged into the payload. Use sparingly —
-     * PAFI gateway only reads `iss`, `sub`, `aud`, `iat`, `exp`, `jti`.
-     */
-    extra?: Record<string, unknown>;
-}
-
-export type { IssuerPrivateJwk as I, SignIssuerJwtParams as S, IssuerPublicJwk as a };

package/dist/wallet-auth/index.d.cts

@@ -1,29 +0,0 @@
-import { S as SignIssuerJwtParams } from '../types-CxVXRHLy.cjs';
-export { I as IssuerPrivateJwk, a as IssuerPublicJwk } from '../types-CxVXRHLy.cjs';
-import 'jose';
-
-/**
- * Mint an issuer JWT for the PAFI Wallet Auth Gateway.
- *
- * Returns a compact JWT (header.payload.signature) ready to send as
- * the `issuer_jwt` body field in `POST /v1/token-exchange`.
- *
- * The matching public key must be reachable at the issuer's
- * `/.well-known/jwks.json` (see `WalletAuthJwksModule`) so the
- * gateway can verify the signature.
- *
- * @example
- *   import { signIssuerJwt } from '@pafi-dev/issuer/wallet-auth';
- *
- *   const jwt = await signIssuerJwt({
- *     privateJwk: JSON.parse(process.env.ISSUER_PRIVATE_JWK_JSON!),
- *     iss: 'https://gg56.com',
- *     sub: 'gg56_user_99',
- *     aud: 'pafi-gateway-prod',
- *   });
- *
- *   // POST { issuer_id: 'GG56', issuer_jwt: jwt } to gateway
- */
-declare function signIssuerJwt(params: SignIssuerJwtParams): Promise<string>;
-
-export { SignIssuerJwtParams, signIssuerJwt };

package/dist/wallet-auth/index.d.ts

@@ -1,29 +0,0 @@
-import { S as SignIssuerJwtParams } from '../types-CxVXRHLy.js';
-export { I as IssuerPrivateJwk, a as IssuerPublicJwk } from '../types-CxVXRHLy.js';
-import 'jose';
-
-/**
- * Mint an issuer JWT for the PAFI Wallet Auth Gateway.
- *
- * Returns a compact JWT (header.payload.signature) ready to send as
- * the `issuer_jwt` body field in `POST /v1/token-exchange`.
- *
- * The matching public key must be reachable at the issuer's
- * `/.well-known/jwks.json` (see `WalletAuthJwksModule`) so the
- * gateway can verify the signature.
- *
- * @example
- *   import { signIssuerJwt } from '@pafi-dev/issuer/wallet-auth';
- *
- *   const jwt = await signIssuerJwt({
- *     privateJwk: JSON.parse(process.env.ISSUER_PRIVATE_JWK_JSON!),
- *     iss: 'https://gg56.com',
- *     sub: 'gg56_user_99',
- *     aud: 'pafi-gateway-prod',
- *   });
- *
- *   // POST { issuer_id: 'GG56', issuer_jwt: jwt } to gateway
- */
-declare function signIssuerJwt(params: SignIssuerJwtParams): Promise<string>;
-
-export { SignIssuerJwtParams, signIssuerJwt };