@pafi-dev/issuer 0.35.1 → 0.38.0

package/dist/nestjs/index.d.cts

@@ -1,6 +1,6 @@
 import { ExceptionFilter, ArgumentsHost, DynamicModule, FactoryProvider } from '@nestjs/common';
 import { PafiErrorEnvelope } from '../http/index.cjs';
-import { a as IssuerPublicJwk } from '../types-CxVXRHLy.cjs';
+import { b as IssuerPublicJwk } from '../types-DPqLTJk-.cjs';
 import '@pafi-dev/core';
 import 'jose';
 

package/dist/nestjs/index.d.ts

@@ -1,6 +1,6 @@
 import { ExceptionFilter, ArgumentsHost, DynamicModule, FactoryProvider } from '@nestjs/common';
 import { PafiErrorEnvelope } from '../http/index.js';
-import { a as IssuerPublicJwk } from '../types-CxVXRHLy.js';
+import { b as IssuerPublicJwk } from '../types-DPqLTJk-.js';
 import '@pafi-dev/core';
 import 'jose';
 

package/dist/{types-CxVXRHLy.d.cts → types-DPqLTJk-.d.cts}

@@ -23,6 +23,31 @@ interface IssuerPrivateJwk extends JWK {
     kid: string;
     alg?: string;
 }
+/**
+ * Strong identifier the issuer has verified the user owns at the moment
+ * of this login. Drives cross-issuer wallet unification in the gateway:
+ * `canonical_pafi_user_id = HMAC(pepper, type + ":" + normalized_value)`,
+ * so the same email or wallet address used at two different issuers
+ * resolves to the same Privy embedded wallet.
+ *
+ * Issuers MUST only attach an attribute they have actually verified
+ * (email OTP confirmed, SIWE signature accepted, OAuth provider returned
+ * `email_verified=true`, etc.). The gateway trusts the issuer's claim —
+ * attaching unverified values lets users hijack wallets.
+ *
+ * Normalization rules (gateway enforces, but issuers should mirror to
+ * avoid surprising hash mismatches):
+ *   - `email`:      lowercase + trim. No Gmail dot-strip, no plus-tag strip.
+ *   - `eth_wallet`: lowercase 0x-prefixed 20-byte hex.
+ *
+ * Omit entirely on logins where no strong attribute is verifiable —
+ * gateway falls back to legacy isolated-per-issuer canonical_id.
+ */
+type AuthAttributeType = "email" | "eth_wallet";
+interface AuthAttribute {
+    type: AuthAttributeType;
+    value: string;
+}
 /**
  * Parameters for minting an issuer JWT to send to the PAFI gateway.
  */
@@ -54,11 +79,20 @@ interface SignIssuerJwtParams {
      * uses this for replay protection — must be unique per request.
      */
     jti?: string;
+    /**
+     * Optional strong identifier the user proved ownership of during this
+     * login. Same attribute across issuers = same wallet. See
+     * {@link AuthAttribute}. Omit for SIWE-pure issuers, OAuth providers
+     * that don't expose verified contacts, etc. — gateway then falls back
+     * to legacy per-issuer canonical_id isolation for this login.
+     */
+    authAttribute?: AuthAttribute;
     /**
      * Optional additional claims merged into the payload. Use sparingly —
-     * PAFI gateway only reads `iss`, `sub`, `aud`, `iat`, `exp`, `jti`.
+     * PAFI gateway only reads `iss`, `sub`, `aud`, `iat`, `exp`, `jti`,
+     * and `auth_attribute`.
      */
     extra?: Record<string, unknown>;
 }
 
-export type { IssuerPrivateJwk as I, SignIssuerJwtParams as S, IssuerPublicJwk as a };
+export type { AuthAttribute as A, IssuerPrivateJwk as I, SignIssuerJwtParams as S, AuthAttributeType as a, IssuerPublicJwk as b };

package/dist/{types-CxVXRHLy.d.ts → types-DPqLTJk-.d.ts}

@@ -23,6 +23,31 @@ interface IssuerPrivateJwk extends JWK {
     kid: string;
     alg?: string;
 }
+/**
+ * Strong identifier the issuer has verified the user owns at the moment
+ * of this login. Drives cross-issuer wallet unification in the gateway:
+ * `canonical_pafi_user_id = HMAC(pepper, type + ":" + normalized_value)`,
+ * so the same email or wallet address used at two different issuers
+ * resolves to the same Privy embedded wallet.
+ *
+ * Issuers MUST only attach an attribute they have actually verified
+ * (email OTP confirmed, SIWE signature accepted, OAuth provider returned
+ * `email_verified=true`, etc.). The gateway trusts the issuer's claim —
+ * attaching unverified values lets users hijack wallets.
+ *
+ * Normalization rules (gateway enforces, but issuers should mirror to
+ * avoid surprising hash mismatches):
+ *   - `email`:      lowercase + trim. No Gmail dot-strip, no plus-tag strip.
+ *   - `eth_wallet`: lowercase 0x-prefixed 20-byte hex.
+ *
+ * Omit entirely on logins where no strong attribute is verifiable —
+ * gateway falls back to legacy isolated-per-issuer canonical_id.
+ */
+type AuthAttributeType = "email" | "eth_wallet";
+interface AuthAttribute {
+    type: AuthAttributeType;
+    value: string;
+}
 /**
  * Parameters for minting an issuer JWT to send to the PAFI gateway.
  */
@@ -54,11 +79,20 @@ interface SignIssuerJwtParams {
      * uses this for replay protection — must be unique per request.
      */
     jti?: string;
+    /**
+     * Optional strong identifier the user proved ownership of during this
+     * login. Same attribute across issuers = same wallet. See
+     * {@link AuthAttribute}. Omit for SIWE-pure issuers, OAuth providers
+     * that don't expose verified contacts, etc. — gateway then falls back
+     * to legacy per-issuer canonical_id isolation for this login.
+     */
+    authAttribute?: AuthAttribute;
     /**
      * Optional additional claims merged into the payload. Use sparingly —
-     * PAFI gateway only reads `iss`, `sub`, `aud`, `iat`, `exp`, `jti`.
+     * PAFI gateway only reads `iss`, `sub`, `aud`, `iat`, `exp`, `jti`,
+     * and `auth_attribute`.
      */
     extra?: Record<string, unknown>;
 }
 
-export type { IssuerPrivateJwk as I, SignIssuerJwtParams as S, IssuerPublicJwk as a };
+export type { AuthAttribute as A, IssuerPrivateJwk as I, SignIssuerJwtParams as S, AuthAttributeType as a, IssuerPublicJwk as b };

package/dist/wallet-auth/index.cjs

@@ -38,7 +38,14 @@ async function signIssuerJwt(params) {
   const key = await (0, import_jose.importJWK)(params.privateJwk, alg);
   const now = Math.floor(Date.now() / 1e3);
   const lifetime = params.expiresInSec ?? 60;
-  const builder = new import_jose.SignJWT({ ...params.extra ?? {} }).setProtectedHeader({ alg, typ: "JWT", kid }).setIssuer(params.iss).setSubject(params.sub).setAudience(params.aud).setIssuedAt(now).setExpirationTime(now + lifetime).setJti(params.jti ?? (0, import_node_crypto.randomUUID)());
+  const payload = { ...params.extra ?? {} };
+  if (params.authAttribute) {
+    payload.auth_attribute = {
+      type: params.authAttribute.type,
+      value: params.authAttribute.value
+    };
+  }
+  const builder = new import_jose.SignJWT(payload).setProtectedHeader({ alg, typ: "JWT", kid }).setIssuer(params.iss).setSubject(params.sub).setAudience(params.aud).setIssuedAt(now).setExpirationTime(now + lifetime).setJti(params.jti ?? (0, import_node_crypto.randomUUID)());
   return builder.sign(key);
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/wallet-auth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/wallet-auth/index.ts","../../src/wallet-auth/signIssuerJwt.ts"],"sourcesContent":["/**\n * Wallet-auth helpers — for issuer backends that integrate with the\n * PAFI Wallet Auth Gateway.\n *\n * Sub-modules:\n *   - signIssuerJwt   : mint an issuer JWT to send to the gateway\n *   - types           : IssuerPublicJwk, IssuerPrivateJwk, SignIssuerJwtParams\n *\n * NestJS-specific helpers (drop-in JWKS publishing controller) live\n * under `@pafi-dev/issuer/nestjs`.\n */\n\nexport { signIssuerJwt } from \"./signIssuerJwt\";\nexport type {\n  IssuerPublicJwk,\n  IssuerPrivateJwk,\n  SignIssuerJwtParams,\n} from \"./types\";\n","import { importJWK, SignJWT } from \"jose\";\nimport { randomUUID } from \"node:crypto\";\nimport type { SignIssuerJwtParams } from \"./types\";\n\n/**\n * Mint an issuer JWT for the PAFI Wallet Auth Gateway.\n *\n * Returns a compact JWT (header.payload.signature) ready to send as\n * the `issuer_jwt` body field in `POST /v1/token-exchange`.\n *\n * The matching public key must be reachable at the issuer's\n * `/.well-known/jwks.json` (see `WalletAuthJwksModule`) so the\n * gateway can verify the signature.\n *\n * @example\n *   import { signIssuerJwt } from '@pafi-dev/issuer/wallet-auth';\n *\n *   const jwt = await signIssuerJwt({\n *     privateJwk: JSON.parse(process.env.ISSUER_PRIVATE_JWK_JSON!),\n *     iss: 'https://gg56.com',\n *     sub: 'gg56_user_99',\n *     aud: 'pafi-gateway-prod',\n *   });\n *\n *   // POST { issuer_id: 'GG56', issuer_jwt: jwt } to gateway\n */\nexport async function signIssuerJwt(\n  params: SignIssuerJwtParams,\n): Promise<string> {\n  const alg = params.alg ?? params.privateJwk.alg ?? \"ES256\";\n  const kid = params.privateJwk.kid;\n\n  if (!kid) {\n    throw new Error(\n      \"signIssuerJwt: privateJwk.kid is required (gateway uses kid to look up the verification key)\",\n    );\n  }\n\n  const key = await importJWK(params.privateJwk, alg);\n  const now = Math.floor(Date.now() / 1000);\n  const lifetime = params.expiresInSec ?? 60;\n\n  const builder = new SignJWT({ ...(params.extra ?? {}) })\n    .setProtectedHeader({ alg, typ: \"JWT\", kid })\n    .setIssuer(params.iss)\n    .setSubject(params.sub)\n    .setAudience(params.aud)\n    .setIssuedAt(now)\n    .setExpirationTime(now + lifetime)\n    .setJti(params.jti ?? randomUUID());\n\n  return builder.sign(key);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,kBAAmC;AACnC,yBAA2B;AAyB3B,eAAsB,cACpB,QACiB;AACjB,QAAM,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO;AACnD,QAAM,MAAM,OAAO,WAAW;AAE9B,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,UAAM,uBAAU,OAAO,YAAY,GAAG;AAClD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,WAAW,OAAO,gBAAgB;AAExC,QAAM,UAAU,IAAI,oBAAQ,EAAE,GAAI,OAAO,SAAS,CAAC,EAAG,CAAC,EACpD,mBAAmB,EAAE,KAAK,KAAK,OAAO,IAAI,CAAC,EAC3C,UAAU,OAAO,GAAG,EACpB,WAAW,OAAO,GAAG,EACrB,YAAY,OAAO,GAAG,EACtB,YAAY,GAAG,EACf,kBAAkB,MAAM,QAAQ,EAChC,OAAO,OAAO,WAAO,+BAAW,CAAC;AAEpC,SAAO,QAAQ,KAAK,GAAG;AACzB;","names":[]}
+{"version":3,"sources":["../../src/wallet-auth/index.ts","../../src/wallet-auth/signIssuerJwt.ts"],"sourcesContent":["/**\n * Wallet-auth helpers — for issuer backends that integrate with the\n * PAFI Wallet Auth Gateway.\n *\n * Sub-modules:\n *   - signIssuerJwt   : mint an issuer JWT to send to the gateway\n *   - types           : IssuerPublicJwk, IssuerPrivateJwk, SignIssuerJwtParams\n *\n * NestJS-specific helpers (drop-in JWKS publishing controller) live\n * under `@pafi-dev/issuer/nestjs`.\n */\n\nexport { signIssuerJwt } from \"./signIssuerJwt\";\nexport type {\n  AuthAttribute,\n  AuthAttributeType,\n  IssuerPublicJwk,\n  IssuerPrivateJwk,\n  SignIssuerJwtParams,\n} from \"./types\";\n","import { importJWK, SignJWT } from \"jose\";\nimport { randomUUID } from \"node:crypto\";\nimport type { SignIssuerJwtParams } from \"./types\";\n\n/**\n * Mint an issuer JWT for the PAFI Wallet Auth Gateway.\n *\n * Returns a compact JWT (header.payload.signature) ready to send as\n * the `issuer_jwt` body field in `POST /v1/token-exchange`.\n *\n * The matching public key must be reachable at the issuer's\n * `/.well-known/jwks.json` (see `WalletAuthJwksModule`) so the\n * gateway can verify the signature.\n *\n * @example\n *   import { signIssuerJwt } from '@pafi-dev/issuer/wallet-auth';\n *\n *   const jwt = await signIssuerJwt({\n *     privateJwk: JSON.parse(process.env.ISSUER_PRIVATE_JWK_JSON!),\n *     iss: 'https://gg56.com',\n *     sub: 'gg56_user_99',\n *     aud: 'pafi-gateway-prod',\n *   });\n *\n *   // POST { issuer_id: 'GG56', issuer_jwt: jwt } to gateway\n */\nexport async function signIssuerJwt(\n  params: SignIssuerJwtParams,\n): Promise<string> {\n  const alg = params.alg ?? params.privateJwk.alg ?? \"ES256\";\n  const kid = params.privateJwk.kid;\n\n  if (!kid) {\n    throw new Error(\n      \"signIssuerJwt: privateJwk.kid is required (gateway uses kid to look up the verification key)\",\n    );\n  }\n\n  const key = await importJWK(params.privateJwk, alg);\n  const now = Math.floor(Date.now() / 1000);\n  const lifetime = params.expiresInSec ?? 60;\n\n  const payload: Record<string, unknown> = { ...(params.extra ?? {}) };\n  if (params.authAttribute) {\n    payload.auth_attribute = {\n      type: params.authAttribute.type,\n      value: params.authAttribute.value,\n    };\n  }\n\n  const builder = new SignJWT(payload)\n    .setProtectedHeader({ alg, typ: \"JWT\", kid })\n    .setIssuer(params.iss)\n    .setSubject(params.sub)\n    .setAudience(params.aud)\n    .setIssuedAt(now)\n    .setExpirationTime(now + lifetime)\n    .setJti(params.jti ?? randomUUID());\n\n  return builder.sign(key);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,kBAAmC;AACnC,yBAA2B;AAyB3B,eAAsB,cACpB,QACiB;AACjB,QAAM,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO;AACnD,QAAM,MAAM,OAAO,WAAW;AAE9B,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,UAAM,uBAAU,OAAO,YAAY,GAAG;AAClD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,WAAW,OAAO,gBAAgB;AAExC,QAAM,UAAmC,EAAE,GAAI,OAAO,SAAS,CAAC,EAAG;AACnE,MAAI,OAAO,eAAe;AACxB,YAAQ,iBAAiB;AAAA,MACvB,MAAM,OAAO,cAAc;AAAA,MAC3B,OAAO,OAAO,cAAc;AAAA,IAC9B;AAAA,EACF;AAEA,QAAM,UAAU,IAAI,oBAAQ,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,OAAO,IAAI,CAAC,EAC3C,UAAU,OAAO,GAAG,EACpB,WAAW,OAAO,GAAG,EACrB,YAAY,OAAO,GAAG,EACtB,YAAY,GAAG,EACf,kBAAkB,MAAM,QAAQ,EAChC,OAAO,OAAO,WAAO,+BAAW,CAAC;AAEpC,SAAO,QAAQ,KAAK,GAAG;AACzB;","names":[]}

package/dist/wallet-auth/index.d.cts

@@ -1,5 +1,5 @@
-import { S as SignIssuerJwtParams } from '../types-CxVXRHLy.cjs';
-export { I as IssuerPrivateJwk, a as IssuerPublicJwk } from '../types-CxVXRHLy.cjs';
+import { S as SignIssuerJwtParams } from '../types-DPqLTJk-.cjs';
+export { A as AuthAttribute, a as AuthAttributeType, I as IssuerPrivateJwk, b as IssuerPublicJwk } from '../types-DPqLTJk-.cjs';
 import 'jose';
 
 /**

package/dist/wallet-auth/index.d.ts

@@ -1,5 +1,5 @@
-import { S as SignIssuerJwtParams } from '../types-CxVXRHLy.js';
-export { I as IssuerPrivateJwk, a as IssuerPublicJwk } from '../types-CxVXRHLy.js';
+import { S as SignIssuerJwtParams } from '../types-DPqLTJk-.js';
+export { A as AuthAttribute, a as AuthAttributeType, I as IssuerPrivateJwk, b as IssuerPublicJwk } from '../types-DPqLTJk-.js';
 import 'jose';
 
 /**

package/dist/wallet-auth/index.js

@@ -14,7 +14,14 @@ async function signIssuerJwt(params) {
   const key = await importJWK(params.privateJwk, alg);
   const now = Math.floor(Date.now() / 1e3);
   const lifetime = params.expiresInSec ?? 60;
-  const builder = new SignJWT({ ...params.extra ?? {} }).setProtectedHeader({ alg, typ: "JWT", kid }).setIssuer(params.iss).setSubject(params.sub).setAudience(params.aud).setIssuedAt(now).setExpirationTime(now + lifetime).setJti(params.jti ?? randomUUID());
+  const payload = { ...params.extra ?? {} };
+  if (params.authAttribute) {
+    payload.auth_attribute = {
+      type: params.authAttribute.type,
+      value: params.authAttribute.value
+    };
+  }
+  const builder = new SignJWT(payload).setProtectedHeader({ alg, typ: "JWT", kid }).setIssuer(params.iss).setSubject(params.sub).setAudience(params.aud).setIssuedAt(now).setExpirationTime(now + lifetime).setJti(params.jti ?? randomUUID());
   return builder.sign(key);
 }
 export {

package/dist/wallet-auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/wallet-auth/signIssuerJwt.ts"],"sourcesContent":["import { importJWK, SignJWT } from \"jose\";\nimport { randomUUID } from \"node:crypto\";\nimport type { SignIssuerJwtParams } from \"./types\";\n\n/**\n * Mint an issuer JWT for the PAFI Wallet Auth Gateway.\n *\n * Returns a compact JWT (header.payload.signature) ready to send as\n * the `issuer_jwt` body field in `POST /v1/token-exchange`.\n *\n * The matching public key must be reachable at the issuer's\n * `/.well-known/jwks.json` (see `WalletAuthJwksModule`) so the\n * gateway can verify the signature.\n *\n * @example\n *   import { signIssuerJwt } from '@pafi-dev/issuer/wallet-auth';\n *\n *   const jwt = await signIssuerJwt({\n *     privateJwk: JSON.parse(process.env.ISSUER_PRIVATE_JWK_JSON!),\n *     iss: 'https://gg56.com',\n *     sub: 'gg56_user_99',\n *     aud: 'pafi-gateway-prod',\n *   });\n *\n *   // POST { issuer_id: 'GG56', issuer_jwt: jwt } to gateway\n */\nexport async function signIssuerJwt(\n  params: SignIssuerJwtParams,\n): Promise<string> {\n  const alg = params.alg ?? params.privateJwk.alg ?? \"ES256\";\n  const kid = params.privateJwk.kid;\n\n  if (!kid) {\n    throw new Error(\n      \"signIssuerJwt: privateJwk.kid is required (gateway uses kid to look up the verification key)\",\n    );\n  }\n\n  const key = await importJWK(params.privateJwk, alg);\n  const now = Math.floor(Date.now() / 1000);\n  const lifetime = params.expiresInSec ?? 60;\n\n  const builder = new SignJWT({ ...(params.extra ?? {}) })\n    .setProtectedHeader({ alg, typ: \"JWT\", kid })\n    .setIssuer(params.iss)\n    .setSubject(params.sub)\n    .setAudience(params.aud)\n    .setIssuedAt(now)\n    .setExpirationTime(now + lifetime)\n    .setJti(params.jti ?? randomUUID());\n\n  return builder.sign(key);\n}\n"],"mappings":";;;AAAA,SAAS,WAAW,eAAe;AACnC,SAAS,kBAAkB;AAyB3B,eAAsB,cACpB,QACiB;AACjB,QAAM,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO;AACnD,QAAM,MAAM,OAAO,WAAW;AAE9B,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,UAAU,OAAO,YAAY,GAAG;AAClD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,WAAW,OAAO,gBAAgB;AAExC,QAAM,UAAU,IAAI,QAAQ,EAAE,GAAI,OAAO,SAAS,CAAC,EAAG,CAAC,EACpD,mBAAmB,EAAE,KAAK,KAAK,OAAO,IAAI,CAAC,EAC3C,UAAU,OAAO,GAAG,EACpB,WAAW,OAAO,GAAG,EACrB,YAAY,OAAO,GAAG,EACtB,YAAY,GAAG,EACf,kBAAkB,MAAM,QAAQ,EAChC,OAAO,OAAO,OAAO,WAAW,CAAC;AAEpC,SAAO,QAAQ,KAAK,GAAG;AACzB;","names":[]}
+{"version":3,"sources":["../../src/wallet-auth/signIssuerJwt.ts"],"sourcesContent":["import { importJWK, SignJWT } from \"jose\";\nimport { randomUUID } from \"node:crypto\";\nimport type { SignIssuerJwtParams } from \"./types\";\n\n/**\n * Mint an issuer JWT for the PAFI Wallet Auth Gateway.\n *\n * Returns a compact JWT (header.payload.signature) ready to send as\n * the `issuer_jwt` body field in `POST /v1/token-exchange`.\n *\n * The matching public key must be reachable at the issuer's\n * `/.well-known/jwks.json` (see `WalletAuthJwksModule`) so the\n * gateway can verify the signature.\n *\n * @example\n *   import { signIssuerJwt } from '@pafi-dev/issuer/wallet-auth';\n *\n *   const jwt = await signIssuerJwt({\n *     privateJwk: JSON.parse(process.env.ISSUER_PRIVATE_JWK_JSON!),\n *     iss: 'https://gg56.com',\n *     sub: 'gg56_user_99',\n *     aud: 'pafi-gateway-prod',\n *   });\n *\n *   // POST { issuer_id: 'GG56', issuer_jwt: jwt } to gateway\n */\nexport async function signIssuerJwt(\n  params: SignIssuerJwtParams,\n): Promise<string> {\n  const alg = params.alg ?? params.privateJwk.alg ?? \"ES256\";\n  const kid = params.privateJwk.kid;\n\n  if (!kid) {\n    throw new Error(\n      \"signIssuerJwt: privateJwk.kid is required (gateway uses kid to look up the verification key)\",\n    );\n  }\n\n  const key = await importJWK(params.privateJwk, alg);\n  const now = Math.floor(Date.now() / 1000);\n  const lifetime = params.expiresInSec ?? 60;\n\n  const payload: Record<string, unknown> = { ...(params.extra ?? {}) };\n  if (params.authAttribute) {\n    payload.auth_attribute = {\n      type: params.authAttribute.type,\n      value: params.authAttribute.value,\n    };\n  }\n\n  const builder = new SignJWT(payload)\n    .setProtectedHeader({ alg, typ: \"JWT\", kid })\n    .setIssuer(params.iss)\n    .setSubject(params.sub)\n    .setAudience(params.aud)\n    .setIssuedAt(now)\n    .setExpirationTime(now + lifetime)\n    .setJti(params.jti ?? randomUUID());\n\n  return builder.sign(key);\n}\n"],"mappings":";;;AAAA,SAAS,WAAW,eAAe;AACnC,SAAS,kBAAkB;AAyB3B,eAAsB,cACpB,QACiB;AACjB,QAAM,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO;AACnD,QAAM,MAAM,OAAO,WAAW;AAE9B,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,UAAU,OAAO,YAAY,GAAG;AAClD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,WAAW,OAAO,gBAAgB;AAExC,QAAM,UAAmC,EAAE,GAAI,OAAO,SAAS,CAAC,EAAG;AACnE,MAAI,OAAO,eAAe;AACxB,YAAQ,iBAAiB;AAAA,MACvB,MAAM,OAAO,cAAc;AAAA,MAC3B,OAAO,OAAO,cAAc;AAAA,IAC9B;AAAA,EACF;AAEA,QAAM,UAAU,IAAI,QAAQ,OAAO,EAChC,mBAAmB,EAAE,KAAK,KAAK,OAAO,IAAI,CAAC,EAC3C,UAAU,OAAO,GAAG,EACpB,WAAW,OAAO,GAAG,EACrB,YAAY,OAAO,GAAG,EACtB,YAAY,GAAG,EACf,kBAAkB,MAAM,QAAQ,EAChC,OAAO,OAAO,OAAO,WAAW,CAAC;AAEpC,SAAO,QAAQ,KAAK,GAAG;AACzB;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pafi-dev/issuer",
-  "version": "0.35.1",
+  "version": "0.38.0",
   "description": "Issuer backend API and services for the PAFI point token system",
   "repository": {
     "type": "git",
@@ -55,6 +55,16 @@
         "types": "./dist/wallet-auth/index.d.cts",
         "default": "./dist/wallet-auth/index.cjs"
       }
+    },
+    "./auth-client": {
+      "import": {
+        "types": "./dist/auth-client/index.d.ts",
+        "default": "./dist/auth-client/index.js"
+      },
+      "require": {
+        "types": "./dist/auth-client/index.d.cts",
+        "default": "./dist/auth-client/index.cjs"
+      }
     }
   },
   "typesVersions": {
@@ -67,15 +77,25 @@
       ],
       "wallet-auth": [
         "./dist/wallet-auth/index.d.ts"
+      ],
+      "auth-client": [
+        "./dist/auth-client/index.d.ts"
       ]
     }
   },
   "files": [
     "dist"
   ],
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest",
+    "test:cov": "vitest run --coverage --passWithNoTests",
+    "typecheck": "tsc --noEmit"
+  },
   "dependencies": {
-    "jose": "^5.9.0",
-    "@pafi-dev/core": "0.24.0"
+    "@pafi-dev/core": "workspace:*",
+    "jose": "^5.9.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^10.0.0",
@@ -94,12 +114,5 @@
     "viem": "^2.21.0",
     "vitest": "^2.0.0"
   },
-  "license": "Apache-2.0",
-  "scripts": {
-    "build": "tsup",
-    "test": "vitest run --passWithNoTests",
-    "test:watch": "vitest",
-    "test:cov": "vitest run --coverage --passWithNoTests",
-    "typecheck": "tsc --noEmit"
-  }
-}
+  "license": "Apache-2.0"
+}