@pafi-dev/issuer 0.38.1 → 0.39.1

package/dist/direct-auth/index.cjs

@@ -0,0 +1,662 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+  if (kind && result) __defProp(target, key, result);
+  return result;
+};
+var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+
+// src/direct-auth/index.ts
+var direct_auth_exports = {};
+__export(direct_auth_exports, {
+  EmailStartRequestDto: () => EmailStartRequestDto,
+  EmailStartResponseDto: () => EmailStartResponseDto,
+  EmailVerifyRequestDto: () => EmailVerifyRequestDto,
+  GoogleExchangeRequestDto: () => GoogleExchangeRequestDto,
+  KakaoExchangeRequestDto: () => KakaoExchangeRequestDto,
+  PAFI_DIRECT_AUTH_MODULE_OPTIONS: () => PAFI_DIRECT_AUTH_MODULE_OPTIONS,
+  PafiAuthClientProvider: () => PafiAuthClientProvider,
+  PafiAuthSuccessDto: () => PafiAuthSuccessDto,
+  PafiDirectAuthController: () => PafiDirectAuthController,
+  PafiDirectAuthModule: () => PafiDirectAuthModule,
+  PafiDirectAuthService: () => PafiDirectAuthService,
+  PafiSessionVerifierService: () => PafiSessionVerifierService,
+  SESSION_TOKEN_MINTER: () => SESSION_TOKEN_MINTER,
+  USER_STORE: () => USER_STORE
+});
+module.exports = __toCommonJS(direct_auth_exports);
+
+// src/direct-auth/pafi-direct-auth.module.ts
+var import_common5 = require("@nestjs/common");
+
+// src/direct-auth/services/pafi-auth-client.provider.ts
+var import_common = require("@nestjs/common");
+
+// src/auth-client/pafi-auth-client.ts
+var import_node_crypto2 = require("crypto");
+
+// src/auth-client/sign-client-assertion.ts
+var import_jose = require("jose");
+var import_node_crypto = require("crypto");
+async function signClientAssertion(args) {
+  const alg = args.alg ?? args.privateJwk.alg ?? "ES256";
+  const key = await (0, import_jose.importJWK)(args.privateJwk, alg);
+  const now = Math.floor(Date.now() / 1e3);
+  return new import_jose.SignJWT({}).setProtectedHeader({ alg, typ: "JWT", kid: args.privateJwk.kid }).setIssuer(args.clientId).setSubject(args.clientId).setAudience(`${args.gatewayUrl}/v1/token-exchange`).setIssuedAt(now).setExpirationTime(now + 60).setJti((0, import_node_crypto.randomUUID)()).sign(key);
+}
+
+// src/auth-client/types.ts
+var PafiAuthError = class extends Error {
+  constructor(message, status, code, correlationId) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.correlationId = correlationId;
+    this.name = "PafiAuthError";
+  }
+  status;
+  code;
+  correlationId;
+};
+
+// src/auth-client/pafi-auth-client.ts
+var PafiAuthClient = class {
+  constructor(opts) {
+    this.opts = opts;
+    if (!opts.clientPrivateJwk.kid) {
+      throw new Error(
+        "PafiAuthClient: clientPrivateJwk.kid is required (gateway uses kid to look up the verification key)"
+      );
+    }
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.tokenExchangeAud = `${opts.gatewayUrl}/v1/token-exchange`;
+  }
+  opts;
+  fetchImpl;
+  tokenExchangeAud;
+  // ───────────────────────────────────────────────────────────────
+  // EMAIL OTP — 2-step
+  // ───────────────────────────────────────────────────────────────
+  /**
+   * Step 1: ask the gateway to send the user an OTP. Returns the
+   * `challengeId` to echo back on {@link verifyEmail}.
+   */
+  async startEmail(args) {
+    const res = await this.post(
+      "/v1/auth/email/start",
+      {
+        issuer_id: this.opts.issuerId,
+        email: args.email
+      },
+      args.correlationId
+    );
+    return {
+      challengeId: res.challenge_id,
+      expiresInSec: res.expires_in
+    };
+  }
+  /**
+   * Step 2: submit the OTP the user received. On success returns
+   * {@link AuthSuccess} containing BOTH the long-lived
+   * pafi_session_token (issuer verifies via gateway JWKS) AND the
+   * short-lived pafi_jwt (issuer FE feeds to Privy).
+   */
+  async verifyEmail(args) {
+    const res = await this.post(
+      "/v1/auth/email/verify",
+      {
+        challenge_id: args.challengeId,
+        otp_code: args.otpCode
+      },
+      args.correlationId
+    );
+    return mapAuthSuccess(res);
+  }
+  // ───────────────────────────────────────────────────────────────
+  // GOOGLE — 1-step exchange
+  // ───────────────────────────────────────────────────────────────
+  /**
+   * Hand the gateway an id_token the issuer FE obtained from Google
+   * Identity Services (using PAFI's shared client_id). Gateway verifies
+   * signature + audience + `email_verified` before resolving identity.
+   */
+  async exchangeGoogle(args) {
+    const res = await this.post(
+      "/v1/auth/google/exchange",
+      {
+        issuer_id: this.opts.issuerId,
+        id_token: args.idToken
+      },
+      args.correlationId
+    );
+    return mapAuthSuccess(res);
+  }
+  // ───────────────────────────────────────────────────────────────
+  // KAKAO — 1-step exchange (authorization code)
+  // ───────────────────────────────────────────────────────────────
+  /**
+   * Hand the gateway the authorization code returned by Kakao's
+   * redirect. Gateway exchanges with Kakao (server-to-server using
+   * PAFI's client_secret), verifies id_token, resolves identity.
+   *
+   * `redirectUri` must match the URL the FE used when starting the
+   * Kakao flow. Falls back to the gateway's KAKAO_REDIRECT_URI when
+   * omitted — pass an explicit value for multi-environment FEs.
+   */
+  async exchangeKakao(args) {
+    const res = await this.post(
+      "/v1/auth/kakao/exchange",
+      {
+        issuer_id: this.opts.issuerId,
+        code: args.code,
+        ...args.redirectUri ? { redirect_uri: args.redirectUri } : {}
+      },
+      args.correlationId
+    );
+    return mapAuthSuccess(res);
+  }
+  // ───────────────────────────────────────────────────────────────
+  async post(path, body, correlationId) {
+    const assertion = await signClientAssertion({
+      gatewayUrl: this.opts.gatewayUrl,
+      clientId: this.opts.clientId,
+      privateJwk: this.opts.clientPrivateJwk,
+      alg: this.opts.alg
+    });
+    const finalCorrelationId = correlationId ?? `iss-${(0, import_node_crypto2.randomUUID)()}`;
+    const res = await this.fetchImpl(`${this.opts.gatewayUrl}${path}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${assertion}`,
+        "Content-Type": "application/json",
+        "X-Correlation-Id": finalCorrelationId
+      },
+      body: JSON.stringify(body)
+    });
+    const text = await res.text();
+    let parsed;
+    try {
+      parsed = text ? JSON.parse(text) : {};
+    } catch {
+      throw new PafiAuthError(
+        `Non-JSON response from gateway (${path}): ${text.slice(0, 120)}`,
+        res.status,
+        "non_json_response",
+        finalCorrelationId
+      );
+    }
+    if (!res.ok) {
+      const err = parsed;
+      throw new PafiAuthError(
+        err.error_description ?? err.error ?? `Gateway returned HTTP ${res.status}`,
+        res.status,
+        err.error ?? "unknown_error",
+        err.correlation_id ?? finalCorrelationId
+      );
+    }
+    return parsed;
+  }
+};
+function mapAuthSuccess(res) {
+  return {
+    pafiSessionToken: res.pafi_session_token,
+    pafiJwt: res.pafi_jwt,
+    canonicalId: res.canonical_id,
+    expiresAt: res.expires_at,
+    isFirstLogin: res.is_first_login,
+    ...res.verified_email ? { verifiedEmail: res.verified_email } : {}
+  };
+}
+
+// src/direct-auth/pafi-direct-auth.module-options.ts
+var PAFI_DIRECT_AUTH_MODULE_OPTIONS = /* @__PURE__ */ Symbol(
+  "PAFI_DIRECT_AUTH_MODULE_OPTIONS"
+);
+
+// src/direct-auth/services/pafi-auth-client.provider.ts
+var PafiAuthClientProvider = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  _client;
+  onModuleInit() {
+    const jwk = this.options.clientPrivateJwk;
+    if (!jwk.kid) {
+      throw new Error(
+        "PafiDirectAuthModule: clientPrivateJwk.kid is required \u2014 gateway uses kid for key lookup"
+      );
+    }
+    this._client = new PafiAuthClient({
+      gatewayUrl: this.options.gatewayUrl,
+      issuerId: this.options.issuerId,
+      clientId: this.options.clientId,
+      clientPrivateJwk: jwk
+    });
+  }
+  get client() {
+    return this._client;
+  }
+};
+PafiAuthClientProvider = __decorateClass([
+  (0, import_common.Injectable)(),
+  __decorateParam(0, (0, import_common.Inject)(PAFI_DIRECT_AUTH_MODULE_OPTIONS))
+], PafiAuthClientProvider);
+
+// src/direct-auth/services/pafi-session-verifier.service.ts
+var import_common2 = require("@nestjs/common");
+var import_jose2 = require("jose");
+var PafiSessionVerifierService = class {
+  jwks;
+  expectedIssuer;
+  constructor(options) {
+    this.jwks = (0, import_jose2.createRemoteJWKSet)(
+      new URL(`${options.gatewayUrl}/.well-known/jwks.json`)
+    );
+    this.expectedIssuer = options.gatewayUrl;
+  }
+  async verify(token) {
+    let payload;
+    try {
+      ({ payload } = await (0, import_jose2.jwtVerify)(token, this.jwks, {
+        issuer: this.expectedIssuer
+      }));
+    } catch (err) {
+      throw new import_common2.UnauthorizedException(
+        `Invalid pafi_session_token: ${err.message}`
+      );
+    }
+    if (payload.scope !== "pafi-session") {
+      throw new import_common2.UnauthorizedException(
+        `pafi_session_token has wrong scope: ${String(payload.scope)}`
+      );
+    }
+    if (typeof payload.sub !== "string") {
+      throw new import_common2.UnauthorizedException("pafi_session_token missing sub");
+    }
+    if (typeof payload.exp !== "number" || typeof payload.iat !== "number") {
+      throw new import_common2.UnauthorizedException("pafi_session_token missing iat/exp");
+    }
+    const verifiedAttribute = parseVerifiedAttribute(
+      payload.verified_attribute
+    );
+    return {
+      sub: payload.sub,
+      scope: "pafi-session",
+      verifiedAttribute,
+      issuerId: typeof payload.issuer_id === "string" ? payload.issuer_id : void 0,
+      exp: payload.exp,
+      iat: payload.iat,
+      raw: payload
+    };
+  }
+};
+PafiSessionVerifierService = __decorateClass([
+  (0, import_common2.Injectable)(),
+  __decorateParam(0, (0, import_common2.Inject)(PAFI_DIRECT_AUTH_MODULE_OPTIONS))
+], PafiSessionVerifierService);
+function parseVerifiedAttribute(raw) {
+  if (!raw || typeof raw !== "object") return void 0;
+  const obj = raw;
+  if (typeof obj.type !== "string") return void 0;
+  return {
+    type: obj.type,
+    valueHash: typeof obj.value_hash === "string" ? obj.value_hash : void 0
+  };
+}
+
+// src/direct-auth/services/pafi-direct-auth.service.ts
+var import_common3 = require("@nestjs/common");
+
+// src/direct-auth/interfaces/user-store.interface.ts
+var USER_STORE = /* @__PURE__ */ Symbol("USER_STORE");
+
+// src/direct-auth/interfaces/session-token-minter.interface.ts
+var SESSION_TOKEN_MINTER = /* @__PURE__ */ Symbol("SESSION_TOKEN_MINTER");
+
+// src/direct-auth/services/pafi-direct-auth.service.ts
+var PafiDirectAuthService = class {
+  constructor(clientProvider, sessionVerifier, userStore, sessionTokenMinter) {
+    this.clientProvider = clientProvider;
+    this.sessionVerifier = sessionVerifier;
+    this.userStore = userStore;
+    this.sessionTokenMinter = sessionTokenMinter;
+  }
+  clientProvider;
+  sessionVerifier;
+  userStore;
+  sessionTokenMinter;
+  logger = new import_common3.Logger(PafiDirectAuthService.name);
+  // ── Email OTP ────────────────────────────────────────────────────
+  async startEmail(args) {
+    return this.clientProvider.client.startEmail({
+      email: args.email,
+      correlationId: args.correlationId
+    });
+  }
+  async verifyEmail(args) {
+    const success = await this.clientProvider.client.verifyEmail({
+      challengeId: args.challengeId,
+      otpCode: args.otpCode,
+      correlationId: args.correlationId
+    });
+    await this.sessionVerifier.verify(success.pafiSessionToken);
+    return this.finalize(success);
+  }
+  // ── Google ───────────────────────────────────────────────────────
+  async exchangeGoogle(args) {
+    const success = await this.clientProvider.client.exchangeGoogle({
+      idToken: args.idToken,
+      correlationId: args.correlationId
+    });
+    await this.sessionVerifier.verify(success.pafiSessionToken);
+    return this.finalize(success);
+  }
+  // ── Kakao ────────────────────────────────────────────────────────
+  async exchangeKakao(args) {
+    const success = await this.clientProvider.client.exchangeKakao({
+      code: args.code,
+      redirectUri: args.redirectUri,
+      correlationId: args.correlationId
+    });
+    await this.sessionVerifier.verify(success.pafiSessionToken);
+    return this.finalize(success);
+  }
+  // ── Internal: upsert user + mint issuer session token ───────────
+  async finalize(success) {
+    await this.userStore.upsertByCanonicalAndEmail({
+      canonicalId: success.canonicalId,
+      verifiedEmail: success.verifiedEmail
+    });
+    const { token, expiresAt } = await this.sessionTokenMinter.mint({
+      canonicalId: success.canonicalId,
+      verifiedEmail: success.verifiedEmail
+    });
+    return {
+      sessionToken: token,
+      sessionExpiresAt: expiresAt,
+      pafiJwt: success.pafiJwt,
+      pafiSessionToken: success.pafiSessionToken,
+      canonicalId: success.canonicalId,
+      isFirstLogin: success.isFirstLogin,
+      ...success.verifiedEmail ? { verifiedEmail: success.verifiedEmail } : {}
+    };
+  }
+};
+PafiDirectAuthService = __decorateClass([
+  (0, import_common3.Injectable)(),
+  __decorateParam(2, (0, import_common3.Inject)(USER_STORE)),
+  __decorateParam(3, (0, import_common3.Inject)(SESSION_TOKEN_MINTER))
+], PafiDirectAuthService);
+
+// src/direct-auth/pafi-direct-auth.controller.ts
+var import_common4 = require("@nestjs/common");
+var import_swagger2 = require("@nestjs/swagger");
+
+// src/direct-auth/pafi-direct-auth.dto.ts
+var import_swagger = require("@nestjs/swagger");
+var import_class_validator = require("class-validator");
+var EmailStartRequestDto = class {
+  email;
+};
+__decorateClass([
+  (0, import_swagger.ApiProperty)({ example: "user1@example.com" }),
+  (0, import_class_validator.IsEmail)(),
+  (0, import_class_validator.MaxLength)(320)
+], EmailStartRequestDto.prototype, "email", 2);
+var EmailVerifyRequestDto = class {
+  challengeId;
+  otpCode;
+};
+__decorateClass([
+  (0, import_swagger.ApiProperty)({
+    description: "Challenge id returned by POST /auth/v2/email/start. Opaque to the FE; echo verbatim."
+  }),
+  (0, import_class_validator.IsString)(),
+  (0, import_class_validator.IsNotEmpty)(),
+  (0, import_class_validator.MaxLength)(128)
+], EmailVerifyRequestDto.prototype, "challengeId", 2);
+__decorateClass([
+  (0, import_swagger.ApiProperty)({ example: "123456" }),
+  (0, import_class_validator.IsString)(),
+  (0, import_class_validator.Length)(4, 10)
+], EmailVerifyRequestDto.prototype, "otpCode", 2);
+var GoogleExchangeRequestDto = class {
+  idToken;
+};
+__decorateClass([
+  (0, import_swagger.ApiProperty)({
+    description: "Google-issued ID token (JWS). Obtain on FE via Google Identity Services using PAFI's Google OAuth client_id."
+  }),
+  (0, import_class_validator.IsString)(),
+  (0, import_class_validator.IsNotEmpty)(),
+  (0, import_class_validator.MaxLength)(8192)
+], GoogleExchangeRequestDto.prototype, "idToken", 2);
+var KakaoExchangeRequestDto = class {
+  code;
+  redirectUri;
+};
+__decorateClass([
+  (0, import_swagger.ApiProperty)({
+    description: "Authorization code returned by Kakao to the FE redirect URL."
+  }),
+  (0, import_class_validator.IsString)(),
+  (0, import_class_validator.IsNotEmpty)(),
+  (0, import_class_validator.MaxLength)(2048)
+], KakaoExchangeRequestDto.prototype, "code", 2);
+__decorateClass([
+  (0, import_swagger.ApiProperty)({
+    description: "Redirect URI the FE used when initiating the Kakao flow. Optional \u2014 gateway falls back to its own KAKAO_REDIRECT_URI env.",
+    required: false
+  }),
+  (0, import_class_validator.IsOptional)(),
+  (0, import_class_validator.IsUrl)({ require_tld: false, require_protocol: true }),
+  (0, import_class_validator.MaxLength)(2048)
+], KakaoExchangeRequestDto.prototype, "redirectUri", 2);
+var EmailStartResponseDto = class {
+  challengeId;
+  expiresInSec;
+};
+__decorateClass([
+  (0, import_swagger.ApiProperty)()
+], EmailStartResponseDto.prototype, "challengeId", 2);
+__decorateClass([
+  (0, import_swagger.ApiProperty)({ description: "Seconds until the challenge expires." })
+], EmailStartResponseDto.prototype, "expiresInSec", 2);
+var PafiAuthSuccessDto = class {
+  sessionToken;
+  sessionExpiresAt;
+  pafiJwt;
+  pafiSessionToken;
+  canonicalId;
+  isFirstLogin;
+  verifiedEmail;
+};
+__decorateClass([
+  (0, import_swagger.ApiProperty)({
+    description: "Issuer-native session token (typically HS256, minted by ISessionTokenMinter) \u2014 Bearer-auth for subsequent issuer API calls."
+  })
+], PafiAuthSuccessDto.prototype, "sessionToken", 2);
+__decorateClass([
+  (0, import_swagger.ApiProperty)({ description: "Issuer session token expiration (ISO 8601)." })
+], PafiAuthSuccessDto.prototype, "sessionExpiresAt", 2);
+__decorateClass([
+  (0, import_swagger.ApiProperty)({
+    description: "Short-lived PAFI JWT (60s) \u2014 FE feeds verbatim to Privy.loginWithCustomAuth() to provision the embedded wallet."
+  })
+], PafiAuthSuccessDto.prototype, "pafiJwt", 2);
+__decorateClass([
+  (0, import_swagger.ApiProperty)({
+    description: "Long-lived PAFI session token (24h) \u2014 opaque to FE; keep alongside sessionToken if you ever need to call the gateway directly."
+  })
+], PafiAuthSuccessDto.prototype, "pafiSessionToken", 2);
+__decorateClass([
+  (0, import_swagger.ApiProperty)({ description: "canonical_pafi_user_id assigned by the gateway." })
+], PafiAuthSuccessDto.prototype, "canonicalId", 2);
+__decorateClass([
+  (0, import_swagger.ApiProperty)({
+    description: "True the first time the user appears at the gateway."
+  })
+], PafiAuthSuccessDto.prototype, "isFirstLogin", 2);
+__decorateClass([
+  (0, import_swagger.ApiProperty)({
+    description: "Verified email (when the auth method exposed one \u2014 email OTP and Google always; Kakao only if the user shared their email).",
+    required: false
+  })
+], PafiAuthSuccessDto.prototype, "verifiedEmail", 2);
+
+// src/direct-auth/pafi-direct-auth.controller.ts
+var PafiDirectAuthController = class {
+  constructor(directAuth) {
+    this.directAuth = directAuth;
+  }
+  directAuth;
+  async startEmail(body) {
+    const res = await this.directAuth.startEmail({ email: body.email });
+    return {
+      challengeId: res.challengeId,
+      expiresInSec: res.expiresInSec
+    };
+  }
+  async verifyEmail(body) {
+    return this.directAuth.verifyEmail({
+      challengeId: body.challengeId,
+      otpCode: body.otpCode
+    });
+  }
+  async exchangeGoogle(body) {
+    return this.directAuth.exchangeGoogle({ idToken: body.idToken });
+  }
+  async exchangeKakao(body) {
+    return this.directAuth.exchangeKakao({
+      code: body.code,
+      redirectUri: body.redirectUri
+    });
+  }
+};
+__decorateClass([
+  (0, import_common4.Post)("email/start"),
+  (0, import_common4.HttpCode)(import_common4.HttpStatus.OK),
+  (0, import_swagger2.ApiOperation)({
+    summary: "Step 1: ask gateway to send an OTP to the user email.",
+    description: "Gateway generates the OTP, sends it via its configured email provider, and returns an opaque challenge_id. The FE echoes that challenge_id back on step 2 along with the code the user typed."
+  }),
+  (0, import_swagger2.ApiOkResponse)({ type: EmailStartResponseDto }),
+  __decorateParam(0, (0, import_common4.Body)())
+], PafiDirectAuthController.prototype, "startEmail", 1);
+__decorateClass([
+  (0, import_common4.Post)("email/verify"),
+  (0, import_common4.HttpCode)(import_common4.HttpStatus.OK),
+  (0, import_swagger2.ApiOperation)({
+    summary: "Step 2: submit the OTP to complete email sign-in.",
+    description: "Gateway verifies the OTP, derives canonical_id from the verified email, and mints both a pafi_session_token (24h, gateway-signed) and pafi_jwt (60s, for Privy.loginWithCustomAuth). Issuer wraps these in a session token of its own (sub = canonical_id) so existing guards keep working."
+  }),
+  (0, import_swagger2.ApiOkResponse)({ type: PafiAuthSuccessDto }),
+  __decorateParam(0, (0, import_common4.Body)())
+], PafiDirectAuthController.prototype, "verifyEmail", 1);
+__decorateClass([
+  (0, import_common4.Post)("google/exchange"),
+  (0, import_common4.HttpCode)(import_common4.HttpStatus.OK),
+  (0, import_swagger2.ApiOperation)({
+    summary: "Sign in with Google.",
+    description: "Hand the gateway a Google-issued id_token (FE obtains via Google Identity Services using PAFI's shared client_id). Gateway verifies signature + email_verified, derives canonical_id from the email, returns the same token bundle as /email/verify."
+  }),
+  (0, import_swagger2.ApiOkResponse)({ type: PafiAuthSuccessDto }),
+  __decorateParam(0, (0, import_common4.Body)())
+], PafiDirectAuthController.prototype, "exchangeGoogle", 1);
+__decorateClass([
+  (0, import_common4.Post)("kakao/exchange"),
+  (0, import_common4.HttpCode)(import_common4.HttpStatus.OK),
+  (0, import_swagger2.ApiOperation)({
+    summary: "Sign in with Kakao.",
+    description: "Hand the gateway the authorization code Kakao redirected back to the FE. Gateway exchanges with Kakao server-to-server (using PAFI-held client_secret), verifies the id_token, and returns the same token bundle as /email/verify. canonical_id derives from email when present, else from the Kakao sub."
+  }),
+  (0, import_swagger2.ApiOkResponse)({ type: PafiAuthSuccessDto }),
+  __decorateParam(0, (0, import_common4.Body)())
+], PafiDirectAuthController.prototype, "exchangeKakao", 1);
+PafiDirectAuthController = __decorateClass([
+  (0, import_swagger2.ApiTags)("pafi-auth-v2"),
+  (0, import_common4.Controller)("auth/v2")
+], PafiDirectAuthController);
+
+// src/direct-auth/pafi-direct-auth.module.ts
+var PafiDirectAuthModule = class {
+  static forRoot(options) {
+    return {
+      module: PafiDirectAuthModule,
+      imports: options.imports ?? [],
+      controllers: [PafiDirectAuthController],
+      providers: [
+        {
+          provide: PAFI_DIRECT_AUTH_MODULE_OPTIONS,
+          useValue: options
+        },
+        // Register adapter classes IN THIS MODULE'S SCOPE. NestJS then
+        // resolves their constructor deps from imports + global
+        // providers — which is exactly what the issuer expected to
+        // happen via `useExisting`, but `useExisting` does NOT cross
+        // module boundaries (it's an alias lookup within the module's
+        // own provider registry, not a host-tree walk).
+        options.userStore,
+        options.sessionTokenMinter,
+        {
+          provide: USER_STORE,
+          useExisting: options.userStore
+        },
+        {
+          provide: SESSION_TOKEN_MINTER,
+          useExisting: options.sessionTokenMinter
+        },
+        PafiAuthClientProvider,
+        PafiSessionVerifierService,
+        PafiDirectAuthService
+      ],
+      exports: [
+        PafiAuthClientProvider,
+        PafiSessionVerifierService,
+        PafiDirectAuthService
+      ]
+    };
+  }
+};
+PafiDirectAuthModule = __decorateClass([
+  (0, import_common5.Module)({})
+], PafiDirectAuthModule);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  EmailStartRequestDto,
+  EmailStartResponseDto,
+  EmailVerifyRequestDto,
+  GoogleExchangeRequestDto,
+  KakaoExchangeRequestDto,
+  PAFI_DIRECT_AUTH_MODULE_OPTIONS,
+  PafiAuthClientProvider,
+  PafiAuthSuccessDto,
+  PafiDirectAuthController,
+  PafiDirectAuthModule,
+  PafiDirectAuthService,
+  PafiSessionVerifierService,
+  SESSION_TOKEN_MINTER,
+  USER_STORE
+});
+//# sourceMappingURL=index.cjs.map