@pafi-dev/issuer 0.39.2 → 0.40.0

package/dist/auth-client/index.cjs

@@ -3,6 +3,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -36,117 +37,109 @@ async function signClientAssertion(args) {
   const alg = args.alg ?? args.privateJwk.alg ?? "ES256";
   const key = await (0, import_jose.importJWK)(args.privateJwk, alg);
   const now = Math.floor(Date.now() / 1e3);
-  return new import_jose.SignJWT({}).setProtectedHeader({ alg, typ: "JWT", kid: args.privateJwk.kid }).setIssuer(args.clientId).setSubject(args.clientId).setAudience(`${args.gatewayUrl}/v1/token-exchange`).setIssuedAt(now).setExpirationTime(now + 60).setJti((0, import_node_crypto.randomUUID)()).sign(key);
+  return new import_jose.SignJWT({}).setProtectedHeader({
+    alg,
+    typ: "JWT",
+    kid: args.privateJwk.kid
+  }).setIssuer(args.clientId).setSubject(args.clientId).setAudience(`${args.gatewayUrl}/v1/token-exchange`).setIssuedAt(now).setExpirationTime(now + 60).setJti((0, import_node_crypto.randomUUID)()).sign(key);
 }
+__name(signClientAssertion, "signClientAssertion");
 
 // src/auth-client/types.ts
 var PafiAuthError = class extends Error {
-  constructor(message, status, code, correlationId) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.correlationId = correlationId;
-    this.name = "PafiAuthError";
+  static {
+    __name(this, "PafiAuthError");
   }
   status;
   code;
   correlationId;
+  constructor(message, status, code, correlationId) {
+    super(message), this.status = status, this.code = code, this.correlationId = correlationId;
+    this.name = "PafiAuthError";
+  }
 };
 
 // src/auth-client/pafi-auth-client.ts
 var PafiAuthClient = class {
+  static {
+    __name(this, "PafiAuthClient");
+  }
+  opts;
+  fetchImpl;
+  tokenExchangeAud;
   constructor(opts) {
     this.opts = opts;
     if (!opts.clientPrivateJwk.kid) {
-      throw new Error(
-        "PafiAuthClient: clientPrivateJwk.kid is required (gateway uses kid to look up the verification key)"
-      );
+      throw new Error("PafiAuthClient: clientPrivateJwk.kid is required (gateway uses kid to look up the verification key)");
     }
     this.fetchImpl = opts.fetchImpl ?? fetch;
     this.tokenExchangeAud = `${opts.gatewayUrl}/v1/token-exchange`;
   }
-  opts;
-  fetchImpl;
-  tokenExchangeAud;
   // ───────────────────────────────────────────────────────────────
   // EMAIL OTP — 2-step
   // ───────────────────────────────────────────────────────────────
   /**
-   * Step 1: ask the gateway to send the user an OTP. Returns the
-   * `challengeId` to echo back on {@link verifyEmail}.
-   */
+  * Step 1: ask the gateway to send the user an OTP. Returns the
+  * `challengeId` to echo back on {@link verifyEmail}.
+  */
   async startEmail(args) {
-    const res = await this.post(
-      "/v1/auth/email/start",
-      {
-        issuer_id: this.opts.issuerId,
-        email: args.email
-      },
-      args.correlationId
-    );
+    const res = await this.post("/v1/auth/email/start", {
+      issuer_id: this.opts.issuerId,
+      email: args.email
+    }, args.correlationId);
     return {
       challengeId: res.challenge_id,
       expiresInSec: res.expires_in
     };
   }
   /**
-   * Step 2: submit the OTP the user received. On success returns
-   * {@link AuthSuccess} containing BOTH the long-lived
-   * pafi_session_token (issuer verifies via gateway JWKS) AND the
-   * short-lived pafi_jwt (issuer FE feeds to Privy).
-   */
+  * Step 2: submit the OTP the user received. On success returns
+  * {@link AuthSuccess} containing BOTH the long-lived
+  * pafi_session_token (issuer verifies via gateway JWKS) AND the
+  * short-lived pafi_jwt (issuer FE feeds to Privy).
+  */
   async verifyEmail(args) {
-    const res = await this.post(
-      "/v1/auth/email/verify",
-      {
-        challenge_id: args.challengeId,
-        otp_code: args.otpCode
-      },
-      args.correlationId
-    );
+    const res = await this.post("/v1/auth/email/verify", {
+      challenge_id: args.challengeId,
+      otp_code: args.otpCode
+    }, args.correlationId);
     return mapAuthSuccess(res);
   }
   // ───────────────────────────────────────────────────────────────
   // GOOGLE — 1-step exchange
   // ───────────────────────────────────────────────────────────────
   /**
-   * Hand the gateway an id_token the issuer FE obtained from Google
-   * Identity Services (using PAFI's shared client_id). Gateway verifies
-   * signature + audience + `email_verified` before resolving identity.
-   */
+  * Hand the gateway an id_token the issuer FE obtained from Google
+  * Identity Services (using PAFI's shared client_id). Gateway verifies
+  * signature + audience + `email_verified` before resolving identity.
+  */
   async exchangeGoogle(args) {
-    const res = await this.post(
-      "/v1/auth/google/exchange",
-      {
-        issuer_id: this.opts.issuerId,
-        id_token: args.idToken
-      },
-      args.correlationId
-    );
+    const res = await this.post("/v1/auth/google/exchange", {
+      issuer_id: this.opts.issuerId,
+      id_token: args.idToken
+    }, args.correlationId);
     return mapAuthSuccess(res);
   }
   // ───────────────────────────────────────────────────────────────
   // KAKAO — 1-step exchange (authorization code)
   // ───────────────────────────────────────────────────────────────
   /**
-   * Hand the gateway the authorization code returned by Kakao's
-   * redirect. Gateway exchanges with Kakao (server-to-server using
-   * PAFI's client_secret), verifies id_token, resolves identity.
-   *
-   * `redirectUri` must match the URL the FE used when starting the
-   * Kakao flow. Falls back to the gateway's KAKAO_REDIRECT_URI when
-   * omitted — pass an explicit value for multi-environment FEs.
-   */
+  * Hand the gateway the authorization code returned by Kakao's
+  * redirect. Gateway exchanges with Kakao (server-to-server using
+  * PAFI's client_secret), verifies id_token, resolves identity.
+  *
+  * `redirectUri` must match the URL the FE used when starting the
+  * Kakao flow. Falls back to the gateway's KAKAO_REDIRECT_URI when
+  * omitted — pass an explicit value for multi-environment FEs.
+  */
   async exchangeKakao(args) {
-    const res = await this.post(
-      "/v1/auth/kakao/exchange",
-      {
-        issuer_id: this.opts.issuerId,
-        code: args.code,
-        ...args.redirectUri ? { redirect_uri: args.redirectUri } : {}
-      },
-      args.correlationId
-    );
+    const res = await this.post("/v1/auth/kakao/exchange", {
+      issuer_id: this.opts.issuerId,
+      code: args.code,
+      ...args.redirectUri ? {
+        redirect_uri: args.redirectUri
+      } : {}
+    }, args.correlationId);
     return mapAuthSuccess(res);
   }
   // ───────────────────────────────────────────────────────────────
@@ -172,21 +165,11 @@ var PafiAuthClient = class {
     try {
       parsed = text ? JSON.parse(text) : {};
     } catch {
-      throw new PafiAuthError(
-        `Non-JSON response from gateway (${path}): ${text.slice(0, 120)}`,
-        res.status,
-        "non_json_response",
-        finalCorrelationId
-      );
+      throw new PafiAuthError(`Non-JSON response from gateway (${path}): ${text.slice(0, 120)}`, res.status, "non_json_response", finalCorrelationId);
     }
     if (!res.ok) {
       const err = parsed;
-      throw new PafiAuthError(
-        err.error_description ?? err.error ?? `Gateway returned HTTP ${res.status}`,
-        res.status,
-        err.error ?? "unknown_error",
-        err.correlation_id ?? finalCorrelationId
-      );
+      throw new PafiAuthError(err.error_description ?? err.error ?? `Gateway returned HTTP ${res.status}`, res.status, err.error ?? "unknown_error", err.correlation_id ?? finalCorrelationId);
     }
     return parsed;
   }
@@ -198,9 +181,12 @@ function mapAuthSuccess(res) {
     canonicalId: res.canonical_id,
     expiresAt: res.expires_at,
     isFirstLogin: res.is_first_login,
-    ...res.verified_email ? { verifiedEmail: res.verified_email } : {}
+    ...res.verified_email ? {
+      verifiedEmail: res.verified_email
+    } : {}
   };
 }
+__name(mapAuthSuccess, "mapAuthSuccess");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   PafiAuthClient,

package/dist/auth-client/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth-client/index.ts","../../src/auth-client/pafi-auth-client.ts","../../src/auth-client/sign-client-assertion.ts","../../src/auth-client/types.ts"],"sourcesContent":["export { PafiAuthClient } from \"./pafi-auth-client\";\nexport { PafiAuthError } from \"./types\";\nexport type {\n  AuthSuccess,\n  EmailChallenge,\n  PafiAuthClientOptions,\n} from \"./types\";\nexport { signClientAssertion } from \"./sign-client-assertion\";\n","import { randomUUID } from \"node:crypto\";\nimport { signClientAssertion } from \"./sign-client-assertion\";\nimport {\n  PafiAuthError,\n  type AuthSuccess,\n  type EmailChallenge,\n  type PafiAuthClientOptions,\n} from \"./types\";\n\ninterface GatewayErrorResponse {\n  error?: string;\n  error_description?: string;\n  correlation_id?: string;\n}\n\ninterface GatewayAuthSuccessResponse {\n  pafi_session_token: string;\n  pafi_jwt: string;\n  canonical_id: string;\n  expires_at: number;\n  is_first_login: boolean;\n  verified_email?: string;\n}\n\ninterface GatewayChallengeResponse {\n  challenge_id: string;\n  expires_in: number;\n}\n\n/**\n * Issuer-side client for the PAFI gateway's direct-auth endpoints. Use\n * one instance per issuer backend — the constructor binds gateway URL +\n * issuer id + signing credentials, methods just route to specific\n * endpoints.\n *\n * Each method signs a fresh client_assertion (RFC 7523, 60s TTL) so\n * a leaked one is useless beyond the window + replay-protected by jti.\n *\n * The gateway endpoints invoked here are owned by PAFI — the issuer\n * never sees OTP codes, never holds OAuth client_secrets, never\n * verifies signatures itself. Gateway is the sole authority; this\n * client is purely a transport.\n *\n * Usage in a NestJS issuer backend:\n *\n *   @Injectable()\n *   export class PafiAuthClientProvider {\n *     readonly client: PafiAuthClient;\n *     constructor(config: ConfigService) {\n *       this.client = new PafiAuthClient({\n *         gatewayUrl: config.getOrThrow('PAFI_GATEWAY_URL'),\n *         issuerId:   config.getOrThrow('PAFI_GATEWAY_ISSUER_ID'),\n *         clientId:   config.getOrThrow('PAFI_GATEWAY_CLIENT_ID'),\n *         clientPrivateJwk: JSON.parse(\n *           config.getOrThrow('PAFI_GATEWAY_CLIENT_PRIVATE_JWK_JSON'),\n *         ),\n *       });\n *     }\n *   }\n */\nexport class PafiAuthClient {\n  private readonly fetchImpl: typeof fetch;\n  private readonly tokenExchangeAud: string;\n\n  constructor(private readonly opts: PafiAuthClientOptions) {\n    if (!opts.clientPrivateJwk.kid) {\n      throw new Error(\n        \"PafiAuthClient: clientPrivateJwk.kid is required (gateway uses kid to look up the verification key)\",\n      );\n    }\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n    this.tokenExchangeAud = `${opts.gatewayUrl}/v1/token-exchange`;\n  }\n\n  // ───────────────────────────────────────────────────────────────\n  // EMAIL OTP — 2-step\n  // ───────────────────────────────────────────────────────────────\n\n  /**\n   * Step 1: ask the gateway to send the user an OTP. Returns the\n   * `challengeId` to echo back on {@link verifyEmail}.\n   */\n  async startEmail(args: {\n    email: string;\n    correlationId?: string;\n  }): Promise<EmailChallenge> {\n    const res = await this.post<GatewayChallengeResponse>(\n      \"/v1/auth/email/start\",\n      {\n        issuer_id: this.opts.issuerId,\n        email: args.email,\n      },\n      args.correlationId,\n    );\n    return {\n      challengeId: res.challenge_id,\n      expiresInSec: res.expires_in,\n    };\n  }\n\n  /**\n   * Step 2: submit the OTP the user received. On success returns\n   * {@link AuthSuccess} containing BOTH the long-lived\n   * pafi_session_token (issuer verifies via gateway JWKS) AND the\n   * short-lived pafi_jwt (issuer FE feeds to Privy).\n   */\n  async verifyEmail(args: {\n    challengeId: string;\n    otpCode: string;\n    correlationId?: string;\n  }): Promise<AuthSuccess> {\n    const res = await this.post<GatewayAuthSuccessResponse>(\n      \"/v1/auth/email/verify\",\n      {\n        challenge_id: args.challengeId,\n        otp_code: args.otpCode,\n      },\n      args.correlationId,\n    );\n    return mapAuthSuccess(res);\n  }\n\n  // ───────────────────────────────────────────────────────────────\n  // GOOGLE — 1-step exchange\n  // ───────────────────────────────────────────────────────────────\n\n  /**\n   * Hand the gateway an id_token the issuer FE obtained from Google\n   * Identity Services (using PAFI's shared client_id). Gateway verifies\n   * signature + audience + `email_verified` before resolving identity.\n   */\n  async exchangeGoogle(args: {\n    idToken: string;\n    correlationId?: string;\n  }): Promise<AuthSuccess> {\n    const res = await this.post<GatewayAuthSuccessResponse>(\n      \"/v1/auth/google/exchange\",\n      {\n        issuer_id: this.opts.issuerId,\n        id_token: args.idToken,\n      },\n      args.correlationId,\n    );\n    return mapAuthSuccess(res);\n  }\n\n  // ───────────────────────────────────────────────────────────────\n  // KAKAO — 1-step exchange (authorization code)\n  // ───────────────────────────────────────────────────────────────\n\n  /**\n   * Hand the gateway the authorization code returned by Kakao's\n   * redirect. Gateway exchanges with Kakao (server-to-server using\n   * PAFI's client_secret), verifies id_token, resolves identity.\n   *\n   * `redirectUri` must match the URL the FE used when starting the\n   * Kakao flow. Falls back to the gateway's KAKAO_REDIRECT_URI when\n   * omitted — pass an explicit value for multi-environment FEs.\n   */\n  async exchangeKakao(args: {\n    code: string;\n    redirectUri?: string;\n    correlationId?: string;\n  }): Promise<AuthSuccess> {\n    const res = await this.post<GatewayAuthSuccessResponse>(\n      \"/v1/auth/kakao/exchange\",\n      {\n        issuer_id: this.opts.issuerId,\n        code: args.code,\n        ...(args.redirectUri ? { redirect_uri: args.redirectUri } : {}),\n      },\n      args.correlationId,\n    );\n    return mapAuthSuccess(res);\n  }\n\n  // ───────────────────────────────────────────────────────────────\n\n  private async post<T>(\n    path: string,\n    body: unknown,\n    correlationId: string | undefined,\n  ): Promise<T> {\n    const assertion = await signClientAssertion({\n      gatewayUrl: this.opts.gatewayUrl,\n      clientId: this.opts.clientId,\n      privateJwk: this.opts.clientPrivateJwk,\n      alg: this.opts.alg,\n    });\n    const finalCorrelationId = correlationId ?? `iss-${randomUUID()}`;\n    const res = await this.fetchImpl(`${this.opts.gatewayUrl}${path}`, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${assertion}`,\n        \"Content-Type\": \"application/json\",\n        \"X-Correlation-Id\": finalCorrelationId,\n      },\n      body: JSON.stringify(body),\n    });\n    const text = await res.text();\n    let parsed: unknown;\n    try {\n      parsed = text ? JSON.parse(text) : {};\n    } catch {\n      throw new PafiAuthError(\n        `Non-JSON response from gateway (${path}): ${text.slice(0, 120)}`,\n        res.status,\n        \"non_json_response\",\n        finalCorrelationId,\n      );\n    }\n    if (!res.ok) {\n      const err = parsed as GatewayErrorResponse;\n      throw new PafiAuthError(\n        err.error_description ??\n          err.error ??\n          `Gateway returned HTTP ${res.status}`,\n        res.status,\n        err.error ?? \"unknown_error\",\n        err.correlation_id ?? finalCorrelationId,\n      );\n    }\n    return parsed as T;\n  }\n}\n\nfunction mapAuthSuccess(res: GatewayAuthSuccessResponse): AuthSuccess {\n  return {\n    pafiSessionToken: res.pafi_session_token,\n    pafiJwt: res.pafi_jwt,\n    canonicalId: res.canonical_id,\n    expiresAt: res.expires_at,\n    isFirstLogin: res.is_first_login,\n    ...(res.verified_email ? { verifiedEmail: res.verified_email } : {}),\n  };\n}\n","import { importJWK, SignJWT, type JWK } from \"jose\";\nimport { randomUUID } from \"node:crypto\";\n\n/**\n * Mint the RFC 7523 client_assertion JWT the gateway expects in the\n * `Authorization: Bearer …` header of every direct-auth call.\n *\n * Claims:\n *   - iss / sub  = clientId (RFC 7523 §3: same value for client auth)\n *   - aud        = `${gatewayUrl}/v1/token-exchange` (exact endpoint URL)\n *                  — NOTE the gateway also accepts this same audience\n *                  for the direct-auth endpoints because they live on\n *                  the same client-auth boundary. Single audience keeps\n *                  one client_assertion reusable across all gateway\n *                  endpoints for the duration of its short lifetime.\n *   - iat / exp  = 60-second window (replay-protected by jti)\n *   - jti        = random UUID\n *\n * 60-second lifetime is a deliberate trade-off: long enough to absorb\n * clock skew + slow networks, short enough that a stolen assertion is\n * usable only briefly. The gateway's per-jti replay cache means even\n * within that window an assertion is single-use.\n */\nexport async function signClientAssertion(args: {\n  gatewayUrl: string;\n  clientId: string;\n  privateJwk: JWK & { kid: string };\n  alg?: string;\n}): Promise<string> {\n  const alg = args.alg ?? args.privateJwk.alg ?? \"ES256\";\n  const key = await importJWK(args.privateJwk, alg);\n  const now = Math.floor(Date.now() / 1000);\n  return new SignJWT({})\n    .setProtectedHeader({ alg, typ: \"JWT\", kid: args.privateJwk.kid })\n    .setIssuer(args.clientId)\n    .setSubject(args.clientId)\n    .setAudience(`${args.gatewayUrl}/v1/token-exchange`)\n    .setIssuedAt(now)\n    .setExpirationTime(now + 60)\n    .setJti(randomUUID())\n    .sign(key);\n}\n","import type { JWK } from \"jose\";\n\n/**\n * Constructor params for {@link PafiAuthClient}. One instance per\n * issuer backend — wraps the issuer's gateway credentials (client_id +\n * private JWK) plus the static config (gateway URL, audience).\n */\nexport interface PafiAuthClientOptions {\n  /** Base URL of the PAFI gateway (e.g. `https://id-dev.pacificfinance.org`). */\n  gatewayUrl: string;\n  /** Issuer identifier registered with the gateway (e.g. `gg56`). */\n  issuerId: string;\n  /**\n   * Gateway client_id assigned at issuer onboarding. Also acts as the\n   * `iss`/`sub` of the client_assertion JWT (RFC 7523 §3).\n   */\n  clientId: string;\n  /**\n   * Private JWK the issuer uses to sign client_assertion. MUST include\n   * `kid` — gateway looks up the matching public JWK by kid.\n   */\n  clientPrivateJwk: JWK & { kid: string };\n  /**\n   * Optional fetch override — useful for tests / Node env without\n   * global fetch (Node ≥ 18 has it built-in).\n   */\n  fetchImpl?: typeof fetch;\n  /**\n   * Optional algorithm override for the client assertion JWT. Default\n   * `ES256`. Must match what the gateway expects for this client.\n   */\n  alg?: \"ES256\" | \"ES384\" | \"RS256\" | \"RS384\" | \"RS512\" | \"EdDSA\";\n}\n\nexport interface AuthSuccess {\n  pafiSessionToken: string;\n  pafiJwt: string;\n  canonicalId: string;\n  expiresAt: number;\n  isFirstLogin: boolean;\n  verifiedEmail?: string;\n}\n\nexport interface EmailChallenge {\n  challengeId: string;\n  expiresInSec: number;\n}\n\n/**\n * Thrown when the gateway rejects the call. `code` is the gateway's\n * structured `error` field (e.g. `invalid_otp`, `too_many_attempts`,\n * `expired`, `email_not_verified`) — issuers can branch on it to drive\n * UX (e.g. show \"Resend code\" button on `expired`).\n */\nexport class PafiAuthError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code: string,\n    public readonly correlationId?: string,\n  ) {\n    super(message);\n    this.name = \"PafiAuthError\";\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,sBAA2B;;;ACA3B,kBAA6C;AAC7C,yBAA2B;AAsB3B,eAAsB,oBAAoB,MAKtB;AAClB,QAAM,MAAM,KAAK,OAAO,KAAK,WAAW,OAAO;AAC/C,QAAM,MAAM,UAAM,uBAAU,KAAK,YAAY,GAAG;AAChD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO,IAAI,oBAAQ,CAAC,CAAC,EAClB,mBAAmB,EAAE,KAAK,KAAK,OAAO,KAAK,KAAK,WAAW,IAAI,CAAC,EAChE,UAAU,KAAK,QAAQ,EACvB,WAAW,KAAK,QAAQ,EACxB,YAAY,GAAG,KAAK,UAAU,oBAAoB,EAClD,YAAY,GAAG,EACf,kBAAkB,MAAM,EAAE,EAC1B,WAAO,+BAAW,CAAC,EACnB,KAAK,GAAG;AACb;;;ACaO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YACE,SACgB,QACA,MACA,eAChB;AACA,UAAM,OAAO;AAJG;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EANkB;AAAA,EACA;AAAA,EACA;AAKpB;;;AFJO,IAAM,iBAAN,MAAqB;AAAA,EAI1B,YAA6B,MAA6B;AAA7B;AAC3B,QAAI,CAAC,KAAK,iBAAiB,KAAK;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,mBAAmB,GAAG,KAAK,UAAU;AAAA,EAC5C;AAAA,EAR6B;AAAA,EAHZ;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBjB,MAAM,WAAW,MAGW;AAC1B,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,QACE,WAAW,KAAK,KAAK;AAAA,QACrB,OAAO,KAAK;AAAA,MACd;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,IACpB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,YAAY,MAIO;AACvB,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,QACE,cAAc,KAAK;AAAA,QACnB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO,eAAe,GAAG;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,eAAe,MAGI;AACvB,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,QACE,WAAW,KAAK,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO,eAAe,GAAG;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,cAAc,MAIK;AACvB,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,QACE,WAAW,KAAK,KAAK;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,GAAI,KAAK,cAAc,EAAE,cAAc,KAAK,YAAY,IAAI,CAAC;AAAA,MAC/D;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO,eAAe,GAAG;AAAA,EAC3B;AAAA;AAAA,EAIA,MAAc,KACZ,MACA,MACA,eACY;AACZ,UAAM,YAAY,MAAM,oBAAoB;AAAA,MAC1C,YAAY,KAAK,KAAK;AAAA,MACtB,UAAU,KAAK,KAAK;AAAA,MACpB,YAAY,KAAK,KAAK;AAAA,MACtB,KAAK,KAAK,KAAK;AAAA,IACjB,CAAC;AACD,UAAM,qBAAqB,iBAAiB,WAAO,gCAAW,CAAC;AAC/D,UAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,KAAK,UAAU,GAAG,IAAI,IAAI;AAAA,MACjE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,SAAS;AAAA,QAClC,gBAAgB;AAAA,QAChB,oBAAoB;AAAA,MACtB;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AACD,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI;AACJ,QAAI;AACF,eAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,IACtC,QAAQ;AACN,YAAM,IAAI;AAAA,QACR,mCAAmC,IAAI,MAAM,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,QAC/D,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,MAAM;AACZ,YAAM,IAAI;AAAA,QACR,IAAI,qBACF,IAAI,SACJ,yBAAyB,IAAI,MAAM;AAAA,QACrC,IAAI;AAAA,QACJ,IAAI,SAAS;AAAA,QACb,IAAI,kBAAkB;AAAA,MACxB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,KAA8C;AACpE,SAAO;AAAA,IACL,kBAAkB,IAAI;AAAA,IACtB,SAAS,IAAI;AAAA,IACb,aAAa,IAAI;AAAA,IACjB,WAAW,IAAI;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,GAAI,IAAI,iBAAiB,EAAE,eAAe,IAAI,eAAe,IAAI,CAAC;AAAA,EACpE;AACF;","names":["import_node_crypto"]}
+{"version":3,"sources":["../../src/auth-client/index.ts","../../src/auth-client/pafi-auth-client.ts","../../src/auth-client/sign-client-assertion.ts","../../src/auth-client/types.ts"],"sourcesContent":["export { PafiAuthClient } from \"./pafi-auth-client\";\nexport { PafiAuthError } from \"./types\";\nexport type {\n  AuthSuccess,\n  EmailChallenge,\n  PafiAuthClientOptions,\n} from \"./types\";\nexport { signClientAssertion } from \"./sign-client-assertion\";\n","import { randomUUID } from \"node:crypto\";\nimport { signClientAssertion } from \"./sign-client-assertion\";\nimport {\n  PafiAuthError,\n  type AuthSuccess,\n  type EmailChallenge,\n  type PafiAuthClientOptions,\n} from \"./types\";\n\ninterface GatewayErrorResponse {\n  error?: string;\n  error_description?: string;\n  correlation_id?: string;\n}\n\ninterface GatewayAuthSuccessResponse {\n  pafi_session_token: string;\n  pafi_jwt: string;\n  canonical_id: string;\n  expires_at: number;\n  is_first_login: boolean;\n  verified_email?: string;\n}\n\ninterface GatewayChallengeResponse {\n  challenge_id: string;\n  expires_in: number;\n}\n\n/**\n * Issuer-side client for the PAFI gateway's direct-auth endpoints. Use\n * one instance per issuer backend — the constructor binds gateway URL +\n * issuer id + signing credentials, methods just route to specific\n * endpoints.\n *\n * Each method signs a fresh client_assertion (RFC 7523, 60s TTL) so\n * a leaked one is useless beyond the window + replay-protected by jti.\n *\n * The gateway endpoints invoked here are owned by PAFI — the issuer\n * never sees OTP codes, never holds OAuth client_secrets, never\n * verifies signatures itself. Gateway is the sole authority; this\n * client is purely a transport.\n *\n * Usage in a NestJS issuer backend:\n *\n *   @Injectable()\n *   export class PafiAuthClientProvider {\n *     readonly client: PafiAuthClient;\n *     constructor(config: ConfigService) {\n *       this.client = new PafiAuthClient({\n *         gatewayUrl: config.getOrThrow('PAFI_GATEWAY_URL'),\n *         issuerId:   config.getOrThrow('PAFI_GATEWAY_ISSUER_ID'),\n *         clientId:   config.getOrThrow('PAFI_GATEWAY_CLIENT_ID'),\n *         clientPrivateJwk: JSON.parse(\n *           config.getOrThrow('PAFI_GATEWAY_CLIENT_PRIVATE_JWK_JSON'),\n *         ),\n *       });\n *     }\n *   }\n */\nexport class PafiAuthClient {\n  private readonly fetchImpl: typeof fetch;\n  private readonly tokenExchangeAud: string;\n\n  constructor(private readonly opts: PafiAuthClientOptions) {\n    if (!opts.clientPrivateJwk.kid) {\n      throw new Error(\n        \"PafiAuthClient: clientPrivateJwk.kid is required (gateway uses kid to look up the verification key)\",\n      );\n    }\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n    this.tokenExchangeAud = `${opts.gatewayUrl}/v1/token-exchange`;\n  }\n\n  // ───────────────────────────────────────────────────────────────\n  // EMAIL OTP — 2-step\n  // ───────────────────────────────────────────────────────────────\n\n  /**\n   * Step 1: ask the gateway to send the user an OTP. Returns the\n   * `challengeId` to echo back on {@link verifyEmail}.\n   */\n  async startEmail(args: {\n    email: string;\n    correlationId?: string;\n  }): Promise<EmailChallenge> {\n    const res = await this.post<GatewayChallengeResponse>(\n      \"/v1/auth/email/start\",\n      {\n        issuer_id: this.opts.issuerId,\n        email: args.email,\n      },\n      args.correlationId,\n    );\n    return {\n      challengeId: res.challenge_id,\n      expiresInSec: res.expires_in,\n    };\n  }\n\n  /**\n   * Step 2: submit the OTP the user received. On success returns\n   * {@link AuthSuccess} containing BOTH the long-lived\n   * pafi_session_token (issuer verifies via gateway JWKS) AND the\n   * short-lived pafi_jwt (issuer FE feeds to Privy).\n   */\n  async verifyEmail(args: {\n    challengeId: string;\n    otpCode: string;\n    correlationId?: string;\n  }): Promise<AuthSuccess> {\n    const res = await this.post<GatewayAuthSuccessResponse>(\n      \"/v1/auth/email/verify\",\n      {\n        challenge_id: args.challengeId,\n        otp_code: args.otpCode,\n      },\n      args.correlationId,\n    );\n    return mapAuthSuccess(res);\n  }\n\n  // ───────────────────────────────────────────────────────────────\n  // GOOGLE — 1-step exchange\n  // ───────────────────────────────────────────────────────────────\n\n  /**\n   * Hand the gateway an id_token the issuer FE obtained from Google\n   * Identity Services (using PAFI's shared client_id). Gateway verifies\n   * signature + audience + `email_verified` before resolving identity.\n   */\n  async exchangeGoogle(args: {\n    idToken: string;\n    correlationId?: string;\n  }): Promise<AuthSuccess> {\n    const res = await this.post<GatewayAuthSuccessResponse>(\n      \"/v1/auth/google/exchange\",\n      {\n        issuer_id: this.opts.issuerId,\n        id_token: args.idToken,\n      },\n      args.correlationId,\n    );\n    return mapAuthSuccess(res);\n  }\n\n  // ───────────────────────────────────────────────────────────────\n  // KAKAO — 1-step exchange (authorization code)\n  // ───────────────────────────────────────────────────────────────\n\n  /**\n   * Hand the gateway the authorization code returned by Kakao's\n   * redirect. Gateway exchanges with Kakao (server-to-server using\n   * PAFI's client_secret), verifies id_token, resolves identity.\n   *\n   * `redirectUri` must match the URL the FE used when starting the\n   * Kakao flow. Falls back to the gateway's KAKAO_REDIRECT_URI when\n   * omitted — pass an explicit value for multi-environment FEs.\n   */\n  async exchangeKakao(args: {\n    code: string;\n    redirectUri?: string;\n    correlationId?: string;\n  }): Promise<AuthSuccess> {\n    const res = await this.post<GatewayAuthSuccessResponse>(\n      \"/v1/auth/kakao/exchange\",\n      {\n        issuer_id: this.opts.issuerId,\n        code: args.code,\n        ...(args.redirectUri ? { redirect_uri: args.redirectUri } : {}),\n      },\n      args.correlationId,\n    );\n    return mapAuthSuccess(res);\n  }\n\n  // ───────────────────────────────────────────────────────────────\n\n  private async post<T>(\n    path: string,\n    body: unknown,\n    correlationId: string | undefined,\n  ): Promise<T> {\n    const assertion = await signClientAssertion({\n      gatewayUrl: this.opts.gatewayUrl,\n      clientId: this.opts.clientId,\n      privateJwk: this.opts.clientPrivateJwk,\n      alg: this.opts.alg,\n    });\n    const finalCorrelationId = correlationId ?? `iss-${randomUUID()}`;\n    const res = await this.fetchImpl(`${this.opts.gatewayUrl}${path}`, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${assertion}`,\n        \"Content-Type\": \"application/json\",\n        \"X-Correlation-Id\": finalCorrelationId,\n      },\n      body: JSON.stringify(body),\n    });\n    const text = await res.text();\n    let parsed: unknown;\n    try {\n      parsed = text ? JSON.parse(text) : {};\n    } catch {\n      throw new PafiAuthError(\n        `Non-JSON response from gateway (${path}): ${text.slice(0, 120)}`,\n        res.status,\n        \"non_json_response\",\n        finalCorrelationId,\n      );\n    }\n    if (!res.ok) {\n      const err = parsed as GatewayErrorResponse;\n      throw new PafiAuthError(\n        err.error_description ??\n          err.error ??\n          `Gateway returned HTTP ${res.status}`,\n        res.status,\n        err.error ?? \"unknown_error\",\n        err.correlation_id ?? finalCorrelationId,\n      );\n    }\n    return parsed as T;\n  }\n}\n\nfunction mapAuthSuccess(res: GatewayAuthSuccessResponse): AuthSuccess {\n  return {\n    pafiSessionToken: res.pafi_session_token,\n    pafiJwt: res.pafi_jwt,\n    canonicalId: res.canonical_id,\n    expiresAt: res.expires_at,\n    isFirstLogin: res.is_first_login,\n    ...(res.verified_email ? { verifiedEmail: res.verified_email } : {}),\n  };\n}\n","import { importJWK, SignJWT, type JWK } from \"jose\";\nimport { randomUUID } from \"node:crypto\";\n\n/**\n * Mint the RFC 7523 client_assertion JWT the gateway expects in the\n * `Authorization: Bearer …` header of every direct-auth call.\n *\n * Claims:\n *   - iss / sub  = clientId (RFC 7523 §3: same value for client auth)\n *   - aud        = `${gatewayUrl}/v1/token-exchange` (exact endpoint URL)\n *                  — NOTE the gateway also accepts this same audience\n *                  for the direct-auth endpoints because they live on\n *                  the same client-auth boundary. Single audience keeps\n *                  one client_assertion reusable across all gateway\n *                  endpoints for the duration of its short lifetime.\n *   - iat / exp  = 60-second window (replay-protected by jti)\n *   - jti        = random UUID\n *\n * 60-second lifetime is a deliberate trade-off: long enough to absorb\n * clock skew + slow networks, short enough that a stolen assertion is\n * usable only briefly. The gateway's per-jti replay cache means even\n * within that window an assertion is single-use.\n */\nexport async function signClientAssertion(args: {\n  gatewayUrl: string;\n  clientId: string;\n  privateJwk: JWK & { kid: string };\n  alg?: string;\n}): Promise<string> {\n  const alg = args.alg ?? args.privateJwk.alg ?? \"ES256\";\n  const key = await importJWK(args.privateJwk, alg);\n  const now = Math.floor(Date.now() / 1000);\n  return new SignJWT({})\n    .setProtectedHeader({ alg, typ: \"JWT\", kid: args.privateJwk.kid })\n    .setIssuer(args.clientId)\n    .setSubject(args.clientId)\n    .setAudience(`${args.gatewayUrl}/v1/token-exchange`)\n    .setIssuedAt(now)\n    .setExpirationTime(now + 60)\n    .setJti(randomUUID())\n    .sign(key);\n}\n","import type { JWK } from \"jose\";\n\n/**\n * Constructor params for {@link PafiAuthClient}. One instance per\n * issuer backend — wraps the issuer's gateway credentials (client_id +\n * private JWK) plus the static config (gateway URL, audience).\n */\nexport interface PafiAuthClientOptions {\n  /** Base URL of the PAFI gateway (e.g. `https://id-dev.pacificfinance.org`). */\n  gatewayUrl: string;\n  /** Issuer identifier registered with the gateway (e.g. `gg56`). */\n  issuerId: string;\n  /**\n   * Gateway client_id assigned at issuer onboarding. Also acts as the\n   * `iss`/`sub` of the client_assertion JWT (RFC 7523 §3).\n   */\n  clientId: string;\n  /**\n   * Private JWK the issuer uses to sign client_assertion. MUST include\n   * `kid` — gateway looks up the matching public JWK by kid.\n   */\n  clientPrivateJwk: JWK & { kid: string };\n  /**\n   * Optional fetch override — useful for tests / Node env without\n   * global fetch (Node ≥ 18 has it built-in).\n   */\n  fetchImpl?: typeof fetch;\n  /**\n   * Optional algorithm override for the client assertion JWT. Default\n   * `ES256`. Must match what the gateway expects for this client.\n   */\n  alg?: \"ES256\" | \"ES384\" | \"RS256\" | \"RS384\" | \"RS512\" | \"EdDSA\";\n}\n\nexport interface AuthSuccess {\n  pafiSessionToken: string;\n  pafiJwt: string;\n  canonicalId: string;\n  expiresAt: number;\n  isFirstLogin: boolean;\n  verifiedEmail?: string;\n}\n\nexport interface EmailChallenge {\n  challengeId: string;\n  expiresInSec: number;\n}\n\n/**\n * Thrown when the gateway rejects the call. `code` is the gateway's\n * structured `error` field (e.g. `invalid_otp`, `too_many_attempts`,\n * `expired`, `email_not_verified`) — issuers can branch on it to drive\n * UX (e.g. show \"Resend code\" button on `expired`).\n */\nexport class PafiAuthError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code: string,\n    public readonly correlationId?: string,\n  ) {\n    super(message);\n    this.name = \"PafiAuthError\";\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;ACAA,IAAAA,sBAA2B;;;ACA3B,kBAA6C;AAC7C,yBAA2B;AAsB3B,eAAsBC,oBAAoBC,MAKzC;AACC,QAAMC,MAAMD,KAAKC,OAAOD,KAAKE,WAAWD,OAAO;AAC/C,QAAME,MAAM,UAAMC,uBAAUJ,KAAKE,YAAYD,GAAAA;AAC7C,QAAMI,MAAMC,KAAKC,MAAMC,KAAKH,IAAG,IAAK,GAAA;AACpC,SAAO,IAAII,oBAAQ,CAAC,CAAA,EACjBC,mBAAmB;IAAET;IAAKU,KAAK;IAAOC,KAAKZ,KAAKE,WAAWU;EAAI,CAAA,EAC/DC,UAAUb,KAAKc,QAAQ,EACvBC,WAAWf,KAAKc,QAAQ,EACxBE,YAAY,GAAGhB,KAAKiB,UAAU,oBAAoB,EAClDC,YAAYb,GAAAA,EACZc,kBAAkBd,MAAM,EAAA,EACxBe,WAAOC,+BAAAA,CAAAA,EACPC,KAAKnB,GAAAA;AACV;AAlBsBJ;;;AC+Bf,IAAMwB,gBAAN,cAA4BC,MAAAA;EANnC,OAMmCA;;;;;;EACjC,YACEC,SACgBC,QACAC,MACAC,eAChB;AACA,UAAMH,OAAAA,GAAAA,KAJUC,SAAAA,QAAAA,KACAC,OAAAA,MAAAA,KACAC,gBAAAA;AAGhB,SAAKC,OAAO;EACd;AACF;;;AFJO,IAAMC,iBAAN,MAAMA;EA5Db,OA4DaA;;;;EACMC;EACAC;EAEjB,YAA6BC,MAA6B;SAA7BA,OAAAA;AAC3B,QAAI,CAACA,KAAKC,iBAAiBC,KAAK;AAC9B,YAAM,IAAIC,MACR,qGAAA;IAEJ;AACA,SAAKL,YAAYE,KAAKF,aAAaM;AACnC,SAAKL,mBAAmB,GAAGC,KAAKK,UAAU;EAC5C;;;;;;;;EAUA,MAAMC,WAAWC,MAGW;AAC1B,UAAMC,MAAM,MAAM,KAAKC,KACrB,wBACA;MACEC,WAAW,KAAKV,KAAKW;MACrBC,OAAOL,KAAKK;IACd,GACAL,KAAKM,aAAa;AAEpB,WAAO;MACLC,aAAaN,IAAIO;MACjBC,cAAcR,IAAIS;IACpB;EACF;;;;;;;EAQA,MAAMC,YAAYX,MAIO;AACvB,UAAMC,MAAM,MAAM,KAAKC,KACrB,yBACA;MACEM,cAAcR,KAAKO;MACnBK,UAAUZ,KAAKa;IACjB,GACAb,KAAKM,aAAa;AAEpB,WAAOQ,eAAeb,GAAAA;EACxB;;;;;;;;;EAWA,MAAMc,eAAef,MAGI;AACvB,UAAMC,MAAM,MAAM,KAAKC,KACrB,4BACA;MACEC,WAAW,KAAKV,KAAKW;MACrBY,UAAUhB,KAAKiB;IACjB,GACAjB,KAAKM,aAAa;AAEpB,WAAOQ,eAAeb,GAAAA;EACxB;;;;;;;;;;;;;EAeA,MAAMiB,cAAclB,MAIK;AACvB,UAAMC,MAAM,MAAM,KAAKC,KACrB,2BACA;MACEC,WAAW,KAAKV,KAAKW;MACrBe,MAAMnB,KAAKmB;MACX,GAAInB,KAAKoB,cAAc;QAAEC,cAAcrB,KAAKoB;MAAY,IAAI,CAAC;IAC/D,GACApB,KAAKM,aAAa;AAEpB,WAAOQ,eAAeb,GAAAA;EACxB;;EAIA,MAAcC,KACZoB,MACAC,MACAjB,eACY;AACZ,UAAMkB,YAAY,MAAMC,oBAAoB;MAC1C3B,YAAY,KAAKL,KAAKK;MACtB4B,UAAU,KAAKjC,KAAKiC;MACpBC,YAAY,KAAKlC,KAAKC;MACtBkC,KAAK,KAAKnC,KAAKmC;IACjB,CAAA;AACA,UAAMC,qBAAqBvB,iBAAiB,WAAOwB,gCAAAA,CAAAA;AACnD,UAAM7B,MAAM,MAAM,KAAKV,UAAU,GAAG,KAAKE,KAAKK,UAAU,GAAGwB,IAAAA,IAAQ;MACjES,QAAQ;MACRC,SAAS;QACPC,eAAe,UAAUT,SAAAA;QACzB,gBAAgB;QAChB,oBAAoBK;MACtB;MACAN,MAAMW,KAAKC,UAAUZ,IAAAA;IACvB,CAAA;AACA,UAAMa,OAAO,MAAMnC,IAAImC,KAAI;AAC3B,QAAIC;AACJ,QAAI;AACFA,eAASD,OAAOF,KAAKI,MAAMF,IAAAA,IAAQ,CAAC;IACtC,QAAQ;AACN,YAAM,IAAIG,cACR,mCAAmCjB,IAAAA,MAAUc,KAAKI,MAAM,GAAG,GAAA,CAAA,IAC3DvC,IAAIwC,QACJ,qBACAZ,kBAAAA;IAEJ;AACA,QAAI,CAAC5B,IAAIyC,IAAI;AACX,YAAMC,MAAMN;AACZ,YAAM,IAAIE,cACRI,IAAIC,qBACFD,IAAIE,SACJ,yBAAyB5C,IAAIwC,MAAM,IACrCxC,IAAIwC,QACJE,IAAIE,SAAS,iBACbF,IAAIG,kBAAkBjB,kBAAAA;IAE1B;AACA,WAAOQ;EACT;AACF;AAEA,SAASvB,eAAeb,KAA+B;AACrD,SAAO;IACL8C,kBAAkB9C,IAAI+C;IACtBC,SAAShD,IAAIiD;IACbC,aAAalD,IAAImD;IACjBC,WAAWpD,IAAIqD;IACfC,cAActD,IAAIuD;IAClB,GAAIvD,IAAIwD,iBAAiB;MAAEC,eAAezD,IAAIwD;IAAe,IAAI,CAAC;EACpE;AACF;AATS3C;","names":["import_node_crypto","signClientAssertion","args","alg","privateJwk","key","importJWK","now","Math","floor","Date","SignJWT","setProtectedHeader","typ","kid","setIssuer","clientId","setSubject","setAudience","gatewayUrl","setIssuedAt","setExpirationTime","setJti","randomUUID","sign","PafiAuthError","Error","message","status","code","correlationId","name","PafiAuthClient","fetchImpl","tokenExchangeAud","opts","clientPrivateJwk","kid","Error","fetch","gatewayUrl","startEmail","args","res","post","issuer_id","issuerId","email","correlationId","challengeId","challenge_id","expiresInSec","expires_in","verifyEmail","otp_code","otpCode","mapAuthSuccess","exchangeGoogle","id_token","idToken","exchangeKakao","code","redirectUri","redirect_uri","path","body","assertion","signClientAssertion","clientId","privateJwk","alg","finalCorrelationId","randomUUID","method","headers","Authorization","JSON","stringify","text","parsed","parse","PafiAuthError","slice","status","ok","err","error_description","error","correlation_id","pafiSessionToken","pafi_session_token","pafiJwt","pafi_jwt","canonicalId","canonical_id","expiresAt","expires_at","isFirstLogin","is_first_login","verified_email","verifiedEmail"]}

package/dist/auth-client/index.js

@@ -2,8 +2,8 @@ import {
   PafiAuthClient,
   PafiAuthError,
   signClientAssertion
-} from "../chunk-7VEYSL2C.js";
-import "../chunk-BRKEJJFQ.js";
+} from "../chunk-2Z3M2KQG.js";
+import "../chunk-7QVYU63E.js";
 export {
   PafiAuthClient,
   PafiAuthError,

package/dist/{chunk-7VEYSL2C.js → chunk-2Z3M2KQG.js}

@@ -1,3 +1,7 @@
+import {
+  __name
+} from "./chunk-7QVYU63E.js";
+
 // src/auth-client/sign-client-assertion.ts
 import { importJWK, SignJWT } from "jose";
 import { randomUUID } from "crypto";
@@ -5,118 +9,110 @@ async function signClientAssertion(args) {
   const alg = args.alg ?? args.privateJwk.alg ?? "ES256";
   const key = await importJWK(args.privateJwk, alg);
   const now = Math.floor(Date.now() / 1e3);
-  return new SignJWT({}).setProtectedHeader({ alg, typ: "JWT", kid: args.privateJwk.kid }).setIssuer(args.clientId).setSubject(args.clientId).setAudience(`${args.gatewayUrl}/v1/token-exchange`).setIssuedAt(now).setExpirationTime(now + 60).setJti(randomUUID()).sign(key);
+  return new SignJWT({}).setProtectedHeader({
+    alg,
+    typ: "JWT",
+    kid: args.privateJwk.kid
+  }).setIssuer(args.clientId).setSubject(args.clientId).setAudience(`${args.gatewayUrl}/v1/token-exchange`).setIssuedAt(now).setExpirationTime(now + 60).setJti(randomUUID()).sign(key);
 }
+__name(signClientAssertion, "signClientAssertion");
 
 // src/auth-client/types.ts
 var PafiAuthError = class extends Error {
-  constructor(message, status, code, correlationId) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.correlationId = correlationId;
-    this.name = "PafiAuthError";
+  static {
+    __name(this, "PafiAuthError");
   }
   status;
   code;
   correlationId;
+  constructor(message, status, code, correlationId) {
+    super(message), this.status = status, this.code = code, this.correlationId = correlationId;
+    this.name = "PafiAuthError";
+  }
 };
 
 // src/auth-client/pafi-auth-client.ts
 import { randomUUID as randomUUID2 } from "crypto";
 var PafiAuthClient = class {
+  static {
+    __name(this, "PafiAuthClient");
+  }
+  opts;
+  fetchImpl;
+  tokenExchangeAud;
   constructor(opts) {
     this.opts = opts;
     if (!opts.clientPrivateJwk.kid) {
-      throw new Error(
-        "PafiAuthClient: clientPrivateJwk.kid is required (gateway uses kid to look up the verification key)"
-      );
+      throw new Error("PafiAuthClient: clientPrivateJwk.kid is required (gateway uses kid to look up the verification key)");
     }
     this.fetchImpl = opts.fetchImpl ?? fetch;
     this.tokenExchangeAud = `${opts.gatewayUrl}/v1/token-exchange`;
   }
-  opts;
-  fetchImpl;
-  tokenExchangeAud;
   // ───────────────────────────────────────────────────────────────
   // EMAIL OTP — 2-step
   // ───────────────────────────────────────────────────────────────
   /**
-   * Step 1: ask the gateway to send the user an OTP. Returns the
-   * `challengeId` to echo back on {@link verifyEmail}.
-   */
+  * Step 1: ask the gateway to send the user an OTP. Returns the
+  * `challengeId` to echo back on {@link verifyEmail}.
+  */
   async startEmail(args) {
-    const res = await this.post(
-      "/v1/auth/email/start",
-      {
-        issuer_id: this.opts.issuerId,
-        email: args.email
-      },
-      args.correlationId
-    );
+    const res = await this.post("/v1/auth/email/start", {
+      issuer_id: this.opts.issuerId,
+      email: args.email
+    }, args.correlationId);
     return {
       challengeId: res.challenge_id,
       expiresInSec: res.expires_in
     };
   }
   /**
-   * Step 2: submit the OTP the user received. On success returns
-   * {@link AuthSuccess} containing BOTH the long-lived
-   * pafi_session_token (issuer verifies via gateway JWKS) AND the
-   * short-lived pafi_jwt (issuer FE feeds to Privy).
-   */
+  * Step 2: submit the OTP the user received. On success returns
+  * {@link AuthSuccess} containing BOTH the long-lived
+  * pafi_session_token (issuer verifies via gateway JWKS) AND the
+  * short-lived pafi_jwt (issuer FE feeds to Privy).
+  */
   async verifyEmail(args) {
-    const res = await this.post(
-      "/v1/auth/email/verify",
-      {
-        challenge_id: args.challengeId,
-        otp_code: args.otpCode
-      },
-      args.correlationId
-    );
+    const res = await this.post("/v1/auth/email/verify", {
+      challenge_id: args.challengeId,
+      otp_code: args.otpCode
+    }, args.correlationId);
     return mapAuthSuccess(res);
   }
   // ───────────────────────────────────────────────────────────────
   // GOOGLE — 1-step exchange
   // ───────────────────────────────────────────────────────────────
   /**
-   * Hand the gateway an id_token the issuer FE obtained from Google
-   * Identity Services (using PAFI's shared client_id). Gateway verifies
-   * signature + audience + `email_verified` before resolving identity.
-   */
+  * Hand the gateway an id_token the issuer FE obtained from Google
+  * Identity Services (using PAFI's shared client_id). Gateway verifies
+  * signature + audience + `email_verified` before resolving identity.
+  */
   async exchangeGoogle(args) {
-    const res = await this.post(
-      "/v1/auth/google/exchange",
-      {
-        issuer_id: this.opts.issuerId,
-        id_token: args.idToken
-      },
-      args.correlationId
-    );
+    const res = await this.post("/v1/auth/google/exchange", {
+      issuer_id: this.opts.issuerId,
+      id_token: args.idToken
+    }, args.correlationId);
     return mapAuthSuccess(res);
   }
   // ───────────────────────────────────────────────────────────────
   // KAKAO — 1-step exchange (authorization code)
   // ───────────────────────────────────────────────────────────────
   /**
-   * Hand the gateway the authorization code returned by Kakao's
-   * redirect. Gateway exchanges with Kakao (server-to-server using
-   * PAFI's client_secret), verifies id_token, resolves identity.
-   *
-   * `redirectUri` must match the URL the FE used when starting the
-   * Kakao flow. Falls back to the gateway's KAKAO_REDIRECT_URI when
-   * omitted — pass an explicit value for multi-environment FEs.
-   */
+  * Hand the gateway the authorization code returned by Kakao's
+  * redirect. Gateway exchanges with Kakao (server-to-server using
+  * PAFI's client_secret), verifies id_token, resolves identity.
+  *
+  * `redirectUri` must match the URL the FE used when starting the
+  * Kakao flow. Falls back to the gateway's KAKAO_REDIRECT_URI when
+  * omitted — pass an explicit value for multi-environment FEs.
+  */
   async exchangeKakao(args) {
-    const res = await this.post(
-      "/v1/auth/kakao/exchange",
-      {
-        issuer_id: this.opts.issuerId,
-        code: args.code,
-        ...args.redirectUri ? { redirect_uri: args.redirectUri } : {}
-      },
-      args.correlationId
-    );
+    const res = await this.post("/v1/auth/kakao/exchange", {
+      issuer_id: this.opts.issuerId,
+      code: args.code,
+      ...args.redirectUri ? {
+        redirect_uri: args.redirectUri
+      } : {}
+    }, args.correlationId);
     return mapAuthSuccess(res);
   }
   // ───────────────────────────────────────────────────────────────
@@ -142,21 +138,11 @@ var PafiAuthClient = class {
     try {
       parsed = text ? JSON.parse(text) : {};
     } catch {
-      throw new PafiAuthError(
-        `Non-JSON response from gateway (${path}): ${text.slice(0, 120)}`,
-        res.status,
-        "non_json_response",
-        finalCorrelationId
-      );
+      throw new PafiAuthError(`Non-JSON response from gateway (${path}): ${text.slice(0, 120)}`, res.status, "non_json_response", finalCorrelationId);
     }
     if (!res.ok) {
       const err = parsed;
-      throw new PafiAuthError(
-        err.error_description ?? err.error ?? `Gateway returned HTTP ${res.status}`,
-        res.status,
-        err.error ?? "unknown_error",
-        err.correlation_id ?? finalCorrelationId
-      );
+      throw new PafiAuthError(err.error_description ?? err.error ?? `Gateway returned HTTP ${res.status}`, res.status, err.error ?? "unknown_error", err.correlation_id ?? finalCorrelationId);
     }
     return parsed;
   }
@@ -168,13 +154,16 @@ function mapAuthSuccess(res) {
     canonicalId: res.canonical_id,
     expiresAt: res.expires_at,
     isFirstLogin: res.is_first_login,
-    ...res.verified_email ? { verifiedEmail: res.verified_email } : {}
+    ...res.verified_email ? {
+      verifiedEmail: res.verified_email
+    } : {}
   };
 }
+__name(mapAuthSuccess, "mapAuthSuccess");
 
 export {
   signClientAssertion,
   PafiAuthError,
   PafiAuthClient
 };
-//# sourceMappingURL=chunk-7VEYSL2C.js.map
+//# sourceMappingURL=chunk-2Z3M2KQG.js.map

package/dist/{chunk-7VEYSL2C.js.map → chunk-2Z3M2KQG.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth-client/sign-client-assertion.ts","../src/auth-client/types.ts","../src/auth-client/pafi-auth-client.ts"],"sourcesContent":["import { importJWK, SignJWT, type JWK } from \"jose\";\nimport { randomUUID } from \"node:crypto\";\n\n/**\n * Mint the RFC 7523 client_assertion JWT the gateway expects in the\n * `Authorization: Bearer …` header of every direct-auth call.\n *\n * Claims:\n *   - iss / sub  = clientId (RFC 7523 §3: same value for client auth)\n *   - aud        = `${gatewayUrl}/v1/token-exchange` (exact endpoint URL)\n *                  — NOTE the gateway also accepts this same audience\n *                  for the direct-auth endpoints because they live on\n *                  the same client-auth boundary. Single audience keeps\n *                  one client_assertion reusable across all gateway\n *                  endpoints for the duration of its short lifetime.\n *   - iat / exp  = 60-second window (replay-protected by jti)\n *   - jti        = random UUID\n *\n * 60-second lifetime is a deliberate trade-off: long enough to absorb\n * clock skew + slow networks, short enough that a stolen assertion is\n * usable only briefly. The gateway's per-jti replay cache means even\n * within that window an assertion is single-use.\n */\nexport async function signClientAssertion(args: {\n  gatewayUrl: string;\n  clientId: string;\n  privateJwk: JWK & { kid: string };\n  alg?: string;\n}): Promise<string> {\n  const alg = args.alg ?? args.privateJwk.alg ?? \"ES256\";\n  const key = await importJWK(args.privateJwk, alg);\n  const now = Math.floor(Date.now() / 1000);\n  return new SignJWT({})\n    .setProtectedHeader({ alg, typ: \"JWT\", kid: args.privateJwk.kid })\n    .setIssuer(args.clientId)\n    .setSubject(args.clientId)\n    .setAudience(`${args.gatewayUrl}/v1/token-exchange`)\n    .setIssuedAt(now)\n    .setExpirationTime(now + 60)\n    .setJti(randomUUID())\n    .sign(key);\n}\n","import type { JWK } from \"jose\";\n\n/**\n * Constructor params for {@link PafiAuthClient}. One instance per\n * issuer backend — wraps the issuer's gateway credentials (client_id +\n * private JWK) plus the static config (gateway URL, audience).\n */\nexport interface PafiAuthClientOptions {\n  /** Base URL of the PAFI gateway (e.g. `https://id-dev.pacificfinance.org`). */\n  gatewayUrl: string;\n  /** Issuer identifier registered with the gateway (e.g. `gg56`). */\n  issuerId: string;\n  /**\n   * Gateway client_id assigned at issuer onboarding. Also acts as the\n   * `iss`/`sub` of the client_assertion JWT (RFC 7523 §3).\n   */\n  clientId: string;\n  /**\n   * Private JWK the issuer uses to sign client_assertion. MUST include\n   * `kid` — gateway looks up the matching public JWK by kid.\n   */\n  clientPrivateJwk: JWK & { kid: string };\n  /**\n   * Optional fetch override — useful for tests / Node env without\n   * global fetch (Node ≥ 18 has it built-in).\n   */\n  fetchImpl?: typeof fetch;\n  /**\n   * Optional algorithm override for the client assertion JWT. Default\n   * `ES256`. Must match what the gateway expects for this client.\n   */\n  alg?: \"ES256\" | \"ES384\" | \"RS256\" | \"RS384\" | \"RS512\" | \"EdDSA\";\n}\n\nexport interface AuthSuccess {\n  pafiSessionToken: string;\n  pafiJwt: string;\n  canonicalId: string;\n  expiresAt: number;\n  isFirstLogin: boolean;\n  verifiedEmail?: string;\n}\n\nexport interface EmailChallenge {\n  challengeId: string;\n  expiresInSec: number;\n}\n\n/**\n * Thrown when the gateway rejects the call. `code` is the gateway's\n * structured `error` field (e.g. `invalid_otp`, `too_many_attempts`,\n * `expired`, `email_not_verified`) — issuers can branch on it to drive\n * UX (e.g. show \"Resend code\" button on `expired`).\n */\nexport class PafiAuthError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code: string,\n    public readonly correlationId?: string,\n  ) {\n    super(message);\n    this.name = \"PafiAuthError\";\n  }\n}\n","import { randomUUID } from \"node:crypto\";\nimport { signClientAssertion } from \"./sign-client-assertion\";\nimport {\n  PafiAuthError,\n  type AuthSuccess,\n  type EmailChallenge,\n  type PafiAuthClientOptions,\n} from \"./types\";\n\ninterface GatewayErrorResponse {\n  error?: string;\n  error_description?: string;\n  correlation_id?: string;\n}\n\ninterface GatewayAuthSuccessResponse {\n  pafi_session_token: string;\n  pafi_jwt: string;\n  canonical_id: string;\n  expires_at: number;\n  is_first_login: boolean;\n  verified_email?: string;\n}\n\ninterface GatewayChallengeResponse {\n  challenge_id: string;\n  expires_in: number;\n}\n\n/**\n * Issuer-side client for the PAFI gateway's direct-auth endpoints. Use\n * one instance per issuer backend — the constructor binds gateway URL +\n * issuer id + signing credentials, methods just route to specific\n * endpoints.\n *\n * Each method signs a fresh client_assertion (RFC 7523, 60s TTL) so\n * a leaked one is useless beyond the window + replay-protected by jti.\n *\n * The gateway endpoints invoked here are owned by PAFI — the issuer\n * never sees OTP codes, never holds OAuth client_secrets, never\n * verifies signatures itself. Gateway is the sole authority; this\n * client is purely a transport.\n *\n * Usage in a NestJS issuer backend:\n *\n *   @Injectable()\n *   export class PafiAuthClientProvider {\n *     readonly client: PafiAuthClient;\n *     constructor(config: ConfigService) {\n *       this.client = new PafiAuthClient({\n *         gatewayUrl: config.getOrThrow('PAFI_GATEWAY_URL'),\n *         issuerId:   config.getOrThrow('PAFI_GATEWAY_ISSUER_ID'),\n *         clientId:   config.getOrThrow('PAFI_GATEWAY_CLIENT_ID'),\n *         clientPrivateJwk: JSON.parse(\n *           config.getOrThrow('PAFI_GATEWAY_CLIENT_PRIVATE_JWK_JSON'),\n *         ),\n *       });\n *     }\n *   }\n */\nexport class PafiAuthClient {\n  private readonly fetchImpl: typeof fetch;\n  private readonly tokenExchangeAud: string;\n\n  constructor(private readonly opts: PafiAuthClientOptions) {\n    if (!opts.clientPrivateJwk.kid) {\n      throw new Error(\n        \"PafiAuthClient: clientPrivateJwk.kid is required (gateway uses kid to look up the verification key)\",\n      );\n    }\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n    this.tokenExchangeAud = `${opts.gatewayUrl}/v1/token-exchange`;\n  }\n\n  // ───────────────────────────────────────────────────────────────\n  // EMAIL OTP — 2-step\n  // ───────────────────────────────────────────────────────────────\n\n  /**\n   * Step 1: ask the gateway to send the user an OTP. Returns the\n   * `challengeId` to echo back on {@link verifyEmail}.\n   */\n  async startEmail(args: {\n    email: string;\n    correlationId?: string;\n  }): Promise<EmailChallenge> {\n    const res = await this.post<GatewayChallengeResponse>(\n      \"/v1/auth/email/start\",\n      {\n        issuer_id: this.opts.issuerId,\n        email: args.email,\n      },\n      args.correlationId,\n    );\n    return {\n      challengeId: res.challenge_id,\n      expiresInSec: res.expires_in,\n    };\n  }\n\n  /**\n   * Step 2: submit the OTP the user received. On success returns\n   * {@link AuthSuccess} containing BOTH the long-lived\n   * pafi_session_token (issuer verifies via gateway JWKS) AND the\n   * short-lived pafi_jwt (issuer FE feeds to Privy).\n   */\n  async verifyEmail(args: {\n    challengeId: string;\n    otpCode: string;\n    correlationId?: string;\n  }): Promise<AuthSuccess> {\n    const res = await this.post<GatewayAuthSuccessResponse>(\n      \"/v1/auth/email/verify\",\n      {\n        challenge_id: args.challengeId,\n        otp_code: args.otpCode,\n      },\n      args.correlationId,\n    );\n    return mapAuthSuccess(res);\n  }\n\n  // ───────────────────────────────────────────────────────────────\n  // GOOGLE — 1-step exchange\n  // ───────────────────────────────────────────────────────────────\n\n  /**\n   * Hand the gateway an id_token the issuer FE obtained from Google\n   * Identity Services (using PAFI's shared client_id). Gateway verifies\n   * signature + audience + `email_verified` before resolving identity.\n   */\n  async exchangeGoogle(args: {\n    idToken: string;\n    correlationId?: string;\n  }): Promise<AuthSuccess> {\n    const res = await this.post<GatewayAuthSuccessResponse>(\n      \"/v1/auth/google/exchange\",\n      {\n        issuer_id: this.opts.issuerId,\n        id_token: args.idToken,\n      },\n      args.correlationId,\n    );\n    return mapAuthSuccess(res);\n  }\n\n  // ───────────────────────────────────────────────────────────────\n  // KAKAO — 1-step exchange (authorization code)\n  // ───────────────────────────────────────────────────────────────\n\n  /**\n   * Hand the gateway the authorization code returned by Kakao's\n   * redirect. Gateway exchanges with Kakao (server-to-server using\n   * PAFI's client_secret), verifies id_token, resolves identity.\n   *\n   * `redirectUri` must match the URL the FE used when starting the\n   * Kakao flow. Falls back to the gateway's KAKAO_REDIRECT_URI when\n   * omitted — pass an explicit value for multi-environment FEs.\n   */\n  async exchangeKakao(args: {\n    code: string;\n    redirectUri?: string;\n    correlationId?: string;\n  }): Promise<AuthSuccess> {\n    const res = await this.post<GatewayAuthSuccessResponse>(\n      \"/v1/auth/kakao/exchange\",\n      {\n        issuer_id: this.opts.issuerId,\n        code: args.code,\n        ...(args.redirectUri ? { redirect_uri: args.redirectUri } : {}),\n      },\n      args.correlationId,\n    );\n    return mapAuthSuccess(res);\n  }\n\n  // ───────────────────────────────────────────────────────────────\n\n  private async post<T>(\n    path: string,\n    body: unknown,\n    correlationId: string | undefined,\n  ): Promise<T> {\n    const assertion = await signClientAssertion({\n      gatewayUrl: this.opts.gatewayUrl,\n      clientId: this.opts.clientId,\n      privateJwk: this.opts.clientPrivateJwk,\n      alg: this.opts.alg,\n    });\n    const finalCorrelationId = correlationId ?? `iss-${randomUUID()}`;\n    const res = await this.fetchImpl(`${this.opts.gatewayUrl}${path}`, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${assertion}`,\n        \"Content-Type\": \"application/json\",\n        \"X-Correlation-Id\": finalCorrelationId,\n      },\n      body: JSON.stringify(body),\n    });\n    const text = await res.text();\n    let parsed: unknown;\n    try {\n      parsed = text ? JSON.parse(text) : {};\n    } catch {\n      throw new PafiAuthError(\n        `Non-JSON response from gateway (${path}): ${text.slice(0, 120)}`,\n        res.status,\n        \"non_json_response\",\n        finalCorrelationId,\n      );\n    }\n    if (!res.ok) {\n      const err = parsed as GatewayErrorResponse;\n      throw new PafiAuthError(\n        err.error_description ??\n          err.error ??\n          `Gateway returned HTTP ${res.status}`,\n        res.status,\n        err.error ?? \"unknown_error\",\n        err.correlation_id ?? finalCorrelationId,\n      );\n    }\n    return parsed as T;\n  }\n}\n\nfunction mapAuthSuccess(res: GatewayAuthSuccessResponse): AuthSuccess {\n  return {\n    pafiSessionToken: res.pafi_session_token,\n    pafiJwt: res.pafi_jwt,\n    canonicalId: res.canonical_id,\n    expiresAt: res.expires_at,\n    isFirstLogin: res.is_first_login,\n    ...(res.verified_email ? { verifiedEmail: res.verified_email } : {}),\n  };\n}\n"],"mappings":";AAAA,SAAS,WAAW,eAAyB;AAC7C,SAAS,kBAAkB;AAsB3B,eAAsB,oBAAoB,MAKtB;AAClB,QAAM,MAAM,KAAK,OAAO,KAAK,WAAW,OAAO;AAC/C,QAAM,MAAM,MAAM,UAAU,KAAK,YAAY,GAAG;AAChD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,SAAO,IAAI,QAAQ,CAAC,CAAC,EAClB,mBAAmB,EAAE,KAAK,KAAK,OAAO,KAAK,KAAK,WAAW,IAAI,CAAC,EAChE,UAAU,KAAK,QAAQ,EACvB,WAAW,KAAK,QAAQ,EACxB,YAAY,GAAG,KAAK,UAAU,oBAAoB,EAClD,YAAY,GAAG,EACf,kBAAkB,MAAM,EAAE,EAC1B,OAAO,WAAW,CAAC,EACnB,KAAK,GAAG;AACb;;;ACaO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YACE,SACgB,QACA,MACA,eAChB;AACA,UAAM,OAAO;AAJG;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EANkB;AAAA,EACA;AAAA,EACA;AAKpB;;;AChEA,SAAS,cAAAA,mBAAkB;AA4DpB,IAAM,iBAAN,MAAqB;AAAA,EAI1B,YAA6B,MAA6B;AAA7B;AAC3B,QAAI,CAAC,KAAK,iBAAiB,KAAK;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,mBAAmB,GAAG,KAAK,UAAU;AAAA,EAC5C;AAAA,EAR6B;AAAA,EAHZ;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBjB,MAAM,WAAW,MAGW;AAC1B,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,QACE,WAAW,KAAK,KAAK;AAAA,QACrB,OAAO,KAAK;AAAA,MACd;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,IACpB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,YAAY,MAIO;AACvB,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,QACE,cAAc,KAAK;AAAA,QACnB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO,eAAe,GAAG;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,eAAe,MAGI;AACvB,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,QACE,WAAW,KAAK,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO,eAAe,GAAG;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,cAAc,MAIK;AACvB,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,QACE,WAAW,KAAK,KAAK;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,GAAI,KAAK,cAAc,EAAE,cAAc,KAAK,YAAY,IAAI,CAAC;AAAA,MAC/D;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO,eAAe,GAAG;AAAA,EAC3B;AAAA;AAAA,EAIA,MAAc,KACZ,MACA,MACA,eACY;AACZ,UAAM,YAAY,MAAM,oBAAoB;AAAA,MAC1C,YAAY,KAAK,KAAK;AAAA,MACtB,UAAU,KAAK,KAAK;AAAA,MACpB,YAAY,KAAK,KAAK;AAAA,MACtB,KAAK,KAAK,KAAK;AAAA,IACjB,CAAC;AACD,UAAM,qBAAqB,iBAAiB,OAAOC,YAAW,CAAC;AAC/D,UAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,KAAK,UAAU,GAAG,IAAI,IAAI;AAAA,MACjE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,SAAS;AAAA,QAClC,gBAAgB;AAAA,QAChB,oBAAoB;AAAA,MACtB;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AACD,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI;AACJ,QAAI;AACF,eAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,IACtC,QAAQ;AACN,YAAM,IAAI;AAAA,QACR,mCAAmC,IAAI,MAAM,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,QAC/D,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,MAAM;AACZ,YAAM,IAAI;AAAA,QACR,IAAI,qBACF,IAAI,SACJ,yBAAyB,IAAI,MAAM;AAAA,QACrC,IAAI;AAAA,QACJ,IAAI,SAAS;AAAA,QACb,IAAI,kBAAkB;AAAA,MACxB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,KAA8C;AACpE,SAAO;AAAA,IACL,kBAAkB,IAAI;AAAA,IACtB,SAAS,IAAI;AAAA,IACb,aAAa,IAAI;AAAA,IACjB,WAAW,IAAI;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,GAAI,IAAI,iBAAiB,EAAE,eAAe,IAAI,eAAe,IAAI,CAAC;AAAA,EACpE;AACF;","names":["randomUUID","randomUUID"]}
+{"version":3,"sources":["../src/auth-client/sign-client-assertion.ts","../src/auth-client/types.ts","../src/auth-client/pafi-auth-client.ts"],"sourcesContent":["import { importJWK, SignJWT, type JWK } from \"jose\";\nimport { randomUUID } from \"node:crypto\";\n\n/**\n * Mint the RFC 7523 client_assertion JWT the gateway expects in the\n * `Authorization: Bearer …` header of every direct-auth call.\n *\n * Claims:\n *   - iss / sub  = clientId (RFC 7523 §3: same value for client auth)\n *   - aud        = `${gatewayUrl}/v1/token-exchange` (exact endpoint URL)\n *                  — NOTE the gateway also accepts this same audience\n *                  for the direct-auth endpoints because they live on\n *                  the same client-auth boundary. Single audience keeps\n *                  one client_assertion reusable across all gateway\n *                  endpoints for the duration of its short lifetime.\n *   - iat / exp  = 60-second window (replay-protected by jti)\n *   - jti        = random UUID\n *\n * 60-second lifetime is a deliberate trade-off: long enough to absorb\n * clock skew + slow networks, short enough that a stolen assertion is\n * usable only briefly. The gateway's per-jti replay cache means even\n * within that window an assertion is single-use.\n */\nexport async function signClientAssertion(args: {\n  gatewayUrl: string;\n  clientId: string;\n  privateJwk: JWK & { kid: string };\n  alg?: string;\n}): Promise<string> {\n  const alg = args.alg ?? args.privateJwk.alg ?? \"ES256\";\n  const key = await importJWK(args.privateJwk, alg);\n  const now = Math.floor(Date.now() / 1000);\n  return new SignJWT({})\n    .setProtectedHeader({ alg, typ: \"JWT\", kid: args.privateJwk.kid })\n    .setIssuer(args.clientId)\n    .setSubject(args.clientId)\n    .setAudience(`${args.gatewayUrl}/v1/token-exchange`)\n    .setIssuedAt(now)\n    .setExpirationTime(now + 60)\n    .setJti(randomUUID())\n    .sign(key);\n}\n","import type { JWK } from \"jose\";\n\n/**\n * Constructor params for {@link PafiAuthClient}. One instance per\n * issuer backend — wraps the issuer's gateway credentials (client_id +\n * private JWK) plus the static config (gateway URL, audience).\n */\nexport interface PafiAuthClientOptions {\n  /** Base URL of the PAFI gateway (e.g. `https://id-dev.pacificfinance.org`). */\n  gatewayUrl: string;\n  /** Issuer identifier registered with the gateway (e.g. `gg56`). */\n  issuerId: string;\n  /**\n   * Gateway client_id assigned at issuer onboarding. Also acts as the\n   * `iss`/`sub` of the client_assertion JWT (RFC 7523 §3).\n   */\n  clientId: string;\n  /**\n   * Private JWK the issuer uses to sign client_assertion. MUST include\n   * `kid` — gateway looks up the matching public JWK by kid.\n   */\n  clientPrivateJwk: JWK & { kid: string };\n  /**\n   * Optional fetch override — useful for tests / Node env without\n   * global fetch (Node ≥ 18 has it built-in).\n   */\n  fetchImpl?: typeof fetch;\n  /**\n   * Optional algorithm override for the client assertion JWT. Default\n   * `ES256`. Must match what the gateway expects for this client.\n   */\n  alg?: \"ES256\" | \"ES384\" | \"RS256\" | \"RS384\" | \"RS512\" | \"EdDSA\";\n}\n\nexport interface AuthSuccess {\n  pafiSessionToken: string;\n  pafiJwt: string;\n  canonicalId: string;\n  expiresAt: number;\n  isFirstLogin: boolean;\n  verifiedEmail?: string;\n}\n\nexport interface EmailChallenge {\n  challengeId: string;\n  expiresInSec: number;\n}\n\n/**\n * Thrown when the gateway rejects the call. `code` is the gateway's\n * structured `error` field (e.g. `invalid_otp`, `too_many_attempts`,\n * `expired`, `email_not_verified`) — issuers can branch on it to drive\n * UX (e.g. show \"Resend code\" button on `expired`).\n */\nexport class PafiAuthError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code: string,\n    public readonly correlationId?: string,\n  ) {\n    super(message);\n    this.name = \"PafiAuthError\";\n  }\n}\n","import { randomUUID } from \"node:crypto\";\nimport { signClientAssertion } from \"./sign-client-assertion\";\nimport {\n  PafiAuthError,\n  type AuthSuccess,\n  type EmailChallenge,\n  type PafiAuthClientOptions,\n} from \"./types\";\n\ninterface GatewayErrorResponse {\n  error?: string;\n  error_description?: string;\n  correlation_id?: string;\n}\n\ninterface GatewayAuthSuccessResponse {\n  pafi_session_token: string;\n  pafi_jwt: string;\n  canonical_id: string;\n  expires_at: number;\n  is_first_login: boolean;\n  verified_email?: string;\n}\n\ninterface GatewayChallengeResponse {\n  challenge_id: string;\n  expires_in: number;\n}\n\n/**\n * Issuer-side client for the PAFI gateway's direct-auth endpoints. Use\n * one instance per issuer backend — the constructor binds gateway URL +\n * issuer id + signing credentials, methods just route to specific\n * endpoints.\n *\n * Each method signs a fresh client_assertion (RFC 7523, 60s TTL) so\n * a leaked one is useless beyond the window + replay-protected by jti.\n *\n * The gateway endpoints invoked here are owned by PAFI — the issuer\n * never sees OTP codes, never holds OAuth client_secrets, never\n * verifies signatures itself. Gateway is the sole authority; this\n * client is purely a transport.\n *\n * Usage in a NestJS issuer backend:\n *\n *   @Injectable()\n *   export class PafiAuthClientProvider {\n *     readonly client: PafiAuthClient;\n *     constructor(config: ConfigService) {\n *       this.client = new PafiAuthClient({\n *         gatewayUrl: config.getOrThrow('PAFI_GATEWAY_URL'),\n *         issuerId:   config.getOrThrow('PAFI_GATEWAY_ISSUER_ID'),\n *         clientId:   config.getOrThrow('PAFI_GATEWAY_CLIENT_ID'),\n *         clientPrivateJwk: JSON.parse(\n *           config.getOrThrow('PAFI_GATEWAY_CLIENT_PRIVATE_JWK_JSON'),\n *         ),\n *       });\n *     }\n *   }\n */\nexport class PafiAuthClient {\n  private readonly fetchImpl: typeof fetch;\n  private readonly tokenExchangeAud: string;\n\n  constructor(private readonly opts: PafiAuthClientOptions) {\n    if (!opts.clientPrivateJwk.kid) {\n      throw new Error(\n        \"PafiAuthClient: clientPrivateJwk.kid is required (gateway uses kid to look up the verification key)\",\n      );\n    }\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n    this.tokenExchangeAud = `${opts.gatewayUrl}/v1/token-exchange`;\n  }\n\n  // ───────────────────────────────────────────────────────────────\n  // EMAIL OTP — 2-step\n  // ───────────────────────────────────────────────────────────────\n\n  /**\n   * Step 1: ask the gateway to send the user an OTP. Returns the\n   * `challengeId` to echo back on {@link verifyEmail}.\n   */\n  async startEmail(args: {\n    email: string;\n    correlationId?: string;\n  }): Promise<EmailChallenge> {\n    const res = await this.post<GatewayChallengeResponse>(\n      \"/v1/auth/email/start\",\n      {\n        issuer_id: this.opts.issuerId,\n        email: args.email,\n      },\n      args.correlationId,\n    );\n    return {\n      challengeId: res.challenge_id,\n      expiresInSec: res.expires_in,\n    };\n  }\n\n  /**\n   * Step 2: submit the OTP the user received. On success returns\n   * {@link AuthSuccess} containing BOTH the long-lived\n   * pafi_session_token (issuer verifies via gateway JWKS) AND the\n   * short-lived pafi_jwt (issuer FE feeds to Privy).\n   */\n  async verifyEmail(args: {\n    challengeId: string;\n    otpCode: string;\n    correlationId?: string;\n  }): Promise<AuthSuccess> {\n    const res = await this.post<GatewayAuthSuccessResponse>(\n      \"/v1/auth/email/verify\",\n      {\n        challenge_id: args.challengeId,\n        otp_code: args.otpCode,\n      },\n      args.correlationId,\n    );\n    return mapAuthSuccess(res);\n  }\n\n  // ───────────────────────────────────────────────────────────────\n  // GOOGLE — 1-step exchange\n  // ───────────────────────────────────────────────────────────────\n\n  /**\n   * Hand the gateway an id_token the issuer FE obtained from Google\n   * Identity Services (using PAFI's shared client_id). Gateway verifies\n   * signature + audience + `email_verified` before resolving identity.\n   */\n  async exchangeGoogle(args: {\n    idToken: string;\n    correlationId?: string;\n  }): Promise<AuthSuccess> {\n    const res = await this.post<GatewayAuthSuccessResponse>(\n      \"/v1/auth/google/exchange\",\n      {\n        issuer_id: this.opts.issuerId,\n        id_token: args.idToken,\n      },\n      args.correlationId,\n    );\n    return mapAuthSuccess(res);\n  }\n\n  // ───────────────────────────────────────────────────────────────\n  // KAKAO — 1-step exchange (authorization code)\n  // ───────────────────────────────────────────────────────────────\n\n  /**\n   * Hand the gateway the authorization code returned by Kakao's\n   * redirect. Gateway exchanges with Kakao (server-to-server using\n   * PAFI's client_secret), verifies id_token, resolves identity.\n   *\n   * `redirectUri` must match the URL the FE used when starting the\n   * Kakao flow. Falls back to the gateway's KAKAO_REDIRECT_URI when\n   * omitted — pass an explicit value for multi-environment FEs.\n   */\n  async exchangeKakao(args: {\n    code: string;\n    redirectUri?: string;\n    correlationId?: string;\n  }): Promise<AuthSuccess> {\n    const res = await this.post<GatewayAuthSuccessResponse>(\n      \"/v1/auth/kakao/exchange\",\n      {\n        issuer_id: this.opts.issuerId,\n        code: args.code,\n        ...(args.redirectUri ? { redirect_uri: args.redirectUri } : {}),\n      },\n      args.correlationId,\n    );\n    return mapAuthSuccess(res);\n  }\n\n  // ───────────────────────────────────────────────────────────────\n\n  private async post<T>(\n    path: string,\n    body: unknown,\n    correlationId: string | undefined,\n  ): Promise<T> {\n    const assertion = await signClientAssertion({\n      gatewayUrl: this.opts.gatewayUrl,\n      clientId: this.opts.clientId,\n      privateJwk: this.opts.clientPrivateJwk,\n      alg: this.opts.alg,\n    });\n    const finalCorrelationId = correlationId ?? `iss-${randomUUID()}`;\n    const res = await this.fetchImpl(`${this.opts.gatewayUrl}${path}`, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${assertion}`,\n        \"Content-Type\": \"application/json\",\n        \"X-Correlation-Id\": finalCorrelationId,\n      },\n      body: JSON.stringify(body),\n    });\n    const text = await res.text();\n    let parsed: unknown;\n    try {\n      parsed = text ? JSON.parse(text) : {};\n    } catch {\n      throw new PafiAuthError(\n        `Non-JSON response from gateway (${path}): ${text.slice(0, 120)}`,\n        res.status,\n        \"non_json_response\",\n        finalCorrelationId,\n      );\n    }\n    if (!res.ok) {\n      const err = parsed as GatewayErrorResponse;\n      throw new PafiAuthError(\n        err.error_description ??\n          err.error ??\n          `Gateway returned HTTP ${res.status}`,\n        res.status,\n        err.error ?? \"unknown_error\",\n        err.correlation_id ?? finalCorrelationId,\n      );\n    }\n    return parsed as T;\n  }\n}\n\nfunction mapAuthSuccess(res: GatewayAuthSuccessResponse): AuthSuccess {\n  return {\n    pafiSessionToken: res.pafi_session_token,\n    pafiJwt: res.pafi_jwt,\n    canonicalId: res.canonical_id,\n    expiresAt: res.expires_at,\n    isFirstLogin: res.is_first_login,\n    ...(res.verified_email ? { verifiedEmail: res.verified_email } : {}),\n  };\n}\n"],"mappings":";;;;;AAAA,SAASA,WAAWC,eAAyB;AAC7C,SAASC,kBAAkB;AAsB3B,eAAsBC,oBAAoBC,MAKzC;AACC,QAAMC,MAAMD,KAAKC,OAAOD,KAAKE,WAAWD,OAAO;AAC/C,QAAME,MAAM,MAAMC,UAAUJ,KAAKE,YAAYD,GAAAA;AAC7C,QAAMI,MAAMC,KAAKC,MAAMC,KAAKH,IAAG,IAAK,GAAA;AACpC,SAAO,IAAII,QAAQ,CAAC,CAAA,EACjBC,mBAAmB;IAAET;IAAKU,KAAK;IAAOC,KAAKZ,KAAKE,WAAWU;EAAI,CAAA,EAC/DC,UAAUb,KAAKc,QAAQ,EACvBC,WAAWf,KAAKc,QAAQ,EACxBE,YAAY,GAAGhB,KAAKiB,UAAU,oBAAoB,EAClDC,YAAYb,GAAAA,EACZc,kBAAkBd,MAAM,EAAA,EACxBe,OAAOC,WAAAA,CAAAA,EACPC,KAAKnB,GAAAA;AACV;AAlBsBJ;;;AC+Bf,IAAMwB,gBAAN,cAA4BC,MAAAA;EANnC,OAMmCA;;;;;;EACjC,YACEC,SACgBC,QACAC,MACAC,eAChB;AACA,UAAMH,OAAAA,GAAAA,KAJUC,SAAAA,QAAAA,KACAC,OAAAA,MAAAA,KACAC,gBAAAA;AAGhB,SAAKC,OAAO;EACd;AACF;;;AChEA,SAASC,cAAAA,mBAAkB;AA4DpB,IAAMC,iBAAN,MAAMA;EA5Db,OA4DaA;;;;EACMC;EACAC;EAEjB,YAA6BC,MAA6B;SAA7BA,OAAAA;AAC3B,QAAI,CAACA,KAAKC,iBAAiBC,KAAK;AAC9B,YAAM,IAAIC,MACR,qGAAA;IAEJ;AACA,SAAKL,YAAYE,KAAKF,aAAaM;AACnC,SAAKL,mBAAmB,GAAGC,KAAKK,UAAU;EAC5C;;;;;;;;EAUA,MAAMC,WAAWC,MAGW;AAC1B,UAAMC,MAAM,MAAM,KAAKC,KACrB,wBACA;MACEC,WAAW,KAAKV,KAAKW;MACrBC,OAAOL,KAAKK;IACd,GACAL,KAAKM,aAAa;AAEpB,WAAO;MACLC,aAAaN,IAAIO;MACjBC,cAAcR,IAAIS;IACpB;EACF;;;;;;;EAQA,MAAMC,YAAYX,MAIO;AACvB,UAAMC,MAAM,MAAM,KAAKC,KACrB,yBACA;MACEM,cAAcR,KAAKO;MACnBK,UAAUZ,KAAKa;IACjB,GACAb,KAAKM,aAAa;AAEpB,WAAOQ,eAAeb,GAAAA;EACxB;;;;;;;;;EAWA,MAAMc,eAAef,MAGI;AACvB,UAAMC,MAAM,MAAM,KAAKC,KACrB,4BACA;MACEC,WAAW,KAAKV,KAAKW;MACrBY,UAAUhB,KAAKiB;IACjB,GACAjB,KAAKM,aAAa;AAEpB,WAAOQ,eAAeb,GAAAA;EACxB;;;;;;;;;;;;;EAeA,MAAMiB,cAAclB,MAIK;AACvB,UAAMC,MAAM,MAAM,KAAKC,KACrB,2BACA;MACEC,WAAW,KAAKV,KAAKW;MACrBe,MAAMnB,KAAKmB;MACX,GAAInB,KAAKoB,cAAc;QAAEC,cAAcrB,KAAKoB;MAAY,IAAI,CAAC;IAC/D,GACApB,KAAKM,aAAa;AAEpB,WAAOQ,eAAeb,GAAAA;EACxB;;EAIA,MAAcC,KACZoB,MACAC,MACAjB,eACY;AACZ,UAAMkB,YAAY,MAAMC,oBAAoB;MAC1C3B,YAAY,KAAKL,KAAKK;MACtB4B,UAAU,KAAKjC,KAAKiC;MACpBC,YAAY,KAAKlC,KAAKC;MACtBkC,KAAK,KAAKnC,KAAKmC;IACjB,CAAA;AACA,UAAMC,qBAAqBvB,iBAAiB,OAAOwB,YAAAA,CAAAA;AACnD,UAAM7B,MAAM,MAAM,KAAKV,UAAU,GAAG,KAAKE,KAAKK,UAAU,GAAGwB,IAAAA,IAAQ;MACjES,QAAQ;MACRC,SAAS;QACPC,eAAe,UAAUT,SAAAA;QACzB,gBAAgB;QAChB,oBAAoBK;MACtB;MACAN,MAAMW,KAAKC,UAAUZ,IAAAA;IACvB,CAAA;AACA,UAAMa,OAAO,MAAMnC,IAAImC,KAAI;AAC3B,QAAIC;AACJ,QAAI;AACFA,eAASD,OAAOF,KAAKI,MAAMF,IAAAA,IAAQ,CAAC;IACtC,QAAQ;AACN,YAAM,IAAIG,cACR,mCAAmCjB,IAAAA,MAAUc,KAAKI,MAAM,GAAG,GAAA,CAAA,IAC3DvC,IAAIwC,QACJ,qBACAZ,kBAAAA;IAEJ;AACA,QAAI,CAAC5B,IAAIyC,IAAI;AACX,YAAMC,MAAMN;AACZ,YAAM,IAAIE,cACRI,IAAIC,qBACFD,IAAIE,SACJ,yBAAyB5C,IAAIwC,MAAM,IACrCxC,IAAIwC,QACJE,IAAIE,SAAS,iBACbF,IAAIG,kBAAkBjB,kBAAAA;IAE1B;AACA,WAAOQ;EACT;AACF;AAEA,SAASvB,eAAeb,KAA+B;AACrD,SAAO;IACL8C,kBAAkB9C,IAAI+C;IACtBC,SAAShD,IAAIiD;IACbC,aAAalD,IAAImD;IACjBC,WAAWpD,IAAIqD;IACfC,cAActD,IAAIuD;IAClB,GAAIvD,IAAIwD,iBAAiB;MAAEC,eAAezD,IAAIwD;IAAe,IAAI,CAAC;EACpE;AACF;AATS3C;","names":["importJWK","SignJWT","randomUUID","signClientAssertion","args","alg","privateJwk","key","importJWK","now","Math","floor","Date","SignJWT","setProtectedHeader","typ","kid","setIssuer","clientId","setSubject","setAudience","gatewayUrl","setIssuedAt","setExpirationTime","setJti","randomUUID","sign","PafiAuthError","Error","message","status","code","correlationId","name","randomUUID","PafiAuthClient","fetchImpl","tokenExchangeAud","opts","clientPrivateJwk","kid","Error","fetch","gatewayUrl","startEmail","args","res","post","issuer_id","issuerId","email","correlationId","challengeId","challenge_id","expiresInSec","expires_in","verifyEmail","otp_code","otpCode","mapAuthSuccess","exchangeGoogle","id_token","idToken","exchangeKakao","code","redirectUri","redirect_uri","path","body","assertion","signClientAssertion","clientId","privateJwk","alg","finalCorrelationId","randomUUID","method","headers","Authorization","JSON","stringify","text","parsed","parse","PafiAuthError","slice","status","ok","err","error_description","error","correlation_id","pafiSessionToken","pafi_session_token","pafiJwt","pafi_jwt","canonicalId","canonical_id","expiresAt","expires_at","isFirstLogin","is_first_login","verified_email","verifiedEmail"]}

package/dist/chunk-7QVYU63E.js

@@ -0,0 +1,7 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+export {
+  __name
+};
+//# sourceMappingURL=chunk-7QVYU63E.js.map