@pafi-dev/issuer 0.39.2 → 0.40.0

package/dist/direct-auth/index.cjs

@@ -3,6 +3,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -16,15 +17,6 @@ var __copyProps = (to, from, except, desc) => {
   return to;
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var __decorateClass = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
-  for (var i = decorators.length - 1, decorator; i >= 0; i--)
-    if (decorator = decorators[i])
-      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp(target, key, result);
-  return result;
-};
-var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
 
 // src/direct-auth/index.ts
 var direct_auth_exports = {};
@@ -62,117 +54,109 @@ async function signClientAssertion(args) {
   const alg = args.alg ?? args.privateJwk.alg ?? "ES256";
   const key = await (0, import_jose.importJWK)(args.privateJwk, alg);
   const now = Math.floor(Date.now() / 1e3);
-  return new import_jose.SignJWT({}).setProtectedHeader({ alg, typ: "JWT", kid: args.privateJwk.kid }).setIssuer(args.clientId).setSubject(args.clientId).setAudience(`${args.gatewayUrl}/v1/token-exchange`).setIssuedAt(now).setExpirationTime(now + 60).setJti((0, import_node_crypto.randomUUID)()).sign(key);
+  return new import_jose.SignJWT({}).setProtectedHeader({
+    alg,
+    typ: "JWT",
+    kid: args.privateJwk.kid
+  }).setIssuer(args.clientId).setSubject(args.clientId).setAudience(`${args.gatewayUrl}/v1/token-exchange`).setIssuedAt(now).setExpirationTime(now + 60).setJti((0, import_node_crypto.randomUUID)()).sign(key);
 }
+__name(signClientAssertion, "signClientAssertion");
 
 // src/auth-client/types.ts
 var PafiAuthError = class extends Error {
-  constructor(message, status, code, correlationId) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.correlationId = correlationId;
-    this.name = "PafiAuthError";
+  static {
+    __name(this, "PafiAuthError");
   }
   status;
   code;
   correlationId;
+  constructor(message, status, code, correlationId) {
+    super(message), this.status = status, this.code = code, this.correlationId = correlationId;
+    this.name = "PafiAuthError";
+  }
 };
 
 // src/auth-client/pafi-auth-client.ts
 var PafiAuthClient = class {
+  static {
+    __name(this, "PafiAuthClient");
+  }
+  opts;
+  fetchImpl;
+  tokenExchangeAud;
   constructor(opts) {
     this.opts = opts;
     if (!opts.clientPrivateJwk.kid) {
-      throw new Error(
-        "PafiAuthClient: clientPrivateJwk.kid is required (gateway uses kid to look up the verification key)"
-      );
+      throw new Error("PafiAuthClient: clientPrivateJwk.kid is required (gateway uses kid to look up the verification key)");
     }
     this.fetchImpl = opts.fetchImpl ?? fetch;
     this.tokenExchangeAud = `${opts.gatewayUrl}/v1/token-exchange`;
   }
-  opts;
-  fetchImpl;
-  tokenExchangeAud;
   // ───────────────────────────────────────────────────────────────
   // EMAIL OTP — 2-step
   // ───────────────────────────────────────────────────────────────
   /**
-   * Step 1: ask the gateway to send the user an OTP. Returns the
-   * `challengeId` to echo back on {@link verifyEmail}.
-   */
+  * Step 1: ask the gateway to send the user an OTP. Returns the
+  * `challengeId` to echo back on {@link verifyEmail}.
+  */
   async startEmail(args) {
-    const res = await this.post(
-      "/v1/auth/email/start",
-      {
-        issuer_id: this.opts.issuerId,
-        email: args.email
-      },
-      args.correlationId
-    );
+    const res = await this.post("/v1/auth/email/start", {
+      issuer_id: this.opts.issuerId,
+      email: args.email
+    }, args.correlationId);
     return {
       challengeId: res.challenge_id,
       expiresInSec: res.expires_in
     };
   }
   /**
-   * Step 2: submit the OTP the user received. On success returns
-   * {@link AuthSuccess} containing BOTH the long-lived
-   * pafi_session_token (issuer verifies via gateway JWKS) AND the
-   * short-lived pafi_jwt (issuer FE feeds to Privy).
-   */
+  * Step 2: submit the OTP the user received. On success returns
+  * {@link AuthSuccess} containing BOTH the long-lived
+  * pafi_session_token (issuer verifies via gateway JWKS) AND the
+  * short-lived pafi_jwt (issuer FE feeds to Privy).
+  */
   async verifyEmail(args) {
-    const res = await this.post(
-      "/v1/auth/email/verify",
-      {
-        challenge_id: args.challengeId,
-        otp_code: args.otpCode
-      },
-      args.correlationId
-    );
+    const res = await this.post("/v1/auth/email/verify", {
+      challenge_id: args.challengeId,
+      otp_code: args.otpCode
+    }, args.correlationId);
     return mapAuthSuccess(res);
   }
   // ───────────────────────────────────────────────────────────────
   // GOOGLE — 1-step exchange
   // ───────────────────────────────────────────────────────────────
   /**
-   * Hand the gateway an id_token the issuer FE obtained from Google
-   * Identity Services (using PAFI's shared client_id). Gateway verifies
-   * signature + audience + `email_verified` before resolving identity.
-   */
+  * Hand the gateway an id_token the issuer FE obtained from Google
+  * Identity Services (using PAFI's shared client_id). Gateway verifies
+  * signature + audience + `email_verified` before resolving identity.
+  */
   async exchangeGoogle(args) {
-    const res = await this.post(
-      "/v1/auth/google/exchange",
-      {
-        issuer_id: this.opts.issuerId,
-        id_token: args.idToken
-      },
-      args.correlationId
-    );
+    const res = await this.post("/v1/auth/google/exchange", {
+      issuer_id: this.opts.issuerId,
+      id_token: args.idToken
+    }, args.correlationId);
     return mapAuthSuccess(res);
   }
   // ───────────────────────────────────────────────────────────────
   // KAKAO — 1-step exchange (authorization code)
   // ───────────────────────────────────────────────────────────────
   /**
-   * Hand the gateway the authorization code returned by Kakao's
-   * redirect. Gateway exchanges with Kakao (server-to-server using
-   * PAFI's client_secret), verifies id_token, resolves identity.
-   *
-   * `redirectUri` must match the URL the FE used when starting the
-   * Kakao flow. Falls back to the gateway's KAKAO_REDIRECT_URI when
-   * omitted — pass an explicit value for multi-environment FEs.
-   */
+  * Hand the gateway the authorization code returned by Kakao's
+  * redirect. Gateway exchanges with Kakao (server-to-server using
+  * PAFI's client_secret), verifies id_token, resolves identity.
+  *
+  * `redirectUri` must match the URL the FE used when starting the
+  * Kakao flow. Falls back to the gateway's KAKAO_REDIRECT_URI when
+  * omitted — pass an explicit value for multi-environment FEs.
+  */
   async exchangeKakao(args) {
-    const res = await this.post(
-      "/v1/auth/kakao/exchange",
-      {
-        issuer_id: this.opts.issuerId,
-        code: args.code,
-        ...args.redirectUri ? { redirect_uri: args.redirectUri } : {}
-      },
-      args.correlationId
-    );
+    const res = await this.post("/v1/auth/kakao/exchange", {
+      issuer_id: this.opts.issuerId,
+      code: args.code,
+      ...args.redirectUri ? {
+        redirect_uri: args.redirectUri
+      } : {}
+    }, args.correlationId);
     return mapAuthSuccess(res);
   }
   // ───────────────────────────────────────────────────────────────
@@ -198,21 +182,11 @@ var PafiAuthClient = class {
     try {
       parsed = text ? JSON.parse(text) : {};
     } catch {
-      throw new PafiAuthError(
-        `Non-JSON response from gateway (${path}): ${text.slice(0, 120)}`,
-        res.status,
-        "non_json_response",
-        finalCorrelationId
-      );
+      throw new PafiAuthError(`Non-JSON response from gateway (${path}): ${text.slice(0, 120)}`, res.status, "non_json_response", finalCorrelationId);
     }
     if (!res.ok) {
       const err = parsed;
-      throw new PafiAuthError(
-        err.error_description ?? err.error ?? `Gateway returned HTTP ${res.status}`,
-        res.status,
-        err.error ?? "unknown_error",
-        err.correlation_id ?? finalCorrelationId
-      );
+      throw new PafiAuthError(err.error_description ?? err.error ?? `Gateway returned HTTP ${res.status}`, res.status, err.error ?? "unknown_error", err.correlation_id ?? finalCorrelationId);
     }
     return parsed;
   }
@@ -224,28 +198,47 @@ function mapAuthSuccess(res) {
     canonicalId: res.canonical_id,
     expiresAt: res.expires_at,
     isFirstLogin: res.is_first_login,
-    ...res.verified_email ? { verifiedEmail: res.verified_email } : {}
+    ...res.verified_email ? {
+      verifiedEmail: res.verified_email
+    } : {}
   };
 }
+__name(mapAuthSuccess, "mapAuthSuccess");
 
 // src/direct-auth/pafi-direct-auth.module-options.ts
-var PAFI_DIRECT_AUTH_MODULE_OPTIONS = /* @__PURE__ */ Symbol(
-  "PAFI_DIRECT_AUTH_MODULE_OPTIONS"
-);
+var PAFI_DIRECT_AUTH_MODULE_OPTIONS = /* @__PURE__ */ Symbol("PAFI_DIRECT_AUTH_MODULE_OPTIONS");
 
 // src/direct-auth/services/pafi-auth-client.provider.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
 var PafiAuthClientProvider = class {
-  constructor(options) {
-    this.options = options;
+  static {
+    __name(this, "PafiAuthClientProvider");
   }
   options;
   _client;
+  constructor(options) {
+    this.options = options;
+  }
   onModuleInit() {
     const jwk = this.options.clientPrivateJwk;
     if (!jwk.kid) {
-      throw new Error(
-        "PafiDirectAuthModule: clientPrivateJwk.kid is required \u2014 gateway uses kid for key lookup"
-      );
+      throw new Error("PafiDirectAuthModule: clientPrivateJwk.kid is required \u2014 gateway uses kid for key lookup");
     }
     this._client = new PafiAuthClient({
       gatewayUrl: this.options.gatewayUrl,
@@ -258,21 +251,43 @@ var PafiAuthClientProvider = class {
     return this._client;
   }
 };
-PafiAuthClientProvider = __decorateClass([
+PafiAuthClientProvider = _ts_decorate([
   (0, import_common.Injectable)(),
-  __decorateParam(0, (0, import_common.Inject)(PAFI_DIRECT_AUTH_MODULE_OPTIONS))
+  _ts_param(0, (0, import_common.Inject)(PAFI_DIRECT_AUTH_MODULE_OPTIONS)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof PafiDirectAuthModuleOptions === "undefined" ? Object : PafiDirectAuthModuleOptions
+  ])
 ], PafiAuthClientProvider);
 
 // src/direct-auth/services/pafi-session-verifier.service.ts
 var import_common2 = require("@nestjs/common");
 var import_jose2 = require("jose");
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
 var PafiSessionVerifierService = class {
+  static {
+    __name(this, "PafiSessionVerifierService");
+  }
   jwks;
   expectedIssuer;
   constructor(options) {
-    this.jwks = (0, import_jose2.createRemoteJWKSet)(
-      new URL(`${options.gatewayUrl}/.well-known/jwks.json`)
-    );
+    this.jwks = (0, import_jose2.createRemoteJWKSet)(new URL(`${options.gatewayUrl}/.well-known/jwks.json`));
     this.expectedIssuer = options.gatewayUrl;
   }
   async verify(token) {
@@ -282,14 +297,10 @@ var PafiSessionVerifierService = class {
         issuer: this.expectedIssuer
       }));
     } catch (err) {
-      throw new import_common2.UnauthorizedException(
-        `Invalid pafi_session_token: ${err.message}`
-      );
+      throw new import_common2.UnauthorizedException(`Invalid pafi_session_token: ${err.message}`);
     }
     if (payload.scope !== "pafi-session") {
-      throw new import_common2.UnauthorizedException(
-        `pafi_session_token has wrong scope: ${String(payload.scope)}`
-      );
+      throw new import_common2.UnauthorizedException(`pafi_session_token has wrong scope: ${String(payload.scope)}`);
     }
     if (typeof payload.sub !== "string") {
       throw new import_common2.UnauthorizedException("pafi_session_token missing sub");
@@ -297,9 +308,7 @@ var PafiSessionVerifierService = class {
     if (typeof payload.exp !== "number" || typeof payload.iat !== "number") {
       throw new import_common2.UnauthorizedException("pafi_session_token missing iat/exp");
     }
-    const verifiedAttribute = parseVerifiedAttribute(
-      payload.verified_attribute
-    );
+    const verifiedAttribute = parseVerifiedAttribute(payload.verified_attribute);
     return {
       sub: payload.sub,
       scope: "pafi-session",
@@ -311,9 +320,13 @@ var PafiSessionVerifierService = class {
     };
   }
 };
-PafiSessionVerifierService = __decorateClass([
+PafiSessionVerifierService = _ts_decorate2([
   (0, import_common2.Injectable)(),
-  __decorateParam(0, (0, import_common2.Inject)(PAFI_DIRECT_AUTH_MODULE_OPTIONS))
+  _ts_param2(0, (0, import_common2.Inject)(PAFI_DIRECT_AUTH_MODULE_OPTIONS)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof PafiDirectAuthModuleOptions === "undefined" ? Object : PafiDirectAuthModuleOptions
+  ])
 ], PafiSessionVerifierService);
 function parseVerifiedAttribute(raw) {
   if (!raw || typeof raw !== "object") return void 0;
@@ -324,6 +337,7 @@ function parseVerifiedAttribute(raw) {
     valueHash: typeof obj.value_hash === "string" ? obj.value_hash : void 0
   };
 }
+__name(parseVerifiedAttribute, "parseVerifiedAttribute");
 
 // src/direct-auth/services/pafi-direct-auth.service.ts
 var import_common3 = require("@nestjs/common");
@@ -335,18 +349,38 @@ var USER_STORE = /* @__PURE__ */ Symbol("USER_STORE");
 var SESSION_TOKEN_MINTER = /* @__PURE__ */ Symbol("SESSION_TOKEN_MINTER");
 
 // src/direct-auth/services/pafi-direct-auth.service.ts
-var PafiDirectAuthService = class {
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var PafiDirectAuthService = class _PafiDirectAuthService {
+  static {
+    __name(this, "PafiDirectAuthService");
+  }
+  clientProvider;
+  sessionVerifier;
+  userStore;
+  sessionTokenMinter;
+  logger = new import_common3.Logger(_PafiDirectAuthService.name);
   constructor(clientProvider, sessionVerifier, userStore, sessionTokenMinter) {
     this.clientProvider = clientProvider;
     this.sessionVerifier = sessionVerifier;
     this.userStore = userStore;
     this.sessionTokenMinter = sessionTokenMinter;
   }
-  clientProvider;
-  sessionVerifier;
-  userStore;
-  sessionTokenMinter;
-  logger = new import_common3.Logger(PafiDirectAuthService.name);
   // ── Email OTP ────────────────────────────────────────────────────
   async startEmail(args) {
     return this.clientProvider.client.startEmail({
@@ -399,14 +433,23 @@ var PafiDirectAuthService = class {
       pafiSessionToken: success.pafiSessionToken,
       canonicalId: success.canonicalId,
       isFirstLogin: success.isFirstLogin,
-      ...success.verifiedEmail ? { verifiedEmail: success.verifiedEmail } : {}
+      ...success.verifiedEmail ? {
+        verifiedEmail: success.verifiedEmail
+      } : {}
     };
   }
 };
-PafiDirectAuthService = __decorateClass([
+PafiDirectAuthService = _ts_decorate3([
   (0, import_common3.Injectable)(),
-  __decorateParam(2, (0, import_common3.Inject)(USER_STORE)),
-  __decorateParam(3, (0, import_common3.Inject)(SESSION_TOKEN_MINTER))
+  _ts_param3(2, (0, import_common3.Inject)(USER_STORE)),
+  _ts_param3(3, (0, import_common3.Inject)(SESSION_TOKEN_MINTER)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof PafiAuthClientProvider === "undefined" ? Object : PafiAuthClientProvider,
+    typeof PafiSessionVerifierService === "undefined" ? Object : PafiSessionVerifierService,
+    typeof IUserStore === "undefined" ? Object : IUserStore,
+    typeof ISessionTokenMinter === "undefined" ? Object : ISessionTokenMinter
+  ])
 ], PafiDirectAuthService);
 
 // src/direct-auth/pafi-direct-auth.controller.ts
@@ -416,74 +459,120 @@ var import_swagger2 = require("@nestjs/swagger");
 // src/direct-auth/pafi-direct-auth.dto.ts
 var import_swagger = require("@nestjs/swagger");
 var import_class_validator = require("class-validator");
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
 var EmailStartRequestDto = class {
+  static {
+    __name(this, "EmailStartRequestDto");
+  }
   email;
 };
-__decorateClass([
-  (0, import_swagger.ApiProperty)({ example: "user1@example.com" }),
+_ts_decorate4([
+  (0, import_swagger.ApiProperty)({
+    example: "user1@example.com"
+  }),
   (0, import_class_validator.IsEmail)(),
-  (0, import_class_validator.MaxLength)(320)
-], EmailStartRequestDto.prototype, "email", 2);
+  (0, import_class_validator.MaxLength)(320),
+  _ts_metadata4("design:type", String)
+], EmailStartRequestDto.prototype, "email", void 0);
 var EmailVerifyRequestDto = class {
+  static {
+    __name(this, "EmailVerifyRequestDto");
+  }
   challengeId;
   otpCode;
 };
-__decorateClass([
+_ts_decorate4([
   (0, import_swagger.ApiProperty)({
     description: "Challenge id returned by POST /auth/v2/email/start. Opaque to the FE; echo verbatim."
   }),
   (0, import_class_validator.IsString)(),
   (0, import_class_validator.IsNotEmpty)(),
-  (0, import_class_validator.MaxLength)(128)
-], EmailVerifyRequestDto.prototype, "challengeId", 2);
-__decorateClass([
-  (0, import_swagger.ApiProperty)({ example: "123456" }),
+  (0, import_class_validator.MaxLength)(128),
+  _ts_metadata4("design:type", String)
+], EmailVerifyRequestDto.prototype, "challengeId", void 0);
+_ts_decorate4([
+  (0, import_swagger.ApiProperty)({
+    example: "123456"
+  }),
   (0, import_class_validator.IsString)(),
-  (0, import_class_validator.Length)(4, 10)
-], EmailVerifyRequestDto.prototype, "otpCode", 2);
+  (0, import_class_validator.Length)(4, 10),
+  _ts_metadata4("design:type", String)
+], EmailVerifyRequestDto.prototype, "otpCode", void 0);
 var GoogleExchangeRequestDto = class {
+  static {
+    __name(this, "GoogleExchangeRequestDto");
+  }
   idToken;
 };
-__decorateClass([
+_ts_decorate4([
   (0, import_swagger.ApiProperty)({
     description: "Google-issued ID token (JWS). Obtain on FE via Google Identity Services using PAFI's Google OAuth client_id."
   }),
   (0, import_class_validator.IsString)(),
   (0, import_class_validator.IsNotEmpty)(),
-  (0, import_class_validator.MaxLength)(8192)
-], GoogleExchangeRequestDto.prototype, "idToken", 2);
+  (0, import_class_validator.MaxLength)(8192),
+  _ts_metadata4("design:type", String)
+], GoogleExchangeRequestDto.prototype, "idToken", void 0);
 var KakaoExchangeRequestDto = class {
+  static {
+    __name(this, "KakaoExchangeRequestDto");
+  }
   code;
   redirectUri;
 };
-__decorateClass([
+_ts_decorate4([
   (0, import_swagger.ApiProperty)({
     description: "Authorization code returned by Kakao to the FE redirect URL."
   }),
   (0, import_class_validator.IsString)(),
   (0, import_class_validator.IsNotEmpty)(),
-  (0, import_class_validator.MaxLength)(2048)
-], KakaoExchangeRequestDto.prototype, "code", 2);
-__decorateClass([
+  (0, import_class_validator.MaxLength)(2048),
+  _ts_metadata4("design:type", String)
+], KakaoExchangeRequestDto.prototype, "code", void 0);
+_ts_decorate4([
   (0, import_swagger.ApiProperty)({
     description: "Redirect URI the FE used when initiating the Kakao flow. Optional \u2014 gateway falls back to its own KAKAO_REDIRECT_URI env.",
     required: false
   }),
   (0, import_class_validator.IsOptional)(),
-  (0, import_class_validator.IsUrl)({ require_tld: false, require_protocol: true }),
-  (0, import_class_validator.MaxLength)(2048)
-], KakaoExchangeRequestDto.prototype, "redirectUri", 2);
+  (0, import_class_validator.IsUrl)({
+    require_tld: false,
+    require_protocol: true
+  }),
+  (0, import_class_validator.MaxLength)(2048),
+  _ts_metadata4("design:type", String)
+], KakaoExchangeRequestDto.prototype, "redirectUri", void 0);
 var EmailStartResponseDto = class {
+  static {
+    __name(this, "EmailStartResponseDto");
+  }
   challengeId;
   expiresInSec;
 };
-__decorateClass([
-  (0, import_swagger.ApiProperty)()
-], EmailStartResponseDto.prototype, "challengeId", 2);
-__decorateClass([
-  (0, import_swagger.ApiProperty)({ description: "Seconds until the challenge expires." })
-], EmailStartResponseDto.prototype, "expiresInSec", 2);
+_ts_decorate4([
+  (0, import_swagger.ApiProperty)(),
+  _ts_metadata4("design:type", String)
+], EmailStartResponseDto.prototype, "challengeId", void 0);
+_ts_decorate4([
+  (0, import_swagger.ApiProperty)({
+    description: "Seconds until the challenge expires."
+  }),
+  _ts_metadata4("design:type", Number)
+], EmailStartResponseDto.prototype, "expiresInSec", void 0);
 var PafiAuthSuccessDto = class {
+  static {
+    __name(this, "PafiAuthSuccessDto");
+  }
   sessionToken;
   sessionExpiresAt;
   pafiJwt;
@@ -492,47 +581,80 @@ var PafiAuthSuccessDto = class {
   isFirstLogin;
   verifiedEmail;
 };
-__decorateClass([
+_ts_decorate4([
   (0, import_swagger.ApiProperty)({
     description: "Issuer-native session token (typically HS256, minted by ISessionTokenMinter) \u2014 Bearer-auth for subsequent issuer API calls."
-  })
-], PafiAuthSuccessDto.prototype, "sessionToken", 2);
-__decorateClass([
-  (0, import_swagger.ApiProperty)({ description: "Issuer session token expiration (ISO 8601)." })
-], PafiAuthSuccessDto.prototype, "sessionExpiresAt", 2);
-__decorateClass([
+  }),
+  _ts_metadata4("design:type", String)
+], PafiAuthSuccessDto.prototype, "sessionToken", void 0);
+_ts_decorate4([
+  (0, import_swagger.ApiProperty)({
+    description: "Issuer session token expiration (ISO 8601)."
+  }),
+  _ts_metadata4("design:type", String)
+], PafiAuthSuccessDto.prototype, "sessionExpiresAt", void 0);
+_ts_decorate4([
   (0, import_swagger.ApiProperty)({
     description: "Short-lived PAFI JWT (60s) \u2014 FE feeds verbatim to Privy.loginWithCustomAuth() to provision the embedded wallet."
-  })
-], PafiAuthSuccessDto.prototype, "pafiJwt", 2);
-__decorateClass([
+  }),
+  _ts_metadata4("design:type", String)
+], PafiAuthSuccessDto.prototype, "pafiJwt", void 0);
+_ts_decorate4([
   (0, import_swagger.ApiProperty)({
     description: "Long-lived PAFI session token (24h) \u2014 opaque to FE; keep alongside sessionToken if you ever need to call the gateway directly."
-  })
-], PafiAuthSuccessDto.prototype, "pafiSessionToken", 2);
-__decorateClass([
-  (0, import_swagger.ApiProperty)({ description: "canonical_pafi_user_id assigned by the gateway." })
-], PafiAuthSuccessDto.prototype, "canonicalId", 2);
-__decorateClass([
+  }),
+  _ts_metadata4("design:type", String)
+], PafiAuthSuccessDto.prototype, "pafiSessionToken", void 0);
+_ts_decorate4([
+  (0, import_swagger.ApiProperty)({
+    description: "canonical_pafi_user_id assigned by the gateway."
+  }),
+  _ts_metadata4("design:type", String)
+], PafiAuthSuccessDto.prototype, "canonicalId", void 0);
+_ts_decorate4([
   (0, import_swagger.ApiProperty)({
     description: "True the first time the user appears at the gateway."
-  })
-], PafiAuthSuccessDto.prototype, "isFirstLogin", 2);
-__decorateClass([
+  }),
+  _ts_metadata4("design:type", Boolean)
+], PafiAuthSuccessDto.prototype, "isFirstLogin", void 0);
+_ts_decorate4([
   (0, import_swagger.ApiProperty)({
     description: "Verified email (when the auth method exposed one \u2014 email OTP and Google always; Kakao only if the user shared their email).",
     required: false
-  })
-], PafiAuthSuccessDto.prototype, "verifiedEmail", 2);
+  }),
+  _ts_metadata4("design:type", String)
+], PafiAuthSuccessDto.prototype, "verifiedEmail", void 0);
 
 // src/direct-auth/pafi-direct-auth.controller.ts
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
 var PafiDirectAuthController = class {
+  static {
+    __name(this, "PafiDirectAuthController");
+  }
+  directAuth;
   constructor(directAuth) {
     this.directAuth = directAuth;
   }
-  directAuth;
   async startEmail(body) {
-    const res = await this.directAuth.startEmail({ email: body.email });
+    const res = await this.directAuth.startEmail({
+      email: body.email
+    });
     return {
       challengeId: res.challengeId,
       expiresInSec: res.expiresInSec
@@ -545,7 +667,9 @@ var PafiDirectAuthController = class {
     });
   }
   async exchangeGoogle(body) {
-    return this.directAuth.exchangeGoogle({ idToken: body.idToken });
+    return this.directAuth.exchangeGoogle({
+      idToken: body.idToken
+    });
   }
   async exchangeKakao(body) {
     return this.directAuth.exchangeKakao({
@@ -554,58 +678,102 @@ var PafiDirectAuthController = class {
     });
   }
 };
-__decorateClass([
+_ts_decorate5([
   (0, import_common4.Post)("email/start"),
   (0, import_common4.HttpCode)(import_common4.HttpStatus.OK),
   (0, import_swagger2.ApiOperation)({
     summary: "Step 1: ask gateway to send an OTP to the user email.",
     description: "Gateway generates the OTP, sends it via its configured email provider, and returns an opaque challenge_id. The FE echoes that challenge_id back on step 2 along with the code the user typed."
   }),
-  (0, import_swagger2.ApiOkResponse)({ type: EmailStartResponseDto }),
-  __decorateParam(0, (0, import_common4.Body)())
-], PafiDirectAuthController.prototype, "startEmail", 1);
-__decorateClass([
+  (0, import_swagger2.ApiOkResponse)({
+    type: EmailStartResponseDto
+  }),
+  _ts_param4(0, (0, import_common4.Body)()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof EmailStartRequestDto === "undefined" ? Object : EmailStartRequestDto
+  ]),
+  _ts_metadata5("design:returntype", Promise)
+], PafiDirectAuthController.prototype, "startEmail", null);
+_ts_decorate5([
   (0, import_common4.Post)("email/verify"),
   (0, import_common4.HttpCode)(import_common4.HttpStatus.OK),
   (0, import_swagger2.ApiOperation)({
     summary: "Step 2: submit the OTP to complete email sign-in.",
     description: "Gateway verifies the OTP, derives canonical_id from the verified email, and mints both a pafi_session_token (24h, gateway-signed) and pafi_jwt (60s, for Privy.loginWithCustomAuth). Issuer wraps these in a session token of its own (sub = canonical_id) so existing guards keep working."
   }),
-  (0, import_swagger2.ApiOkResponse)({ type: PafiAuthSuccessDto }),
-  __decorateParam(0, (0, import_common4.Body)())
-], PafiDirectAuthController.prototype, "verifyEmail", 1);
-__decorateClass([
+  (0, import_swagger2.ApiOkResponse)({
+    type: PafiAuthSuccessDto
+  }),
+  _ts_param4(0, (0, import_common4.Body)()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof EmailVerifyRequestDto === "undefined" ? Object : EmailVerifyRequestDto
+  ]),
+  _ts_metadata5("design:returntype", Promise)
+], PafiDirectAuthController.prototype, "verifyEmail", null);
+_ts_decorate5([
   (0, import_common4.Post)("google/exchange"),
   (0, import_common4.HttpCode)(import_common4.HttpStatus.OK),
   (0, import_swagger2.ApiOperation)({
     summary: "Sign in with Google.",
     description: "Hand the gateway a Google-issued id_token (FE obtains via Google Identity Services using PAFI's shared client_id). Gateway verifies signature + email_verified, derives canonical_id from the email, returns the same token bundle as /email/verify."
   }),
-  (0, import_swagger2.ApiOkResponse)({ type: PafiAuthSuccessDto }),
-  __decorateParam(0, (0, import_common4.Body)())
-], PafiDirectAuthController.prototype, "exchangeGoogle", 1);
-__decorateClass([
+  (0, import_swagger2.ApiOkResponse)({
+    type: PafiAuthSuccessDto
+  }),
+  _ts_param4(0, (0, import_common4.Body)()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof GoogleExchangeRequestDto === "undefined" ? Object : GoogleExchangeRequestDto
+  ]),
+  _ts_metadata5("design:returntype", Promise)
+], PafiDirectAuthController.prototype, "exchangeGoogle", null);
+_ts_decorate5([
   (0, import_common4.Post)("kakao/exchange"),
   (0, import_common4.HttpCode)(import_common4.HttpStatus.OK),
   (0, import_swagger2.ApiOperation)({
     summary: "Sign in with Kakao.",
     description: "Hand the gateway the authorization code Kakao redirected back to the FE. Gateway exchanges with Kakao server-to-server (using PAFI-held client_secret), verifies the id_token, and returns the same token bundle as /email/verify. canonical_id derives from email when present, else from the Kakao sub."
   }),
-  (0, import_swagger2.ApiOkResponse)({ type: PafiAuthSuccessDto }),
-  __decorateParam(0, (0, import_common4.Body)())
-], PafiDirectAuthController.prototype, "exchangeKakao", 1);
-PafiDirectAuthController = __decorateClass([
+  (0, import_swagger2.ApiOkResponse)({
+    type: PafiAuthSuccessDto
+  }),
+  _ts_param4(0, (0, import_common4.Body)()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof KakaoExchangeRequestDto === "undefined" ? Object : KakaoExchangeRequestDto
+  ]),
+  _ts_metadata5("design:returntype", Promise)
+], PafiDirectAuthController.prototype, "exchangeKakao", null);
+PafiDirectAuthController = _ts_decorate5([
   (0, import_swagger2.ApiTags)("pafi-auth-v2"),
-  (0, import_common4.Controller)("auth/v2")
+  (0, import_common4.Controller)("auth/v2"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof PafiDirectAuthService === "undefined" ? Object : PafiDirectAuthService
+  ])
 ], PafiDirectAuthController);
 
 // src/direct-auth/pafi-direct-auth.module.ts
-var PafiDirectAuthModule = class {
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+var PafiDirectAuthModule = class _PafiDirectAuthModule {
+  static {
+    __name(this, "PafiDirectAuthModule");
+  }
   static forRoot(options) {
     return {
-      module: PafiDirectAuthModule,
+      module: _PafiDirectAuthModule,
       imports: options.imports ?? [],
-      controllers: [PafiDirectAuthController],
+      controllers: [
+        PafiDirectAuthController
+      ],
       providers: [
         {
           provide: PAFI_DIRECT_AUTH_MODULE_OPTIONS,
@@ -639,7 +807,7 @@ var PafiDirectAuthModule = class {
     };
   }
 };
-PafiDirectAuthModule = __decorateClass([
+PafiDirectAuthModule = _ts_decorate6([
   (0, import_common5.Module)({})
 ], PafiDirectAuthModule);
 // Annotate the CommonJS export names for ESM import in node: