@pafi-dev/issuer 0.39.2 → 0.40.0

package/dist/direct-auth/index.js

@@ -1,10 +1,9 @@
 import {
   PafiAuthClient
-} from "../chunk-7VEYSL2C.js";
+} from "../chunk-2Z3M2KQG.js";
 import {
-  __decorateClass,
-  __decorateParam
-} from "../chunk-BRKEJJFQ.js";
+  __name
+} from "../chunk-7QVYU63E.js";
 
 // src/direct-auth/pafi-direct-auth.module.ts
 import { Module } from "@nestjs/common";
@@ -13,23 +12,39 @@ import { Module } from "@nestjs/common";
 import { Injectable, Inject } from "@nestjs/common";
 
 // src/direct-auth/pafi-direct-auth.module-options.ts
-var PAFI_DIRECT_AUTH_MODULE_OPTIONS = /* @__PURE__ */ Symbol(
-  "PAFI_DIRECT_AUTH_MODULE_OPTIONS"
-);
+var PAFI_DIRECT_AUTH_MODULE_OPTIONS = /* @__PURE__ */ Symbol("PAFI_DIRECT_AUTH_MODULE_OPTIONS");
 
 // src/direct-auth/services/pafi-auth-client.provider.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
 var PafiAuthClientProvider = class {
-  constructor(options) {
-    this.options = options;
+  static {
+    __name(this, "PafiAuthClientProvider");
   }
   options;
   _client;
+  constructor(options) {
+    this.options = options;
+  }
   onModuleInit() {
     const jwk = this.options.clientPrivateJwk;
     if (!jwk.kid) {
-      throw new Error(
-        "PafiDirectAuthModule: clientPrivateJwk.kid is required \u2014 gateway uses kid for key lookup"
-      );
+      throw new Error("PafiDirectAuthModule: clientPrivateJwk.kid is required \u2014 gateway uses kid for key lookup");
     }
     this._client = new PafiAuthClient({
       gatewayUrl: this.options.gatewayUrl,
@@ -42,25 +57,43 @@ var PafiAuthClientProvider = class {
     return this._client;
   }
 };
-PafiAuthClientProvider = __decorateClass([
+PafiAuthClientProvider = _ts_decorate([
   Injectable(),
-  __decorateParam(0, Inject(PAFI_DIRECT_AUTH_MODULE_OPTIONS))
+  _ts_param(0, Inject(PAFI_DIRECT_AUTH_MODULE_OPTIONS)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof PafiDirectAuthModuleOptions === "undefined" ? Object : PafiDirectAuthModuleOptions
+  ])
 ], PafiAuthClientProvider);
 
 // src/direct-auth/services/pafi-session-verifier.service.ts
-import {
-  Injectable as Injectable2,
-  Inject as Inject2,
-  UnauthorizedException
-} from "@nestjs/common";
+import { Injectable as Injectable2, Inject as Inject2, UnauthorizedException } from "@nestjs/common";
 import { createRemoteJWKSet, jwtVerify } from "jose";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
 var PafiSessionVerifierService = class {
+  static {
+    __name(this, "PafiSessionVerifierService");
+  }
   jwks;
   expectedIssuer;
   constructor(options) {
-    this.jwks = createRemoteJWKSet(
-      new URL(`${options.gatewayUrl}/.well-known/jwks.json`)
-    );
+    this.jwks = createRemoteJWKSet(new URL(`${options.gatewayUrl}/.well-known/jwks.json`));
     this.expectedIssuer = options.gatewayUrl;
   }
   async verify(token) {
@@ -70,14 +103,10 @@ var PafiSessionVerifierService = class {
         issuer: this.expectedIssuer
       }));
     } catch (err) {
-      throw new UnauthorizedException(
-        `Invalid pafi_session_token: ${err.message}`
-      );
+      throw new UnauthorizedException(`Invalid pafi_session_token: ${err.message}`);
     }
     if (payload.scope !== "pafi-session") {
-      throw new UnauthorizedException(
-        `pafi_session_token has wrong scope: ${String(payload.scope)}`
-      );
+      throw new UnauthorizedException(`pafi_session_token has wrong scope: ${String(payload.scope)}`);
     }
     if (typeof payload.sub !== "string") {
       throw new UnauthorizedException("pafi_session_token missing sub");
@@ -85,9 +114,7 @@ var PafiSessionVerifierService = class {
     if (typeof payload.exp !== "number" || typeof payload.iat !== "number") {
       throw new UnauthorizedException("pafi_session_token missing iat/exp");
     }
-    const verifiedAttribute = parseVerifiedAttribute(
-      payload.verified_attribute
-    );
+    const verifiedAttribute = parseVerifiedAttribute(payload.verified_attribute);
     return {
       sub: payload.sub,
       scope: "pafi-session",
@@ -99,9 +126,13 @@ var PafiSessionVerifierService = class {
     };
   }
 };
-PafiSessionVerifierService = __decorateClass([
+PafiSessionVerifierService = _ts_decorate2([
   Injectable2(),
-  __decorateParam(0, Inject2(PAFI_DIRECT_AUTH_MODULE_OPTIONS))
+  _ts_param2(0, Inject2(PAFI_DIRECT_AUTH_MODULE_OPTIONS)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof PafiDirectAuthModuleOptions === "undefined" ? Object : PafiDirectAuthModuleOptions
+  ])
 ], PafiSessionVerifierService);
 function parseVerifiedAttribute(raw) {
   if (!raw || typeof raw !== "object") return void 0;
@@ -112,6 +143,7 @@ function parseVerifiedAttribute(raw) {
     valueHash: typeof obj.value_hash === "string" ? obj.value_hash : void 0
   };
 }
+__name(parseVerifiedAttribute, "parseVerifiedAttribute");
 
 // src/direct-auth/services/pafi-direct-auth.service.ts
 import { Injectable as Injectable3, Inject as Inject3, Logger } from "@nestjs/common";
@@ -123,18 +155,38 @@ var USER_STORE = /* @__PURE__ */ Symbol("USER_STORE");
 var SESSION_TOKEN_MINTER = /* @__PURE__ */ Symbol("SESSION_TOKEN_MINTER");
 
 // src/direct-auth/services/pafi-direct-auth.service.ts
-var PafiDirectAuthService = class {
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var PafiDirectAuthService = class _PafiDirectAuthService {
+  static {
+    __name(this, "PafiDirectAuthService");
+  }
+  clientProvider;
+  sessionVerifier;
+  userStore;
+  sessionTokenMinter;
+  logger = new Logger(_PafiDirectAuthService.name);
   constructor(clientProvider, sessionVerifier, userStore, sessionTokenMinter) {
     this.clientProvider = clientProvider;
     this.sessionVerifier = sessionVerifier;
     this.userStore = userStore;
     this.sessionTokenMinter = sessionTokenMinter;
   }
-  clientProvider;
-  sessionVerifier;
-  userStore;
-  sessionTokenMinter;
-  logger = new Logger(PafiDirectAuthService.name);
   // ── Email OTP ────────────────────────────────────────────────────
   async startEmail(args) {
     return this.clientProvider.client.startEmail({
@@ -187,105 +239,146 @@ var PafiDirectAuthService = class {
       pafiSessionToken: success.pafiSessionToken,
       canonicalId: success.canonicalId,
       isFirstLogin: success.isFirstLogin,
-      ...success.verifiedEmail ? { verifiedEmail: success.verifiedEmail } : {}
+      ...success.verifiedEmail ? {
+        verifiedEmail: success.verifiedEmail
+      } : {}
     };
   }
 };
-PafiDirectAuthService = __decorateClass([
+PafiDirectAuthService = _ts_decorate3([
   Injectable3(),
-  __decorateParam(2, Inject3(USER_STORE)),
-  __decorateParam(3, Inject3(SESSION_TOKEN_MINTER))
+  _ts_param3(2, Inject3(USER_STORE)),
+  _ts_param3(3, Inject3(SESSION_TOKEN_MINTER)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof PafiAuthClientProvider === "undefined" ? Object : PafiAuthClientProvider,
+    typeof PafiSessionVerifierService === "undefined" ? Object : PafiSessionVerifierService,
+    typeof IUserStore === "undefined" ? Object : IUserStore,
+    typeof ISessionTokenMinter === "undefined" ? Object : ISessionTokenMinter
+  ])
 ], PafiDirectAuthService);
 
 // src/direct-auth/pafi-direct-auth.controller.ts
-import {
-  Body,
-  Controller,
-  HttpCode,
-  HttpStatus,
-  Post
-} from "@nestjs/common";
+import { Body, Controller, HttpCode, HttpStatus, Post } from "@nestjs/common";
 import { ApiOkResponse, ApiOperation, ApiTags } from "@nestjs/swagger";
 
 // src/direct-auth/pafi-direct-auth.dto.ts
 import { ApiProperty } from "@nestjs/swagger";
-import {
-  IsEmail,
-  IsNotEmpty,
-  IsOptional,
-  IsString,
-  IsUrl,
-  Length,
-  MaxLength
-} from "class-validator";
+import { IsEmail, IsNotEmpty, IsOptional, IsString, IsUrl, Length, MaxLength } from "class-validator";
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
 var EmailStartRequestDto = class {
+  static {
+    __name(this, "EmailStartRequestDto");
+  }
   email;
 };
-__decorateClass([
-  ApiProperty({ example: "user1@example.com" }),
+_ts_decorate4([
+  ApiProperty({
+    example: "user1@example.com"
+  }),
   IsEmail(),
-  MaxLength(320)
-], EmailStartRequestDto.prototype, "email", 2);
+  MaxLength(320),
+  _ts_metadata4("design:type", String)
+], EmailStartRequestDto.prototype, "email", void 0);
 var EmailVerifyRequestDto = class {
+  static {
+    __name(this, "EmailVerifyRequestDto");
+  }
   challengeId;
   otpCode;
 };
-__decorateClass([
+_ts_decorate4([
   ApiProperty({
     description: "Challenge id returned by POST /auth/v2/email/start. Opaque to the FE; echo verbatim."
   }),
   IsString(),
   IsNotEmpty(),
-  MaxLength(128)
-], EmailVerifyRequestDto.prototype, "challengeId", 2);
-__decorateClass([
-  ApiProperty({ example: "123456" }),
+  MaxLength(128),
+  _ts_metadata4("design:type", String)
+], EmailVerifyRequestDto.prototype, "challengeId", void 0);
+_ts_decorate4([
+  ApiProperty({
+    example: "123456"
+  }),
   IsString(),
-  Length(4, 10)
-], EmailVerifyRequestDto.prototype, "otpCode", 2);
+  Length(4, 10),
+  _ts_metadata4("design:type", String)
+], EmailVerifyRequestDto.prototype, "otpCode", void 0);
 var GoogleExchangeRequestDto = class {
+  static {
+    __name(this, "GoogleExchangeRequestDto");
+  }
   idToken;
 };
-__decorateClass([
+_ts_decorate4([
   ApiProperty({
     description: "Google-issued ID token (JWS). Obtain on FE via Google Identity Services using PAFI's Google OAuth client_id."
   }),
   IsString(),
   IsNotEmpty(),
-  MaxLength(8192)
-], GoogleExchangeRequestDto.prototype, "idToken", 2);
+  MaxLength(8192),
+  _ts_metadata4("design:type", String)
+], GoogleExchangeRequestDto.prototype, "idToken", void 0);
 var KakaoExchangeRequestDto = class {
+  static {
+    __name(this, "KakaoExchangeRequestDto");
+  }
   code;
   redirectUri;
 };
-__decorateClass([
+_ts_decorate4([
   ApiProperty({
     description: "Authorization code returned by Kakao to the FE redirect URL."
   }),
   IsString(),
   IsNotEmpty(),
-  MaxLength(2048)
-], KakaoExchangeRequestDto.prototype, "code", 2);
-__decorateClass([
+  MaxLength(2048),
+  _ts_metadata4("design:type", String)
+], KakaoExchangeRequestDto.prototype, "code", void 0);
+_ts_decorate4([
   ApiProperty({
     description: "Redirect URI the FE used when initiating the Kakao flow. Optional \u2014 gateway falls back to its own KAKAO_REDIRECT_URI env.",
     required: false
   }),
   IsOptional(),
-  IsUrl({ require_tld: false, require_protocol: true }),
-  MaxLength(2048)
-], KakaoExchangeRequestDto.prototype, "redirectUri", 2);
+  IsUrl({
+    require_tld: false,
+    require_protocol: true
+  }),
+  MaxLength(2048),
+  _ts_metadata4("design:type", String)
+], KakaoExchangeRequestDto.prototype, "redirectUri", void 0);
 var EmailStartResponseDto = class {
+  static {
+    __name(this, "EmailStartResponseDto");
+  }
   challengeId;
   expiresInSec;
 };
-__decorateClass([
-  ApiProperty()
-], EmailStartResponseDto.prototype, "challengeId", 2);
-__decorateClass([
-  ApiProperty({ description: "Seconds until the challenge expires." })
-], EmailStartResponseDto.prototype, "expiresInSec", 2);
+_ts_decorate4([
+  ApiProperty(),
+  _ts_metadata4("design:type", String)
+], EmailStartResponseDto.prototype, "challengeId", void 0);
+_ts_decorate4([
+  ApiProperty({
+    description: "Seconds until the challenge expires."
+  }),
+  _ts_metadata4("design:type", Number)
+], EmailStartResponseDto.prototype, "expiresInSec", void 0);
 var PafiAuthSuccessDto = class {
+  static {
+    __name(this, "PafiAuthSuccessDto");
+  }
   sessionToken;
   sessionExpiresAt;
   pafiJwt;
@@ -294,47 +387,80 @@ var PafiAuthSuccessDto = class {
   isFirstLogin;
   verifiedEmail;
 };
-__decorateClass([
+_ts_decorate4([
   ApiProperty({
     description: "Issuer-native session token (typically HS256, minted by ISessionTokenMinter) \u2014 Bearer-auth for subsequent issuer API calls."
-  })
-], PafiAuthSuccessDto.prototype, "sessionToken", 2);
-__decorateClass([
-  ApiProperty({ description: "Issuer session token expiration (ISO 8601)." })
-], PafiAuthSuccessDto.prototype, "sessionExpiresAt", 2);
-__decorateClass([
+  }),
+  _ts_metadata4("design:type", String)
+], PafiAuthSuccessDto.prototype, "sessionToken", void 0);
+_ts_decorate4([
+  ApiProperty({
+    description: "Issuer session token expiration (ISO 8601)."
+  }),
+  _ts_metadata4("design:type", String)
+], PafiAuthSuccessDto.prototype, "sessionExpiresAt", void 0);
+_ts_decorate4([
   ApiProperty({
     description: "Short-lived PAFI JWT (60s) \u2014 FE feeds verbatim to Privy.loginWithCustomAuth() to provision the embedded wallet."
-  })
-], PafiAuthSuccessDto.prototype, "pafiJwt", 2);
-__decorateClass([
+  }),
+  _ts_metadata4("design:type", String)
+], PafiAuthSuccessDto.prototype, "pafiJwt", void 0);
+_ts_decorate4([
   ApiProperty({
     description: "Long-lived PAFI session token (24h) \u2014 opaque to FE; keep alongside sessionToken if you ever need to call the gateway directly."
-  })
-], PafiAuthSuccessDto.prototype, "pafiSessionToken", 2);
-__decorateClass([
-  ApiProperty({ description: "canonical_pafi_user_id assigned by the gateway." })
-], PafiAuthSuccessDto.prototype, "canonicalId", 2);
-__decorateClass([
+  }),
+  _ts_metadata4("design:type", String)
+], PafiAuthSuccessDto.prototype, "pafiSessionToken", void 0);
+_ts_decorate4([
+  ApiProperty({
+    description: "canonical_pafi_user_id assigned by the gateway."
+  }),
+  _ts_metadata4("design:type", String)
+], PafiAuthSuccessDto.prototype, "canonicalId", void 0);
+_ts_decorate4([
   ApiProperty({
     description: "True the first time the user appears at the gateway."
-  })
-], PafiAuthSuccessDto.prototype, "isFirstLogin", 2);
-__decorateClass([
+  }),
+  _ts_metadata4("design:type", Boolean)
+], PafiAuthSuccessDto.prototype, "isFirstLogin", void 0);
+_ts_decorate4([
   ApiProperty({
     description: "Verified email (when the auth method exposed one \u2014 email OTP and Google always; Kakao only if the user shared their email).",
     required: false
-  })
-], PafiAuthSuccessDto.prototype, "verifiedEmail", 2);
+  }),
+  _ts_metadata4("design:type", String)
+], PafiAuthSuccessDto.prototype, "verifiedEmail", void 0);
 
 // src/direct-auth/pafi-direct-auth.controller.ts
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
 var PafiDirectAuthController = class {
+  static {
+    __name(this, "PafiDirectAuthController");
+  }
+  directAuth;
   constructor(directAuth) {
     this.directAuth = directAuth;
   }
-  directAuth;
   async startEmail(body) {
-    const res = await this.directAuth.startEmail({ email: body.email });
+    const res = await this.directAuth.startEmail({
+      email: body.email
+    });
     return {
       challengeId: res.challengeId,
       expiresInSec: res.expiresInSec
@@ -347,7 +473,9 @@ var PafiDirectAuthController = class {
     });
   }
   async exchangeGoogle(body) {
-    return this.directAuth.exchangeGoogle({ idToken: body.idToken });
+    return this.directAuth.exchangeGoogle({
+      idToken: body.idToken
+    });
   }
   async exchangeKakao(body) {
     return this.directAuth.exchangeKakao({
@@ -356,58 +484,102 @@ var PafiDirectAuthController = class {
     });
   }
 };
-__decorateClass([
+_ts_decorate5([
   Post("email/start"),
   HttpCode(HttpStatus.OK),
   ApiOperation({
     summary: "Step 1: ask gateway to send an OTP to the user email.",
     description: "Gateway generates the OTP, sends it via its configured email provider, and returns an opaque challenge_id. The FE echoes that challenge_id back on step 2 along with the code the user typed."
   }),
-  ApiOkResponse({ type: EmailStartResponseDto }),
-  __decorateParam(0, Body())
-], PafiDirectAuthController.prototype, "startEmail", 1);
-__decorateClass([
+  ApiOkResponse({
+    type: EmailStartResponseDto
+  }),
+  _ts_param4(0, Body()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof EmailStartRequestDto === "undefined" ? Object : EmailStartRequestDto
+  ]),
+  _ts_metadata5("design:returntype", Promise)
+], PafiDirectAuthController.prototype, "startEmail", null);
+_ts_decorate5([
   Post("email/verify"),
   HttpCode(HttpStatus.OK),
   ApiOperation({
     summary: "Step 2: submit the OTP to complete email sign-in.",
     description: "Gateway verifies the OTP, derives canonical_id from the verified email, and mints both a pafi_session_token (24h, gateway-signed) and pafi_jwt (60s, for Privy.loginWithCustomAuth). Issuer wraps these in a session token of its own (sub = canonical_id) so existing guards keep working."
   }),
-  ApiOkResponse({ type: PafiAuthSuccessDto }),
-  __decorateParam(0, Body())
-], PafiDirectAuthController.prototype, "verifyEmail", 1);
-__decorateClass([
+  ApiOkResponse({
+    type: PafiAuthSuccessDto
+  }),
+  _ts_param4(0, Body()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof EmailVerifyRequestDto === "undefined" ? Object : EmailVerifyRequestDto
+  ]),
+  _ts_metadata5("design:returntype", Promise)
+], PafiDirectAuthController.prototype, "verifyEmail", null);
+_ts_decorate5([
   Post("google/exchange"),
   HttpCode(HttpStatus.OK),
   ApiOperation({
     summary: "Sign in with Google.",
     description: "Hand the gateway a Google-issued id_token (FE obtains via Google Identity Services using PAFI's shared client_id). Gateway verifies signature + email_verified, derives canonical_id from the email, returns the same token bundle as /email/verify."
   }),
-  ApiOkResponse({ type: PafiAuthSuccessDto }),
-  __decorateParam(0, Body())
-], PafiDirectAuthController.prototype, "exchangeGoogle", 1);
-__decorateClass([
+  ApiOkResponse({
+    type: PafiAuthSuccessDto
+  }),
+  _ts_param4(0, Body()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof GoogleExchangeRequestDto === "undefined" ? Object : GoogleExchangeRequestDto
+  ]),
+  _ts_metadata5("design:returntype", Promise)
+], PafiDirectAuthController.prototype, "exchangeGoogle", null);
+_ts_decorate5([
   Post("kakao/exchange"),
   HttpCode(HttpStatus.OK),
   ApiOperation({
     summary: "Sign in with Kakao.",
     description: "Hand the gateway the authorization code Kakao redirected back to the FE. Gateway exchanges with Kakao server-to-server (using PAFI-held client_secret), verifies the id_token, and returns the same token bundle as /email/verify. canonical_id derives from email when present, else from the Kakao sub."
   }),
-  ApiOkResponse({ type: PafiAuthSuccessDto }),
-  __decorateParam(0, Body())
-], PafiDirectAuthController.prototype, "exchangeKakao", 1);
-PafiDirectAuthController = __decorateClass([
+  ApiOkResponse({
+    type: PafiAuthSuccessDto
+  }),
+  _ts_param4(0, Body()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof KakaoExchangeRequestDto === "undefined" ? Object : KakaoExchangeRequestDto
+  ]),
+  _ts_metadata5("design:returntype", Promise)
+], PafiDirectAuthController.prototype, "exchangeKakao", null);
+PafiDirectAuthController = _ts_decorate5([
   ApiTags("pafi-auth-v2"),
-  Controller("auth/v2")
+  Controller("auth/v2"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof PafiDirectAuthService === "undefined" ? Object : PafiDirectAuthService
+  ])
 ], PafiDirectAuthController);
 
 // src/direct-auth/pafi-direct-auth.module.ts
-var PafiDirectAuthModule = class {
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+var PafiDirectAuthModule = class _PafiDirectAuthModule {
+  static {
+    __name(this, "PafiDirectAuthModule");
+  }
   static forRoot(options) {
     return {
-      module: PafiDirectAuthModule,
+      module: _PafiDirectAuthModule,
       imports: options.imports ?? [],
-      controllers: [PafiDirectAuthController],
+      controllers: [
+        PafiDirectAuthController
+      ],
       providers: [
         {
           provide: PAFI_DIRECT_AUTH_MODULE_OPTIONS,
@@ -441,7 +613,7 @@ var PafiDirectAuthModule = class {
     };
   }
 };
-PafiDirectAuthModule = __decorateClass([
+PafiDirectAuthModule = _ts_decorate6([
   Module({})
 ], PafiDirectAuthModule);
 export {