@focura/auth-core 1.0.0

package/dist/index.js

@@ -0,0 +1,1362 @@
+import jwt from 'jsonwebtoken';
+import crypto3 from 'crypto';
+import { generateSecret, generateURI, verify } from 'otplib';
+import { z } from 'zod';
+
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/config.ts
+function resolveConfig(raw) {
+  return {
+    ...raw,
+    keyPrefix: raw.keyPrefix ?? DEFAULTS.keyPrefix,
+    issuer: raw.jwt.issuer ?? DEFAULTS.issuer,
+    audience: raw.jwt.audience ?? DEFAULTS.audience,
+    accessTokenExpiry: raw.jwt.accessTokenExpiry ?? DEFAULTS.accessTokenExpiry,
+    refreshTokenExpiry: raw.jwt.refreshTokenExpiry ?? DEFAULTS.refreshTokenExpiry,
+    sseTokenExpiry: raw.jwt.sseTokenExpiry ?? DEFAULTS.sseTokenExpiry,
+    currentVersion: raw.jwt.currentVersion ?? DEFAULTS.currentVersion,
+    maxConcurrentSessions: raw.session?.maxConcurrent ?? DEFAULTS.maxConcurrentSessions,
+    sessionMetadataTtl: raw.session?.metadataTtl ?? DEFAULTS.sessionMetadataTtl,
+    lockoutMaxFailures: raw.lockout?.maxFailures ?? DEFAULTS.lockoutMaxFailures,
+    lockoutSeconds: raw.lockout?.lockoutSeconds ?? DEFAULTS.lockoutSeconds,
+    lockoutWindowSeconds: raw.lockout?.windowSeconds ?? DEFAULTS.lockoutWindowSeconds,
+    inactivityTimeout: raw.session?.inactivityTimeout ?? 7 * 24 * 60 * 60,
+    absoluteTimeout: raw.session?.absoluteTimeout ?? 7 * 24 * 60 * 60
+  };
+}
+var DEFAULTS, AUDIT_SEVERITY;
+var init_config = __esm({
+  "src/config.ts"() {
+    DEFAULTS = {
+      keyPrefix: "focura:",
+      issuer: "focura-app",
+      audience: "focura-backend",
+      accessTokenExpiry: "15m",
+      refreshTokenExpiry: "7d",
+      sseTokenExpiry: "30s",
+      currentVersion: 1,
+      maxConcurrentSessions: 5,
+      sessionMetadataTtl: 7 * 24 * 60 * 60,
+      lockoutMaxFailures: 10,
+      lockoutSeconds: 15 * 60,
+      lockoutWindowSeconds: 60 * 60,
+      refreshLockTtlSeconds: 45,
+      refreshDedupeTtlSeconds: 30,
+      revokedSessionTtl: 7 * 24 * 60 * 60,
+      inactivityTimeout: 7 * 24 * 60 * 60,
+      absoluteTimeout: 7 * 24 * 60 * 60
+    };
+    AUDIT_SEVERITY = {
+      LOGIN_SUCCESS: "info",
+      LOGIN_FAILED: "warn",
+      LOGIN_BLOCKED: "warn",
+      LOGOUT: "info",
+      LOGOUT_ALL_DEVICES: "info",
+      TOKEN_REFRESHED: "info",
+      TOKEN_REVOKED: "info",
+      TOKEN_EXPIRED: "info",
+      TOKEN_VERSION_MISMATCH: "warn",
+      TOKEN_REPLAY_DETECTED: "critical",
+      EXCHANGE_SUCCESS: "info",
+      EXCHANGE_FAILED: "warn",
+      SSE_CONNECTED: "info",
+      SSE_DISCONNECTED: "info",
+      ACCOUNT_LOCKED: "critical",
+      TOTP_VERIFIED: "info",
+      TOTP_FAILED: "warn",
+      PERMISSION_DENIED: "warn",
+      EMAIL_NOT_VERIFIED: "warn",
+      SESSION_HIJACK_DETECTED: "critical",
+      SESSION_BOUND: "info",
+      SESSION_REBOUND: "info",
+      SESSION_TIMEOUT: "info",
+      MAX_SESSIONS_REACHED: "warn",
+      SESSION_REVOKED: "info",
+      SESSIONS_REVOKED: "info",
+      DEVICE_MISMATCH: "warn",
+      SUSPICIOUS_IP_CHANGE: "warn",
+      CSRF_VALIDATION_FAILED: "warn",
+      UNAUTHORIZED_ACCESS: "warn",
+      RATE_LIMIT_EXCEEDED: "warn",
+      MALWARE_DETECTED: "critical",
+      SUSPICIOUS_ACTIVITY: "warn",
+      DATA_EXPORT: "info",
+      DATA_DELETION: "critical",
+      SENSITIVE_DATA_ACCESS: "warn",
+      WORKSPACE_CREATED: "info",
+      WORKSPACE_DELETED: "critical",
+      MEMBER_ADDED: "info",
+      MEMBER_REMOVED: "info",
+      ROLE_CHANGED: "info",
+      SUBSCRIPTION_CREATED: "info",
+      SUBSCRIPTION_CANCELLED: "info",
+      PAYMENT_FAILED: "warn"
+    };
+  }
+});
+
+// src/middleware/sessionTimeout.ts
+var sessionTimeout_exports = {};
+__export(sessionTimeout_exports, {
+  SessionTimeoutManager: () => SessionTimeoutManager
+});
+var SessionTimeoutManager;
+var init_sessionTimeout = __esm({
+  "src/middleware/sessionTimeout.ts"() {
+    init_config();
+    SessionTimeoutManager = class {
+      constructor(redis, config) {
+        this.redis = redis;
+        this.inactivityTimeout = config?.inactivityTimeout ?? DEFAULTS.inactivityTimeout;
+        this.absoluteTimeout = config?.absoluteTimeout ?? DEFAULTS.absoluteTimeout;
+        this.prefix = config?.prefix ?? DEFAULTS.keyPrefix;
+      }
+      redis;
+      inactivityTimeout;
+      absoluteTimeout;
+      prefix;
+      createdKey(sessionId) {
+        return `${this.prefix}session:created:${sessionId}`;
+      }
+      activityKey(sessionId) {
+        return `${this.prefix}session:activity:${sessionId}`;
+      }
+      async recordCreation(sessionId) {
+        const now = Date.now();
+        await this.redis.setex(this.createdKey(sessionId), this.absoluteTimeout, now.toString());
+        await this.redis.setex(this.activityKey(sessionId), this.inactivityTimeout, now.toString());
+      }
+      async invalidate(sessionId) {
+        await this.redis.del(this.createdKey(sessionId), this.activityKey(sessionId));
+      }
+      async isTracked(sessionId) {
+        return await this.redis.exists(this.createdKey(sessionId)) === 1;
+      }
+      async isInactive(sessionId) {
+        const exists = await this.redis.exists(this.activityKey(sessionId));
+        return exists !== 1;
+      }
+      async updateActivity(sessionId) {
+        try {
+          const result = await this.redis.setex(this.activityKey(sessionId), this.inactivityTimeout, Date.now().toString());
+          return result === "OK";
+        } catch {
+          return false;
+        }
+      }
+    };
+  }
+});
+
+// src/tokens/backendToken.ts
+init_config();
+var TokenManager = class _TokenManager {
+  privateKey;
+  publicKey;
+  issuer;
+  audience;
+  accessTokenExpiry;
+  refreshTokenExpiry;
+  sseTokenExpiry;
+  currentVersion;
+  constructor(config) {
+    this.privateKey = config.privateKey;
+    this.publicKey = config.publicKey;
+    this.issuer = config.issuer ?? DEFAULTS.issuer;
+    this.audience = config.audience ?? DEFAULTS.audience;
+    this.accessTokenExpiry = config.accessTokenExpiry ?? DEFAULTS.accessTokenExpiry;
+    this.refreshTokenExpiry = config.refreshTokenExpiry ?? DEFAULTS.refreshTokenExpiry;
+    this.sseTokenExpiry = config.sseTokenExpiry ?? DEFAULTS.sseTokenExpiry;
+    this.currentVersion = config.currentVersion ?? DEFAULTS.currentVersion;
+  }
+  createAccessToken(p) {
+    return jwt.sign(
+      {
+        sub: p.id,
+        email: p.email,
+        role: p.role,
+        type: "access",
+        version: this.currentVersion,
+        jti: crypto3.randomUUID(),
+        sessionId: p.sessionId
+      },
+      this.privateKey,
+      {
+        algorithm: "RS256",
+        expiresIn: this.accessTokenExpiry,
+        issuer: this.issuer,
+        audience: this.audience
+      }
+    );
+  }
+  createRefreshToken(p) {
+    return jwt.sign(
+      {
+        sub: p.id,
+        email: p.email,
+        role: p.role,
+        type: "refresh",
+        version: this.currentVersion,
+        jti: crypto3.randomUUID(),
+        sessionId: p.sessionId
+      },
+      this.privateKey,
+      {
+        algorithm: "RS256",
+        expiresIn: this.refreshTokenExpiry,
+        issuer: this.issuer,
+        audience: this.audience
+      }
+    );
+  }
+  createTokenPair(p) {
+    const sessionId = p.sessionId || crypto3.randomUUID();
+    const payload = { ...p, sessionId };
+    return {
+      accessToken: this.createAccessToken(payload),
+      refreshToken: this.createRefreshToken(payload),
+      accessTokenExpiry: Date.now() + _TokenManager.parseExpiry(this.accessTokenExpiry),
+      refreshTokenExpiry: Date.now() + _TokenManager.parseExpiry(this.refreshTokenExpiry)
+    };
+  }
+  createSseToken(userId) {
+    return jwt.sign(
+      {
+        sub: userId,
+        type: "sse",
+        version: this.currentVersion,
+        jti: crypto3.randomUUID()
+      },
+      this.privateKey,
+      {
+        algorithm: "RS256",
+        expiresIn: this.sseTokenExpiry,
+        issuer: this.issuer,
+        audience: this.audience
+      }
+    );
+  }
+  verifyToken(token, expectedType) {
+    const decoded = jwt.verify(token, this.publicKey, {
+      algorithms: ["RS256"],
+      issuer: this.issuer,
+      audience: this.audience
+    });
+    if (decoded.version !== this.currentVersion) throw new Error("Token version mismatch");
+    if (expectedType && decoded.type !== expectedType) throw new Error(`Expected '${expectedType}', got '${decoded.type}'`);
+    return {
+      id: decoded.sub ?? "",
+      email: decoded.email,
+      role: decoded.role,
+      type: decoded.type,
+      version: decoded.version,
+      jti: decoded.jti ?? "",
+      sessionId: decoded.sessionId
+    };
+  }
+  getPublicKey() {
+    return this.publicKey;
+  }
+  getAccessTokenExpiry() {
+    return this.accessTokenExpiry;
+  }
+  getRefreshTokenExpiry() {
+    return this.refreshTokenExpiry;
+  }
+  getSseTokenExpiry() {
+    return this.sseTokenExpiry;
+  }
+  getCurrentVersion() {
+    return this.currentVersion;
+  }
+  getIssuer() {
+    return this.issuer;
+  }
+  getAudience() {
+    return this.audience;
+  }
+  static parseExpiry(expiry) {
+    const match = expiry.match(/^(\d+)([smhd])$/);
+    if (!match) throw new Error(`Invalid expiry: ${expiry}`);
+    const unit = match[2];
+    const multipliers = { s: 1e3, m: 6e4, h: 36e5, d: 864e5 };
+    return parseInt(match[1], 10) * multipliers[unit];
+  }
+  static extractJti(token) {
+    try {
+      const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf-8"));
+      return payload.jti ?? "";
+    } catch {
+      return "";
+    }
+  }
+};
+
+// src/revocation/tokenRevocation.ts
+init_config();
+var TokenRevocation = class {
+  constructor(redis, prefix = DEFAULTS.keyPrefix) {
+    this.redis = redis;
+    this.prefix = prefix;
+  }
+  redis;
+  prefix;
+  refreshIndexKey(userId) {
+    return `${this.prefix}refresh:index:${userId}`;
+  }
+  refreshTokenKey(userId, jti) {
+    return `${this.prefix}refresh:${userId}:${jti}`;
+  }
+  revokedAccessKey(jti) {
+    return `${this.prefix}revoked:access:${jti}`;
+  }
+  sseKey(jti) {
+    return `${this.prefix}sse:${jti}`;
+  }
+  sessionRevokedKey(sessionId) {
+    return `${this.prefix}session:revoked:${sessionId}`;
+  }
+  async revokeAccessToken(jti, expiresInSeconds) {
+    try {
+      await this.redis.setex(this.revokedAccessKey(jti), expiresInSeconds, "1");
+    } catch (err) {
+      console.error("[TokenRevocation] Failed to revoke access token:", err);
+    }
+  }
+  async isAccessTokenRevoked(jti) {
+    try {
+      const val = await this.redis.get(this.revokedAccessKey(jti));
+      return val === "1";
+    } catch (err) {
+      console.error("[TokenRevocation] Failed to check revoked access token:", err);
+      return false;
+    }
+  }
+  async storeRefreshToken(userId, jti, expiresInSeconds) {
+    try {
+      const tokenKey = this.refreshTokenKey(userId, jti);
+      await this.redis.setex(tokenKey, expiresInSeconds, JSON.stringify({ jti, createdAt: Date.now() }));
+      await this.redis.sadd(this.refreshIndexKey(userId), tokenKey);
+    } catch (err) {
+      console.error("[TokenRevocation] Failed to store refresh token:", err);
+    }
+  }
+  async isRefreshTokenValid(userId, jti) {
+    try {
+      const val = await this.redis.get(this.refreshTokenKey(userId, jti));
+      return val !== null;
+    } catch (err) {
+      console.error("[TokenRevocation] Failed to check refresh token validity:", err);
+      return false;
+    }
+  }
+  async revokeRefreshToken(userId, jti) {
+    try {
+      const tokenKey = this.refreshTokenKey(userId, jti);
+      await this.redis.del(tokenKey);
+      await this.redis.srem(this.refreshIndexKey(userId), tokenKey);
+    } catch (err) {
+      console.error("[TokenRevocation] Failed to revoke refresh token:", err);
+    }
+  }
+  async revokeAllRefreshTokens(userId) {
+    try {
+      const idxKey = this.refreshIndexKey(userId);
+      let keys = await this.redis.smembers(idxKey);
+      if (keys.length === 0) {
+        let cursor = "0";
+        const pattern = `${this.prefix}refresh:${userId}:*`;
+        do {
+          const [nextCursor, found] = await this.redis.scan(cursor, "MATCH", pattern, "COUNT", "100");
+          cursor = nextCursor;
+          keys.push(...found);
+        } while (cursor !== "0");
+      }
+      if (keys.length > 0) await this.redis.del(...keys);
+      await this.redis.del(idxKey);
+    } catch (err) {
+      console.error("[TokenRevocation] Failed to revoke all refresh tokens:", err);
+    }
+  }
+  async rotateRefreshToken(userId, oldJti, newJti, expiresInSeconds) {
+    const oldKey = this.refreshTokenKey(userId, oldJti);
+    const newKey = this.refreshTokenKey(userId, newJti);
+    const indexKey = this.refreshIndexKey(userId);
+    try {
+      const result = await this.redis.eval(
+        `if redis.call("EXISTS", KEYS[1]) == 1 then
+          redis.call("DEL", KEYS[1])
+          redis.call("SETEX", KEYS[2], ARGV[1], ARGV[2])
+          redis.call("SREM", KEYS[3], KEYS[1])
+          redis.call("SADD", KEYS[3], KEYS[2])
+          return 1
+        else
+          return 0
+        end`,
+        3,
+        oldKey,
+        newKey,
+        indexKey,
+        expiresInSeconds.toString(),
+        JSON.stringify({ jti: newJti, createdAt: Date.now() })
+      );
+      return result === 1;
+    } catch (error) {
+      const err = error;
+      if (err?.name === "MaxRetriesPerRequestError") {
+        throw new Error("Redis service temporarily unavailable");
+      }
+      throw error;
+    }
+  }
+  async storeSseToken(jti, userId, ttlSeconds) {
+    try {
+      await this.redis.setex(this.sseKey(jti), ttlSeconds, userId);
+    } catch (error) {
+      const err = error;
+      if (err?.name === "MaxRetriesPerRequestError") {
+        throw new Error("Redis service temporarily unavailable");
+      }
+      throw error;
+    }
+  }
+  async consumeSseToken(jti) {
+    const key = this.sseKey(jti);
+    try {
+      const userId = await this.redis.eval(
+        `local v = redis.call("GET", KEYS[1])
+         if v then redis.call("DEL", KEYS[1]) end
+         return v`,
+        1,
+        key
+      );
+      return typeof userId === "string" ? userId : null;
+    } catch (error) {
+      const err = error;
+      if (err?.name === "MaxRetriesPerRequestError") {
+        throw new Error("Redis service temporarily unavailable");
+      }
+      throw error;
+    }
+  }
+  async markSessionRevoked(sessionId) {
+    try {
+      await this.redis.setex(this.sessionRevokedKey(sessionId), DEFAULTS.revokedSessionTtl, "1");
+    } catch (err) {
+      console.error("[TokenRevocation] Failed to mark session revoked:", err);
+    }
+  }
+  async isSessionRevoked(sessionId) {
+    try {
+      const val = await this.redis.get(this.sessionRevokedKey(sessionId));
+      return val === "1";
+    } catch (err) {
+      console.error("[TokenRevocation] Failed to check revoked session:", err);
+      return false;
+    }
+  }
+};
+
+// src/refresh/refreshLock.ts
+init_config();
+var RefreshLock = class {
+  constructor(redis, prefix = DEFAULTS.keyPrefix) {
+    this.redis = redis;
+    this.prefix = prefix;
+  }
+  redis;
+  prefix;
+  lockKey(sessionId) {
+    return `${this.prefix}refresh:lock:${sessionId}`;
+  }
+  async acquire(sessionId) {
+    try {
+      const result = await this.redis.setnx(
+        this.lockKey(sessionId),
+        "1"
+      );
+      return result === 1;
+    } catch (err) {
+      console.error("[RefreshLock] Failed to acquire lock:", err);
+      return false;
+    }
+  }
+  async release(sessionId) {
+    try {
+      await this.redis.del(this.lockKey(sessionId));
+    } catch (err) {
+      console.error("[RefreshLock] Failed to release lock:", err);
+    }
+  }
+  async isLocked(sessionId) {
+    try {
+      const val = await this.redis.get(this.lockKey(sessionId));
+      return !!val;
+    } catch (err) {
+      console.error("[RefreshLock] Failed to check lock status:", err);
+      return false;
+    }
+  }
+};
+
+// src/session/sessionManager.ts
+init_config();
+var SessionManager = class {
+  constructor(redis, tokenRevocation, auditLogger, prefix = DEFAULTS.keyPrefix, maxConcurrent) {
+    this.redis = redis;
+    this.tokenRevocation = tokenRevocation;
+    this.auditLogger = auditLogger;
+    this.prefix = prefix;
+    this.maxConcurrent = maxConcurrent ?? DEFAULTS.maxConcurrentSessions;
+  }
+  redis;
+  tokenRevocation;
+  auditLogger;
+  maxConcurrent;
+  prefix;
+  sessionKey(userId) {
+    return `${this.prefix}user:sessions:${userId}`;
+  }
+  metadataKey(sessionId) {
+    return `${this.prefix}session:metadata:${sessionId}`;
+  }
+  async trackUserSession(userId, sessionId) {
+    try {
+      const key = this.sessionKey(userId);
+      const members = await this.redis.smembers(key);
+      if (members.length >= this.maxConcurrent) {
+        this.auditLogger?.log("MAX_SESSIONS_REACHED", {
+          userId,
+          sessionCount: members.length,
+          limit: this.maxConcurrent
+        });
+        const evictedSession = await this.pickLeastActiveSession(members);
+        await this.redis.srem(key, evictedSession);
+        await this.redis.del(this.metadataKey(evictedSession));
+        await this.tokenRevocation.markSessionRevoked(evictedSession);
+      }
+      await this.redis.sadd(key, sessionId);
+      await this.redis.expire(key, DEFAULTS.sessionMetadataTtl);
+    } catch (err) {
+      console.error(`[SessionManager] Failed to track session for user ${userId}:`, err);
+    }
+  }
+  async pickLeastActiveSession(members) {
+    let leastActive = members[0];
+    let leastActiveAt = Infinity;
+    for (const member of members) {
+      let lastActivity = 0;
+      try {
+        const meta = await this.redis.get(this.metadataKey(member));
+        if (meta) lastActivity = JSON.parse(meta).lastActivity ?? 0;
+      } catch {
+        lastActivity = 0;
+      }
+      if (lastActivity < leastActiveAt) {
+        leastActiveAt = lastActivity;
+        leastActive = member;
+      }
+    }
+    return leastActive;
+  }
+  async revokeUserSession(userId, sessionId) {
+    try {
+      await this.redis.srem(this.sessionKey(userId), sessionId);
+      await this.redis.del(this.metadataKey(sessionId));
+    } catch (err) {
+      console.error(`[SessionManager] Failed to revoke session for user ${userId}:`, err);
+    }
+  }
+  async getUserActiveSessions(userId) {
+    try {
+      const sessionIds = await this.redis.smembers(this.sessionKey(userId));
+      const sessions = [];
+      for (const sessionId of sessionIds) {
+        const metadata = await this.redis.get(this.metadataKey(sessionId));
+        if (metadata) {
+          try {
+            const parsed = JSON.parse(metadata);
+            sessions.push({
+              sessionId,
+              deviceInfo: parsed.userAgent ?? "",
+              ipAddress: parsed.ipAddress,
+              lastActivity: new Date(parsed.lastActivity).toISOString(),
+              createdAt: new Date(parsed.createdAt ?? parsed.lastActivity).toISOString()
+            });
+          } catch {
+            console.warn(`[SessionManager] Corrupted metadata for session ${sessionId}, skipping`);
+          }
+        }
+      }
+      return sessions;
+    } catch (err) {
+      console.error(`[SessionManager] Failed to get sessions for user ${userId}:`, err);
+      return [];
+    }
+  }
+};
+var SERVER_TO_SERVER_UA = /^(node|undici|axios|curl|go-http-client|python-requests|java\/|okhttp|superagent)/i;
+function looksLikeServerToServerUA(userAgent) {
+  return !userAgent || SERVER_TO_SERVER_UA.test(userAgent);
+}
+function looksLikeServerToServerRequest(req) {
+  const ua = req.headers["user-agent"] ?? "";
+  if (looksLikeServerToServerUA(ua)) return true;
+  return !req.headers["accept-language"] && !req.headers["accept-encoding"];
+}
+function normalizeUserAgent(userAgent) {
+  const ua = userAgent || "";
+  const mobile = /Mobile|Android|iPhone|iPad|iPod/i.test(ua);
+  const browser = /Edg\//i.test(ua) ? "Edge" : /OPR\/|Opera/i.test(ua) ? "Opera" : /Firefox\/|FxiOS/i.test(ua) ? "Firefox" : /CriOS\/|Chrome\//i.test(ua) ? "Chrome" : /Safari\//i.test(ua) ? "Safari" : "Other";
+  const os = /Android/i.test(ua) ? "Android" : /iPhone|iPad|iPod/i.test(ua) ? "iOS" : /Windows/i.test(ua) ? "Windows" : /Macintosh|Mac OS X/i.test(ua) ? "macOS" : /Linux/i.test(ua) ? "Linux" : "Other";
+  return `${browser}|${os}|${mobile ? "mobile" : "desktop"}`;
+}
+function primaryLanguage(acceptLanguage) {
+  const first = (acceptLanguage || "").split(",")[0]?.trim() ?? "";
+  return first ? first.split("-")[0].toLowerCase() : "";
+}
+function generateDeviceFingerprint(req) {
+  const components = [
+    normalizeUserAgent(req.headers["user-agent"] || ""),
+    primaryLanguage(req.headers["accept-language"] || "")
+  ].join("|");
+  return crypto3.createHash("sha256").update(components).digest("hex").substring(0, 32);
+}
+function getClientIp(req) {
+  if (typeof req.ip === "string" && req.ip.length > 0) {
+    return req.ip.startsWith("::ffff:") ? req.ip.slice(7) : req.ip;
+  }
+  const forwarded = req.headers["x-forwarded-for"];
+  if (typeof forwarded === "string") return forwarded.split(",")[0].trim();
+  const ip = req.socket?.remoteAddress || "unknown";
+  return ip.startsWith("::ffff:") ? ip.slice(7) : ip;
+}
+function createSessionMetadata(req) {
+  return {
+    deviceId: null,
+    ipAddress: getClientIp(req),
+    userAgent: req.headers["user-agent"] || "unknown",
+    lastActivity: Date.now()
+  };
+}
+function isPrivateIp(ip) {
+  if (!ip || ip === "unknown") return true;
+  const normalized = ip.startsWith("::ffff:") ? ip.slice(7) : ip;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(normalized)) {
+    const [a, b] = normalized.split(".").map(Number);
+    return a === 0 || a === 10 || a === 127 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
+  }
+  return normalized === "::1" || /^fe80:/i.test(normalized) || /^fc/i.test(normalized) || /^fd/i.test(normalized);
+}
+function validateSessionBinding(req, storedMetadata) {
+  const currentDeviceId = generateDeviceFingerprint(req);
+  const currentIp = getClientIp(req);
+  if (currentDeviceId !== storedMetadata.deviceId) {
+    return { valid: false, reason: "DEVICE_MISMATCH" };
+  }
+  if (currentIp !== storedMetadata.ipAddress) {
+    if (isPrivateIp(currentIp) || isPrivateIp(storedMetadata.ipAddress)) {
+      return { valid: true };
+    }
+    const timeSinceLastActivity = Date.now() - storedMetadata.lastActivity;
+    const maxIpChangeInterval = 5 * 60 * 1e3;
+    if (timeSinceLastActivity < maxIpChangeInterval) {
+      return { valid: false, reason: "SUSPICIOUS_IP_CHANGE" };
+    }
+  }
+  return { valid: true };
+}
+
+// src/lockout/accountLockout.ts
+init_config();
+var AccountLockout = class {
+  constructor(redis, config) {
+    this.redis = redis;
+    this.maxFailures = config?.maxFailures ?? DEFAULTS.lockoutMaxFailures;
+    this.lockoutSeconds = config?.lockoutSeconds ?? DEFAULTS.lockoutSeconds;
+    this.windowSeconds = config?.windowSeconds ?? DEFAULTS.lockoutWindowSeconds;
+    this.prefix = config?.prefix ?? `${DEFAULTS.keyPrefix}lockout`;
+  }
+  redis;
+  maxFailures;
+  lockoutSeconds;
+  windowSeconds;
+  prefix;
+  async recordFailedAttempt(identifier) {
+    try {
+      const failKey = `${this.prefix}:failures:${identifier}`;
+      const lockKey = `${this.prefix}:locked:${identifier}`;
+      const existingLock = await this.redis.get(lockKey);
+      if (existingLock) {
+        return { locked: true, unlocksAt: new Date(Number(existingLock)), attempts: this.maxFailures };
+      }
+      const pipe = this.redis.pipeline();
+      pipe.incr(failKey);
+      pipe.expire(failKey, this.windowSeconds);
+      const results = await pipe.exec();
+      const attempts = results?.[0]?.[1] ?? 1;
+      if (attempts >= this.maxFailures) {
+        const unlocksAt = Date.now() + this.lockoutSeconds * 1e3;
+        await this.redis.setex(lockKey, this.lockoutSeconds, String(unlocksAt));
+        return { locked: true, unlocksAt: new Date(unlocksAt), attempts };
+      }
+      return { locked: false, attempts };
+    } catch (err) {
+      console.error("[AccountLockout] Failed to record failed attempt:", err);
+      return { locked: false, attempts: 0 };
+    }
+  }
+  async clearFailedAttempts(identifier) {
+    try {
+      await this.redis.del(`${this.prefix}:failures:${identifier}`, `${this.prefix}:locked:${identifier}`);
+    } catch (err) {
+      console.error("[AccountLockout] Failed to clear failed attempts:", err);
+    }
+  }
+  async isAccountLocked(identifier) {
+    try {
+      const lockedUntil = await this.redis.get(`${this.prefix}:locked:${identifier}`);
+      if (!lockedUntil) return { locked: false };
+      return { locked: true, unlocksAt: new Date(Number(lockedUntil)) };
+    } catch (err) {
+      console.error("[AccountLockout] Failed to check account lock status:", err);
+      return { locked: false };
+    }
+  }
+};
+
+// src/audit/auditLog.ts
+init_config();
+var AuditLog = class {
+  constructor(logger) {
+    this.logger = logger;
+  }
+  logger;
+  log(event, data) {
+    const severity = AUDIT_SEVERITY[event] ?? "info";
+    const entry = { event, severity, timestamp: (/* @__PURE__ */ new Date()).toISOString(), ...data };
+    const output = JSON.stringify(entry);
+    if (severity === "critical") {
+      console.error(`[AUDIT:CRITICAL] ${output}`);
+    } else if (severity === "warn") {
+      console.warn(`[AUDIT:WARN] ${output}`);
+    } else {
+      console.info(`[AUDIT:INFO] ${output}`);
+    }
+    if (this.logger) {
+      void this.logger.log(event, data).catch((err) => {
+        if (process.env.NODE_ENV !== "test") {
+          console.error("[AuditLog] Failed to persist audit event:", err?.message ?? err);
+        }
+      });
+    }
+  }
+};
+var TotpManager = class {
+  issuer;
+  constructor(issuer = "Auth") {
+    this.issuer = issuer;
+  }
+  generateSecret() {
+    return generateSecret();
+  }
+  createUri(secret, email) {
+    return generateURI({ issuer: this.issuer, label: email, secret });
+  }
+  async verify(token, secret) {
+    try {
+      const result = verify({ token, secret });
+      const normalized = result;
+      if (typeof normalized === "boolean") return normalized;
+      return normalized.valid === true;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// src/index.ts
+init_sessionTimeout();
+
+// src/middleware/middlewareFactory.ts
+init_config();
+
+// src/errors/index.ts
+var UnauthorizedError = class extends Error {
+  code;
+  statusCode = 401;
+  constructor(message = "Unauthorized", code = "UNAUTHORIZED") {
+    super(message);
+    this.name = "UnauthorizedError";
+    this.code = code;
+  }
+};
+var TokenExpiredError = class extends Error {
+  code = "TOKEN_EXPIRED";
+  statusCode = 401;
+  constructor(message = "Token expired") {
+    super(message);
+    this.name = "TokenExpiredError";
+  }
+};
+var InvalidTokenError = class extends Error {
+  code;
+  statusCode = 401;
+  constructor(code = "INVALID_TOKEN") {
+    super("Invalid token");
+    this.name = "InvalidTokenError";
+    this.code = code;
+  }
+};
+var TokenRevokedError = class extends Error {
+  code = "TOKEN_REVOKED";
+  statusCode = 401;
+  constructor(message = "Token has been revoked") {
+    super(message);
+    this.name = "TokenRevokedError";
+  }
+};
+var EmailNotVerifiedError = class extends Error {
+  code = "EMAIL_NOT_VERIFIED";
+  statusCode = 403;
+  constructor(message = "Email not verified") {
+    super(message);
+    this.name = "EmailNotVerifiedError";
+  }
+};
+var AccountBannedError = class extends Error {
+  code = "ACCOUNT_BANNED";
+  statusCode = 403;
+  bannedAt;
+  constructor(reason, bannedAt) {
+    super(reason ?? "Account has been banned");
+    this.name = "AccountBannedError";
+    this.bannedAt = bannedAt ?? void 0;
+  }
+};
+var ForbiddenError = class extends Error {
+  code = "FORBIDDEN";
+  statusCode = 403;
+  constructor(message = "Forbidden") {
+    super(message);
+    this.name = "ForbiddenError";
+  }
+};
+var SessionHijackError = class extends Error {
+  code = "SESSION_HIJACK_DETECTED";
+  statusCode = 401;
+  constructor(reason) {
+    super(reason ?? "Session hijack detected");
+    this.name = "SessionHijackError";
+  }
+};
+var BadRequestError = class extends Error {
+  code;
+  statusCode = 400;
+  constructor(message = "Bad request", code = "BAD_REQUEST") {
+    super(message);
+    this.name = "BadRequestError";
+    this.code = code;
+  }
+};
+var ValidationError = class extends Error {
+  code;
+  statusCode = 400;
+  details;
+  constructor(message = "Validation failed", details, code = "VALIDATION_ERROR") {
+    super(message);
+    this.name = "ValidationError";
+    this.code = code;
+    this.details = details;
+  }
+};
+var defaultErrors = {
+  UnauthorizedError: (msg, code) => new UnauthorizedError(msg, code),
+  TokenExpiredError: () => new TokenExpiredError(),
+  InvalidTokenError: (code) => new InvalidTokenError(code),
+  TokenRevokedError: () => new TokenRevokedError(),
+  EmailNotVerifiedError: () => new EmailNotVerifiedError(),
+  AccountBannedError: (reason, at) => new AccountBannedError(reason, at),
+  ForbiddenError: (msg) => new ForbiddenError(msg),
+  SessionHijackError: (reason) => new SessionHijackError(reason),
+  BadRequestError: (msg, code) => new BadRequestError(msg, code),
+  ValidationError: (msg, details, code) => new ValidationError(msg, details, code)
+};
+
+// src/middleware/middlewareFactory.ts
+var MiddlewareFactory = class {
+  config;
+  tokenManager;
+  tokenRevocation;
+  errors;
+  audit;
+  observability;
+  cache;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  sessionTimeoutManager = null;
+  constructor(rawConfig) {
+    this.config = resolveConfig(rawConfig);
+    this.tokenManager = new TokenManager(rawConfig.jwt);
+    this.tokenRevocation = new TokenRevocation(rawConfig.redis, this.config.keyPrefix);
+    this.errors = rawConfig.errors ?? defaultErrors;
+    this.audit = new AuditLog(rawConfig.auditLogger);
+    this.observability = rawConfig.observability;
+    this.cache = rawConfig.cache;
+  }
+  getTokenManager() {
+    return this.tokenManager;
+  }
+  getTokenRevocation() {
+    return this.tokenRevocation;
+  }
+  getAuditLog() {
+    return this.audit;
+  }
+  getRedis() {
+    return this.config.redis;
+  }
+  getConfig() {
+    return this.config;
+  }
+  async enforceSessionBinding(req, decoded) {
+    if (!decoded.sessionId) return null;
+    const redis = this.config.redis;
+    const metadataKey = `${this.config.keyPrefix}session:metadata:${decoded.sessionId}`;
+    const storedMetadata = await redis.get(metadataKey);
+    if (!storedMetadata) return null;
+    let metadata;
+    try {
+      metadata = JSON.parse(storedMetadata);
+    } catch {
+      return null;
+    }
+    if (looksLikeServerToServerRequest(req)) return null;
+    if (metadata.deviceId == null || looksLikeServerToServerUA(metadata.userAgent)) {
+      metadata.deviceId = generateDeviceFingerprint(req);
+      metadata.ipAddress = getClientIp(req);
+      metadata.userAgent = req.headers["user-agent"] || "unknown";
+      metadata.lastActivity = Date.now();
+      this.audit.log("SESSION_BOUND", {
+        userId: decoded.sub,
+        sessionId: decoded.sessionId,
+        ip: metadata.ipAddress,
+        userAgent: metadata.userAgent
+      });
+    } else {
+      const bindingValidation = validateSessionBinding(req, metadata);
+      const currentIp = getClientIp(req);
+      if (!bindingValidation.valid) {
+        const isSameIpDeviceChange = bindingValidation.reason === "DEVICE_MISMATCH" && (currentIp === metadata.ipAddress || isPrivateIp(currentIp) || isPrivateIp(metadata.ipAddress));
+        if (isSameIpDeviceChange) {
+          metadata.deviceId = generateDeviceFingerprint(req);
+          metadata.userAgent = req.headers["user-agent"] || "unknown";
+          this.audit.log("SESSION_REBOUND", {
+            userId: decoded.sub,
+            sessionId: decoded.sessionId,
+            ip: currentIp,
+            userAgent: metadata.userAgent
+          });
+        } else {
+          await this.tokenRevocation.revokeAllRefreshTokens(decoded.sub);
+          if (decoded.jti && this.cache) {
+            await this.cache.delete(`auth:result:${decoded.jti}`);
+          }
+          this.audit.log("SESSION_HIJACK_DETECTED", {
+            userId: decoded.sub,
+            sessionId: decoded.sessionId,
+            reason: bindingValidation.reason,
+            ip: currentIp,
+            userAgent: req.headers["user-agent"]
+          });
+          return this.errors.SessionHijackError(bindingValidation.reason);
+        }
+      }
+    }
+    metadata.lastActivity = Date.now();
+    await redis.setex(metadataKey, this.config.sessionMetadataTtl, JSON.stringify(metadata));
+    return null;
+  }
+  createAuthenticateMiddleware() {
+    const self = this;
+    return async function authenticate(req, res, next) {
+      try {
+        const authHeader = req.headers.authorization;
+        if (typeof authHeader !== "string" || !authHeader.startsWith("Bearer ")) {
+          return next(self.errors.UnauthorizedError("Authentication required", "NO_TOKEN"));
+        }
+        const token = authHeader.slice(7).trim();
+        if (!token) {
+          return next(self.errors.UnauthorizedError("Authentication required", "NO_TOKEN"));
+        }
+        let decoded;
+        try {
+          decoded = self.tokenManager.verifyToken(token);
+        } catch (err) {
+          if (err.name === "TokenExpiredError") {
+            return next(self.errors.TokenExpiredError());
+          }
+          return next(self.errors.InvalidTokenError());
+        }
+        if (decoded.jti && self.cache) {
+          const cacheKey = `auth:result:${decoded.jti}`;
+          const cachedResult = await self.cache.get(cacheKey);
+          if (cachedResult) {
+            if (!cachedResult.valid) return next(self.errors.InvalidTokenError("INVALID_TOKEN_CACHED"));
+            const bindingError2 = await self.enforceSessionBinding(req, decoded);
+            if (bindingError2) return next(bindingError2);
+            const user2 = await self.loadUser(decoded.sub);
+            if (!user2) return next(self.errors.UnauthorizedError("User not found", "USER_NOT_FOUND"));
+            if (!user2.emailVerified) return next(self.errors.EmailNotVerifiedError());
+            if (user2.bannedAt) return next(self.errors.AccountBannedError(user2.banReason, user2.bannedAt));
+            self.assignUser(req, user2, decoded);
+            return next();
+          }
+        }
+        if (decoded.version !== self.config.currentVersion) {
+          return next(self.errors.InvalidTokenError("TOKEN_VERSION_MISMATCH"));
+        }
+        if (decoded.type !== "access") {
+          return next(self.errors.InvalidTokenError("INVALID_TOKEN_TYPE"));
+        }
+        const [isRevoked, sessionWasRevoked] = await Promise.all([
+          decoded.jti ? self.tokenRevocation.isAccessTokenRevoked(decoded.jti) : Promise.resolve(false),
+          decoded.sessionId ? self.tokenRevocation.isSessionRevoked(decoded.sessionId) : Promise.resolve(false)
+        ]);
+        if (isRevoked) return next(self.errors.TokenRevokedError());
+        if (sessionWasRevoked) return next(self.errors.TokenRevokedError());
+        const [bindingError, cachedUser] = await Promise.all([
+          self.enforceSessionBinding(req, decoded),
+          self.cache?.get(`auth:user:${decoded.sub}`)
+        ]);
+        if (bindingError) return next(bindingError);
+        const user = cachedUser ?? await self.loadUser(decoded.sub);
+        if (!user) return next(self.errors.UnauthorizedError("User not found", "USER_NOT_FOUND"));
+        if (!user.emailVerified) return next(self.errors.EmailNotVerifiedError());
+        if (user.bannedAt) return next(self.errors.AccountBannedError(user.banReason, user.bannedAt));
+        if (!cachedUser && user && self.cache) {
+          void self.cache.set(`auth:user:${decoded.sub}`, user, 30 * 60).catch(() => {
+          });
+        }
+        if (decoded.jti && self.cache) {
+          void self.cache.set(`auth:result:${decoded.jti}`, { userId: decoded.sub, valid: true }, 5 * 60).catch(() => {
+          });
+        }
+        self.assignUser(req, user, decoded);
+        self.observability?.setUserContext?.({ id: user.id, email: user.email });
+        self.observability?.addBreadcrumb?.({
+          message: "User authenticated successfully",
+          data: { userId: user.id, email: user.email, role: user.role }
+        });
+        next();
+      } catch (err) {
+        console.error("Unexpected authentication error:", err);
+        self.observability?.captureException?.(err, { context: "authentication" });
+        next(err);
+      }
+    };
+  }
+  createAuthorizeMiddleware(...roles) {
+    const self = this;
+    return function authorize(req, res, next) {
+      if (!req.user) {
+        return next(self.errors.UnauthorizedError("Authentication required", "NOT_AUTHENTICATED"));
+      }
+      if (!roles.includes(req.user.role)) {
+        return next(self.errors.ForbiddenError("Insufficient permissions"));
+      }
+      next();
+    };
+  }
+  createCsrfMiddleware() {
+    const self = this;
+    const CSRF_TOKEN_LENGTH = 32;
+    const CSRF_TOKEN_TTL = 3600;
+    return {
+      generateToken: async (userId, sessionId) => {
+        const token = crypto3.randomBytes(CSRF_TOKEN_LENGTH).toString("base64url");
+        const key = `${self.config.keyPrefix}csrf:${userId}:${sessionId}`;
+        await self.config.redis.setex(key, CSRF_TOKEN_TTL, token);
+        return token;
+      },
+      validateToken: async (userId, sessionId, token) => {
+        if (!token) return false;
+        const key = `${self.config.keyPrefix}csrf:${userId}:${sessionId}`;
+        const storedToken = await self.config.redis.get(key);
+        if (!storedToken) return false;
+        try {
+          return crypto3.timingSafeEqual(Buffer.from(token, "base64url"), Buffer.from(storedToken, "base64url"));
+        } catch {
+          return false;
+        }
+      },
+      middleware() {
+        return async (req, res, next) => {
+          if (["GET", "HEAD", "OPTIONS"].includes(req.method ?? "")) return next();
+          if (req.path?.startsWith("/webhooks/") || req.path?.includes("/callback")) return next();
+          const csrfToken = req.headers["x-csrf-token"];
+          if (!req.user?.id) {
+            return res.status(401).json({ success: false, message: "Authentication required", code: "NOT_AUTHENTICATED" });
+          }
+          const sessionId = req.user.sessionId || "default";
+          const stored = await self.config.redis.get(`${self.config.keyPrefix}csrf:${req.user.id}:${sessionId}`);
+          if (!stored || !csrfToken) return res.status(403).json({ success: false, message: "Invalid CSRF token", code: "CSRF_VALIDATION_FAILED" });
+          let isValid = false;
+          try {
+            isValid = crypto3.timingSafeEqual(Buffer.from(csrfToken, "base64url"), Buffer.from(stored, "base64url"));
+          } catch {
+            isValid = false;
+          }
+          if (!isValid) {
+            return res.status(403).json({ success: false, message: "Invalid CSRF token", code: "CSRF_VALIDATION_FAILED" });
+          }
+          next();
+        };
+      }
+    };
+  }
+  createRateLimitMiddleware() {
+    const self = this;
+    return (max, windowSeconds, keyFn, options) => {
+      return async (req, res, next) => {
+        const ip = getClientIp(req);
+        const userKey = keyFn?.(req);
+        const key = userKey ? `${self.config.keyPrefix}rl:user:${userKey}` : `${self.config.keyPrefix}rl:backend:${ip}`;
+        try {
+          const redis = self.config.redis;
+          const countKey = `${key}:count`;
+          const count = await redis.incr(countKey);
+          if (count === 1) await redis.expire(countKey, windowSeconds);
+          if (count > max) {
+            return res.status(429).json({ success: false, message: "Too many requests", code: "RATE_LIMIT_EXCEEDED", retryAfter: windowSeconds });
+          }
+          next();
+        } catch (error) {
+          if (options?.failOpen) return next();
+          return res.status(429).json({ success: false, message: "Rate limit service unavailable", code: "RATE_LIMIT_SERVICE_UNAVAILABLE", retryAfter: windowSeconds });
+        }
+      };
+    };
+  }
+  createSessionTimeoutMiddleware() {
+    const self = this;
+    return async (req, res, next) => {
+      const sessionId = req.user?.sessionId;
+      if (!sessionId) return next();
+      if (!self.sessionTimeoutManager) {
+        const { SessionTimeoutManager: SessionTimeoutManager2 } = await Promise.resolve().then(() => (init_sessionTimeout(), sessionTimeout_exports));
+        self.sessionTimeoutManager = new SessionTimeoutManager2(self.config.redis, {
+          inactivityTimeout: self.config.inactivityTimeout,
+          absoluteTimeout: self.config.absoluteTimeout,
+          prefix: self.config.keyPrefix
+        });
+      }
+      const tracked = await self.sessionTimeoutManager.isTracked(sessionId);
+      if (!tracked) return next();
+      const inactive = await self.sessionTimeoutManager.isInactive(sessionId);
+      if (inactive) {
+        return res.status(401).json({ success: false, code: "SESSION_TIMEOUT", message: "Session expired" });
+      }
+      await self.sessionTimeoutManager.updateActivity(sessionId);
+      next();
+    };
+  }
+  createExchangeHandler() {
+    const self = this;
+    return async (req, res) => {
+      const ip = getClientIp(req);
+      const { userId, email, role, sessionId, timestamp, signature } = req.body;
+      const age = Date.now() - Number(timestamp);
+      if (age > 6e4 || age < 0) {
+        self.audit.log("EXCHANGE_FAILED", { userId, email, ip, reason: "Proof expired" });
+        throw self.errors.UnauthorizedError("Exchange proof expired", "PROOF_EXPIRED");
+      }
+      const proofPayload = `${userId}${email}${role}${sessionId}${timestamp}`;
+      const expected = crypto3.createHmac("sha256", self.config.hmacSecret).update(proofPayload).digest("hex");
+      let valid = false;
+      try {
+        if (signature) {
+          valid = crypto3.timingSafeEqual(Buffer.from(signature, "hex"), Buffer.from(expected, "hex"));
+        }
+      } catch {
+        valid = false;
+      }
+      if (!valid) {
+        self.audit.log("EXCHANGE_FAILED", { userId, email, ip, reason: "Invalid signature" });
+        throw self.errors.UnauthorizedError("Invalid exchange proof", "INVALID_SIGNATURE");
+      }
+      const idempotencyKey = `exchange:idempotent:${userId}:${sessionId}:${timestamp}`;
+      const existing = await self.config.redis.get(idempotencyKey);
+      if (existing) {
+        return res.status(200).json(JSON.parse(existing));
+      }
+      const user = await self.config.userStore.findById(userId);
+      if (!user) {
+        self.audit.log("EXCHANGE_FAILED", { userId, email, ip, reason: "User not found" });
+        throw self.errors.UnauthorizedError("User not found", "USER_NOT_FOUND");
+      }
+      if (user.email.toLowerCase() !== email.toLowerCase()) {
+        self.audit.log("EXCHANGE_FAILED", { userId, email, ip, reason: "Email mismatch" });
+        throw self.errors.UnauthorizedError("Email mismatch", "EMAIL_MISMATCH");
+      }
+      if (!user.emailVerified) {
+        self.audit.log("EXCHANGE_FAILED", { userId, email, ip, reason: "Email not verified" });
+        throw self.errors.UnauthorizedError("Email not verified", "EMAIL_NOT_VERIFIED");
+      }
+      const sid = sessionId || crypto3.randomUUID();
+      const tokens = self.tokenManager.createTokenPair({
+        id: user.id,
+        email: user.email,
+        role: user.role,
+        sessionId: sid
+      });
+      const refreshTtlSeconds = self.tokenManager.getRefreshTokenExpiry() === "7d" ? 7 * 24 * 60 * 60 : TokenManager.parseExpiry(self.tokenManager.getRefreshTokenExpiry()) / 1e3;
+      await self.tokenRevocation.storeRefreshToken(user.id, TokenManager.extractJti(tokens.refreshToken), refreshTtlSeconds);
+      const sseToken = self.tokenManager.createSseToken(user.id);
+      const sseTtlSeconds = TokenManager.parseExpiry(self.tokenManager.getSseTokenExpiry()) / 1e3;
+      await self.tokenRevocation.storeSseToken(TokenManager.extractJti(sseToken), user.id, sseTtlSeconds);
+      await self.config.redis.setex(
+        `${self.config.keyPrefix}session:created:${sid}`,
+        self.config.absoluteTimeout,
+        Date.now().toString()
+      );
+      await self.config.redis.setex(
+        `${self.config.keyPrefix}session:activity:${sid}`,
+        self.config.inactivityTimeout,
+        Date.now().toString()
+      );
+      await self.config.redis.setex(idempotencyKey, 90, JSON.stringify(tokens));
+      self.audit.log("EXCHANGE_SUCCESS", { userId: user.id, email: user.email, ip });
+      return res.status(200).json(tokens);
+    };
+  }
+  createRefreshHandler() {
+    const self = this;
+    return async (req, res) => {
+      const { refreshToken } = req.body;
+      if (!refreshToken) throw self.errors.BadRequestError("Refresh token required");
+      let decoded;
+      try {
+        decoded = self.tokenManager.verifyToken(refreshToken, "refresh");
+      } catch {
+        throw self.errors.UnauthorizedError("Invalid refresh token", "INVALID_TOKEN");
+      }
+      const redis = self.config.redis;
+      const lockKey = `${self.config.keyPrefix}refresh:lock:${decoded.sessionId}`;
+      const lockResult = await redis.set(lockKey, "1", "EX", 45, "NX");
+      if (lockResult !== "OK") {
+        throw self.errors.BadRequestError("Refresh already in progress", "REFRESH_IN_PROGRESS");
+      }
+      try {
+        const dedupeKey = `${self.config.keyPrefix}refresh:dedupe:${decoded.id}:${decoded.jti}`;
+        const cached = await redis.get(dedupeKey);
+        if (cached) return res.status(200).json(JSON.parse(cached));
+        const sessionRevokedKey = `${self.config.keyPrefix}session:revoked:${decoded.sessionId}`;
+        if (await redis.get(sessionRevokedKey) === "1") {
+          throw self.errors.UnauthorizedError("Session revoked", "SESSION_REVOKED");
+        }
+        const createdKey = `${self.config.keyPrefix}session:created:${decoded.sessionId}`;
+        if (await redis.exists(createdKey) !== 1) {
+          throw self.errors.UnauthorizedError("Session expired", "SESSION_TIMEOUT");
+        }
+        const newTokens = self.tokenManager.createTokenPair({
+          id: decoded.id,
+          email: decoded.email,
+          role: decoded.role,
+          sessionId: decoded.sessionId
+        });
+        const refreshTtlSeconds = TokenManager.parseExpiry(self.tokenManager.getRefreshTokenExpiry()) / 1e3;
+        await self.tokenRevocation.rotateRefreshToken(
+          decoded.id,
+          decoded.jti,
+          TokenManager.extractJti(newTokens.refreshToken),
+          refreshTtlSeconds
+        );
+        const newSseToken = self.tokenManager.createSseToken(decoded.id);
+        const sseTtlSeconds = TokenManager.parseExpiry(self.tokenManager.getSseTokenExpiry()) / 1e3;
+        await self.tokenRevocation.storeSseToken(TokenManager.extractJti(newSseToken), decoded.id, sseTtlSeconds);
+        const response = { ...newTokens, sseToken: newSseToken };
+        await redis.setex(dedupeKey, 30, JSON.stringify(response));
+        self.audit.log("TOKEN_REFRESHED", { userId: decoded.id, sessionId: decoded.sessionId });
+        return res.status(200).json(response);
+      } finally {
+        await redis.del(lockKey);
+      }
+    };
+  }
+  createLogoutHandler() {
+    const self = this;
+    return async (req, res) => {
+      const { logoutAll } = req.body;
+      const userId = req.user?.id;
+      const sessionId = req.user?.sessionId;
+      if (req.user?.tokenJti) {
+        const token = req.headers.authorization?.slice(7);
+        if (token) {
+          const expiry = self.tokenManager.getAccessTokenExpiry();
+          const ttlSeconds = TokenManager.parseExpiry(expiry) / 1e3;
+          await self.tokenRevocation.revokeAccessToken(req.user.tokenJti, ttlSeconds);
+        }
+      }
+      if (logoutAll && userId) {
+        await self.tokenRevocation.revokeAllRefreshTokens(userId);
+        await self.config.redis.setex(
+          `${self.config.keyPrefix}session:revoked:${sessionId}`,
+          DEFAULTS.revokedSessionTtl,
+          "1"
+        );
+        self.audit.log("LOGOUT_ALL_DEVICES", { userId });
+      } else if (userId && sessionId) {
+        await self.config.redis.del(`${self.config.keyPrefix}session:metadata:${sessionId}`);
+        self.audit.log("LOGOUT", { userId, sessionId });
+      }
+      return res.status(200).json({ success: true, message: "Logged out" });
+    };
+  }
+  async loadUser(id) {
+    try {
+      return await this.config.userStore.findById(id);
+    } catch {
+      return null;
+    }
+  }
+  assignUser(req, user, decoded) {
+    req.user = {
+      id: user.id,
+      email: user.email,
+      name: user.name,
+      role: user.role,
+      tokenJti: decoded.jti,
+      sessionId: decoded.sessionId
+    };
+  }
+};
+var exchangeSchema = z.object({
+  userId: z.string().uuid(),
+  email: z.string().email(),
+  role: z.string(),
+  sessionId: z.string().uuid(),
+  timestamp: z.string().or(z.number()),
+  signature: z.string()
+});
+var refreshSchema = z.object({
+  refreshToken: z.string().min(1)
+});
+var logoutSchema = z.object({
+  logoutAll: z.boolean().optional()
+});
+
+// src/index.ts
+init_config();
+
+export { AUDIT_SEVERITY, AccountBannedError, AccountLockout, AuditLog, BadRequestError, DEFAULTS, EmailNotVerifiedError, ForbiddenError, InvalidTokenError, MiddlewareFactory, RefreshLock, SessionHijackError, SessionManager, SessionTimeoutManager, TokenExpiredError, TokenManager, TokenRevocation, TokenRevokedError, TotpManager, UnauthorizedError, ValidationError, createSessionMetadata, defaultErrors, exchangeSchema, generateDeviceFingerprint, getClientIp, isPrivateIp, logoutSchema, looksLikeServerToServerRequest, looksLikeServerToServerUA, normalizeUserAgent, refreshSchema, resolveConfig, validateSessionBinding };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map