@touchque/node 1.3.0

package/dist/index.js

@@ -0,0 +1,804 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  Auth: () => Auth,
+  Login: () => Login,
+  TouchQue: () => TouchQue,
+  TouchQueAPIError: () => TouchQueAPIError,
+  TouchQueConfigError: () => TouchQueConfigError,
+  TouchQueError: () => TouchQueError,
+  TouchQueRejectedError: () => TouchQueRejectedError,
+  TouchQueTimeoutError: () => TouchQueTimeoutError,
+  TouchQueWebhookSignatureError: () => TouchQueWebhookSignatureError,
+  WebAuthn: () => WebAuthn,
+  Webhook: () => Webhook,
+  requireTouchQue: () => requireTouchQue
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/core/HttpClient.ts
+var import_axios = __toESM(require("axios"));
+var crypto = __toESM(require("crypto"));
+
+// src/errors.ts
+var TouchQueError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TouchQueError";
+  }
+};
+var TouchQueAPIError = class extends TouchQueError {
+  status;
+  code;
+  data;
+  constructor(status, data) {
+    const message = data.message || data.error || `TouchQue API Error: HTTP ${status}`;
+    super(message);
+    this.name = "TouchQueAPIError";
+    this.status = status;
+    this.code = data.code;
+    this.data = data;
+  }
+};
+var TouchQueTimeoutError = class extends TouchQueError {
+  requestId;
+  constructor(requestId, timeoutMs) {
+    super(
+      `TouchQue: Request '${requestId}' was not approved within ${timeoutMs / 1e3}s. The user did not respond in time.`
+    );
+    this.name = "TouchQueTimeoutError";
+    this.requestId = requestId;
+  }
+};
+var TouchQueRejectedError = class extends TouchQueError {
+  requestId;
+  constructor(requestId) {
+    super(
+      `TouchQue: Request '${requestId}' was rejected by the user.`
+    );
+    this.name = "TouchQueRejectedError";
+    this.requestId = requestId;
+  }
+};
+var TouchQueWebhookSignatureError = class extends TouchQueError {
+  constructor() {
+    super(
+      "TouchQue: Webhook signature verification failed. This request did not come from TouchQue or the payload was tampered."
+    );
+    this.name = "TouchQueWebhookSignatureError";
+  }
+};
+var TouchQueConfigError = class extends TouchQueError {
+  constructor(message) {
+    super(`TouchQue Config Error: ${message}`);
+    this.name = "TouchQueConfigError";
+  }
+};
+
+// src/core/HttpClient.ts
+var TEN_MB = 10 * 1024 * 1024;
+function assertSafeBaseUrl(baseUrl) {
+  let url;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    throw new TouchQueConfigError(`baseUrl is not a valid URL: ${baseUrl}`);
+  }
+  if (url.protocol === "https:") return;
+  if (url.protocol === "http:") {
+    const host = url.hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]") return;
+    throw new TouchQueConfigError(
+      `Refusing to use a plaintext http:// baseUrl for "${url.hostname}". The API key and request signature would be sent in the clear \u2014 use https://.`
+    );
+  }
+  throw new TouchQueConfigError(`baseUrl must be http(s): ${baseUrl}`);
+}
+function buildQuery(params) {
+  if (!params) return "";
+  const keys = Object.keys(params).filter((k) => params[k] !== void 0 && params[k] !== null);
+  if (keys.length === 0) return "";
+  keys.sort();
+  const parts = keys.map((k) => `${encodeURIComponent(k)}=${encodeURIComponent(String(params[k]))}`);
+  return `?${parts.join("&")}`;
+}
+var HttpClient = class {
+  client;
+  apiKey;
+  apiSecret;
+  constructor(config) {
+    if (!config.apiKey || typeof config.apiKey !== "string") {
+      throw new TouchQueConfigError("apiKey is required and must be a string");
+    }
+    if (!config.apiSecret || typeof config.apiSecret !== "string") {
+      throw new TouchQueConfigError("apiSecret is required and must be a string");
+    }
+    if (!config.apiKey.startsWith("tq_")) {
+      throw new TouchQueConfigError(
+        'apiKey must start with "tq_". Did you accidentally swap apiKey and apiSecret?'
+      );
+    }
+    this.apiKey = config.apiKey;
+    this.apiSecret = config.apiSecret;
+    const baseURL = config.baseUrl || "https://api-authenticator.touchque.com";
+    assertSafeBaseUrl(baseURL);
+    this.client = import_axios.default.create({
+      baseURL,
+      timeout: config.timeout || 1e4,
+      headers: { "Content-Type": "application/json" },
+      // An API endpoint should never redirect; a redirect to another host
+      // could leak the signed auth headers.
+      maxRedirects: 0,
+      // Cap the response/request size so a misbehaving or spoofed endpoint
+      // can't exhaust memory.
+      maxContentLength: TEN_MB,
+      maxBodyLength: TEN_MB
+    });
+  }
+  /**
+   * Canonical signature.
+   * Format: HMAC(apiSecret, "METHOD:pathWithQuery:timestamp:nonce:bodyHash")
+   *
+   * `pathWithQuery` includes the sorted query string so GET/DELETE query
+   * params are covered by the signature (older SDKs signed the path only;
+   * the backend accepts either form).
+   */
+  sign(method, pathWithQuery, body, timestamp, nonce) {
+    const bodyHash = crypto.createHash("sha256").update(body || "").digest("hex");
+    const message = `${method.toUpperCase()}:${pathWithQuery}:${timestamp}:${nonce}:${bodyHash}`;
+    return crypto.createHmac("sha256", this.apiSecret).update(message).digest("hex");
+  }
+  generateNonce() {
+    return crypto.randomBytes(16).toString("hex");
+  }
+  authHeaders(method, pathWithQuery, body) {
+    const timestamp = Date.now().toString();
+    const nonce = this.generateNonce();
+    return {
+      "x-api-key": this.apiKey,
+      "x-signature": this.sign(method, pathWithQuery, body, timestamp, nonce),
+      "x-timestamp": timestamp,
+      "x-nonce": nonce
+    };
+  }
+  async post(path, body = {}) {
+    const bodyStr = JSON.stringify(body);
+    try {
+      const response = await this.client.post(path, bodyStr, {
+        headers: this.authHeaders("POST", path, bodyStr)
+      });
+      return response.data;
+    } catch (error) {
+      throw this.handleError(error);
+    }
+  }
+  async get(path, params) {
+    const query = buildQuery(params);
+    try {
+      const response = await this.client.get(path + query, {
+        headers: this.authHeaders("GET", path + query, "")
+      });
+      return response.data;
+    } catch (error) {
+      throw this.handleError(error);
+    }
+  }
+  async delete(path) {
+    try {
+      const response = await this.client.delete(path, {
+        headers: this.authHeaders("DELETE", path, "")
+      });
+      return response.data;
+    } catch (error) {
+      throw this.handleError(error);
+    }
+  }
+  handleError(error) {
+    if (import_axios.default.isAxiosError(error)) {
+      const axiosErr = error;
+      const status = axiosErr.response?.status || 500;
+      const data = axiosErr.response?.data || {};
+      return new TouchQueAPIError(status, {
+        error: data.error,
+        message: data.message,
+        code: data.code
+      });
+    }
+    return new TouchQueAPIError(500, {
+      message: error instanceof Error ? error.message : "Unknown error"
+    });
+  }
+};
+
+// src/resources/Auth.ts
+var Auth = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /**
+   * Generate a new setup secret for a user.
+   * Show this secret to the user ONCE (e.g. as a QR code) so they can
+   * link their TouchQue app.
+   *
+   * The secret expires after 60 seconds if not used (scanned by the mobile app).
+   * After expiry, calling this method again will automatically rotate the secret.
+   *
+   * @example
+   * const { secret, expiresAt } = await tq.auth.generateSecret({
+   *   externalUsername: 'user@company.com'
+   * });
+   * // Show `secret` to user as QR code
+   * // Secret expires at `expiresAt` if not scanned
+   */
+  async generateSecret(options) {
+    return this.http.post("/auth/generate-secret", {
+      externalUsername: options.externalUsername
+    });
+  }
+  /**
+   * Reset (regenerate) a user's secret.
+   * This invalidates the old secret and generates a new one.
+   * Show the new secret to the user.
+   *
+   * @example
+   * const { secret } = await tq.auth.resetSecret({
+   *   externalUsername: 'user@company.com'
+   * });
+   * // Show new secret to user
+   */
+  async resetSecret(options) {
+    return this.http.post("/auth/secret/reset", {
+      externalUsername: options.externalUsername
+    });
+  }
+  /**
+   * Validate a secret code.
+   * Useful if you want to verify the user entered the correct setup secret.
+   * Note: The backend allows this without an API key, but the SDK sends it for consistency.
+   */
+  async validateSecret(options) {
+    return this.http.post("/auth/secret/validate", {
+      secret: options.secret
+    });
+  }
+  /**
+   * Look up a user's current link status — no push notification is sent.
+   * Useful for detecting "the mobile app just linked this secret" (`used`
+   * flips true, `deviceId` gets set) without sending a LOGIN challenge to
+   * their device, e.g. while polling during enrollment.
+   *
+   * @example
+   * const { used, deviceId } = await tq.auth.getUser({
+   *   externalUsername: 'user@company.com'
+   * });
+   * if (used && deviceId) {
+   *   // Device has linked — no approval push needed to confirm this.
+   * }
+   */
+  async getUser(options) {
+    return this.http.get(`/users/${encodeURIComponent(options.externalUsername)}`);
+  }
+};
+
+// src/resources/Login.ts
+var Login = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /**
+   * Request 2FA confirmation from a user's TouchQue app.
+   *
+   * The user will receive a push notification on their device.
+   * They can then approve or reject the request.
+   *
+   * Built-in `type` values:
+   * - `'LOGIN'` — User is logging in
+   * - `'DISABLE_2FA'` — User is disabling 2FA
+   * - Custom action type IDs or slugs configured in your TouchQue Dashboard
+   *
+   * @example
+   * // Basic login verification
+   * const response = await tq.login.request({
+   *   externalUsername: 'user@company.com',
+   *   type: 'LOGIN'
+   * });
+   *
+   * @example
+   * // Protect a custom action using its Dashboard-configured ID or slug
+   * const response = await tq.login.request({
+   *   externalUsername: 'user@company.com',
+   *   type: 'action_type_slug_or_id',
+   *   referenceId: 'txn_abc123' // Your internal transaction ID
+   * });
+   */
+  async request(options) {
+    return this.http.post("/login/request", {
+      externalUsername: options.externalUsername,
+      type: options.type,
+      ...options.referenceId && { referenceId: options.referenceId },
+      ...options.clientIp && { clientIp: options.clientIp },
+      ...options.userAgent && { userAgent: options.userAgent },
+      ...options.requireBiometric && { requireBiometric: options.requireBiometric },
+      ...options.requireNumberMatch && { requireNumberMatch: options.requireNumberMatch }
+    });
+  }
+  /**
+   * Check the current status of a login request.
+   *
+   * Returns: `'PENDING'` | `'CONFIRMED'` | `'REJECTED'` | `'EXPIRED'`
+   *
+   * @example
+   * const { status } = await tq.login.status('request_id_here');
+   * if (status === 'CONFIRMED') {
+   *   // User approved — proceed with action
+   * }
+   */
+  async status(requestId) {
+    return this.http.get(`/login/status/${encodeURIComponent(requestId)}`);
+  }
+  /**
+   * Wait for the user to approve or reject a login request.
+   *
+   * This is a convenience method that polls the status endpoint
+   * until the request is approved, rejected, or times out.
+   *
+   * **This is the recommended way to integrate TouchQue into your routes.**
+   *
+   * @throws {TouchQueRejectedError} If the user rejects the request
+   * @throws {TouchQueTimeoutError} If the request times out (user didn't respond)
+   *
+   * @example
+   * // Simple: Send request and wait for approval in one step
+   * try {
+   *   const loginReq = await tq.login.request({
+   *     externalUsername: 'user@company.com',
+   *     type: 'LOGIN'
+   *   });
+   *
+   *   const result = await tq.login.waitForApproval({
+   *     requestId: loginReq.requestId,
+   *     timeout: 30000  // Wait up to 30 seconds
+   *   });
+   *
+   *   if (result.approved) {
+   *     // ✅ User approved — proceed
+   *     proceedWithAction();
+   *   }
+   * } catch (err) {
+   *   if (err instanceof TouchQueRejectedError) {
+   *     // ❌ User rejected — cancel the action
+   *   } else if (err instanceof TouchQueTimeoutError) {
+   *     // ⏰ User didn't respond in time
+   *   }
+   * }
+   */
+  async waitForApproval(options) {
+    const timeout = options.timeout || 3e4;
+    const pollInterval = options.pollInterval || 400;
+    const startTime = Date.now();
+    while (Date.now() - startTime < timeout) {
+      const { status } = await this.status(options.requestId);
+      if (status === "CONFIRMED") {
+        return { approved: true, status };
+      }
+      if (status === "REJECTED") {
+        throw new TouchQueRejectedError(options.requestId);
+      }
+      if (status === "EXPIRED") {
+        throw new TouchQueTimeoutError(options.requestId, timeout);
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    }
+    throw new TouchQueTimeoutError(options.requestId, timeout);
+  }
+  /**
+   * Convenience: Send a 2FA request AND wait for approval in one call.
+   *
+   * Perfect for protecting any action with a single function call.
+   *
+   * @throws {TouchQueRejectedError} User rejected
+   * @throws {TouchQueTimeoutError} User didn't respond in time
+   *
+   * @example
+   * // Protect an action with 2FA — ONE LINE!
+   * const result = await tq.login.verify({
+   *   externalUsername: 'user@company.com',
+   *   type: 'action_type_slug_or_id',
+   *   referenceId: 'action_789'
+   * });
+   * // If we reach here, user approved ✅
+   * executeAction();
+   */
+  async verify(options) {
+    const { timeout, pollInterval, ...requestOptions } = options;
+    const loginReq = await this.request(requestOptions);
+    const result = await this.waitForApproval({
+      requestId: loginReq.requestId,
+      timeout,
+      pollInterval
+    });
+    return {
+      ...result,
+      requestId: loginReq.requestId,
+      challengeCode: loginReq.challengeCode
+    };
+  }
+  /**
+   * Approve a pending 2FA request using a Recovery Code.
+   * Useful when a user loses their phone and needs to bypass 2FA
+   * using one of the backup codes generated during setup.
+   */
+  async approveWithRecoveryCode(options) {
+    return this.http.post("/login/recovery", {
+      requestId: options.requestId,
+      code: options.code
+    });
+  }
+};
+
+// src/resources/Webhook.ts
+var crypto2 = __toESM(require("crypto"));
+function canonicalize(payload) {
+  const { signature: _drop, ...rest } = payload;
+  const sorted = {};
+  for (const key of Object.keys(rest).sort()) {
+    sorted[key] = rest[key];
+  }
+  return JSON.stringify(sorted);
+}
+var Webhook = class {
+  apiSecret;
+  constructor(apiSecret) {
+    this.apiSecret = apiSecret;
+  }
+  /**
+   * Verify that an incoming webhook request is genuinely from TouchQue and
+   * return its parsed payload. Throws `TouchQueWebhookSignatureError` if the
+   * signature is invalid, the body is malformed, or the webhook is stale.
+   *
+   * **Always verify before processing, and de-duplicate on `payload.jti`
+   * (or `payload.requestId` + `payload.event`) so a replayed webhook can't
+   * re-trigger your logic.**
+   *
+   * @throws {TouchQueWebhookSignatureError}
+   *
+   * @example
+   * // Express.js — mount with a raw body parser on this route
+   * app.post('/webhooks/touchque', express.raw({ type: 'application/json' }), (req, res) => {
+   *   try {
+   *     const event = tq.webhook.verify({
+   *       rawBody: req.body.toString('utf8'),
+   *       signature: req.headers['x-signature'] as string,
+   *     });
+   *     // ... handle event.event, guarded by an idempotency check on event.jti
+   *     res.sendStatus(200);
+   *   } catch {
+   *     res.sendStatus(403); // not from TouchQue, tampered, or replayed
+   *   }
+   * });
+   */
+  verify(options) {
+    const { rawBody } = options;
+    if (!rawBody || typeof rawBody !== "string") {
+      throw new TouchQueWebhookSignatureError();
+    }
+    let payload;
+    try {
+      const parsed = JSON.parse(rawBody);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("not an object");
+      }
+      payload = parsed;
+    } catch {
+      throw new TouchQueWebhookSignatureError();
+    }
+    const provided = typeof options.signature === "string" && options.signature ? options.signature : typeof payload.signature === "string" ? payload.signature : "";
+    if (!provided) {
+      throw new TouchQueWebhookSignatureError();
+    }
+    const expected = crypto2.createHmac("sha256", this.apiSecret).update(canonicalize(payload)).digest("hex");
+    const providedBuf = Buffer.from(provided, "utf8");
+    const expectedBuf = Buffer.from(expected, "utf8");
+    if (providedBuf.length !== expectedBuf.length || !crypto2.timingSafeEqual(providedBuf, expectedBuf)) {
+      throw new TouchQueWebhookSignatureError();
+    }
+    const tolerance = options.toleranceSeconds ?? 300;
+    if (tolerance > 0 && typeof payload.timestamp === "string") {
+      const ts = Date.parse(payload.timestamp);
+      if (!Number.isNaN(ts) && Math.abs(Date.now() - ts) > tolerance * 1e3) {
+        throw new TouchQueWebhookSignatureError();
+      }
+    }
+    return payload;
+  }
+  /**
+   * Check a webhook signature without throwing. Returns `true` / `false`.
+   *
+   * @example
+   * if (tq.webhook.isValid({ rawBody, signature })) {
+   *   // process
+   * }
+   */
+  isValid(options) {
+    try {
+      this.verify(options);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// src/resources/WebAuthn.ts
+var WebAuthn = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /**
+   * Step 1 of registering a passkey: get options for `navigator.credentials.create()`.
+   *
+   * @example
+   * const options = await tq.webauthn.registerOptions({ externalUsername: 'user@company.com' });
+   * // send `options` to the browser, call navigator.credentials.create({ publicKey: options })
+   */
+  async registerOptions(options) {
+    return this.http.post("/webauthn/register/options", {
+      externalUsername: options.externalUsername,
+      ...options.discoverable ? { discoverable: true } : {}
+    });
+  }
+  /**
+   * Step 2: verify the browser's registration response and store the credential.
+   *
+   * @example
+   * const { verified, credentialId } = await tq.webauthn.registerVerify({
+   *   externalUsername: 'user@company.com',
+   *   response: browserRegistrationResponseJSON,
+   *   label: 'MacBook Touch ID',
+   * });
+   */
+  async registerVerify(options) {
+    return this.http.post("/webauthn/register/verify", {
+      externalUsername: options.externalUsername,
+      response: options.response,
+      ...options.label && { label: options.label }
+    });
+  }
+  /**
+   * Step 1 of approving a pending login with a passkey: get options for
+   * `navigator.credentials.get()`, scoped to a specific `requestId` (from
+   * `tq.login.request()`).
+   *
+   * @example
+   * const loginReq = await tq.login.request({ externalUsername: 'user@company.com', type: 'LOGIN' });
+   * const options = await tq.webauthn.authenticateOptions({ requestId: loginReq.requestId });
+   */
+  async authenticateOptions(options) {
+    return this.http.post("/webauthn/login/options", {
+      requestId: options.requestId
+    });
+  }
+  /**
+   * Step 2: verify the browser's assertion — approves the LoginRequest on success.
+   *
+   * @example
+   * const result = await tq.webauthn.authenticateVerify({
+   *   requestId: loginReq.requestId,
+   *   response: browserAuthenticationResponseJSON,
+   * });
+   */
+  async authenticateVerify(options) {
+    return this.http.post("/webauthn/login/verify", {
+      requestId: options.requestId,
+      response: options.response
+    });
+  }
+  /**
+   * Step 1 of a PASSWORDLESS-PRIMARY login: authenticate a user *from zero*
+   * (no password, no prior `tq.login.request()`, no mobile device) with a
+   * passkey registered via `registerOptions({ discoverable: true })`.
+   *
+   * Requires `TenantPolicy.passwordlessLoginEnabled` for the integration.
+   * Returns `404 no_passkey_registered` if the user has no passkey — the
+   * caller should then fall back to password login.
+   *
+   * @example
+   * const { attemptId, options } = await tq.webauthn.primaryOptions({ externalUsername: 'user@company.com' });
+   * // browser: const assertion = await navigator.credentials.get({ publicKey: options });
+   */
+  async primaryOptions(options) {
+    return this.http.post("/webauthn/authenticate/primary/options", {
+      externalUsername: options.externalUsername
+    });
+  }
+  /**
+   * Step 2 of a passwordless-primary login: verify the browser assertion.
+   *
+   * On `success:true` the returned `requestId` is a CONFIRMED LoginRequest —
+   * the login is done. On `success:false` with `requiresStepUp:true`, risk
+   * or policy demands a second factor: start the normal `tq.login.request()`
+   * / number-match flow instead of trusting this assertion alone.
+   */
+  async primaryVerify(options) {
+    return this.http.post("/webauthn/authenticate/primary/verify", {
+      attemptId: options.attemptId,
+      response: options.response
+    });
+  }
+  /**
+   * List a user's registered WebAuthn credentials (labels/metadata only, no key material).
+   */
+  async listCredentials(options) {
+    return this.http.get("/webauthn/credentials", {
+      externalUsername: options.externalUsername
+    });
+  }
+  /**
+   * Remove a registered credential (e.g. the user lost that device).
+   */
+  async deleteCredential(credentialRecordId) {
+    return this.http.delete(`/webauthn/credentials/${encodeURIComponent(credentialRecordId)}`);
+  }
+};
+
+// src/middleware/express.ts
+function requireTouchQue(tqClient, actionType, options = {}) {
+  return async (req, res, next) => {
+    const getUserId = options.getUserId || ((r) => r.user?.email || r.user?.id || r.user?.username);
+    const userId = getUserId(req);
+    if (!userId) {
+      res.status(401).json({
+        error: "UNAUTHORIZED_FOR_2FA",
+        message: "Could not find user ID in request. Ensure the user is authenticated before this middleware."
+      });
+      return;
+    }
+    const referenceId = options.getReferenceId ? options.getReferenceId(req) : void 0;
+    const timeout = options.timeout || 3e4;
+    try {
+      const result = await tqClient.login.verify({
+        externalUsername: userId,
+        type: actionType,
+        referenceId,
+        timeout
+      });
+      req.touchque = {
+        requestId: result.requestId,
+        challengeCode: result.challengeCode,
+        approved: result.approved
+      };
+      next();
+    } catch (error) {
+      if (error instanceof TouchQueRejectedError) {
+        res.status(403).json({
+          error: "2FA_REJECTED",
+          message: "User rejected the 2FA request on their device."
+        });
+        return;
+      }
+      if (error instanceof TouchQueTimeoutError) {
+        res.status(408).json({
+          error: "2FA_TIMEOUT",
+          message: "User did not respond to the 2FA request in time."
+        });
+        return;
+      }
+      console.error("[TouchQue Middleware Error]", error);
+      res.status(503).json({
+        error: "2FA_UNAVAILABLE",
+        message: "The 2FA verification service is temporarily unavailable."
+      });
+      return;
+    }
+  };
+}
+
+// src/index.ts
+var TouchQue = class {
+  client;
+  auth;
+  login;
+  /** Webhook signature verification */
+  webhook;
+  /** WebAuthn/FIDO2 (passkey) registration and login approval */
+  webauthn;
+  /**
+   * Create a new TouchQue SDK client.
+   *
+   * @param config - Your API credentials from the TouchQue Dashboard
+   *
+   * @example
+   * import { TouchQue } from '@touchque/node';
+   *
+   * const tq = new TouchQue({
+   *   apiKey: 'tq_auth_abc123',
+   *   apiSecret: 'your_api_secret'
+   * });
+   *
+   * // Now use tq.auth, tq.login, tq.webhook
+   */
+  constructor(config) {
+    const http = new HttpClient(config);
+    this.client = http;
+    this.auth = new Auth(http);
+    this.login = new Login(http);
+    this.webhook = new Webhook(config.apiSecret);
+    this.webauthn = new WebAuthn(http);
+  }
+  /**
+   * Wrap and protect any async function with TouchQue 2FA.
+   * 
+   * @param fn The function to protect
+   * @param options Configuration for extracting the user identity and 2FA type
+   * @returns A new function that requires 2FA approval before executing the original function
+   * 
+   * @example
+   * const secureWithdraw = tq.protect(processWithdraw, {
+   *   type: 'WITHDRAW',
+   *   getUserIdentifier: (username, amount) => username
+   * });
+   * 
+   * await secureWithdraw("user@company.com", 500); // Prompts 2FA automatically
+   */
+  protect(fn, options) {
+    return async (...args) => {
+      const externalUsername = options.getUserIdentifier(...args);
+      const referenceId = options.getReferenceId ? options.getReferenceId(...args) : void 0;
+      await this.login.verify({
+        externalUsername,
+        type: options.type,
+        referenceId,
+        timeout: options.timeout,
+        pollInterval: options.pollInterval
+      });
+      return fn(...args);
+    };
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Auth,
+  Login,
+  TouchQue,
+  TouchQueAPIError,
+  TouchQueConfigError,
+  TouchQueError,
+  TouchQueRejectedError,
+  TouchQueTimeoutError,
+  TouchQueWebhookSignatureError,
+  WebAuthn,
+  Webhook,
+  requireTouchQue
+});