@glinr/theauth 0.4.2 → 0.6.0

package/dist/permission/index.d.ts

@@ -1,7 +1,7 @@
-import { D as Database, A as AgentIdentity, i as AuthorizeRequest, j as AuthorizeResult, P as Permission } from '../types-D1sBnWrs.js';
-export { ar as PermissionConstraints } from '../types-D1sBnWrs.js';
+import { D as Database, A as AgentIdentity, n as AuthorizeRequest, o as AuthorizeResult, P as Permission } from '../types-JOx1R8-Q.js';
+export { at as PermissionConstraints } from '../types-JOx1R8-Q.js';
 import 'drizzle-orm/sqlite-core';
-import '../types-BiUe9e8u.js';
+import '../types-XoCxTUZj.js';
 import 'zod';
 import '../redirect/index.js';
 

package/dist/permission/index.js

@@ -6,7 +6,7 @@ function generateId() {
   return globalThis.crypto.randomUUID();
 }
 new TextEncoder();
-var users = sqliteTable("kavach_users", {
+var users = sqliteTable("theauth_users", {
   id: text("id").primaryKey(),
   email: text("email").notNull().unique(),
   name: text("name"),
@@ -22,14 +22,14 @@ var users = sqliteTable("kavach_users", {
   banExpiresAt: integer("ban_expires_at", { mode: "timestamp" }),
   forcePasswordReset: integer("force_password_reset").notNull().default(0),
   emailVerified: integer("email_verified").notNull().default(0),
-  // Stripe integration fields (populated by kavach-stripe plugin)
+  // Stripe integration fields (populated by theauth-stripe plugin)
   stripeCustomerId: text("stripe_customer_id").unique(),
   stripeSubscriptionId: text("stripe_subscription_id"),
   stripeSubscriptionStatus: text("stripe_subscription_status"),
   stripePriceId: text("stripe_price_id"),
   stripeCurrentPeriodEnd: integer("stripe_current_period_end", { mode: "timestamp" }),
   stripeCancelAtPeriodEnd: integer("stripe_cancel_at_period_end", { mode: "boolean" }).notNull().default(false),
-  // Polar integration fields (populated by kavach-polar plugin)
+  // Polar integration fields (populated by theauth-polar plugin)
   polarCustomerId: text("polar_customer_id").unique(),
   polarSubscriptionId: text("polar_subscription_id"),
   polarSubscriptionStatus: text("polar_subscription_status"),
@@ -39,7 +39,7 @@ var users = sqliteTable("kavach_users", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var tenants = sqliteTable("kavach_tenants", {
+var tenants = sqliteTable("theauth_tenants", {
   id: text("id").primaryKey(),
   name: text("name").notNull(),
   slug: text("slug").notNull().unique(),
@@ -48,7 +48,7 @@ var tenants = sqliteTable("kavach_tenants", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var agents = sqliteTable("kavach_agents", {
+var agents = sqliteTable("theauth_agents", {
   id: text("id").primaryKey(),
   ownerId: text("owner_id").notNull().references(() => users.id),
   tenantId: text("tenant_id").references(() => tenants.id),
@@ -66,7 +66,7 @@ var agents = sqliteTable("kavach_agents", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_permissions", {
+sqliteTable("theauth_permissions", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   resource: text("resource").notNull(),
@@ -78,7 +78,7 @@ sqliteTable("kavach_permissions", {
   relation: text("relation"),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_delegation_chains", {
+sqliteTable("theauth_delegation_chains", {
   id: text("id").primaryKey(),
   fromAgentId: text("from_agent_id").notNull().references(() => agents.id),
   toAgentId: text("to_agent_id").notNull().references(() => agents.id),
@@ -89,7 +89,7 @@ sqliteTable("kavach_delegation_chains", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var auditLogs = sqliteTable("kavach_audit_logs", {
+var auditLogs = sqliteTable("theauth_audit_logs", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id),
   userId: text("user_id").notNull().references(() => users.id),
@@ -109,14 +109,14 @@ var auditLogs = sqliteTable("kavach_audit_logs", {
   cacheHit: integer("cache_hit", { mode: "boolean" }).notNull().default(false),
   timestamp: integer("timestamp", { mode: "timestamp" }).notNull()
 });
-var rateLimits = sqliteTable("kavach_rate_limits", {
+var rateLimits = sqliteTable("theauth_rate_limits", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   resource: text("resource").notNull(),
   windowStart: integer("window_start", { mode: "timestamp" }).notNull(),
   count: integer("count").notNull().default(0)
 });
-sqliteTable("kavach_mcp_servers", {
+sqliteTable("theauth_mcp_servers", {
   id: text("id").primaryKey(),
   name: text("name").notNull(),
   endpoint: text("endpoint").notNull().unique(),
@@ -127,14 +127,14 @@ sqliteTable("kavach_mcp_servers", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_sessions", {
+sqliteTable("theauth_sessions", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id),
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   metadata: text("metadata", { mode: "json" }).$type(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var oauthClients = sqliteTable("kavach_oauth_clients", {
+var oauthClients = sqliteTable("theauth_oauth_clients", {
   id: text("id").primaryKey(),
   clientId: text("client_id").notNull().unique(),
   clientSecret: text("client_secret"),
@@ -151,7 +151,7 @@ var oauthClients = sqliteTable("kavach_oauth_clients", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_oauth_access_tokens", {
+sqliteTable("theauth_oauth_access_tokens", {
   id: text("id").primaryKey(),
   accessToken: text("access_token").notNull().unique(),
   refreshToken: text("refresh_token").unique(),
@@ -165,7 +165,7 @@ sqliteTable("kavach_oauth_access_tokens", {
   refreshTokenExpiresAt: integer("refresh_token_expires_at", { mode: "timestamp" }),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_oauth_authorization_codes", {
+sqliteTable("theauth_oauth_authorization_codes", {
   id: text("id").primaryKey(),
   code: text("code").notNull().unique(),
   clientId: text("client_id").notNull().references(() => oauthClients.clientId),
@@ -181,7 +181,7 @@ sqliteTable("kavach_oauth_authorization_codes", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_budget_policies", {
+sqliteTable("theauth_budget_policies", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").references(() => agents.id, { onDelete: "cascade" }),
   // nullable
@@ -195,7 +195,7 @@ sqliteTable("kavach_budget_policies", {
   status: text("status", { enum: ["active", "triggered", "disabled"] }).notNull().default("active"),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_agent_cards", {
+sqliteTable("theauth_agent_cards", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   name: text("name").notNull(),
@@ -209,7 +209,7 @@ sqliteTable("kavach_agent_cards", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_approval_requests", {
+sqliteTable("theauth_approval_requests", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   userId: text("user_id").notNull().references(() => users.id),
@@ -222,7 +222,7 @@ sqliteTable("kavach_approval_requests", {
   respondedBy: text("responded_by"),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_trust_scores", {
+sqliteTable("theauth_trust_scores", {
   agentId: text("agent_id").primaryKey().references(() => agents.id, { onDelete: "cascade" }),
   score: integer("score").notNull(),
   level: text("level", {
@@ -231,7 +231,7 @@ sqliteTable("kavach_trust_scores", {
   factors: text("factors", { mode: "json" }).notNull().$type(),
   computedAt: integer("computed_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_magic_links", {
+sqliteTable("theauth_magic_links", {
   id: text("id").primaryKey(),
   email: text("email").notNull(),
   token: text("token").notNull().unique(),
@@ -239,7 +239,7 @@ sqliteTable("kavach_magic_links", {
   used: integer("used", { mode: "boolean" }).notNull().default(false),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_email_otps", {
+sqliteTable("theauth_email_otps", {
   id: text("id").primaryKey(),
   email: text("email").notNull(),
   codeHash: text("code_hash").notNull(),
@@ -247,7 +247,7 @@ sqliteTable("kavach_email_otps", {
   attempts: integer("attempts").notNull().default(0),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_totp", {
+sqliteTable("theauth_totp", {
   userId: text("user_id").primaryKey().references(() => users.id),
   secret: text("secret").notNull(),
   // base32-encoded TOTP secret
@@ -256,7 +256,7 @@ sqliteTable("kavach_totp", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var organizations = sqliteTable("kavach_organizations", {
+var organizations = sqliteTable("theauth_organizations", {
   id: text("id").primaryKey(),
   name: text("name").notNull(),
   slug: text("slug").notNull().unique(),
@@ -265,14 +265,14 @@ var organizations = sqliteTable("kavach_organizations", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_org_members", {
+sqliteTable("theauth_org_members", {
   id: text("id").primaryKey(),
   orgId: text("org_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
   userId: text("user_id").notNull().references(() => users.id),
   role: text("role").notNull().default("member"),
   joinedAt: integer("joined_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_org_invitations", {
+sqliteTable("theauth_org_invitations", {
   id: text("id").primaryKey(),
   orgId: text("org_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
   email: text("email").notNull(),
@@ -282,13 +282,13 @@ sqliteTable("kavach_org_invitations", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_org_roles", {
+sqliteTable("theauth_org_roles", {
   id: text("id").primaryKey(),
   orgId: text("org_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
   name: text("name").notNull(),
   permissions: text("permissions", { mode: "json" }).notNull().$type()
 });
-sqliteTable("kavach_passkey_credentials", {
+sqliteTable("theauth_passkey_credentials", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id),
   credentialId: text("credential_id").notNull().unique(),
@@ -301,7 +301,7 @@ sqliteTable("kavach_passkey_credentials", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   lastUsedAt: integer("last_used_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_sso_connections", {
+sqliteTable("theauth_sso_connections", {
   id: text("id").primaryKey(),
   orgId: text("org_id").notNull(),
   providerId: text("provider_id").notNull(),
@@ -310,7 +310,7 @@ sqliteTable("kavach_sso_connections", {
   enabled: integer("enabled").notNull().default(1),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_api_keys", {
+sqliteTable("theauth_api_keys", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id),
   name: text("name").notNull(),
@@ -321,7 +321,7 @@ sqliteTable("kavach_api_keys", {
   lastUsedAt: integer("last_used_at", { mode: "timestamp" }),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_passkey_challenges", {
+sqliteTable("theauth_passkey_challenges", {
   id: text("id").primaryKey(),
   challenge: text("challenge").notNull().unique(),
   userId: text("user_id"),
@@ -330,7 +330,7 @@ sqliteTable("kavach_passkey_challenges", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_username_accounts", {
+sqliteTable("theauth_username_accounts", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   username: text("username").notNull().unique(),
@@ -338,7 +338,7 @@ sqliteTable("kavach_username_accounts", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_phone_verifications", {
+sqliteTable("theauth_phone_verifications", {
   id: text("id").primaryKey(),
   phoneNumber: text("phone_number").notNull(),
   codeHash: text("code_hash").notNull(),
@@ -346,7 +346,7 @@ sqliteTable("kavach_phone_verifications", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_trusted_devices", {
+sqliteTable("theauth_trusted_devices", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   fingerprint: text("fingerprint").notNull(),
@@ -356,7 +356,7 @@ sqliteTable("kavach_trusted_devices", {
   trustedAt: integer("trusted_at", { mode: "timestamp" }).notNull(),
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_one_time_tokens", {
+sqliteTable("theauth_one_time_tokens", {
   id: text("id").primaryKey(),
   tokenHash: text("token_hash").notNull().unique(),
   // SHA-256 hex of the raw token
@@ -370,7 +370,7 @@ sqliteTable("kavach_one_time_tokens", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_login_history", {
+sqliteTable("theauth_login_history", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   method: text("method").notNull(),
@@ -379,7 +379,7 @@ sqliteTable("kavach_login_history", {
   userAgent: text("user_agent"),
   timestamp: integer("timestamp", { mode: "timestamp_ms" }).notNull()
 });
-sqliteTable("kavach_agent_dids", {
+sqliteTable("theauth_agent_dids", {
   agentId: text("agent_id").primaryKey().references(() => agents.id, { onDelete: "cascade" }),
   did: text("did").notNull().unique(),
   method: text("method", { enum: ["key", "web"] }).notNull(),
@@ -389,7 +389,7 @@ sqliteTable("kavach_agent_dids", {
   // JSON-serialised DID Document
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_oidc_clients", {
+sqliteTable("theauth_oidc_clients", {
   id: text("id").primaryKey(),
   clientId: text("client_id").notNull().unique(),
   clientSecretHash: text("client_secret_hash").notNull(),
@@ -403,7 +403,7 @@ sqliteTable("kavach_oidc_clients", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_oidc_auth_codes", {
+sqliteTable("theauth_oidc_auth_codes", {
   id: text("id").primaryKey(),
   codeHash: text("code_hash").notNull().unique(),
   // SHA-256 hex of the raw code
@@ -420,7 +420,7 @@ sqliteTable("kavach_oidc_auth_codes", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_oidc_refresh_tokens", {
+sqliteTable("theauth_oidc_refresh_tokens", {
   id: text("id").primaryKey(),
   tokenHash: text("token_hash").notNull().unique(),
   // SHA-256 hex of the raw token
@@ -432,7 +432,7 @@ sqliteTable("kavach_oidc_refresh_tokens", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_cost_events", {
+sqliteTable("theauth_cost_events", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   tool: text("tool").notNull(),
@@ -447,7 +447,7 @@ sqliteTable("kavach_cost_events", {
   // null when not part of a chain
   recordedAt: integer("recorded_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_ephemeral_sessions", {
+sqliteTable("theauth_ephemeral_sessions", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   ownerId: text("owner_id").notNull().references(() => users.id),
@@ -461,7 +461,7 @@ sqliteTable("kavach_ephemeral_sessions", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_stream_events", {
+sqliteTable("theauth_stream_events", {
   id: text("id").primaryKey(),
   type: text("type").notNull(),
   timestamp: integer("timestamp", { mode: "timestamp" }).notNull(),
@@ -469,7 +469,7 @@ sqliteTable("kavach_stream_events", {
   agentId: text("agent_id"),
   userId: text("user_id")
 });
-sqliteTable("kavach_jwt_refresh_tokens", {
+sqliteTable("theauth_jwt_refresh_tokens", {
   id: text("id").primaryKey(),
   /** SHA-256 hex of the raw refresh token. The raw token is never stored. */
   tokenHash: text("token_hash").notNull().unique(),
@@ -480,7 +480,7 @@ sqliteTable("kavach_jwt_refresh_tokens", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_rebac_resources", {
+sqliteTable("theauth_rebac_resources", {
   id: text("id").notNull().primaryKey(),
   type: text("type").notNull(),
   // 'org', 'workspace', 'project', 'document', etc.
@@ -488,7 +488,7 @@ sqliteTable("kavach_rebac_resources", {
   parentType: text("parent_type"),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_rebac_relationships", {
+sqliteTable("theauth_rebac_relationships", {
   id: text("id").primaryKey(),
   subjectType: text("subject_type").notNull(),
   // 'user', 'agent', 'team', 'role'
@@ -499,7 +499,7 @@ sqliteTable("kavach_rebac_relationships", {
   objectId: text("object_id").notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_federation_instances", {
+sqliteTable("theauth_federation_instances", {
   id: text("id").primaryKey(),
   instanceId: text("instance_id").notNull().unique(),
   instanceUrl: text("instance_url").notNull(),
@@ -510,7 +510,7 @@ sqliteTable("kavach_federation_instances", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_federation_tokens", {
+sqliteTable("theauth_federation_tokens", {
   id: text("id").primaryKey(),
   tokenJti: text("token_jti").notNull().unique(),
   // JWT ID for dedup
@@ -524,7 +524,7 @@ sqliteTable("kavach_federation_tokens", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var refreshTokenFamilies = sqliteTable("kavach_refresh_token_families", {
+var refreshTokenFamilies = sqliteTable("theauth_refresh_token_families", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   /** Absolute session expiry — no rotation can extend beyond this date. */
@@ -533,7 +533,7 @@ var refreshTokenFamilies = sqliteTable("kavach_refresh_token_families", {
   revoked: integer("revoked").notNull().default(0),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_refresh_tokens", {
+sqliteTable("theauth_refresh_tokens", {
   id: text("id").primaryKey(),
   familyId: text("family_id").notNull().references(() => refreshTokenFamilies.id, { onDelete: "cascade" }),
   /** SHA-256 hash of the opaque token — never store the raw token. */
@@ -713,7 +713,8 @@ function createPermissionEngine(config) {
           subjectId: agent.id,
           resource: request.resource,
           arguments: request.arguments,
-          ip: request.ip
+          // Adapters pass the client IP via context; direct callers may set request.ip.
+          ip: request.context?.ip ?? request.ip
         },
         matchingPermission.constraints
       );
@@ -750,7 +751,7 @@ async function writeAuditLog(db, agent, request, result, startTime, auditId) {
     reason: result.reason ?? null,
     durationMs,
     timestamp: /* @__PURE__ */ new Date(),
-    ip: request.context?.ip ?? null,
+    ip: request.context?.ip ?? request.ip ?? null,
     userAgent: request.context?.userAgent ?? null
   });
 }