@glinr/theauth 0.4.2 → 0.6.0

package/dist/auth/index.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
-import { a5 as AuthAdapter, o as ResolvedUser, X as KavachPlugin, D as Database, _ as AdminConfig, p as SessionManager, a2 as ApiKeyManagerConfig, aa as EmailOtpConfig, P as Permission, ae as MagicLinkConfig, aj as OrgConfig, ao as PasskeyConfig, N as PluginEndpoint, aF as TotpConfig } from '../types-D1sBnWrs.js';
-export { u as AdminModule, $ as AdminUser, a1 as ApiKey, v as ApiKeyManagerModule, a6 as CaptchaConfig, G as CaptchaModule, a7 as CaptchaVerifyResult, a8 as CreateTokenInput, E as EmailOtpModule, ab as EmailVerificationConfig, y as EmailVerificationModule, r as MagicLinkModule, ag as OidcProvider, ah as OneTimeTokenConfig, z as OneTimeTokenModule, ai as OneTimeTokenPurpose, ak as OrgInvitation, al as OrgMember, O as OrgModule, am as OrgRole, an as Organization, ap as PasskeyCredential, s as PasskeyModule, aq as PasswordResetConfig, x as PasswordResetModule, as as PhoneAuthConfig, F as PhoneAuthModule, av as RevokeTokensResult, aw as SSO_ERROR, ax as SamlProvider, aA as SsoAuditEvent, aB as SsoConfig, aC as SsoConnection, aD as SsoError, t as SsoModule, T as TotpModule, aG as TotpSetup, aH as UsernameAuthConfig, w as UsernameAuthModule, aI as ValidateTokenResult, bu as WebhookConfig, bv as WebhookEvent, W as WebhookModule, aS as createAdminModule, aT as createApiKeyManagerModule, aV as createCaptchaModule, aY as createEmailOtpModule, aZ as createEmailVerificationModule, a_ as createMagicLinkModule, a$ as createOneTimeTokenModule, b0 as createOrgModule, b1 as createPasskeyModule, b2 as createPasswordResetModule, b3 as createPhoneAuthModule, b6 as createSsoModule, b7 as createTotpModule, b8 as createUsernameAuthModule, bw as createWebhookModule } from '../types-D1sBnWrs.js';
-import { R as Result } from '../types-BiUe9e8u.js';
+import { a5 as AuthAdapter, t as ResolvedUser, i as TheAuthPlugin, D as Database, _ as AdminConfig, j as SessionManager, a2 as ApiKeyManagerConfig, ae as EmailOtpConfig, P as Permission, ag as MagicLinkConfig, al as OrgConfig, aq as PasskeyConfig, h as PluginEndpoint, aJ as TotpConfig } from '../types-JOx1R8-Q.js';
+export { B as AdminModule, $ as AdminUser, a1 as ApiKey, F as ApiKeyManagerModule, aa as CaptchaConfig, N as CaptchaModule, ab as CaptchaVerifyResult, ac as CreateTokenInput, w as EmailOtpModule, af as EmailVerificationConfig, I as EmailVerificationModule, v as MagicLinkModule, ai as OidcProvider, aj as OneTimeTokenConfig, J as OneTimeTokenModule, ak as OneTimeTokenPurpose, am as OrgInvitation, an as OrgMember, O as OrgModule, ao as OrgRole, ap as Organization, ar as PasskeyCredential, y as PasskeyModule, as as PasswordResetConfig, H as PasswordResetModule, au as PhoneAuthConfig, L as PhoneAuthModule, ax as RevokeTokensResult, ay as SSO_ERROR, az as SamlProvider, aC as SsoAuditEvent, aD as SsoConfig, aE as SsoConnection, aF as SsoError, z as SsoModule, x as TotpModule, aK as TotpSetup, aL as UsernameAuthConfig, G as UsernameAuthModule, aM as ValidateTokenResult, by as WebhookConfig, bz as WebhookEvent, W as WebhookModule, aW as createAdminModule, aX as createApiKeyManagerModule, aZ as createCaptchaModule, b0 as createEmailOtpModule, b1 as createEmailVerificationModule, b2 as createMagicLinkModule, b3 as createOneTimeTokenModule, b4 as createOrgModule, b5 as createPasskeyModule, b6 as createPasswordResetModule, b7 as createPhoneAuthModule, ba as createSsoModule, bb as createTotpModule, bc as createUsernameAuthModule, bA as createWebhookModule } from '../types-JOx1R8-Q.js';
+import { R as Result } from '../types-XoCxTUZj.js';
 import { AgentType, TrustTier } from '../standards/index.js';
 import * as jose from 'jose';
 import 'drizzle-orm/sqlite-core';
@@ -159,11 +159,11 @@ declare function headerAuth(options?: HeaderAuthOptions): AuthAdapter;
  *
  * @example
  * ```typescript
- * import { createKavach } from '@glinr/theauth';
+ * import { createTheAuth } from '@glinr/theauth';
  * import { additionalFields } from '@glinr/theauth/auth';
  *
- * const kavach = await createKavach({
- *   database: { provider: 'sqlite', url: 'kavach.db' },
+ * const theauth = await createTheAuth({
+ *   database: { provider: 'sqlite', url: 'theauth.db' },
  *   plugins: [
  *     additionalFields({
  *       user: {
@@ -174,7 +174,7 @@ declare function headerAuth(options?: HeaderAuthOptions): AuthAdapter;
  *   ],
  * });
  *
- * const mod = kavach.plugins.getContext().additionalFields as AdditionalFieldsModule;
+ * const mod = theauth.plugins.getContext().additionalFields as AdditionalFieldsModule;
  * await mod.setUserFields(userId, { plan: 'pro', credits: 100 });
  * const fields = await mod.getUserFields(userId);
  * // => { plan: 'pro', credits: 100 }
@@ -231,9 +231,9 @@ interface AdditionalFieldsModule {
     validate(fields: Record<string, unknown>, schema: "user" | "session"): ValidationResult;
 }
 declare function createAdditionalFieldsModule(config: AdditionalFieldsConfig, db: Database): AdditionalFieldsModule;
-declare function additionalFields(config?: AdditionalFieldsConfig): KavachPlugin;
+declare function additionalFields(config?: AdditionalFieldsConfig): TheAuthPlugin;
 
-declare function admin(config?: AdminConfig): KavachPlugin;
+declare function admin(config?: AdminConfig): TheAuthPlugin;
 
 /**
  * Anonymous authentication for TheAuth.
@@ -241,7 +241,7 @@ declare function admin(config?: AdminConfig): KavachPlugin;
  * Lets users start as guests without providing credentials. The anonymous
  * user can later be upgraded to a real account by supplying an email.
  *
- * Anonymous users are stored in `kavach_users` with a synthetic placeholder
+ * Anonymous users are stored in `theauth_users` with a synthetic placeholder
  * email (`anon_<uuid>@theauth.anonymous`) and a metadata flag
  * `{ anonymous: true }`. This satisfies the NOT NULL UNIQUE constraint on
  * the email column while keeping them easily identifiable.
@@ -285,9 +285,9 @@ interface AnonymousAuthModule {
 }
 declare function createAnonymousAuthModule(config: AnonymousAuthConfig, db: Database, sessionManager: SessionManager): AnonymousAuthModule;
 
-declare function anonymousAuth(config?: AnonymousAuthConfig): KavachPlugin;
+declare function anonymousAuth(config?: AnonymousAuthConfig): TheAuthPlugin;
 
-declare function apiKeys(config?: ApiKeyManagerConfig): KavachPlugin;
+declare function apiKeys(config?: ApiKeyManagerConfig): TheAuthPlugin;
 
 interface CostAttributionConfig {
     /** ISO 4217 currency code, default 'USD' */
@@ -386,11 +386,11 @@ declare function createCostAttributionModule(db: Database, config?: CostAttribut
  *
  * @example
  * ```typescript
- * import { createKavach } from '@glinr/theauth';
+ * import { createTheAuth } from '@glinr/theauth';
  * import { customSession } from '@glinr/theauth/auth';
  *
- * const kavach = await createKavach({
- *   database: { provider: 'sqlite', url: 'kavach.db' },
+ * const theauth = await createTheAuth({
+ *   database: { provider: 'sqlite', url: 'theauth.db' },
  *   auth: { session: { secret: process.env.SESSION_SECRET } },
  *   plugins: [
  *     customSession({
@@ -400,8 +400,8 @@ declare function createCostAttributionModule(db: Database, config?: CostAttribut
  *   ],
  * });
  *
- * // After a session is created via kavach.auth.session.create(...)
- * const mod = kavach.plugins.getContext().customSession as CustomSessionModule;
+ * // After a session is created via theauth.auth.session.create(...)
+ * const mod = theauth.plugins.getContext().customSession as CustomSessionModule;
  * const fields = await mod.getSessionFields(session.id);
  * // => { theme: 'dark', lastSeen: 1234567890 }
  * ```
@@ -432,7 +432,7 @@ interface CustomSessionModule {
     updateSessionFields(sessionId: string, fields: Record<string, unknown>): Promise<void>;
 }
 declare function createCustomSessionModule(_config: CustomSessionConfig, db: Database): CustomSessionModule;
-declare function customSession(config?: CustomSessionConfig): KavachPlugin;
+declare function customSession(config?: CustomSessionConfig): TheAuthPlugin;
 
 /**
  * OAuth Device Authorization Grant (RFC 8628) for TheAuth.
@@ -501,9 +501,9 @@ interface DeviceAuthModule {
 }
 declare function createDeviceAuthModule(config: DeviceAuthConfig): DeviceAuthModule;
 
-declare function deviceAuth(config: DeviceAuthConfig): KavachPlugin;
+declare function deviceAuth(config: DeviceAuthConfig): TheAuthPlugin;
 
-declare function emailOtp(config: EmailOtpConfig): KavachPlugin;
+declare function emailOtp(config: EmailOtpConfig): TheAuthPlugin;
 
 /**
  * Ephemeral agent sessions for TheAuth.
@@ -601,7 +601,7 @@ declare function createEphemeralSessionModule(config: EphemeralSessionConfig): E
  * changes, auth events, and anomalies. SOC teams and monitoring systems can
  * subscribe instead of polling the audit API or relying solely on webhooks.
  *
- * Endpoint: GET /api/kavach/events/stream
+ * Endpoint: GET /api/theauth/events/stream
  * Auth: Bearer token via Authorization header or `?token=` query param
  * Filtering: `?types=audit,agent.created`
  * Replay: `?since=2026-01-01T00:00:00Z` or Last-Event-ID header
@@ -677,7 +677,7 @@ declare function createEventStreamModule(config: EventStreamConfig): EventStream
  *
  * Federation tokens are short-lived JWTs signed by the source instance.
  * The target instance verifies them by fetching the source's public key
- * from `/.well-known/kavach-federation.json`. Optionally, a Verifiable
+ * from `/.well-known/theauth-federation.json`. Optionally, a Verifiable
  * Credential can be embedded for offline verification.
  *
  * @example
@@ -774,7 +774,7 @@ interface IssueFederationTokenInput {
     /** Optional VC JWT to embed */
     credential?: string;
 }
-/** The well-known document served at /.well-known/kavach-federation.json */
+/** The well-known document served at /.well-known/theauth-federation.json */
 interface FederationWellKnown {
     instanceId: string;
     instanceUrl: string;
@@ -925,17 +925,17 @@ declare function createGdprModule(db: Database): GdprModule;
  *
  * @example
  * ```typescript
- * import { createKavach } from '@glinr/theauth';
+ * import { createTheAuth } from '@glinr/theauth';
  * import { gdpr } from '@glinr/theauth/auth';
  *
- * const kavach = await createKavach({
- *   database: { provider: 'sqlite', url: 'kavach.db' },
+ * const theauth = await createTheAuth({
+ *   database: { provider: 'sqlite', url: 'theauth.db' },
  *   plugins: [gdpr()],
  * });
  * ```
  */
 
-declare function gdpr(): KavachPlugin;
+declare function gdpr(): TheAuthPlugin;
 
 /**
  * Have I Been Pwned password checking for TheAuth.
@@ -1218,7 +1218,7 @@ interface LastLoginModule {
  */
 declare function createLastLoginModule(config: LastLoginConfig, db: Database): LastLoginModule;
 
-declare function magicLink(config: MagicLinkConfig): KavachPlugin;
+declare function magicLink(config: MagicLinkConfig): TheAuthPlugin;
 
 /**
  * Types for the OAuth 2.0 / OIDC provider system.
@@ -1401,8 +1401,8 @@ interface OAuthAccount {
  * 3. `linkAccount` — manually link provider tokens to an existing user.
  * 4. `findLinkedUser` — look up which user owns a provider account.
  *
- * All state operations use the `kavach_oauth_states` table; all account links
- * use the `kavach_oauth_accounts` table — both defined in `./schema.ts`.
+ * All state operations use the `theauth_oauth_states` table; all account links
+ * use the `theauth_oauth_accounts` table — both defined in `./schema.ts`.
  */
 
 /**
@@ -1440,7 +1440,7 @@ interface OAuthPluginConfig extends OAuthModuleConfig {
      */
     buildRedirectUri?: (provider: string, baseUrl: string) => string;
 }
-declare function oauth(config: OAuthPluginConfig): KavachPlugin;
+declare function oauth(config: OAuthPluginConfig): TheAuthPlugin;
 
 /**
  * Apple Sign In provider (OAuth 2.0 / OIDC).
@@ -2437,7 +2437,7 @@ interface OAuthProxyPluginConfig extends OAuthProxyConfig {
      */
     providers: Record<string, OAuthProvider>;
 }
-declare function oauthProxy(config: OAuthProxyPluginConfig): KavachPlugin;
+declare function oauthProxy(config: OAuthProxyPluginConfig): TheAuthPlugin;
 
 /**
  * OIDC Provider module for TheAuth.
@@ -2620,8 +2620,8 @@ declare function createOidcProviderModule(config: OidcProviderConfig, db: Databa
  *
  * @example
  * ```typescript
- * const kavach = await createKavach({
- *   database: { provider: 'sqlite', url: 'kavach.db' },
+ * const theauth = await createTheAuth({
+ *   database: { provider: 'sqlite', url: 'theauth.db' },
  *   auth: { session: { secret: process.env.SESSION_SECRET } },
  * });
  *
@@ -2675,13 +2675,13 @@ declare class OneTapVerifyError extends Error {
 }
 declare function createOneTapModule(config: OneTapConfig, db: Database, sessionManager: SessionManager): OneTapModule;
 
-declare function oneTap(config: OneTapConfig): KavachPlugin;
+declare function oneTap(config: OneTapConfig): TheAuthPlugin;
 
 /**
  * OpenAPI 3.1 spec generation plugin for TheAuth.
  *
  * Generates a complete OpenAPI document from TheAuth's registered auth
- * endpoints. Useful for serving at `/api/kavach/openapi.json` or wiring
+ * endpoints. Useful for serving at `/api/theauth/openapi.json` or wiring
  * into Swagger UI / Scalar.
  *
  * @example
@@ -2710,7 +2710,7 @@ interface OpenApiConfig {
     description?: string;
     /** Server base URL. Default: "/" */
     serverUrl?: string;
-    /** Path prefix for all TheAuth endpoints. Default: "/api/kavach" */
+    /** Path prefix for all TheAuth endpoints. Default: "/api/theauth" */
     basePath?: string;
     /**
      * Limit which endpoint groups are included in the spec.
@@ -2819,9 +2819,9 @@ interface OpenApiModule {
  */
 declare function createOpenApiModule(): OpenApiModule;
 
-declare function organization(config?: OrgConfig): KavachPlugin;
+declare function organization(config?: OrgConfig): TheAuthPlugin;
 
-declare function passkey(config: PasskeyConfig): KavachPlugin;
+declare function passkey(config: PasskeyConfig): TheAuthPlugin;
 
 /**
  * Polar payment integration for TheAuth.
@@ -2886,7 +2886,7 @@ interface PolarModule {
 }
 declare function createPolarModule(config: PolarConfig, db: Database): PolarModule;
 
-declare function polar(config: PolarConfig): KavachPlugin;
+declare function polar(config: PolarConfig): TheAuthPlugin;
 
 /**
  * Shared store interface for the rateLimit() plugin.
@@ -2916,11 +2916,11 @@ interface RateLimitStore {
  *
  * @example
  * ```typescript
- * import { createKavach } from '@glinr/theauth';
+ * import { createTheAuth } from '@glinr/theauth';
  * import { rateLimit } from '@glinr/theauth/auth';
  * import { kvStore } from '@glinr/theauth/auth/stores/kv';
  *
- * const kavach = createKavach({
+ * const theauth = createTheAuth({
  *   plugins: [
  *     rateLimit({
  *       signIn:        { window: '15m', max: 10 },
@@ -2970,7 +2970,7 @@ interface RateLimitConfig$1 {
      */
     onLimit?: (request: Request, retryAfter: number) => Response;
 }
-declare function rateLimit(config?: RateLimitConfig$1): KavachPlugin;
+declare function rateLimit(config?: RateLimitConfig$1): TheAuthPlugin;
 
 /**
  * In-memory sliding window rate limiter for auth endpoints.
@@ -3128,7 +3128,7 @@ declare function createReBACModule(config: ReBACConfig, db: Database): ReBACModu
  * providers (Okta, Azure AD, Google Workspace) to provision and deprovision
  * users and groups automatically.
  *
- * Users map to kavach_users. Groups map to kavach_organizations.
+ * Users map to theauth_users. Groups map to theauth_organizations.
  *
  * @example
  * ```typescript
@@ -3157,6 +3157,26 @@ interface ScimConfig {
     onProvision?: (user: ScimUser) => Promise<void>;
     /** Callback when user is deprovisioned */
     onDeprovision?: (userId: string) => Promise<void>;
+    /**
+     * Resolves the user id the current request speaks for. Required to enable
+     * `GET /scim/v2/Me`. If omitted, `/Me` returns 501 with a clear detail.
+     * The resolver should derive the id from the bearer token or associated
+     * session and return `null` when the caller is not tied to a user.
+     */
+    resolveSelf?: (request: Request) => Promise<string | null>;
+    /**
+     * Audit every SCIM provisioning write. When configured, each
+     * POST/PUT/PATCH/DELETE on /Users or /Groups writes an `auditLogs` row
+     * attributed to `agentId`. The caller is responsible for pre-creating a
+     * system agent and passing its id. Set `enabled: false` to turn off
+     * writes without deleting the agent (useful in tests).
+     */
+    audit?: {
+        /** FK to kavach_agents.id — typically a dedicated "scim-provisioner" system agent. */
+        agentId: string;
+        /** Defaults to true when `audit` is set. */
+        enabled?: boolean;
+    };
 }
 interface ScimUser {
     id: string;
@@ -3196,11 +3216,11 @@ declare function createScimModule(config: ScimConfig, db: Database): ScimModule;
  *
  * @example
  * ```typescript
- * import { createKavach } from '@glinr/theauth';
+ * import { createTheAuth } from '@glinr/theauth';
  * import { scim } from '@glinr/theauth/auth';
  *
- * const kavach = await createKavach({
- *   database: { provider: 'sqlite', url: 'kavach.db' },
+ * const theauth = await createTheAuth({
+ *   database: { provider: 'sqlite', url: 'theauth.db' },
  *   plugins: [
  *     scim({
  *       bearerToken: process.env.SCIM_TOKEN,
@@ -3212,7 +3232,7 @@ declare function createScimModule(config: ScimConfig, db: Database): ScimModule;
  * });
  * ```
  */
-declare function scim(config: ScimConfig): KavachPlugin;
+declare function scim(config: ScimConfig): TheAuthPlugin;
 
 /**
  * Sign In With Ethereum (SIWE) for TheAuth.
@@ -3276,7 +3296,7 @@ interface SiweVerifyResult {
 }
 declare function createSiweModule(config: SiweConfig): SiweModule;
 
-declare function siwe(config: SiweConfig): KavachPlugin;
+declare function siwe(config: SiweConfig): TheAuthPlugin;
 
 /**
  * Cloudflare KV rate limit store.
@@ -3400,10 +3420,10 @@ interface StripeModule {
 }
 declare function createStripeModule(config: StripeConfig, db: Database): StripeModule;
 
-declare function stripe(config: StripeConfig): KavachPlugin;
+declare function stripe(config: StripeConfig): TheAuthPlugin;
 
 type TwoFactorConfig = TotpConfig;
-declare function twoFactor(config?: TwoFactorConfig): KavachPlugin;
+declare function twoFactor(config?: TwoFactorConfig): TheAuthPlugin;
 
 /**
  * Trusted device windows for 2FA in TheAuth.