@glinr/theauth 0.4.2 → 0.6.0

package/dist/auth/index.js

@@ -93,7 +93,7 @@ function headerAuth(options) {
     }
   };
 }
-var users = sqliteTable("kavach_users", {
+var users = sqliteTable("theauth_users", {
   id: text("id").primaryKey(),
   email: text("email").notNull().unique(),
   name: text("name"),
@@ -109,14 +109,14 @@ var users = sqliteTable("kavach_users", {
   banExpiresAt: integer("ban_expires_at", { mode: "timestamp" }),
   forcePasswordReset: integer("force_password_reset").notNull().default(0),
   emailVerified: integer("email_verified").notNull().default(0),
-  // Stripe integration fields (populated by kavach-stripe plugin)
+  // Stripe integration fields (populated by theauth-stripe plugin)
   stripeCustomerId: text("stripe_customer_id").unique(),
   stripeSubscriptionId: text("stripe_subscription_id"),
   stripeSubscriptionStatus: text("stripe_subscription_status"),
   stripePriceId: text("stripe_price_id"),
   stripeCurrentPeriodEnd: integer("stripe_current_period_end", { mode: "timestamp" }),
   stripeCancelAtPeriodEnd: integer("stripe_cancel_at_period_end", { mode: "boolean" }).notNull().default(false),
-  // Polar integration fields (populated by kavach-polar plugin)
+  // Polar integration fields (populated by theauth-polar plugin)
   polarCustomerId: text("polar_customer_id").unique(),
   polarSubscriptionId: text("polar_subscription_id"),
   polarSubscriptionStatus: text("polar_subscription_status"),
@@ -126,7 +126,7 @@ var users = sqliteTable("kavach_users", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var tenants = sqliteTable("kavach_tenants", {
+var tenants = sqliteTable("theauth_tenants", {
   id: text("id").primaryKey(),
   name: text("name").notNull(),
   slug: text("slug").notNull().unique(),
@@ -135,7 +135,7 @@ var tenants = sqliteTable("kavach_tenants", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var agents = sqliteTable("kavach_agents", {
+var agents = sqliteTable("theauth_agents", {
   id: text("id").primaryKey(),
   ownerId: text("owner_id").notNull().references(() => users.id),
   tenantId: text("tenant_id").references(() => tenants.id),
@@ -153,7 +153,7 @@ var agents = sqliteTable("kavach_agents", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var permissions = sqliteTable("kavach_permissions", {
+var permissions = sqliteTable("theauth_permissions", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   resource: text("resource").notNull(),
@@ -165,7 +165,7 @@ var permissions = sqliteTable("kavach_permissions", {
   relation: text("relation"),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var delegationChains = sqliteTable("kavach_delegation_chains", {
+var delegationChains = sqliteTable("theauth_delegation_chains", {
   id: text("id").primaryKey(),
   fromAgentId: text("from_agent_id").notNull().references(() => agents.id),
   toAgentId: text("to_agent_id").notNull().references(() => agents.id),
@@ -176,7 +176,7 @@ var delegationChains = sqliteTable("kavach_delegation_chains", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var auditLogs = sqliteTable("kavach_audit_logs", {
+var auditLogs = sqliteTable("theauth_audit_logs", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id),
   userId: text("user_id").notNull().references(() => users.id),
@@ -196,14 +196,14 @@ var auditLogs = sqliteTable("kavach_audit_logs", {
   cacheHit: integer("cache_hit", { mode: "boolean" }).notNull().default(false),
   timestamp: integer("timestamp", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_rate_limits", {
+sqliteTable("theauth_rate_limits", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   resource: text("resource").notNull(),
   windowStart: integer("window_start", { mode: "timestamp" }).notNull(),
   count: integer("count").notNull().default(0)
 });
-sqliteTable("kavach_mcp_servers", {
+sqliteTable("theauth_mcp_servers", {
   id: text("id").primaryKey(),
   name: text("name").notNull(),
   endpoint: text("endpoint").notNull().unique(),
@@ -214,14 +214,14 @@ sqliteTable("kavach_mcp_servers", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var sessions = sqliteTable("kavach_sessions", {
+var sessions = sqliteTable("theauth_sessions", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id),
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   metadata: text("metadata", { mode: "json" }).$type(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var oauthClients = sqliteTable("kavach_oauth_clients", {
+var oauthClients = sqliteTable("theauth_oauth_clients", {
   id: text("id").primaryKey(),
   clientId: text("client_id").notNull().unique(),
   clientSecret: text("client_secret"),
@@ -238,7 +238,7 @@ var oauthClients = sqliteTable("kavach_oauth_clients", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var oauthAccessTokens = sqliteTable("kavach_oauth_access_tokens", {
+var oauthAccessTokens = sqliteTable("theauth_oauth_access_tokens", {
   id: text("id").primaryKey(),
   accessToken: text("access_token").notNull().unique(),
   refreshToken: text("refresh_token").unique(),
@@ -252,7 +252,7 @@ var oauthAccessTokens = sqliteTable("kavach_oauth_access_tokens", {
   refreshTokenExpiresAt: integer("refresh_token_expires_at", { mode: "timestamp" }),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var oauthAuthorizationCodes = sqliteTable("kavach_oauth_authorization_codes", {
+var oauthAuthorizationCodes = sqliteTable("theauth_oauth_authorization_codes", {
   id: text("id").primaryKey(),
   code: text("code").notNull().unique(),
   clientId: text("client_id").notNull().references(() => oauthClients.clientId),
@@ -268,7 +268,7 @@ var oauthAuthorizationCodes = sqliteTable("kavach_oauth_authorization_codes", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var budgetPolicies = sqliteTable("kavach_budget_policies", {
+var budgetPolicies = sqliteTable("theauth_budget_policies", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").references(() => agents.id, { onDelete: "cascade" }),
   // nullable
@@ -282,7 +282,7 @@ var budgetPolicies = sqliteTable("kavach_budget_policies", {
   status: text("status", { enum: ["active", "triggered", "disabled"] }).notNull().default("active"),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_agent_cards", {
+sqliteTable("theauth_agent_cards", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   name: text("name").notNull(),
@@ -296,7 +296,7 @@ sqliteTable("kavach_agent_cards", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var approvalRequests = sqliteTable("kavach_approval_requests", {
+var approvalRequests = sqliteTable("theauth_approval_requests", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   userId: text("user_id").notNull().references(() => users.id),
@@ -309,7 +309,7 @@ var approvalRequests = sqliteTable("kavach_approval_requests", {
   respondedBy: text("responded_by"),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_trust_scores", {
+sqliteTable("theauth_trust_scores", {
   agentId: text("agent_id").primaryKey().references(() => agents.id, { onDelete: "cascade" }),
   score: integer("score").notNull(),
   level: text("level", {
@@ -318,7 +318,7 @@ sqliteTable("kavach_trust_scores", {
   factors: text("factors", { mode: "json" }).notNull().$type(),
   computedAt: integer("computed_at", { mode: "timestamp" }).notNull()
 });
-var magicLinks = sqliteTable("kavach_magic_links", {
+var magicLinks = sqliteTable("theauth_magic_links", {
   id: text("id").primaryKey(),
   email: text("email").notNull(),
   token: text("token").notNull().unique(),
@@ -326,7 +326,7 @@ var magicLinks = sqliteTable("kavach_magic_links", {
   used: integer("used", { mode: "boolean" }).notNull().default(false),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var emailOtps = sqliteTable("kavach_email_otps", {
+var emailOtps = sqliteTable("theauth_email_otps", {
   id: text("id").primaryKey(),
   email: text("email").notNull(),
   codeHash: text("code_hash").notNull(),
@@ -334,7 +334,7 @@ var emailOtps = sqliteTable("kavach_email_otps", {
   attempts: integer("attempts").notNull().default(0),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var totpRecords = sqliteTable("kavach_totp", {
+var totpRecords = sqliteTable("theauth_totp", {
   userId: text("user_id").primaryKey().references(() => users.id),
   secret: text("secret").notNull(),
   // base32-encoded TOTP secret
@@ -343,7 +343,7 @@ var totpRecords = sqliteTable("kavach_totp", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var organizations = sqliteTable("kavach_organizations", {
+var organizations = sqliteTable("theauth_organizations", {
   id: text("id").primaryKey(),
   name: text("name").notNull(),
   slug: text("slug").notNull().unique(),
@@ -352,14 +352,14 @@ var organizations = sqliteTable("kavach_organizations", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var orgMembers = sqliteTable("kavach_org_members", {
+var orgMembers = sqliteTable("theauth_org_members", {
   id: text("id").primaryKey(),
   orgId: text("org_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
   userId: text("user_id").notNull().references(() => users.id),
   role: text("role").notNull().default("member"),
   joinedAt: integer("joined_at", { mode: "timestamp" }).notNull()
 });
-var orgInvitations = sqliteTable("kavach_org_invitations", {
+var orgInvitations = sqliteTable("theauth_org_invitations", {
   id: text("id").primaryKey(),
   orgId: text("org_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
   email: text("email").notNull(),
@@ -369,13 +369,13 @@ var orgInvitations = sqliteTable("kavach_org_invitations", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var orgRoles = sqliteTable("kavach_org_roles", {
+var orgRoles = sqliteTable("theauth_org_roles", {
   id: text("id").primaryKey(),
   orgId: text("org_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
   name: text("name").notNull(),
   permissions: text("permissions", { mode: "json" }).notNull().$type()
 });
-var passkeyCredentials = sqliteTable("kavach_passkey_credentials", {
+var passkeyCredentials = sqliteTable("theauth_passkey_credentials", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id),
   credentialId: text("credential_id").notNull().unique(),
@@ -388,7 +388,7 @@ var passkeyCredentials = sqliteTable("kavach_passkey_credentials", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   lastUsedAt: integer("last_used_at", { mode: "timestamp" }).notNull()
 });
-var ssoConnections = sqliteTable("kavach_sso_connections", {
+var ssoConnections = sqliteTable("theauth_sso_connections", {
   id: text("id").primaryKey(),
   orgId: text("org_id").notNull(),
   providerId: text("provider_id").notNull(),
@@ -397,7 +397,7 @@ var ssoConnections = sqliteTable("kavach_sso_connections", {
   enabled: integer("enabled").notNull().default(1),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var apiKeys = sqliteTable("kavach_api_keys", {
+var apiKeys = sqliteTable("theauth_api_keys", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id),
   name: text("name").notNull(),
@@ -408,7 +408,7 @@ var apiKeys = sqliteTable("kavach_api_keys", {
   lastUsedAt: integer("last_used_at", { mode: "timestamp" }),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var passkeyChallenges = sqliteTable("kavach_passkey_challenges", {
+var passkeyChallenges = sqliteTable("theauth_passkey_challenges", {
   id: text("id").primaryKey(),
   challenge: text("challenge").notNull().unique(),
   userId: text("user_id"),
@@ -417,7 +417,7 @@ var passkeyChallenges = sqliteTable("kavach_passkey_challenges", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var usernameAccounts = sqliteTable("kavach_username_accounts", {
+var usernameAccounts = sqliteTable("theauth_username_accounts", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   username: text("username").notNull().unique(),
@@ -425,7 +425,7 @@ var usernameAccounts = sqliteTable("kavach_username_accounts", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var phoneVerifications = sqliteTable("kavach_phone_verifications", {
+var phoneVerifications = sqliteTable("theauth_phone_verifications", {
   id: text("id").primaryKey(),
   phoneNumber: text("phone_number").notNull(),
   codeHash: text("code_hash").notNull(),
@@ -433,7 +433,7 @@ var phoneVerifications = sqliteTable("kavach_phone_verifications", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var trustedDevices = sqliteTable("kavach_trusted_devices", {
+var trustedDevices = sqliteTable("theauth_trusted_devices", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   fingerprint: text("fingerprint").notNull(),
@@ -443,7 +443,7 @@ var trustedDevices = sqliteTable("kavach_trusted_devices", {
   trustedAt: integer("trusted_at", { mode: "timestamp" }).notNull(),
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull()
 });
-var oneTimeTokens = sqliteTable("kavach_one_time_tokens", {
+var oneTimeTokens = sqliteTable("theauth_one_time_tokens", {
   id: text("id").primaryKey(),
   tokenHash: text("token_hash").notNull().unique(),
   // SHA-256 hex of the raw token
@@ -457,7 +457,7 @@ var oneTimeTokens = sqliteTable("kavach_one_time_tokens", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var loginHistory = sqliteTable("kavach_login_history", {
+var loginHistory = sqliteTable("theauth_login_history", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   method: text("method").notNull(),
@@ -466,7 +466,7 @@ var loginHistory = sqliteTable("kavach_login_history", {
   userAgent: text("user_agent"),
   timestamp: integer("timestamp", { mode: "timestamp_ms" }).notNull()
 });
-sqliteTable("kavach_agent_dids", {
+sqliteTable("theauth_agent_dids", {
   agentId: text("agent_id").primaryKey().references(() => agents.id, { onDelete: "cascade" }),
   did: text("did").notNull().unique(),
   method: text("method", { enum: ["key", "web"] }).notNull(),
@@ -476,7 +476,7 @@ sqliteTable("kavach_agent_dids", {
   // JSON-serialised DID Document
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var oidcClients = sqliteTable("kavach_oidc_clients", {
+var oidcClients = sqliteTable("theauth_oidc_clients", {
   id: text("id").primaryKey(),
   clientId: text("client_id").notNull().unique(),
   clientSecretHash: text("client_secret_hash").notNull(),
@@ -490,7 +490,7 @@ var oidcClients = sqliteTable("kavach_oidc_clients", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var oidcAuthCodes = sqliteTable("kavach_oidc_auth_codes", {
+var oidcAuthCodes = sqliteTable("theauth_oidc_auth_codes", {
   id: text("id").primaryKey(),
   codeHash: text("code_hash").notNull().unique(),
   // SHA-256 hex of the raw code
@@ -507,7 +507,7 @@ var oidcAuthCodes = sqliteTable("kavach_oidc_auth_codes", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var oidcRefreshTokens = sqliteTable("kavach_oidc_refresh_tokens", {
+var oidcRefreshTokens = sqliteTable("theauth_oidc_refresh_tokens", {
   id: text("id").primaryKey(),
   tokenHash: text("token_hash").notNull().unique(),
   // SHA-256 hex of the raw token
@@ -519,7 +519,7 @@ var oidcRefreshTokens = sqliteTable("kavach_oidc_refresh_tokens", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var costEvents = sqliteTable("kavach_cost_events", {
+var costEvents = sqliteTable("theauth_cost_events", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   tool: text("tool").notNull(),
@@ -534,7 +534,7 @@ var costEvents = sqliteTable("kavach_cost_events", {
   // null when not part of a chain
   recordedAt: integer("recorded_at", { mode: "timestamp" }).notNull()
 });
-var ephemeralSessions = sqliteTable("kavach_ephemeral_sessions", {
+var ephemeralSessions = sqliteTable("theauth_ephemeral_sessions", {
   id: text("id").primaryKey(),
   agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
   ownerId: text("owner_id").notNull().references(() => users.id),
@@ -548,7 +548,7 @@ var ephemeralSessions = sqliteTable("kavach_ephemeral_sessions", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var streamEvents = sqliteTable("kavach_stream_events", {
+var streamEvents = sqliteTable("theauth_stream_events", {
   id: text("id").primaryKey(),
   type: text("type").notNull(),
   timestamp: integer("timestamp", { mode: "timestamp" }).notNull(),
@@ -556,7 +556,7 @@ var streamEvents = sqliteTable("kavach_stream_events", {
   agentId: text("agent_id"),
   userId: text("user_id")
 });
-var jwtRefreshTokens = sqliteTable("kavach_jwt_refresh_tokens", {
+var jwtRefreshTokens = sqliteTable("theauth_jwt_refresh_tokens", {
   id: text("id").primaryKey(),
   /** SHA-256 hex of the raw refresh token. The raw token is never stored. */
   tokenHash: text("token_hash").notNull().unique(),
@@ -567,7 +567,7 @@ var jwtRefreshTokens = sqliteTable("kavach_jwt_refresh_tokens", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var rebacResources = sqliteTable("kavach_rebac_resources", {
+var rebacResources = sqliteTable("theauth_rebac_resources", {
   id: text("id").notNull().primaryKey(),
   type: text("type").notNull(),
   // 'org', 'workspace', 'project', 'document', etc.
@@ -575,7 +575,7 @@ var rebacResources = sqliteTable("kavach_rebac_resources", {
   parentType: text("parent_type"),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var rebacRelationships = sqliteTable("kavach_rebac_relationships", {
+var rebacRelationships = sqliteTable("theauth_rebac_relationships", {
   id: text("id").primaryKey(),
   subjectType: text("subject_type").notNull(),
   // 'user', 'agent', 'team', 'role'
@@ -586,7 +586,7 @@ var rebacRelationships = sqliteTable("kavach_rebac_relationships", {
   objectId: text("object_id").notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_federation_instances", {
+sqliteTable("theauth_federation_instances", {
   id: text("id").primaryKey(),
   instanceId: text("instance_id").notNull().unique(),
   instanceUrl: text("instance_url").notNull(),
@@ -597,7 +597,7 @@ sqliteTable("kavach_federation_instances", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_federation_tokens", {
+sqliteTable("theauth_federation_tokens", {
   id: text("id").primaryKey(),
   tokenJti: text("token_jti").notNull().unique(),
   // JWT ID for dedup
@@ -611,7 +611,7 @@ sqliteTable("kavach_federation_tokens", {
   expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-var refreshTokenFamilies = sqliteTable("kavach_refresh_token_families", {
+var refreshTokenFamilies = sqliteTable("theauth_refresh_token_families", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   /** Absolute session expiry — no rotation can extend beyond this date. */
@@ -620,7 +620,7 @@ var refreshTokenFamilies = sqliteTable("kavach_refresh_token_families", {
   revoked: integer("revoked").notNull().default(0),
   createdAt: integer("created_at", { mode: "timestamp" }).notNull()
 });
-sqliteTable("kavach_refresh_tokens", {
+sqliteTable("theauth_refresh_tokens", {
   id: text("id").primaryKey(),
   familyId: text("family_id").notNull().references(() => refreshTokenFamilies.id, { onDelete: "cascade" }),
   /** SHA-256 hash of the opaque token — never store the raw token. */
@@ -728,7 +728,7 @@ function createAdditionalFieldsModule(config, db) {
 }
 function additionalFields(config = {}) {
   return {
-    id: "kavach-additional-fields",
+    id: "theauth-additional-fields",
     async init(ctx) {
       const mod = createAdditionalFieldsModule(config, ctx.db);
       ctx.addEndpoint({
@@ -1081,7 +1081,7 @@ function buildSetCookie(name, value, maxAge, path = "/", secure = true) {
 // src/auth/admin-plugin.ts
 function admin(config) {
   return {
-    id: "kavach-admin",
+    id: "theauth-admin",
     async init(ctx) {
       const module = createAdminModule(config ?? {}, ctx.db, ctx.sessionManager ?? null);
       ctx.addEndpoint({
@@ -1510,7 +1510,7 @@ function createAnonymousAuthModule(config, db, sessionManager) {
 // src/auth/anonymous-plugin.ts
 function anonymousAuth(config) {
   return {
-    id: "kavach-anonymous",
+    id: "theauth-anonymous",
     async init(ctx) {
       if (!ctx.sessionManager) {
         throw new Error("anonymousAuth plugin requires auth.session.secret to be configured");
@@ -1521,7 +1521,7 @@ function anonymousAuth(config) {
         path: "/auth/anonymous",
         metadata: {
           description: "Create an anonymous guest user and return a session token",
-          rateLimit: { window: 6e4, max: 20 }
+          rateLimit: { window: 60, max: 20 }
         },
         async handler(_request, _endpointCtx) {
           try {
@@ -1745,7 +1745,7 @@ function createApiKeyManagerModule(config, db) {
 // src/auth/api-key-plugin.ts
 function apiKeys2(config) {
   return {
-    id: "kavach-api-key",
+    id: "theauth-api-key",
     async init(ctx) {
       const module = createApiKeyManagerModule(config ?? {}, ctx.db);
       ctx.addEndpoint({
@@ -2214,7 +2214,7 @@ function createCustomSessionModule(_config, db) {
 }
 function customSession(config = {}) {
   return {
-    id: "kavach-custom-session",
+    id: "theauth-custom-session",
     hooks: {
       /**
        * Fired by the plugin runner after a session record is inserted.
@@ -2531,7 +2531,7 @@ function createDeviceAuthModule(config) {
 }
 function deviceAuth(config) {
   return {
-    id: "kavach-device-auth",
+    id: "theauth-device-auth",
     async init(ctx) {
       const mod = createDeviceAuthModule(config);
       ctx.addEndpoint({
@@ -2539,7 +2539,7 @@ function deviceAuth(config) {
         path: "/auth/device/code",
         metadata: {
           description: "Request a device code and user code for the device authorization flow",
-          rateLimit: { window: 6e4, max: 30 }
+          rateLimit: { window: 60, max: 30 }
         },
         async handler(_request, _endpointCtx) {
           const response = await mod.requestCode();
@@ -2561,7 +2561,7 @@ function deviceAuth(config) {
         path: "/auth/device/token",
         metadata: {
           description: "Poll for device authorization status (RFC 8628)",
-          rateLimit: { window: 1e4, max: 5 }
+          rateLimit: { window: 10, max: 5 }
         },
         async handler(request, _endpointCtx) {
           let body;
@@ -2799,11 +2799,11 @@ function createEmailOtpModule(config, db, sessionManager) {
 // src/auth/email-otp-plugin.ts
 function emailOtp(config) {
   return {
-    id: "kavach-email-otp",
+    id: "theauth-email-otp",
     async init(ctx) {
       if (!ctx.sessionManager) {
         throw new Error(
-          "kavach-email-otp plugin requires auth.session to be configured so that sessions can be issued on successful verification."
+          "theauth-email-otp plugin requires auth.session to be configured so that sessions can be issued on successful verification."
         );
       }
       const module = createEmailOtpModule(config, ctx.db, ctx.sessionManager);
@@ -3492,8 +3492,8 @@ data: ${JSON.stringify({ clientId, timestamp: (/* @__PURE__ */ new Date()).toISO
   return { emit, handleRequest, getConnectionCount, replay, close };
 }
 var DEFAULT_TOKEN_TTL_SECONDS2 = 300;
-var WELL_KNOWN_PATH = "/.well-known/kavach-federation.json";
-var FEDERATION_TOKEN_TYPE = "kavach-federation+jwt";
+var WELL_KNOWN_PATH = "/.well-known/theauth-federation.json";
+var FEDERATION_TOKEN_TYPE = "theauth-federation+jwt";
 var TrustLevelSchema = z.enum(["full", "limited", "verify-only"]);
 var TrustedInstanceSchema = z.object({
   instanceId: z.string().min(1),
@@ -3569,8 +3569,8 @@ function createFederationModule(config) {
       const now = Math.floor(Date.now() / 1e3);
       const exp = now + tokenTtlSeconds;
       const payload = {
-        kavach_instance: instanceId,
-        kavach_instance_url: instanceUrl,
+        theauth_instance: instanceId,
+        theauth_instance_url: instanceUrl,
         permissions: permissions2,
         trust_score: trustScore,
         delegation_scope: delegationScope,
@@ -3693,7 +3693,7 @@ function createFederationModule(config) {
         data: {
           agentId,
           sourceInstance: sourceInstanceId,
-          sourceInstanceUrl: claims.kavach_instance_url ?? "",
+          sourceInstanceUrl: claims.theauth_instance_url ?? "",
           permissions: permissions2,
           trustScore: effectiveTrustScore,
           delegationScope,
@@ -4009,7 +4009,7 @@ function createGdprModule(db) {
 // src/auth/gdpr-plugin.ts
 function gdpr() {
   return {
-    id: "kavach-gdpr",
+    id: "theauth-gdpr",
     async init(ctx) {
       const module = createGdprModule(ctx.db);
       ctx.addEndpoint({
@@ -4800,11 +4800,11 @@ function createRateLimiter(config) {
 // src/auth/magic-link-plugin.ts
 function magicLink(config) {
   return {
-    id: "kavach-magic-link",
+    id: "theauth-magic-link",
     async init(ctx) {
       if (!ctx.sessionManager) {
         throw new Error(
-          "kavach-magic-link plugin requires auth.session to be configured so that sessions can be issued on successful verification."
+          "theauth-magic-link plugin requires auth.session to be configured so that sessions can be issued on successful verification."
         );
       }
       const module = createMagicLinkModule(config, ctx.db, ctx.sessionManager);
@@ -4876,7 +4876,7 @@ function base64url(bytes) {
   }
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-var oauthAccounts = sqliteTable("kavach_oauth_accounts", {
+var oauthAccounts = sqliteTable("theauth_oauth_accounts", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   /** Provider machine ID, e.g. `'google'`, `'github'`. */
@@ -4892,7 +4892,7 @@ var oauthAccounts = sqliteTable("kavach_oauth_accounts", {
   createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
   updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
 });
-var oauthStates = sqliteTable("kavach_oauth_states", {
+var oauthStates = sqliteTable("theauth_oauth_states", {
   /** Random, opaque state value sent as the `state` query parameter. */
   state: text("state").primaryKey(),
   /** PKCE code verifier (plain text — never sent to the provider). */
@@ -4994,7 +4994,7 @@ function createOAuthModule(db, config) {
     await db.insert(oauthAccounts).values({
       id: accountId,
       // userId will be set by the caller via linkAccount once they know the
-      // kavach user ID.  We use a placeholder that foreign-key-checks will
+      // theauth user ID.  We use a placeholder that foreign-key-checks will
       // reject on real databases — callers MUST call linkAccount.
       userId: "__pending__",
       provider: providerId,
@@ -5089,14 +5089,14 @@ function redirectResponse(url) {
 }
 function oauth(config) {
   return {
-    id: "kavach-oauth",
+    id: "theauth-oauth",
     async init(ctx) {
       const module = createOAuthModule(ctx.db, config);
       const baseUrl = ctx.config.baseUrl ?? "";
       const sessionManager = ctx.sessionManager;
       if (!sessionManager) {
         throw new Error(
-          "kavach-oauth plugin requires auth.session to be configured so that sessions can be issued on successful OAuth callback."
+          "theauth-oauth plugin requires auth.session to be configured so that sessions can be issued on successful OAuth callback."
         );
       }
       const authorizeLimiter = createRateLimiter({ max: 20, window: 60 });
@@ -5180,7 +5180,7 @@ function oauth(config) {
               const { session, token } = await sessionManager.create(userId);
               const maxAge = Math.floor((session.expiresAt.getTime() - Date.now()) / 1e3);
               const isSecure = baseUrl.startsWith("https://");
-              const cookie = buildSetCookie("kavach_session", token, maxAge, "/", isSecure);
+              const cookie = buildSetCookie("theauth_session", token, maxAge, "/", isSecure);
               const userInfo = encodeURIComponent(JSON.stringify({ id: userId, email }));
               const callbackUrl = `${baseUrl}/?auth_user=${userInfo}`;
               return new Response(null, {
@@ -7755,7 +7755,7 @@ var OAuthProxyError = class extends Error {
 // src/auth/oauth-proxy-plugin.ts
 function oauthProxy(config) {
   return {
-    id: "kavach-oauth-proxy",
+    id: "theauth-oauth-proxy",
     async init(ctx) {
       const baseUrl = ctx.config.baseUrl;
       if (!baseUrl) {
@@ -7770,7 +7770,7 @@ function oauthProxy(config) {
         metadata: {
           description: "Start an OAuth proxy flow for a mobile app. Returns the provider authorization URL.",
           rateLimit: {
-            window: (config.rateLimit?.windowSeconds ?? 60) * 1e3,
+            window: config.rateLimit?.windowSeconds ?? 60,
             max: config.rateLimit?.max ?? 20
           }
         },
@@ -7886,7 +7886,7 @@ function createOidcProviderModule(config, db, getUserClaims) {
           jwk = { ...config.signingKey };
         }
         const { d, p, q, dp, dq, qi, k, ...publicComponents } = jwk;
-        return { ...publicComponents, alg: signingAlg, use: "sig", kid: "kavach-oidc-1" };
+        return { ...publicComponents, alg: signingAlg, use: "sig", kid: "theauth-oidc-1" };
       })();
     }
     return publicJwkPromise;
@@ -8209,7 +8209,7 @@ function createOidcProviderModule(config, db, getUserClaims) {
     const accessTokenBuilder = new jose2.SignJWT({
       scope: scopes.join(" "),
       client_id: clientId
-    }).setProtectedHeader({ alg: signingAlg, kid: "kavach-oidc-1" }).setIssuer(issuer).setSubject(userId).setAudience(clientId).setIssuedAt(now).setExpirationTime(now + accessTokenTtl).setJti(jti);
+    }).setProtectedHeader({ alg: signingAlg, kid: "theauth-oidc-1" }).setIssuer(issuer).setSubject(userId).setAudience(clientId).setIssuedAt(now).setExpirationTime(now + accessTokenTtl).setJti(jti);
     const accessToken = await accessTokenBuilder.sign(key);
     const userClaims = await getUserClaims(userId, scopes);
     const idTokenPayload = {
@@ -8222,7 +8222,7 @@ function createOidcProviderModule(config, db, getUserClaims) {
     const atHashBuffer = await sha256Raw(accessToken);
     const atHashHalf = atHashBuffer.subarray(0, atHashBuffer.length / 2);
     idTokenPayload.at_hash = jose2.base64url.encode(atHashHalf);
-    const idToken = await new jose2.SignJWT(idTokenPayload).setProtectedHeader({ alg: signingAlg, kid: "kavach-oidc-1" }).setIssuer(issuer).setSubject(userId).setAudience(clientId).setIssuedAt(now).setExpirationTime(now + idTokenTtl).sign(key);
+    const idToken = await new jose2.SignJWT(idTokenPayload).setProtectedHeader({ alg: signingAlg, kid: "theauth-oidc-1" }).setIssuer(issuer).setSubject(userId).setAudience(clientId).setIssuedAt(now).setExpirationTime(now + idTokenTtl).sign(key);
     const rawRefreshToken = generateRandomHex(REFRESH_TOKEN_BYTE_LENGTH);
     const refreshTokenHash = await hashSecret(rawRefreshToken);
     const refreshExpiresAt = new Date((now + refreshTokenTtl) * 1e3);
@@ -8577,12 +8577,12 @@ function createSessionManager(config, db) {
 // src/auth/one-tap-plugin.ts
 function oneTap(config) {
   return {
-    id: "kavach-one-tap",
+    id: "theauth-one-tap",
     async init(ctx) {
       const sessionConfig = ctx.config.auth?.session;
       if (!sessionConfig) {
         throw new Error(
-          "kavach-one-tap plugin requires auth.session to be configured so that sessions can be issued on successful sign-in."
+          "theauth-one-tap plugin requires auth.session to be configured so that sessions can be issued on successful sign-in."
         );
       }
       const sessionManager = createSessionManager(sessionConfig, ctx.db);
@@ -8766,7 +8766,7 @@ function createOneTimeTokenModule(config, db) {
 var DEFAULT_TITLE = "TheAuth API";
 var DEFAULT_VERSION = "0.0.1";
 var DEFAULT_SERVER_URL = "/";
-var DEFAULT_BASE_PATH = "/api/kavach";
+var DEFAULT_BASE_PATH = "/api/theauth";
 var ERROR_SCHEMA = {
   type: "object",
   properties: {
@@ -10351,7 +10351,7 @@ async function parseBody3(request) {
 var ADMIN_ROLES = /* @__PURE__ */ new Set(["owner", "admin"]);
 function organization(config) {
   return {
-    id: "kavach-organization",
+    id: "theauth-organization",
     async init(ctx) {
       const module = createOrgModule(config ?? {}, ctx.db);
       ctx.addEndpoint({
@@ -11394,7 +11394,7 @@ async function parseBody5(request) {
 }
 function passkey(config) {
   return {
-    id: "kavach-passkey",
+    id: "theauth-passkey",
     async init(ctx) {
       const module = createPasskeyModule(config, ctx.db);
       ctx.addEndpoint({
@@ -11503,7 +11503,7 @@ function passkey(config) {
                   headers: {
                     "Content-Type": "application/json",
                     "Set-Cookie": buildSetCookie(
-                      "kavach_session",
+                      "theauth_session",
                       token,
                       maxAge,
                       "/",
@@ -11954,8 +11954,8 @@ function createPolarModule(config, db) {
     const sub = obj;
     let userId = null;
     const metadata = sub.metadata;
-    if (metadata && typeof metadata === "object" && typeof metadata.kavach_user_id === "string") {
-      userId = metadata.kavach_user_id;
+    if (metadata && typeof metadata === "object" && typeof metadata.theauth_user_id === "string") {
+      userId = metadata.theauth_user_id;
     }
     if (!userId && sub.customer_id) {
       const user = await findUserByPolarCustomerId(sub.customer_id);
@@ -11972,8 +11972,8 @@ function createPolarModule(config, db) {
     const sub = obj;
     let userId = null;
     const metadata = sub.metadata;
-    if (metadata && typeof metadata === "object" && typeof metadata.kavach_user_id === "string") {
-      userId = metadata.kavach_user_id;
+    if (metadata && typeof metadata === "object" && typeof metadata.theauth_user_id === "string") {
+      userId = metadata.theauth_user_id;
     }
     if (!userId && sub.customer_id) {
       const user = await findUserByPolarCustomerId(sub.customer_id);
@@ -11998,7 +11998,7 @@ function createPolarModule(config, db) {
     }
     const body = {
       product_id: productId,
-      metadata: { kavach_user_id: userId }
+      metadata: { theauth_user_id: userId }
     };
     if (options.successUrl) {
       body.success_url = options.successUrl;
@@ -12095,7 +12095,7 @@ function createPolarModule(config, db) {
 // src/auth/polar-plugin.ts
 function polar(config) {
   return {
-    id: "kavach-polar",
+    id: "theauth-polar",
     async init(ctx) {
       const module = createPolarModule(config, ctx.db);
       ctx.addEndpoint({
@@ -12248,7 +12248,7 @@ function rateLimit(config = {}) {
   const extractKey = config.keyExtractor ?? defaultKeyExtractor2;
   const onLimitFn = config.onLimit ?? defaultOnLimit;
   return {
-    id: "kavach-rate-limit",
+    id: "theauth-rate-limit",
     hooks: {
       async onRequest(request) {
         const url = new URL(request.url);
@@ -12640,6 +12640,618 @@ function createReBACModule(config, db) {
     expand
   };
 }
+
+// src/auth/scim-filter.ts
+var ScimFilterError = class extends Error {
+  scimType = "invalidFilter";
+  constructor(message) {
+    super(message);
+    this.name = "ScimFilterError";
+  }
+};
+var WORD_RE = /[A-Za-z0-9_\-:.]/;
+function tokenize(input) {
+  const tokens = [];
+  let i = 0;
+  const n = input.length;
+  while (i < n) {
+    const c = input[i];
+    if (c === " " || c === "	" || c === "\n" || c === "\r") {
+      i += 1;
+      continue;
+    }
+    if (c === "(") {
+      tokens.push({ kind: "lparen", value: "(", start: i });
+      i += 1;
+      continue;
+    }
+    if (c === ")") {
+      tokens.push({ kind: "rparen", value: ")", start: i });
+      i += 1;
+      continue;
+    }
+    if (c === "[") {
+      tokens.push({ kind: "lbracket", value: "[", start: i });
+      i += 1;
+      continue;
+    }
+    if (c === "]") {
+      tokens.push({ kind: "rbracket", value: "]", start: i });
+      i += 1;
+      continue;
+    }
+    if (c === '"') {
+      const start = i;
+      i += 1;
+      let value = "";
+      while (i < n && input[i] !== '"') {
+        if (input[i] === "\\" && i + 1 < n) {
+          const next = input[i + 1];
+          if (next === '"' || next === "\\" || next === "/") {
+            value += next;
+            i += 2;
+            continue;
+          }
+          if (next === "t") {
+            value += "	";
+            i += 2;
+            continue;
+          }
+          if (next === "n") {
+            value += "\n";
+            i += 2;
+            continue;
+          }
+          if (next === "r") {
+            value += "\r";
+            i += 2;
+            continue;
+          }
+          value += input[i];
+          i += 1;
+          continue;
+        }
+        value += input[i];
+        i += 1;
+      }
+      if (i >= n) {
+        throw new ScimFilterError(`Unterminated string literal at position ${start}`);
+      }
+      i += 1;
+      tokens.push({ kind: "string", value, start });
+      continue;
+    }
+    if (c === "-" || c >= "0" && c <= "9") {
+      const start = i;
+      let raw = "";
+      if (c === "-") {
+        raw += "-";
+        i += 1;
+      }
+      while (i < n && /[0-9.eE+-]/.test(input[i])) {
+        raw += input[i];
+        i += 1;
+      }
+      if (raw === "" || raw === "-" || Number.isNaN(Number(raw))) {
+        throw new ScimFilterError(`Invalid number literal at position ${start}`);
+      }
+      tokens.push({ kind: "number", value: raw, start });
+      continue;
+    }
+    if (WORD_RE.test(c)) {
+      const start = i;
+      let raw = "";
+      while (i < n && WORD_RE.test(input[i])) {
+        raw += input[i];
+        i += 1;
+      }
+      const lower = raw.toLowerCase();
+      if (lower === "true" || lower === "false") {
+        tokens.push({ kind: "boolean", value: lower, start });
+        continue;
+      }
+      if (lower === "null") {
+        tokens.push({ kind: "null", value: "null", start });
+        continue;
+      }
+      tokens.push({ kind: "word", value: raw, start });
+      continue;
+    }
+    throw new ScimFilterError(`Unexpected character "${c}" at position ${i}`);
+  }
+  tokens.push({ kind: "eof", value: "", start: n });
+  return tokens;
+}
+var COMP_OPS = /* @__PURE__ */ new Set(["eq", "ne", "co", "sw", "ew", "gt", "lt", "ge", "le"]);
+function parseFilter(input) {
+  const tokens = tokenize(input);
+  let pos = 0;
+  function peek() {
+    return tokens[pos];
+  }
+  function eat() {
+    const t = tokens[pos];
+    pos += 1;
+    return t;
+  }
+  function expectKind(kind) {
+    const t = peek();
+    if (t.kind !== kind) {
+      throw new ScimFilterError(`Expected ${kind} at position ${t.start}, got ${t.kind}`);
+    }
+    return eat();
+  }
+  function matchWord(word) {
+    const t = peek();
+    return t.kind === "word" && t.value.toLowerCase() === word;
+  }
+  function parseAttrPath() {
+    const t = peek();
+    if (t.kind !== "word") {
+      throw new ScimFilterError(`Expected attribute path at position ${t.start}`);
+    }
+    eat();
+    const raw = t.value;
+    const colonIndex = raw.lastIndexOf(":");
+    let schemaUrn;
+    let tail = raw;
+    if (colonIndex > 0 && raw.startsWith("urn:")) {
+      schemaUrn = raw.slice(0, colonIndex);
+      tail = raw.slice(colonIndex + 1);
+    }
+    const parts = tail.split(".").filter((part) => part.length > 0);
+    if (parts.length === 0) {
+      throw new ScimFilterError(`Empty attribute path at position ${t.start}`);
+    }
+    return { schemaUrn, path: parts };
+  }
+  function parseCompValue() {
+    const t = eat();
+    if (t.kind === "string") return t.value;
+    if (t.kind === "number") return Number(t.value);
+    if (t.kind === "boolean") return t.value === "true";
+    if (t.kind === "null") return null;
+    throw new ScimFilterError(`Expected comparison value at position ${t.start}, got ${t.kind}`);
+  }
+  function parsePrimary() {
+    if (matchWord("not")) {
+      eat();
+      expectKind("lparen");
+      const inner = parseOr();
+      expectKind("rparen");
+      return { kind: "not", inner };
+    }
+    if (peek().kind === "lparen") {
+      eat();
+      const inner = parseOr();
+      expectKind("rparen");
+      return inner;
+    }
+    const attr = parseAttrPath();
+    if (peek().kind === "lbracket") {
+      eat();
+      const inner = parseOr();
+      expectKind("rbracket");
+      return { kind: "valuePath", attr, inner };
+    }
+    const opTok = peek();
+    if (opTok.kind !== "word") {
+      throw new ScimFilterError(`Expected operator at position ${opTok.start}`);
+    }
+    const op = opTok.value.toLowerCase();
+    if (op === "pr") {
+      eat();
+      return { kind: "pr", attr };
+    }
+    if (COMP_OPS.has(op)) {
+      eat();
+      const value = parseCompValue();
+      return { kind: "cmp", attr, op, value };
+    }
+    throw new ScimFilterError(`Unknown operator "${opTok.value}" at position ${opTok.start}`);
+  }
+  function parseAnd() {
+    let left = parsePrimary();
+    while (matchWord("and")) {
+      eat();
+      const right = parsePrimary();
+      left = { kind: "and", left, right };
+    }
+    return left;
+  }
+  function parseOr() {
+    let left = parseAnd();
+    while (matchWord("or")) {
+      eat();
+      const right = parseAnd();
+      left = { kind: "or", left, right };
+    }
+    return left;
+  }
+  const ast = parseOr();
+  if (peek().kind !== "eof") {
+    throw new ScimFilterError(`Unexpected trailing input at position ${peek().start}`);
+  }
+  return ast;
+}
+function evaluateFilter(ast, resource) {
+  switch (ast.kind) {
+    case "and":
+      return evaluateFilter(ast.left, resource) && evaluateFilter(ast.right, resource);
+    case "or":
+      return evaluateFilter(ast.left, resource) || evaluateFilter(ast.right, resource);
+    case "not":
+      return !evaluateFilter(ast.inner, resource);
+    case "pr":
+      return hasPresent(readPath(resource, ast.attr));
+    case "cmp":
+      return compareAny(readPath(resource, ast.attr), ast.op, ast.value);
+    case "valuePath":
+      return evaluateValuePath(ast, resource);
+  }
+}
+function evaluateValuePath(node, resource) {
+  const value = readPath(resource, node.attr);
+  if (value === void 0 || value === null) return false;
+  const items = Array.isArray(value) ? value : [value];
+  for (const item of items) {
+    if (item && typeof item === "object") {
+      if (evaluateFilter(node.inner, item)) return true;
+    }
+  }
+  return false;
+}
+function readPath(resource, attr) {
+  let current = resource;
+  if (attr.schemaUrn && attr.schemaUrn !== "urn:ietf:params:scim:schemas:core:2.0:User") {
+    if (current && typeof current === "object") {
+      const record = current;
+      current = record[attr.schemaUrn];
+    }
+  }
+  for (const segment of attr.path) {
+    if (current === void 0 || current === null) return void 0;
+    if (Array.isArray(current)) {
+      const collected = [];
+      for (const item of current) {
+        if (item && typeof item === "object") {
+          const sub = item[segment];
+          if (sub !== void 0) collected.push(sub);
+        }
+      }
+      current = collected.length > 0 ? collected : void 0;
+      continue;
+    }
+    if (typeof current !== "object") return void 0;
+    current = current[segment];
+  }
+  return current;
+}
+function hasPresent(value) {
+  if (value === void 0 || value === null) return false;
+  if (typeof value === "string") return value.length > 0;
+  if (Array.isArray(value)) return value.length > 0;
+  if (typeof value === "object") return Object.keys(value).length > 0;
+  return true;
+}
+function compareAny(raw, op, target) {
+  if (Array.isArray(raw)) {
+    return raw.some((item) => compareScalar(item, op, target));
+  }
+  return compareScalar(raw, op, target);
+}
+function compareScalar(raw, op, target) {
+  if (raw === void 0) return false;
+  if (typeof raw === "string" && typeof target === "string") {
+    return compareString(raw, op, target);
+  }
+  if (typeof raw === "number" && typeof target === "number") {
+    return compareNumber(raw, op, target);
+  }
+  if (typeof raw === "boolean" && typeof target === "boolean") {
+    if (op === "eq") return raw === target;
+    if (op === "ne") return raw !== target;
+    return false;
+  }
+  if (raw === null) {
+    if (op === "eq") return target === null;
+    if (op === "ne") return target !== null;
+    return false;
+  }
+  if (op === "ne") return true;
+  return false;
+}
+function compareString(raw, op, target) {
+  const a = raw.toLowerCase();
+  const b = target.toLowerCase();
+  switch (op) {
+    case "eq":
+      return a === b;
+    case "ne":
+      return a !== b;
+    case "co":
+      return a.includes(b);
+    case "sw":
+      return a.startsWith(b);
+    case "ew":
+      return a.endsWith(b);
+    case "gt":
+      return a > b;
+    case "ge":
+      return a >= b;
+    case "lt":
+      return a < b;
+    case "le":
+      return a <= b;
+  }
+}
+function compareNumber(raw, op, target) {
+  switch (op) {
+    case "eq":
+      return raw === target;
+    case "ne":
+      return raw !== target;
+    case "gt":
+      return raw > target;
+    case "ge":
+      return raw >= target;
+    case "lt":
+      return raw < target;
+    case "le":
+      return raw <= target;
+    case "co":
+    case "sw":
+    case "ew":
+      return false;
+  }
+}
+
+// src/auth/scim-patch.ts
+var ScimPatchError = class extends Error {
+  scimType;
+  status;
+  constructor(message, scimType, status = 400) {
+    super(message);
+    this.name = "ScimPatchError";
+    this.scimType = scimType;
+    this.status = status;
+  }
+};
+var IMMUTABLE_PATHS = /* @__PURE__ */ new Set([
+  "id",
+  "schemas",
+  "meta",
+  "meta.created",
+  "meta.lastmodified",
+  "meta.location",
+  "meta.resourcetype"
+]);
+function parsePatchPath(raw) {
+  if (raw.length === 0) {
+    throw new ScimPatchError("Empty PATCH path", "invalidPath");
+  }
+  const bracketIdx = raw.indexOf("[");
+  if (bracketIdx === -1) {
+    const { schemaUrn: schemaUrn2, parts } = splitSchemaUrn(raw);
+    if (parts.length === 0) throw new ScimPatchError("Empty PATCH path", "invalidPath");
+    return {
+      schemaUrn: schemaUrn2,
+      base: parts[0],
+      subPath: parts.length > 1 ? parts.slice(1) : void 0
+    };
+  }
+  const closeIdx = raw.lastIndexOf("]");
+  if (closeIdx < bracketIdx) {
+    throw new ScimPatchError("Unbalanced brackets in PATCH path", "invalidPath");
+  }
+  const headRaw = raw.slice(0, bracketIdx);
+  const filterRaw = raw.slice(bracketIdx + 1, closeIdx);
+  const tailRaw = raw.slice(closeIdx + 1);
+  const { schemaUrn, parts: headParts } = splitSchemaUrn(headRaw);
+  if (headParts.length === 0) {
+    throw new ScimPatchError("PATCH path missing attribute before '['", "invalidPath");
+  }
+  if (headParts.length > 1) {
+    throw new ScimPatchError(
+      "PATCH value-filter must attach to a top-level attribute",
+      "invalidPath"
+    );
+  }
+  let valueFilter;
+  try {
+    valueFilter = parseFilter(filterRaw);
+  } catch (err2) {
+    if (err2 instanceof ScimFilterError) {
+      throw new ScimPatchError(`Invalid value filter: ${err2.message}`, "invalidPath");
+    }
+    throw err2;
+  }
+  let subPath;
+  if (tailRaw.length > 0) {
+    if (!tailRaw.startsWith(".")) {
+      throw new ScimPatchError(
+        `Unexpected characters after value filter: "${tailRaw}"`,
+        "invalidPath"
+      );
+    }
+    subPath = tailRaw.slice(1).split(".").filter((p) => p.length > 0);
+    if (subPath.length === 0) {
+      throw new ScimPatchError("Trailing '.' in PATCH path", "invalidPath");
+    }
+  }
+  return { schemaUrn, base: headParts[0], valueFilter, subPath };
+}
+function splitSchemaUrn(raw) {
+  if (!raw.startsWith("urn:")) {
+    return { parts: raw.split(".").filter((p) => p.length > 0) };
+  }
+  const colonIndex = raw.lastIndexOf(":");
+  if (colonIndex < 4) return { parts: raw.split(".").filter((p) => p.length > 0) };
+  const schemaUrn = raw.slice(0, colonIndex);
+  const tail = raw.slice(colonIndex + 1);
+  return { schemaUrn, parts: tail.split(".").filter((p) => p.length > 0) };
+}
+function applyPatchOps(resource, operations, options = {}) {
+  const cap = options.maxOperations ?? 1e3;
+  if (operations.length > cap) {
+    throw new ScimPatchError(
+      `PATCH has ${operations.length} operations, limit is ${cap}`,
+      "tooMany",
+      413
+    );
+  }
+  const extraReadonly = new Set((options.readonlyPaths ?? []).map((p) => p.toLowerCase()));
+  for (const rawOp of operations) {
+    const op = rawOp.op?.toLowerCase();
+    if (op !== "add" && op !== "replace" && op !== "remove") {
+      throw new ScimPatchError(`Unknown PATCH op "${rawOp.op}"`, "invalidValue");
+    }
+    if (!rawOp.path) {
+      if (op === "remove") {
+        throw new ScimPatchError("PATCH remove requires a path", "noTarget");
+      }
+      if (rawOp.value === void 0 || rawOp.value === null) continue;
+      if (typeof rawOp.value !== "object") {
+        throw new ScimPatchError(
+          "PATCH value must be an object when path is absent",
+          "invalidValue"
+        );
+      }
+      mergeInto(resource, rawOp.value, op, extraReadonly);
+      continue;
+    }
+    let path;
+    try {
+      path = parsePatchPath(rawOp.path);
+    } catch (err2) {
+      if (err2 instanceof ScimPatchError) throw err2;
+      throw new ScimPatchError(`Invalid PATCH path "${rawOp.path}"`, "invalidPath");
+    }
+    const joinedPath = joinPath(path);
+    if (IMMUTABLE_PATHS.has(joinedPath) || extraReadonly.has(joinedPath)) {
+      throw new ScimPatchError(`Attribute "${joinedPath}" is immutable`, "mutability");
+    }
+    applyToResource(resource, path, op, rawOp.value);
+  }
+  return resource;
+}
+function joinPath(path) {
+  const head = path.schemaUrn ? `${path.schemaUrn}:${path.base}` : path.base;
+  const sub = path.subPath && path.subPath.length > 0 ? `.${path.subPath.join(".")}` : "";
+  return `${head}${sub}`.toLowerCase();
+}
+function containerFor(resource, schemaUrn) {
+  if (!schemaUrn) return resource;
+  const existing = resource[schemaUrn];
+  if (existing && typeof existing === "object" && !Array.isArray(existing)) {
+    return existing;
+  }
+  const next = {};
+  resource[schemaUrn] = next;
+  return next;
+}
+function mergeInto(target, source, op, readonlyPaths) {
+  for (const [key, value] of Object.entries(source)) {
+    const lower = key.toLowerCase();
+    if (IMMUTABLE_PATHS.has(lower) || readonlyPaths.has(lower)) {
+      throw new ScimPatchError(`Attribute "${key}" is immutable`, "mutability");
+    }
+    if (op === "add" && Array.isArray(target[key]) && Array.isArray(value)) {
+      target[key] = target[key].concat(value);
+      continue;
+    }
+    target[key] = value;
+  }
+}
+function applyToResource(resource, path, op, value) {
+  const container = containerFor(resource, path.schemaUrn);
+  const currentBase = container[path.base];
+  if (path.valueFilter) {
+    if (!Array.isArray(currentBase)) {
+      throw new ScimPatchError(
+        `Value filter requires "${path.base}" to be an array`,
+        "invalidPath"
+      );
+    }
+    const arr = currentBase;
+    if (op === "remove") {
+      container[path.base] = arr.filter(
+        (item) => !evaluateFilter(path.valueFilter, item)
+      );
+      return;
+    }
+    for (const item of arr) {
+      if (!evaluateFilter(path.valueFilter, item)) continue;
+      if (path.subPath && path.subPath.length > 0) {
+        setDeep(item, path.subPath, value);
+      } else if (value && typeof value === "object" && !Array.isArray(value)) {
+        mergeInto(item, value, op, /* @__PURE__ */ new Set());
+      } else {
+        throw new ScimPatchError(
+          "Value filter without subPath requires object value",
+          "invalidValue"
+        );
+      }
+    }
+    return;
+  }
+  if (op === "remove") {
+    if (path.subPath && path.subPath.length > 0) {
+      deleteDeep(currentBase, path.subPath);
+    } else {
+      container[path.base] = void 0;
+    }
+    return;
+  }
+  if (path.subPath && path.subPath.length > 0) {
+    const host = ensureObject(container, path.base);
+    setDeep(host, path.subPath, value);
+    return;
+  }
+  if (op === "add" && Array.isArray(currentBase) && Array.isArray(value)) {
+    container[path.base] = currentBase.concat(value);
+    return;
+  }
+  container[path.base] = value;
+}
+function ensureObject(container, key) {
+  const current = container[key];
+  if (current && typeof current === "object" && !Array.isArray(current)) {
+    return current;
+  }
+  const next = {};
+  container[key] = next;
+  return next;
+}
+function setDeep(target, path, value) {
+  if (!target || typeof target !== "object") return;
+  let cursor = target;
+  for (let i = 0; i < path.length - 1; i += 1) {
+    const segment = path[i];
+    const next = cursor[segment];
+    if (next && typeof next === "object" && !Array.isArray(next)) {
+      cursor = next;
+    } else {
+      const fresh = {};
+      cursor[segment] = fresh;
+      cursor = fresh;
+    }
+  }
+  cursor[path[path.length - 1]] = value;
+}
+function deleteDeep(target, path) {
+  if (!target || typeof target !== "object") return;
+  let cursor = target;
+  for (let i = 0; i < path.length - 1; i += 1) {
+    const segment = path[i];
+    const next = cursor[segment];
+    if (!next || typeof next !== "object") return;
+    cursor = next;
+  }
+  cursor[path[path.length - 1]] = void 0;
+}
+
+// src/auth/scim.ts
 var SCIM_CONTENT_TYPE = "application/scim+json";
 var SCHEMA_USER = "urn:ietf:params:scim:schemas:core:2.0:User";
 var SCHEMA_GROUP = "urn:ietf:params:scim:schemas:core:2.0:Group";
@@ -12648,6 +13260,7 @@ var SCHEMA_PATCH = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
 var SCHEMA_ERROR = "urn:ietf:params:scim:api:messages:2.0:Error";
 var SCHEMA_SP_CONFIG = "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig";
 var SCHEMA_RESOURCE_TYPE = "urn:ietf:params:scim:schemas:core:2.0:ResourceType";
+var SCHEMA_ENTERPRISE = "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";
 function scimResponse(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
@@ -12682,8 +13295,13 @@ function userRowToScim(row, baseUrl) {
   const primaryEmail = row.email;
   const meta = row.metadata ?? {};
   const active = meta["scim:active"] !== false && row.banned === 0;
-  return {
-    schemas: [SCHEMA_USER],
+  const enterprise = meta["scim:enterprise"];
+  const schemas = [SCHEMA_USER];
+  if (enterprise && typeof enterprise === "object" && Object.keys(enterprise).length > 0) {
+    schemas.push("urn:ietf:params:scim:schemas:extension:enterprise:2.0:User");
+  }
+  const body = {
+    schemas,
     id: row.id,
     externalId: row.externalId ?? void 0,
     userName: row.username ?? row.email,
@@ -12702,6 +13320,10 @@ function userRowToScim(row, baseUrl) {
       location: `${baseUrl}/scim/v2/Users/${row.id}`
     }
   };
+  if (enterprise && typeof enterprise === "object") {
+    body["urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"] = enterprise;
+  }
+  return body;
 }
 function orgRowToScim(row, members, memberEmails, baseUrl) {
   const meta = row.metadata ?? {};
@@ -12723,35 +13345,71 @@ function orgRowToScim(row, members, memberEmails, baseUrl) {
     }
   };
 }
-function parseScimFilter(filter) {
+function flattenToLegacyClauses(ast) {
   const clauses = [];
-  const parts = filter.split(/\s+and\s+/i);
-  for (const part of parts) {
-    const trimmed = part.trim();
-    const matchWithValue = trimmed.match(/^(\S+)\s+(eq|co|sw)\s+"([^"]*)"$/i);
-    if (matchWithValue) {
+  const stack = [ast];
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (node.kind === "and") {
+      stack.push(node.right, node.left);
+      continue;
+    }
+    if (node.kind === "pr") {
+      clauses.push({ attribute: attrKey(node.attr.path), op: "pr" });
+      continue;
+    }
+    if (node.kind === "cmp") {
+      if (node.op !== "eq" && node.op !== "co" && node.op !== "sw") return null;
+      if (typeof node.value !== "string" && typeof node.value !== "boolean") return null;
       clauses.push({
-        attribute: matchWithValue[1].toLowerCase(),
-        op: matchWithValue[2].toLowerCase(),
-        value: matchWithValue[3]
+        attribute: attrKey(node.attr.path),
+        op: node.op,
+        value: typeof node.value === "boolean" ? String(node.value) : node.value
       });
       continue;
     }
-    const matchPr = trimmed.match(/^(\S+)\s+pr$/i);
-    if (matchPr) {
-      clauses.push({ attribute: matchPr[1].toLowerCase(), op: "pr" });
-    }
+    return null;
   }
   return clauses;
 }
+function attrKey(path) {
+  return path.join(".").toLowerCase();
+}
+function parseScimFilter(filter) {
+  const ast = parseFilter(filter);
+  const clauses = flattenToLegacyClauses(ast);
+  return { ast, clauses };
+}
 function createScimModule(config, db) {
   const {
     bearerToken,
     autoCreateUsers = true,
     autoDeactivateUsers = true,
     onProvision,
-    onDeprovision
+    onDeprovision,
+    resolveSelf,
+    audit
   } = config;
+  async function writeScimAudit(action, resource, subjectUserId, durationMs, result = "allowed", reason) {
+    if (!audit || audit.enabled === false) return;
+    try {
+      await db.insert(auditLogs).values({
+        id: generateId2(),
+        agentId: audit.agentId,
+        userId: subjectUserId,
+        action,
+        resource,
+        parameters: {},
+        result,
+        reason: reason ?? null,
+        durationMs,
+        timestamp: /* @__PURE__ */ new Date(),
+        ip: null,
+        userAgent: null
+      });
+    } catch {
+    }
+  }
   function isAuthorized(request) {
     const authHeader = request.headers.get("Authorization");
     if (!authHeader) return false;
@@ -12762,64 +13420,144 @@ function createScimModule(config, db) {
     const url = new URL(request.url);
     return `${url.protocol}//${url.host}`;
   }
+  function parseSortSpec(url) {
+    const by = url.searchParams.get("sortBy");
+    if (!by) return null;
+    const order = url.searchParams.get("sortOrder")?.toLowerCase();
+    return {
+      by: by.split(".").filter((p) => p.length > 0),
+      order: order === "descending" ? "descending" : "ascending"
+    };
+  }
+  function sortResources(items, spec) {
+    const direction = spec.order === "descending" ? -1 : 1;
+    return [...items].sort((a, b) => {
+      const av = readAttr(a.scim, spec.by);
+      const bv = readAttr(b.scim, spec.by);
+      const primary = compareSortValues(av, bv);
+      if (primary !== 0) return primary * direction;
+      const ida = a.scim.id ?? "";
+      const idb = b.scim.id ?? "";
+      return ida < idb ? -1 : ida > idb ? 1 : 0;
+    });
+  }
+  function readAttr(resource, path) {
+    let current = resource;
+    for (const segment of path) {
+      if (current === void 0 || current === null) return void 0;
+      if (typeof current !== "object") return void 0;
+      current = current[segment];
+    }
+    return current;
+  }
+  function compareSortValues(a, b) {
+    if (a === void 0 && b === void 0) return 0;
+    if (a === void 0) return 1;
+    if (b === void 0) return -1;
+    if (typeof a === "string" && typeof b === "string") {
+      return a.toLowerCase().localeCompare(b.toLowerCase());
+    }
+    if (typeof a === "number" && typeof b === "number") {
+      return a - b;
+    }
+    if (typeof a === "boolean" && typeof b === "boolean") {
+      return a === b ? 0 : a ? 1 : -1;
+    }
+    return String(a).localeCompare(String(b));
+  }
   async function handleListUsers(request) {
     const url = new URL(request.url);
     const filterParam = url.searchParams.get("filter") ?? "";
     const startIndex = Math.max(1, parseInt(url.searchParams.get("startIndex") ?? "1", 10));
     const count = Math.min(200, parseInt(url.searchParams.get("count") ?? "100", 10));
     const baseUrl = getBaseUrl(request);
-    const conditions = [];
+    const sortSpec = parseSortSpec(url);
+    let ast = null;
+    let clauses = null;
     if (filterParam) {
-      const clauses = parseScimFilter(filterParam);
-      for (const clause of clauses) {
-        if (clause.attribute === "username" && clause.value !== void 0) {
-          if (clause.op === "eq") {
-            conditions.push(
-              sql`(${users.username} = ${clause.value} OR ${users.email} = ${clause.value})`
-            );
-          } else if (clause.op === "co") {
-            conditions.push(
-              sql`(${users.username} LIKE ${`%${clause.value}%`} OR ${users.email} LIKE ${`%${clause.value}%`})`
-            );
-          } else if (clause.op === "sw") {
-            conditions.push(
-              sql`(${users.username} LIKE ${`${clause.value}%`} OR ${users.email} LIKE ${`${clause.value}%`})`
-            );
-          }
-        } else if (clause.attribute === "emails.value" && clause.value !== void 0) {
-          if (clause.op === "eq") {
-            conditions.push(eq(users.email, clause.value));
-          } else if (clause.op === "co") {
-            conditions.push(like(users.email, `%${clause.value}%`));
-          } else if (clause.op === "sw") {
-            conditions.push(like(users.email, `${clause.value}%`));
-          }
-        } else if (clause.attribute === "externalid" && clause.value !== void 0) {
-          if (clause.op === "eq") {
-            conditions.push(eq(users.externalId, clause.value));
-          }
-        } else if (clause.attribute === "active") {
-          if (clause.op === "eq" && clause.value === "false") {
-            conditions.push(eq(users.banned, 1));
-          } else if (clause.op === "eq" && clause.value === "true") {
-            conditions.push(eq(users.banned, 0));
-          }
+      try {
+        const parsed = parseScimFilter(filterParam);
+        ast = parsed.ast;
+        clauses = parsed.clauses;
+      } catch (err2) {
+        if (err2 instanceof ScimFilterError) {
+          return scimError(err2.message, 400, "invalidFilter");
         }
+        throw err2;
       }
     }
-    const whereClause = conditions.length > 0 ? and(...conditions) : void 0;
-    const countRows = await db.select({ count: sql`count(*)` }).from(users).where(whereClause);
-    const totalResults = Number(countRows[0]?.count ?? 0);
-    const offset = startIndex - 1;
-    const rows = await db.select().from(users).where(whereClause).limit(count).offset(offset);
+    const conditions = clauses ? buildUserSqlConditions(clauses) : null;
+    const whereClause = conditions && conditions.length > 0 ? and(...conditions) : void 0;
+    if (conditions !== null && !sortSpec) {
+      const countRows = await db.select({ count: sql`count(*)` }).from(users).where(whereClause);
+      const totalResults2 = Number(countRows[0]?.count ?? 0);
+      const offset = startIndex - 1;
+      const rows = await db.select().from(users).where(whereClause).limit(count).offset(offset);
+      return scimResponse({
+        schemas: [SCHEMA_LIST],
+        totalResults: totalResults2,
+        startIndex,
+        itemsPerPage: rows.length,
+        Resources: rows.map((r) => userRowToScim(r, baseUrl))
+      });
+    }
+    const allRows = await db.select().from(users);
+    const mapped = allRows.map((r) => ({ row: r, scim: userRowToScim(r, baseUrl) }));
+    const matched = ast ? mapped.filter(({ scim: scim2 }) => evaluateFilter(ast, scim2)) : mapped;
+    const sorted = sortSpec ? sortResources(matched, sortSpec) : matched;
+    const totalResults = sorted.length;
+    const page = sorted.slice(startIndex - 1, startIndex - 1 + count);
     return scimResponse({
       schemas: [SCHEMA_LIST],
       totalResults,
       startIndex,
-      itemsPerPage: rows.length,
-      Resources: rows.map((r) => userRowToScim(r, baseUrl))
+      itemsPerPage: page.length,
+      Resources: page.map((p) => p.scim)
     });
   }
+  function buildUserSqlConditions(list) {
+    const conds = [];
+    for (const clause of list) {
+      if (clause.attribute === "username" && clause.value !== void 0) {
+        if (clause.op === "eq") {
+          conds.push(
+            sql`(${users.username} = ${clause.value} OR ${users.email} = ${clause.value})`
+          );
+        } else if (clause.op === "co") {
+          conds.push(
+            sql`(${users.username} LIKE ${`%${clause.value}%`} OR ${users.email} LIKE ${`%${clause.value}%`})`
+          );
+        } else if (clause.op === "sw") {
+          conds.push(
+            sql`(${users.username} LIKE ${`${clause.value}%`} OR ${users.email} LIKE ${`${clause.value}%`})`
+          );
+        } else {
+          return null;
+        }
+        continue;
+      }
+      if (clause.attribute === "emails.value" && clause.value !== void 0) {
+        if (clause.op === "eq") conds.push(eq(users.email, clause.value));
+        else if (clause.op === "co") conds.push(like(users.email, `%${clause.value}%`));
+        else if (clause.op === "sw") conds.push(like(users.email, `${clause.value}%`));
+        else return null;
+        continue;
+      }
+      if (clause.attribute === "externalid" && clause.value !== void 0) {
+        if (clause.op === "eq") conds.push(eq(users.externalId, clause.value));
+        else return null;
+        continue;
+      }
+      if (clause.attribute === "active") {
+        if (clause.op === "eq" && clause.value === "false") conds.push(eq(users.banned, 1));
+        else if (clause.op === "eq" && clause.value === "true") conds.push(eq(users.banned, 0));
+        else return null;
+        continue;
+      }
+      return null;
+    }
+    return conds;
+  }
   async function handleGetUser(request, userId) {
     const baseUrl = getBaseUrl(request);
     const rows = await db.select().from(users).where(eq(users.id, userId)).limit(1);
@@ -12828,6 +13566,7 @@ function createScimModule(config, db) {
     return scimResponse(userRowToScim(row, baseUrl));
   }
   async function handleCreateUser(request) {
+    const auditStart = performance.now();
     if (!autoCreateUsers) {
       return scimError("User provisioning is disabled", 403);
     }
@@ -12862,6 +13601,10 @@ function createScimModule(config, db) {
     };
     if (givenName) metadata["scim:givenName"] = givenName;
     if (familyName) metadata["scim:familyName"] = familyName;
+    const enterpriseExt = body[SCHEMA_ENTERPRISE];
+    if (enterpriseExt && typeof enterpriseExt === "object") {
+      metadata["scim:enterprise"] = enterpriseExt;
+    }
     await db.insert(users).values({
       id,
       email: primaryEmail,
@@ -12888,9 +13631,16 @@ function createScimModule(config, db) {
       await onProvision(scimUser);
     }
     const baseUrl = getBaseUrl(request);
+    await writeScimAudit(
+      "scim.user.create",
+      `scim:users:${id}`,
+      id,
+      Math.round(performance.now() - auditStart)
+    );
     return scimResponse(userRowToScim(created, baseUrl), 201);
   }
   async function handleReplaceUser(request, userId) {
+    const auditStart = performance.now();
     const rows = await db.select().from(users).where(eq(users.id, userId)).limit(1);
     const existing = rows[0];
     if (!existing) return scimError("User not found", 404, "noTarget");
@@ -12917,6 +13667,10 @@ function createScimModule(config, db) {
     };
     if (givenName !== void 0) metadata["scim:givenName"] = givenName;
     if (familyName !== void 0) metadata["scim:familyName"] = familyName;
+    const enterpriseExt = body[SCHEMA_ENTERPRISE];
+    if (enterpriseExt && typeof enterpriseExt === "object") {
+      metadata["scim:enterprise"] = enterpriseExt;
+    }
     const now = /* @__PURE__ */ new Date();
     await db.update(users).set({
       email: primaryEmail,
@@ -12929,9 +13683,16 @@ function createScimModule(config, db) {
     }).where(eq(users.id, userId));
     const updatedRows = await db.select().from(users).where(eq(users.id, userId)).limit(1);
     const baseUrl = getBaseUrl(request);
+    await writeScimAudit(
+      "scim.user.replace",
+      `scim:users:${userId}`,
+      userId,
+      Math.round(performance.now() - auditStart)
+    );
     return scimResponse(userRowToScim(updatedRows[0], baseUrl));
   }
   async function handlePatchUser(request, userId) {
+    const auditStart = performance.now();
     const rows = await db.select().from(users).where(eq(users.id, userId)).limit(1);
     const current = rows[0];
     if (!current) return scimError("User not found", 404, "noTarget");
@@ -12944,76 +13705,68 @@ function createScimModule(config, db) {
     if (!body.schemas?.includes(SCHEMA_PATCH) || !Array.isArray(body.Operations) || body.Operations.length === 0) {
       return scimError("Invalid PATCH body: missing Operations", 400, "invalidValue");
     }
+    const baseUrlForPatch = getBaseUrl(request);
+    const scimView = userRowToScim(current, baseUrlForPatch);
+    try {
+      applyPatchOps(scimView, body.Operations, {
+        readonlyPaths: ["id", "externalid"]
+      });
+    } catch (err2) {
+      if (err2 instanceof ScimPatchError) {
+        return scimError(err2.message, err2.status, err2.scimType);
+      }
+      throw err2;
+    }
     const updatedMeta = { ...current.metadata ?? {} };
     let email = current.email;
     let name = current.name;
     let username = current.username;
     let banned = current.banned;
-    let externalId = current.externalId;
-    for (const op of body.Operations) {
-      const opLower = op.op?.toLowerCase();
-      if (!opLower || !["add", "replace", "remove"].includes(opLower)) continue;
-      const path = op.path?.toLowerCase();
-      if (opLower === "remove") {
-        if (path === "active") {
-          updatedMeta["scim:active"] = false;
-          banned = autoDeactivateUsers ? 1 : 0;
-        }
-        continue;
-      }
-      if (path === "active" || path === "urn:ietf:params:scim:schemas:core:2.0:user:active") {
-        const active = op.value === true || op.value === "true";
-        updatedMeta["scim:active"] = active;
-        banned = active ? 0 : autoDeactivateUsers ? 1 : 0;
-      } else if (path === "username" || path === "urn:ietf:params:scim:schemas:core:2.0:user:username") {
-        username = typeof op.value === "string" ? op.value : username;
-      } else if (path === "displayname") {
-        name = typeof op.value === "string" ? op.value : name;
-      } else if (path === "name.givenname") {
-        updatedMeta["scim:givenName"] = op.value;
-      } else if (path === "name.familyname") {
-        updatedMeta["scim:familyName"] = op.value;
-      } else if (path === "externalid") {
-        externalId = typeof op.value === "string" ? op.value : externalId;
-      } else if (path === "emails" || path?.startsWith("emails[")) {
-        const emailsVal = op.value;
-        if (Array.isArray(emailsVal)) {
-          const primary = emailsVal.find((e) => e.primary)?.value ?? emailsVal[0]?.value;
-          if (primary) email = primary;
-        }
-      } else if (!path) {
-        const val = op.value;
-        if (val && typeof val === "object") {
-          if ("active" in val) {
-            const active = val.active === true || val.active === "true";
-            updatedMeta["scim:active"] = active;
-            banned = active ? 0 : autoDeactivateUsers ? 1 : 0;
-          }
-          if ("displayName" in val && typeof val.displayName === "string") {
-            name = val.displayName;
-          }
-          if ("userName" in val && typeof val.userName === "string") {
-            username = val.userName;
-          }
-          if ("externalId" in val && typeof val.externalId === "string") {
-            externalId = val.externalId;
-          }
-          const nameVal = val.name;
-          if (nameVal) {
-            if (nameVal.givenName !== void 0) updatedMeta["scim:givenName"] = nameVal.givenName;
-            if (nameVal.familyName !== void 0)
-              updatedMeta["scim:familyName"] = nameVal.familyName;
-          }
-        }
+    const externalId = current.externalId;
+    const scimUserName = scimView.userName;
+    if (typeof scimUserName === "string") username = scimUserName;
+    const scimDisplay = scimView.displayName;
+    if (typeof scimDisplay === "string") name = scimDisplay;
+    const scimName = scimView.name;
+    if (scimName) {
+      if (scimName.givenName !== void 0) updatedMeta["scim:givenName"] = scimName.givenName;
+      if (scimName.familyName !== void 0) updatedMeta["scim:familyName"] = scimName.familyName;
+    }
+    const scimActive = scimView.active;
+    if (typeof scimActive === "boolean") {
+      updatedMeta["scim:active"] = scimActive;
+      banned = scimActive ? 0 : autoDeactivateUsers ? 1 : 0;
+    } else if (scimActive === void 0 && scimView.active === void 0) {
+      updatedMeta["scim:active"] = false;
+      banned = autoDeactivateUsers ? 1 : 0;
+    }
+    const scimEmails = scimView.emails;
+    if (Array.isArray(scimEmails)) {
+      const primary = scimEmails.find(
+        (entry) => typeof entry === "object" && entry !== null && entry.primary === true
+      )?.value ?? scimEmails[0]?.value;
+      if (typeof primary === "string" && primary.length > 0) {
+        email = primary;
       }
     }
+    const extKey = "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";
+    const enterpriseExt = scimView[extKey];
+    if (enterpriseExt && typeof enterpriseExt === "object") {
+      updatedMeta["scim:enterprise"] = enterpriseExt;
+    }
     const now = /* @__PURE__ */ new Date();
     await db.update(users).set({ email, name, username, banned, externalId, metadata: updatedMeta, updatedAt: now }).where(eq(users.id, userId));
     const updatedRows = await db.select().from(users).where(eq(users.id, userId)).limit(1);
-    const baseUrl = getBaseUrl(request);
-    return scimResponse(userRowToScim(updatedRows[0], baseUrl));
+    await writeScimAudit(
+      "scim.user.update",
+      `scim:users:${userId}`,
+      userId,
+      Math.round(performance.now() - auditStart)
+    );
+    return scimResponse(userRowToScim(updatedRows[0], baseUrlForPatch));
   }
   async function handleDeleteUser(_request, userId) {
+    const auditStart = performance.now();
     const rows = await db.select().from(users).where(eq(users.id, userId)).limit(1);
     const row = rows[0];
     if (!row) return scimError("User not found", 404, "noTarget");
@@ -13027,6 +13780,12 @@ function createScimModule(config, db) {
     if (onDeprovision) {
       await onDeprovision(userId);
     }
+    await writeScimAudit(
+      "scim.user.delete",
+      `scim:users:${userId}`,
+      userId,
+      Math.round(performance.now() - auditStart)
+    );
     return new Response(null, { status: 204 });
   }
   async function getMembersForOrg(orgId) {
@@ -13044,41 +13803,74 @@ function createScimModule(config, db) {
     const startIndex = Math.max(1, parseInt(url.searchParams.get("startIndex") ?? "1", 10));
     const count = Math.min(200, parseInt(url.searchParams.get("count") ?? "100", 10));
     const baseUrl = getBaseUrl(request);
-    const conditions = [];
+    const sortSpec = parseSortSpec(url);
+    let ast = null;
+    let clauses = null;
     if (filterParam) {
-      const clauses = parseScimFilter(filterParam);
-      for (const clause of clauses) {
-        if (clause.attribute === "displayname" && clause.value !== void 0) {
-          if (clause.op === "eq") {
-            conditions.push(eq(organizations.name, clause.value));
-          } else if (clause.op === "co") {
-            conditions.push(like(organizations.name, `%${clause.value}%`));
-          } else if (clause.op === "sw") {
-            conditions.push(like(organizations.name, `${clause.value}%`));
-          }
+      try {
+        const parsed = parseScimFilter(filterParam);
+        ast = parsed.ast;
+        clauses = parsed.clauses;
+      } catch (err2) {
+        if (err2 instanceof ScimFilterError) {
+          return scimError(err2.message, 400, "invalidFilter");
         }
+        throw err2;
       }
     }
-    const whereClause = conditions.length > 0 ? and(...conditions) : void 0;
-    const countRows = await db.select({ count: sql`count(*)` }).from(organizations).where(whereClause);
-    const totalResults = Number(countRows[0]?.count ?? 0);
-    const offset = startIndex - 1;
-    const orgRows = await db.select().from(organizations).where(whereClause).limit(count).offset(offset);
+    const conditions = clauses ? buildGroupSqlConditions(clauses) : null;
+    const whereClause = conditions && conditions.length > 0 ? and(...conditions) : void 0;
+    if (conditions !== null && !sortSpec) {
+      const countRows = await db.select({ count: sql`count(*)` }).from(organizations).where(whereClause);
+      const totalResults2 = Number(countRows[0]?.count ?? 0);
+      const offset = startIndex - 1;
+      const orgRows = await db.select().from(organizations).where(whereClause).limit(count).offset(offset);
+      const resources2 = await Promise.all(
+        orgRows.map(async (org) => {
+          const members = await getMembersForOrg(org.id);
+          const memberEmails = await getMemberEmails(members);
+          return orgRowToScim(org, members, memberEmails, baseUrl);
+        })
+      );
+      return scimResponse({
+        schemas: [SCHEMA_LIST],
+        totalResults: totalResults2,
+        startIndex,
+        itemsPerPage: orgRows.length,
+        Resources: resources2
+      });
+    }
+    const allOrgs = await db.select().from(organizations);
     const resources = await Promise.all(
-      orgRows.map(async (org) => {
+      allOrgs.map(async (org) => {
         const members = await getMembersForOrg(org.id);
         const memberEmails = await getMemberEmails(members);
-        return orgRowToScim(org, members, memberEmails, baseUrl);
+        return { org, scim: orgRowToScim(org, members, memberEmails, baseUrl) };
       })
     );
+    const matched = ast ? resources.filter(({ scim: scim2 }) => evaluateFilter(ast, scim2)) : resources;
+    const sorted = sortSpec ? sortResources(matched, sortSpec) : matched;
+    const totalResults = sorted.length;
+    const page = sorted.slice(startIndex - 1, startIndex - 1 + count);
     return scimResponse({
       schemas: [SCHEMA_LIST],
       totalResults,
       startIndex,
-      itemsPerPage: orgRows.length,
-      Resources: resources
+      itemsPerPage: page.length,
+      Resources: page.map((p) => p.scim)
     });
   }
+  function buildGroupSqlConditions(list) {
+    const conds = [];
+    for (const clause of list) {
+      if (clause.attribute !== "displayname" || clause.value === void 0) return null;
+      if (clause.op === "eq") conds.push(eq(organizations.name, clause.value));
+      else if (clause.op === "co") conds.push(like(organizations.name, `%${clause.value}%`));
+      else if (clause.op === "sw") conds.push(like(organizations.name, `${clause.value}%`));
+      else return null;
+    }
+    return conds;
+  }
   async function handleGetGroup(request, groupId) {
     const baseUrl = getBaseUrl(request);
     const orgRows = await db.select().from(organizations).where(eq(organizations.id, groupId)).limit(1);
@@ -13089,6 +13881,7 @@ function createScimModule(config, db) {
     return scimResponse(orgRowToScim(orgRow, members, memberEmails, baseUrl));
   }
   async function handleCreateGroup(request) {
+    const auditStart = performance.now();
     let body;
     try {
       body = await request.json();
@@ -13147,12 +13940,19 @@ function createScimModule(config, db) {
     const createdMembers = await getMembersForOrg(id);
     const memberEmails = await getMemberEmails(createdMembers);
     const baseUrl = getBaseUrl(request);
+    await writeScimAudit(
+      "scim.group.create",
+      `scim:groups:${id}`,
+      ownerId,
+      Math.round(performance.now() - auditStart)
+    );
     return scimResponse(
       orgRowToScim(orgRows[0], createdMembers, memberEmails, baseUrl),
       201
     );
   }
   async function handleReplaceGroup(request, groupId) {
+    const auditStart = performance.now();
     const orgRows = await db.select().from(organizations).where(eq(organizations.id, groupId)).limit(1);
     const existingOrg = orgRows[0];
     if (!existingOrg) return scimError("Group not found", 404, "noTarget");
@@ -13188,9 +13988,16 @@ function createScimModule(config, db) {
     const members = await getMembersForOrg(groupId);
     const memberEmails = await getMemberEmails(members);
     const baseUrl = getBaseUrl(request);
+    await writeScimAudit(
+      "scim.group.replace",
+      `scim:groups:${groupId}`,
+      updatedOrg[0].ownerId,
+      Math.round(performance.now() - auditStart)
+    );
     return scimResponse(orgRowToScim(updatedOrg[0], members, memberEmails, baseUrl));
   }
   async function handlePatchGroup(request, groupId) {
+    const auditStart = performance.now();
     const orgRows = await db.select().from(organizations).where(eq(organizations.id, groupId)).limit(1);
     const current = orgRows[0];
     if (!current) return scimError("Group not found", 404, "noTarget");
@@ -13258,13 +14065,27 @@ function createScimModule(config, db) {
     const members = await getMembersForOrg(groupId);
     const memberEmails = await getMemberEmails(members);
     const baseUrl = getBaseUrl(request);
+    await writeScimAudit(
+      "scim.group.update",
+      `scim:groups:${groupId}`,
+      updatedOrg[0].ownerId,
+      Math.round(performance.now() - auditStart)
+    );
     return scimResponse(orgRowToScim(updatedOrg[0], members, memberEmails, baseUrl));
   }
   async function handleDeleteGroup(_request, groupId) {
+    const auditStart = performance.now();
     const orgRows = await db.select().from(organizations).where(eq(organizations.id, groupId)).limit(1);
-    if (orgRows.length === 0) return scimError("Group not found", 404, "noTarget");
+    const existing = orgRows[0];
+    if (!existing) return scimError("Group not found", 404, "noTarget");
     await db.delete(orgMembers).where(eq(orgMembers.orgId, groupId));
     await db.delete(organizations).where(eq(organizations.id, groupId));
+    await writeScimAudit(
+      "scim.group.delete",
+      `scim:groups:${groupId}`,
+      existing.ownerId,
+      Math.round(performance.now() - auditStart)
+    );
     return new Response(null, { status: 204 });
   }
   function handleServiceProviderConfig(request) {
@@ -13276,7 +14097,7 @@ function createScimModule(config, db) {
       bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },
       filter: { supported: true, maxResults: 200 },
       changePassword: { supported: false },
-      sort: { supported: false },
+      sort: { supported: true },
       etag: { supported: false },
       authenticationSchemes: [
         {
@@ -13297,9 +14118,9 @@ function createScimModule(config, db) {
     const baseUrl = getBaseUrl(request);
     return scimResponse({
       schemas: [SCHEMA_LIST],
-      totalResults: 2,
+      totalResults: 3,
       startIndex: 1,
-      itemsPerPage: 2,
+      itemsPerPage: 3,
       Resources: [
         {
           schemas: ["urn:ietf:params:scim:schemas:core:2.0:Schema"],
@@ -13342,6 +14163,39 @@ function createScimModule(config, db) {
             resourceType: "Schema",
             location: `${baseUrl}/scim/v2/Schemas/${SCHEMA_GROUP}`
           }
+        },
+        {
+          schemas: ["urn:ietf:params:scim:schemas:core:2.0:Schema"],
+          id: SCHEMA_ENTERPRISE,
+          name: "EnterpriseUser",
+          description: "Enterprise User extension (RFC 7643 \xA74.3). Carries employeeNumber, department, and manager.",
+          attributes: [
+            {
+              name: "employeeNumber",
+              type: "string",
+              required: false,
+              mutability: "readWrite"
+            },
+            { name: "department", type: "string", required: false, mutability: "readWrite" },
+            { name: "costCenter", type: "string", required: false, mutability: "readWrite" },
+            { name: "organization", type: "string", required: false, mutability: "readWrite" },
+            { name: "division", type: "string", required: false, mutability: "readWrite" },
+            {
+              name: "manager",
+              type: "complex",
+              required: false,
+              mutability: "readWrite",
+              subAttributes: [
+                { name: "value", type: "string" },
+                { name: "$ref", type: "reference" },
+                { name: "displayName", type: "string" }
+              ]
+            }
+          ],
+          meta: {
+            resourceType: "Schema",
+            location: `${baseUrl}/scim/v2/Schemas/${SCHEMA_ENTERPRISE}`
+          }
         }
       ]
     });
@@ -13381,6 +14235,45 @@ function createScimModule(config, db) {
       ]
     });
   }
+  const SCHEMA_BULK_REQUEST = "urn:ietf:params:scim:api:messages:2.0:BulkRequest";
+  function handleBulk(request) {
+    const contentType = request.headers.get("Content-Type") ?? "";
+    if (!contentType.toLowerCase().startsWith(SCIM_CONTENT_TYPE)) {
+      return scimError(`Bulk requires Content-Type "${SCIM_CONTENT_TYPE}"`, 415, "invalidValue");
+    }
+    return scimResponse(
+      {
+        schemas: [SCHEMA_ERROR],
+        status: "501",
+        detail: `Bulk operations are not supported by this server. See /scim/v2/ServiceProviderConfig for supported features. Requested schema: ${SCHEMA_BULK_REQUEST}`
+      },
+      501
+    );
+  }
+  async function handleMe(request) {
+    if (!resolveSelf) {
+      return scimError(
+        "Me endpoint requires a resolveSelf configuration callback",
+        501,
+        "invalidValue"
+      );
+    }
+    let userId;
+    try {
+      userId = await resolveSelf(request);
+    } catch {
+      return scimError("resolveSelf threw while resolving the current user", 500);
+    }
+    if (!userId) {
+      return scimError("No user is associated with this bearer token", 404, "noTarget");
+    }
+    const rows = await db.select().from(users).where(eq(users.id, userId)).limit(1);
+    const row = rows[0];
+    if (!row) {
+      return scimError("Resolved user does not exist", 404, "noTarget");
+    }
+    return scimResponse(userRowToScim(row, getBaseUrl(request)));
+  }
   async function handleRequest(request) {
     const url = new URL(request.url);
     const pathname = url.pathname;
@@ -13398,6 +14291,12 @@ function createScimModule(config, db) {
     if (method === "GET" && pathname.endsWith("/scim/v2/ResourceTypes")) {
       return handleResourceTypes(request);
     }
+    if (method === "GET" && pathname.endsWith("/scim/v2/Me")) {
+      return handleMe(request);
+    }
+    if (method === "POST" && pathname.endsWith("/scim/v2/Bulk")) {
+      return handleBulk(request);
+    }
     if (method === "GET" && /\/scim\/v2\/Users\/?$/.test(pathname)) {
       return handleListUsers(request);
     }
@@ -13432,7 +14331,7 @@ function createScimModule(config, db) {
 // src/auth/scim-plugin.ts
 function scim(config) {
   return {
-    id: "kavach-scim",
+    id: "theauth-scim",
     async init(ctx) {
       const module = createScimModule(config, ctx.db);
       ctx.addEndpoint({
@@ -13459,6 +14358,22 @@ function scim(config) {
           return await module.handleRequest(request);
         }
       });
+      ctx.addEndpoint({
+        method: "GET",
+        path: "/scim/v2/Me",
+        metadata: { description: "SCIM /Me: current user for the bearer token" },
+        async handler(request) {
+          return await module.handleRequest(request);
+        }
+      });
+      ctx.addEndpoint({
+        method: "POST",
+        path: "/scim/v2/Bulk",
+        metadata: { description: "SCIM /Bulk: returns 501 (bulk ops not supported)" },
+        async handler(request) {
+          return await module.handleRequest(request);
+        }
+      });
       ctx.addEndpoint({
         method: "GET",
         path: "/scim/v2/Users",
@@ -13728,7 +14643,7 @@ function createSiweModule(config) {
 }
 function siwe(config) {
   return {
-    id: "kavach-siwe",
+    id: "theauth-siwe",
     async init(ctx) {
       const mod = createSiweModule(config);
       ctx.addEndpoint({
@@ -13736,7 +14651,7 @@ function siwe(config) {
         path: "/auth/siwe/nonce",
         metadata: {
           description: "Generate a SIWE nonce for wallet signing",
-          rateLimit: { window: 6e4, max: 60 }
+          rateLimit: { window: 60, max: 60 }
         },
         async handler(_request, _endpointCtx) {
           const nonce = await mod.generateNonce();
@@ -13751,7 +14666,7 @@ function siwe(config) {
         path: "/auth/siwe/verify",
         metadata: {
           description: "Verify a SIWE-signed message and return the Ethereum address",
-          rateLimit: { window: 6e4, max: 20 }
+          rateLimit: { window: 60, max: 20 }
         },
         async handler(request, _endpointCtx) {
           let body;
@@ -15114,7 +16029,7 @@ function createStripeModule(config, db) {
     const customer = await api("POST", "/customers", {
       email,
       ...name ? { name } : {},
-      metadata: { kavach_user_id: userId }
+      metadata: { theauth_user_id: userId }
     });
     await db.update(users).set({ stripeCustomerId: customer.id, updatedAt: /* @__PURE__ */ new Date() }).where(eq(users.id, userId));
     return customer.id;
@@ -15268,7 +16183,7 @@ function createStripeModule(config, db) {
 // src/auth/stripe-plugin.ts
 function stripe(config) {
   return {
-    id: "kavach-stripe",
+    id: "theauth-stripe",
     async init(ctx) {
       const module = createStripeModule(config, ctx.db);
       ctx.addEndpoint({
@@ -15639,7 +16554,7 @@ async function parseBody8(request) {
 }
 function twoFactor(config) {
   return {
-    id: "kavach-2fa",
+    id: "theauth-2fa",
     async init(ctx) {
       const module = createTotpModule(config ?? {}, ctx.db);
       ctx.addEndpoint({
@@ -16089,9 +17004,9 @@ async function deliverOnce(endpoint, event, body, timestamp) {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        "X-Kavach-Event": event,
-        "X-Kavach-Signature": `sha256=${signature}`,
-        "X-Kavach-Timestamp": timestamp
+        "X-TheAuth-Event": event,
+        "X-TheAuth-Signature": `sha256=${signature}`,
+        "X-TheAuth-Timestamp": timestamp
       },
       body,
       signal: controller.signal