@glinr/theauth 0.4.2

package/dist/permission/index.js

@@ -0,0 +1,801 @@
+import { sqliteTable, integer, text } from 'drizzle-orm/sqlite-core';
+import { and, eq, gte } from 'drizzle-orm';
+
+// src/crypto/web-crypto.ts
+function generateId() {
+  return globalThis.crypto.randomUUID();
+}
+new TextEncoder();
+var users = sqliteTable("kavach_users", {
+  id: text("id").primaryKey(),
+  email: text("email").notNull().unique(),
+  name: text("name"),
+  username: text("username").unique(),
+  externalId: text("external_id"),
+  // ID from external auth (better-auth, Auth.js, etc.)
+  externalProvider: text("external_provider"),
+  // "better-auth", "authjs", "clerk", etc.
+  metadata: text("metadata", { mode: "json" }).$type(),
+  // Admin ban fields (populated by admin module)
+  banned: integer("banned").notNull().default(0),
+  banReason: text("ban_reason"),
+  banExpiresAt: integer("ban_expires_at", { mode: "timestamp" }),
+  forcePasswordReset: integer("force_password_reset").notNull().default(0),
+  emailVerified: integer("email_verified").notNull().default(0),
+  // Stripe integration fields (populated by kavach-stripe plugin)
+  stripeCustomerId: text("stripe_customer_id").unique(),
+  stripeSubscriptionId: text("stripe_subscription_id"),
+  stripeSubscriptionStatus: text("stripe_subscription_status"),
+  stripePriceId: text("stripe_price_id"),
+  stripeCurrentPeriodEnd: integer("stripe_current_period_end", { mode: "timestamp" }),
+  stripeCancelAtPeriodEnd: integer("stripe_cancel_at_period_end", { mode: "boolean" }).notNull().default(false),
+  // Polar integration fields (populated by kavach-polar plugin)
+  polarCustomerId: text("polar_customer_id").unique(),
+  polarSubscriptionId: text("polar_subscription_id"),
+  polarSubscriptionStatus: text("polar_subscription_status"),
+  polarProductId: text("polar_product_id"),
+  polarCurrentPeriodEnd: integer("polar_current_period_end", { mode: "timestamp" }),
+  polarCancelAtPeriodEnd: integer("polar_cancel_at_period_end", { mode: "boolean" }).notNull().default(false),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+var tenants = sqliteTable("kavach_tenants", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  slug: text("slug").notNull().unique(),
+  settings: text("settings", { mode: "json" }).$type(),
+  status: text("status", { enum: ["active", "suspended"] }).notNull().default("active"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+var agents = sqliteTable("kavach_agents", {
+  id: text("id").primaryKey(),
+  ownerId: text("owner_id").notNull().references(() => users.id),
+  tenantId: text("tenant_id").references(() => tenants.id),
+  // nullable, for multi-tenant scoping
+  name: text("name").notNull(),
+  type: text("type", { enum: ["autonomous", "delegated", "service"] }).notNull(),
+  status: text("status", { enum: ["active", "revoked", "expired"] }).notNull().default("active"),
+  tokenHash: text("token_hash").notNull(),
+  // hashed agent token
+  tokenPrefix: text("token_prefix").notNull(),
+  // first 8 chars for identification
+  expiresAt: integer("expires_at", { mode: "timestamp" }),
+  lastActiveAt: integer("last_active_at", { mode: "timestamp" }),
+  metadata: text("metadata", { mode: "json" }).$type(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_permissions", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+  resource: text("resource").notNull(),
+  // e.g. "mcp:github:*", "tool:file_read"
+  actions: text("actions", { mode: "json" }).notNull().$type(),
+  // ["read", "write", "execute"]
+  constraints: text("constraints", { mode: "json" }).$type(),
+  // When set, the policy engine consults the ReBAC graph for this permission.
+  relation: text("relation"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_delegation_chains", {
+  id: text("id").primaryKey(),
+  fromAgentId: text("from_agent_id").notNull().references(() => agents.id),
+  toAgentId: text("to_agent_id").notNull().references(() => agents.id),
+  permissions: text("permissions", { mode: "json" }).notNull().$type(),
+  depth: integer("depth").notNull().default(1),
+  maxDepth: integer("max_depth").notNull().default(3),
+  status: text("status", { enum: ["active", "revoked", "expired"] }).notNull().default("active"),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+var auditLogs = sqliteTable("kavach_audit_logs", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id),
+  userId: text("user_id").notNull().references(() => users.id),
+  action: text("action").notNull(),
+  // "execute", "read", "write", "delete"
+  resource: text("resource").notNull(),
+  // "mcp:github:create_issue"
+  parameters: text("parameters", { mode: "json" }).$type(),
+  result: text("result", { enum: ["allowed", "denied", "rate_limited"] }).notNull(),
+  reason: text("reason"),
+  // why denied/rate_limited
+  durationMs: integer("duration_ms").notNull(),
+  tokensCost: integer("tokens_cost"),
+  ip: text("ip"),
+  userAgent: text("user_agent"),
+  // True when this audit row corresponds to a policy-engine cache-hit evaluation.
+  cacheHit: integer("cache_hit", { mode: "boolean" }).notNull().default(false),
+  timestamp: integer("timestamp", { mode: "timestamp" }).notNull()
+});
+var rateLimits = sqliteTable("kavach_rate_limits", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+  resource: text("resource").notNull(),
+  windowStart: integer("window_start", { mode: "timestamp" }).notNull(),
+  count: integer("count").notNull().default(0)
+});
+sqliteTable("kavach_mcp_servers", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  endpoint: text("endpoint").notNull().unique(),
+  tools: text("tools", { mode: "json" }).notNull().$type(),
+  authRequired: integer("auth_required", { mode: "boolean" }).notNull().default(true),
+  rateLimitRpm: integer("rate_limit_rpm"),
+  status: text("status", { enum: ["active", "inactive"] }).notNull().default("active"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_sessions", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  metadata: text("metadata", { mode: "json" }).$type(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+var oauthClients = sqliteTable("kavach_oauth_clients", {
+  id: text("id").primaryKey(),
+  clientId: text("client_id").notNull().unique(),
+  clientSecret: text("client_secret"),
+  // null for public clients
+  clientName: text("client_name"),
+  clientUri: text("client_uri"),
+  redirectUris: text("redirect_uris", { mode: "json" }).notNull().$type(),
+  grantTypes: text("grant_types", { mode: "json" }).notNull().$type().default(["authorization_code"]),
+  responseTypes: text("response_types", { mode: "json" }).notNull().$type().default(["code"]),
+  tokenEndpointAuthMethod: text("token_endpoint_auth_method").notNull().default("client_secret_basic"),
+  type: text("type", { enum: ["public", "confidential"] }).notNull().default("confidential"),
+  disabled: integer("disabled", { mode: "boolean" }).notNull().default(false),
+  metadata: text("metadata", { mode: "json" }).$type(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_oauth_access_tokens", {
+  id: text("id").primaryKey(),
+  accessToken: text("access_token").notNull().unique(),
+  refreshToken: text("refresh_token").unique(),
+  clientId: text("client_id").notNull().references(() => oauthClients.clientId),
+  userId: text("user_id").notNull().references(() => users.id),
+  scopes: text("scopes").notNull(),
+  // space-separated
+  resource: text("resource"),
+  // RFC 8707 - audience binding
+  accessTokenExpiresAt: integer("access_token_expires_at", { mode: "timestamp" }).notNull(),
+  refreshTokenExpiresAt: integer("refresh_token_expires_at", { mode: "timestamp" }),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_oauth_authorization_codes", {
+  id: text("id").primaryKey(),
+  code: text("code").notNull().unique(),
+  clientId: text("client_id").notNull().references(() => oauthClients.clientId),
+  userId: text("user_id").notNull().references(() => users.id),
+  redirectUri: text("redirect_uri").notNull(),
+  scopes: text("scopes").notNull(),
+  codeChallenge: text("code_challenge"),
+  // PKCE
+  codeChallengeMethod: text("code_challenge_method"),
+  // "S256"
+  resource: text("resource"),
+  // RFC 8707
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_budget_policies", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").references(() => agents.id, { onDelete: "cascade" }),
+  // nullable
+  userId: text("user_id").references(() => users.id),
+  // nullable
+  tenantId: text("tenant_id").references(() => tenants.id),
+  // nullable
+  limits: text("limits", { mode: "json" }).notNull().$type(),
+  currentUsage: text("current_usage", { mode: "json" }).notNull().$type(),
+  action: text("action", { enum: ["warn", "throttle", "block", "revoke"] }).notNull().default("warn"),
+  status: text("status", { enum: ["active", "triggered", "disabled"] }).notNull().default("active"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_agent_cards", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  description: text("description"),
+  version: text("version").notNull(),
+  protocols: text("protocols", { mode: "json" }).notNull().$type(),
+  capabilities: text("capabilities", { mode: "json" }).notNull().$type(),
+  authRequirements: text("auth_requirements", { mode: "json" }).notNull().$type(),
+  endpoint: text("endpoint"),
+  metadata: text("metadata", { mode: "json" }).$type(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_approval_requests", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+  userId: text("user_id").notNull().references(() => users.id),
+  action: text("action").notNull(),
+  resource: text("resource").notNull(),
+  arguments: text("arguments", { mode: "json" }).$type(),
+  status: text("status", { enum: ["pending", "approved", "denied", "expired"] }).notNull().default("pending"),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  respondedAt: integer("responded_at", { mode: "timestamp" }),
+  respondedBy: text("responded_by"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_trust_scores", {
+  agentId: text("agent_id").primaryKey().references(() => agents.id, { onDelete: "cascade" }),
+  score: integer("score").notNull(),
+  level: text("level", {
+    enum: ["untrusted", "limited", "standard", "trusted", "elevated"]
+  }).notNull(),
+  factors: text("factors", { mode: "json" }).notNull().$type(),
+  computedAt: integer("computed_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_magic_links", {
+  id: text("id").primaryKey(),
+  email: text("email").notNull(),
+  token: text("token").notNull().unique(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  used: integer("used", { mode: "boolean" }).notNull().default(false),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_email_otps", {
+  id: text("id").primaryKey(),
+  email: text("email").notNull(),
+  codeHash: text("code_hash").notNull(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  attempts: integer("attempts").notNull().default(0),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_totp", {
+  userId: text("user_id").primaryKey().references(() => users.id),
+  secret: text("secret").notNull(),
+  // base32-encoded TOTP secret
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(false),
+  backupCodes: text("backup_codes", { mode: "json" }).notNull().$type(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+var organizations = sqliteTable("kavach_organizations", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  slug: text("slug").notNull().unique(),
+  ownerId: text("owner_id").notNull().references(() => users.id),
+  metadata: text("metadata", { mode: "json" }).$type(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_org_members", {
+  id: text("id").primaryKey(),
+  orgId: text("org_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  userId: text("user_id").notNull().references(() => users.id),
+  role: text("role").notNull().default("member"),
+  joinedAt: integer("joined_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_org_invitations", {
+  id: text("id").primaryKey(),
+  orgId: text("org_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  email: text("email").notNull(),
+  role: text("role").notNull().default("member"),
+  invitedBy: text("invited_by").notNull().references(() => users.id),
+  status: text("status", { enum: ["pending", "accepted", "expired"] }).notNull().default("pending"),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_org_roles", {
+  id: text("id").primaryKey(),
+  orgId: text("org_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  permissions: text("permissions", { mode: "json" }).notNull().$type()
+});
+sqliteTable("kavach_passkey_credentials", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id),
+  credentialId: text("credential_id").notNull().unique(),
+  publicKey: text("public_key").notNull(),
+  // base64url-encoded COSE key
+  counter: integer("counter").notNull().default(0),
+  deviceName: text("device_name"),
+  transports: text("transports"),
+  // JSON array, e.g. '["internal","usb"]'
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  lastUsedAt: integer("last_used_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_sso_connections", {
+  id: text("id").primaryKey(),
+  orgId: text("org_id").notNull(),
+  providerId: text("provider_id").notNull(),
+  type: text("type", { enum: ["saml", "oidc"] }).notNull(),
+  domain: text("domain").notNull().unique(),
+  enabled: integer("enabled").notNull().default(1),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_api_keys", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id),
+  name: text("name").notNull(),
+  keyHash: text("key_hash").notNull(),
+  keyPrefix: text("key_prefix").notNull(),
+  permissions: text("permissions", { mode: "json" }).notNull().$type(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }),
+  lastUsedAt: integer("last_used_at", { mode: "timestamp" }),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_passkey_challenges", {
+  id: text("id").primaryKey(),
+  challenge: text("challenge").notNull().unique(),
+  userId: text("user_id"),
+  // null for discoverable credential flows
+  type: text("type", { enum: ["registration", "authentication"] }).notNull(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_username_accounts", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  username: text("username").notNull().unique(),
+  passwordHash: text("password_hash").notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_phone_verifications", {
+  id: text("id").primaryKey(),
+  phoneNumber: text("phone_number").notNull(),
+  codeHash: text("code_hash").notNull(),
+  attempts: integer("attempts").notNull().default(0),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_trusted_devices", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  fingerprint: text("fingerprint").notNull(),
+  // HMAC-SHA256 of stable request headers
+  label: text("label").notNull(),
+  // human-readable, e.g. "Mac", "iPhone"
+  trustedAt: integer("trusted_at", { mode: "timestamp" }).notNull(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_one_time_tokens", {
+  id: text("id").primaryKey(),
+  tokenHash: text("token_hash").notNull().unique(),
+  // SHA-256 hex of the raw token
+  purpose: text("purpose", {
+    enum: ["email-verify", "password-reset", "invitation", "custom"]
+  }).notNull(),
+  identifier: text("identifier").notNull(),
+  // email, userId, or any caller-supplied key
+  metadata: text("metadata", { mode: "json" }).$type(),
+  used: integer("used", { mode: "boolean" }).notNull().default(false),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_login_history", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  method: text("method").notNull(),
+  // LoginMethod — kept as text to support oauth:{provider} variants
+  ip: text("ip"),
+  userAgent: text("user_agent"),
+  timestamp: integer("timestamp", { mode: "timestamp_ms" }).notNull()
+});
+sqliteTable("kavach_agent_dids", {
+  agentId: text("agent_id").primaryKey().references(() => agents.id, { onDelete: "cascade" }),
+  did: text("did").notNull().unique(),
+  method: text("method", { enum: ["key", "web"] }).notNull(),
+  publicKeyJwk: text("public_key_jwk").notNull(),
+  // JSON-serialised JWK (public key only)
+  didDocument: text("did_document").notNull(),
+  // JSON-serialised DID Document
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_oidc_clients", {
+  id: text("id").primaryKey(),
+  clientId: text("client_id").notNull().unique(),
+  clientSecretHash: text("client_secret_hash").notNull(),
+  // SHA-256 hex of the raw secret
+  clientName: text("client_name").notNull(),
+  redirectUris: text("redirect_uris", { mode: "json" }).notNull().$type(),
+  grantTypes: text("grant_types", { mode: "json" }).notNull().$type(),
+  responseTypes: text("response_types", { mode: "json" }).notNull().$type(),
+  scopes: text("scopes", { mode: "json" }).notNull().$type(),
+  tokenEndpointAuthMethod: text("token_endpoint_auth_method").notNull().default("client_secret_post"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_oidc_auth_codes", {
+  id: text("id").primaryKey(),
+  codeHash: text("code_hash").notNull().unique(),
+  // SHA-256 hex of the raw code
+  clientId: text("client_id").notNull(),
+  userId: text("user_id").notNull(),
+  redirectUri: text("redirect_uri").notNull(),
+  scopes: text("scopes").notNull(),
+  // space-separated
+  nonce: text("nonce"),
+  codeChallenge: text("code_challenge"),
+  // PKCE S256
+  codeChallengeMethod: text("code_challenge_method"),
+  used: integer("used", { mode: "boolean" }).notNull().default(false),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_oidc_refresh_tokens", {
+  id: text("id").primaryKey(),
+  tokenHash: text("token_hash").notNull().unique(),
+  // SHA-256 hex of the raw token
+  clientId: text("client_id").notNull(),
+  userId: text("user_id").notNull(),
+  scopes: text("scopes").notNull(),
+  // space-separated
+  revoked: integer("revoked", { mode: "boolean" }).notNull().default(false),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_cost_events", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+  tool: text("tool").notNull(),
+  // e.g. 'openai:gpt-4o', 'anthropic:claude-3-5-sonnet', 'mcp:github'
+  inputTokens: integer("input_tokens"),
+  outputTokens: integer("output_tokens"),
+  /** Cost stored as integer microdollars (costUsd × 1_000_000) to avoid float drift */
+  costMicros: integer("cost_micros").notNull(),
+  currency: text("currency").notNull().default("USD"),
+  metadata: text("metadata", { mode: "json" }).$type(),
+  delegationChainId: text("delegation_chain_id"),
+  // null when not part of a chain
+  recordedAt: integer("recorded_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_ephemeral_sessions", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+  ownerId: text("owner_id").notNull().references(() => users.id),
+  tokenHash: text("token_hash").notNull().unique(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  maxActions: integer("max_actions"),
+  // null = unlimited
+  actionsUsed: integer("actions_used").notNull().default(0),
+  status: text("status", { enum: ["active", "expired", "exhausted", "revoked"] }).notNull().default("active"),
+  auditGroupId: text("audit_group_id").notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_stream_events", {
+  id: text("id").primaryKey(),
+  type: text("type").notNull(),
+  timestamp: integer("timestamp", { mode: "timestamp" }).notNull(),
+  data: text("data", { mode: "json" }).notNull().$type(),
+  agentId: text("agent_id"),
+  userId: text("user_id")
+});
+sqliteTable("kavach_jwt_refresh_tokens", {
+  id: text("id").primaryKey(),
+  /** SHA-256 hex of the raw refresh token. The raw token is never stored. */
+  tokenHash: text("token_hash").notNull().unique(),
+  /** The user who owns this session. */
+  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  /** True once the token has been used in a refresh or explicit revocation. */
+  used: integer("used", { mode: "boolean" }).notNull().default(false),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_rebac_resources", {
+  id: text("id").notNull().primaryKey(),
+  type: text("type").notNull(),
+  // 'org', 'workspace', 'project', 'document', etc.
+  parentId: text("parent_id"),
+  parentType: text("parent_type"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_rebac_relationships", {
+  id: text("id").primaryKey(),
+  subjectType: text("subject_type").notNull(),
+  // 'user', 'agent', 'team', 'role'
+  subjectId: text("subject_id").notNull(),
+  relation: text("relation").notNull(),
+  // 'owner', 'editor', 'viewer', 'member', 'parent'
+  objectType: text("object_type").notNull(),
+  objectId: text("object_id").notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_federation_instances", {
+  id: text("id").primaryKey(),
+  instanceId: text("instance_id").notNull().unique(),
+  instanceUrl: text("instance_url").notNull(),
+  publicKeyJwk: text("public_key_jwk"),
+  // JSON-serialised JWK (public key only)
+  trustLevel: text("trust_level", { enum: ["full", "limited", "verify-only"] }).notNull().default("verify-only"),
+  discoveredAt: integer("discovered_at", { mode: "timestamp" }),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_federation_tokens", {
+  id: text("id").primaryKey(),
+  tokenJti: text("token_jti").notNull().unique(),
+  // JWT ID for dedup
+  agentId: text("agent_id").notNull(),
+  sourceInstanceId: text("source_instance_id").notNull(),
+  targetInstanceId: text("target_instance_id"),
+  direction: text("direction", { enum: ["issued", "received"] }).notNull(),
+  permissions: text("permissions", { mode: "json" }).notNull().$type(),
+  trustScore: integer("trust_score"),
+  // stored as integer 0-100
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+var refreshTokenFamilies = sqliteTable("kavach_refresh_token_families", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  /** Absolute session expiry — no rotation can extend beyond this date. */
+  absoluteExpiresAt: integer("absolute_expires_at", { mode: "timestamp" }).notNull(),
+  /** 0 = active, 1 = revoked (reuse detection or explicit logout). */
+  revoked: integer("revoked").notNull().default(0),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_refresh_tokens", {
+  id: text("id").primaryKey(),
+  familyId: text("family_id").notNull().references(() => refreshTokenFamilies.id, { onDelete: "cascade" }),
+  /** SHA-256 hash of the opaque token — never store the raw token. */
+  tokenHash: text("token_hash").notNull().unique(),
+  /** 0 = unused, 1 = already consumed (one-time use). */
+  used: integer("used").notNull().default(0),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+function matchResource(pattern, resource) {
+  if (pattern === "*") return true;
+  const patternParts = pattern.split(":");
+  const resourceParts = resource.split(":");
+  for (let i = 0; i < patternParts.length; i++) {
+    const part = patternParts[i];
+    if (part === "*") return true;
+    if (part !== resourceParts[i]) return false;
+  }
+  return patternParts.length === resourceParts.length;
+}
+function matchAction(allowedActions, requestedAction) {
+  return allowedActions.includes(requestedAction) || allowedActions.includes("*");
+}
+function parseIPv4(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  let result = 0;
+  for (const part of parts) {
+    const num = parseInt(part, 10);
+    if (Number.isNaN(num) || num < 0 || num > 255) return null;
+    result = result << 8 | num;
+  }
+  return result >>> 0;
+}
+function matchesIPEntry(entry, ip) {
+  const slashIndex = entry.indexOf("/");
+  if (slashIndex === -1) {
+    return entry === ip;
+  }
+  const cidrIp = entry.slice(0, slashIndex);
+  const prefixLen = parseInt(entry.slice(slashIndex + 1), 10);
+  if (Number.isNaN(prefixLen) || prefixLen < 0 || prefixLen > 32) return false;
+  const entryNum = parseIPv4(cidrIp);
+  const ipNum = parseIPv4(ip);
+  if (entryNum === null || ipNum === null) return false;
+  const mask = prefixLen === 0 ? 0 : -1 << 32 - prefixLen >>> 0;
+  return (entryNum & mask) === (ipNum & mask);
+}
+function isIPAllowed(allowlist, ip) {
+  return allowlist.some((entry) => matchesIPEntry(entry, ip));
+}
+function validateArgPatterns(patterns, args) {
+  for (const pattern of patterns) {
+    const regex = new RegExp(pattern);
+    for (const [key, value] of Object.entries(args)) {
+      if (typeof value === "string" && !regex.test(value)) {
+        return {
+          valid: false,
+          reason: `Argument "${key}" value "${value}" does not match pattern "${pattern}"`
+        };
+      }
+    }
+  }
+  return { valid: true };
+}
+async function checkRateLimit(db, agentId, resource, maxCallsPerHour) {
+  if (!agentId) {
+    return { allowed: true };
+  }
+  const oneHourAgo = new Date(Date.now() - 60 * 60 * 1e3);
+  const rows = await db.select().from(rateLimits).where(
+    and(
+      eq(rateLimits.agentId, agentId),
+      eq(rateLimits.resource, resource),
+      gte(rateLimits.windowStart, oneHourAgo)
+    )
+  );
+  const totalCalls = rows.reduce((sum, r) => sum + r.count, 0);
+  if (totalCalls >= maxCallsPerHour) {
+    return {
+      allowed: false,
+      reason: `Rate limit exceeded: ${totalCalls}/${maxCallsPerHour} calls per hour for resource "${resource}"`
+    };
+  }
+  const currentWindow = new Date(Math.floor(Date.now() / (5 * 60 * 1e3)) * (5 * 60 * 1e3));
+  const existing = rows.find((r) => r.windowStart.getTime() === currentWindow.getTime());
+  if (existing) {
+    await db.update(rateLimits).set({ count: existing.count + 1 }).where(eq(rateLimits.id, existing.id));
+  } else {
+    await db.insert(rateLimits).values({
+      id: generateId(),
+      agentId,
+      resource,
+      windowStart: currentWindow,
+      count: 1
+    });
+  }
+  return { allowed: true };
+}
+async function evaluateConstraints(db, input, constraints) {
+  if (constraints.maxCallsPerHour) {
+    const rateResult = await checkRateLimit(
+      db,
+      input.subjectId,
+      input.resource,
+      constraints.maxCallsPerHour
+    );
+    if (!rateResult.allowed) {
+      return rateResult;
+    }
+  }
+  if (constraints.allowedArgPatterns && input.arguments) {
+    const patternResult = validateArgPatterns(constraints.allowedArgPatterns, input.arguments);
+    if (!patternResult.valid) {
+      return { allowed: false, reason: patternResult.reason };
+    }
+  }
+  if (constraints.requireApproval) {
+    return {
+      allowed: false,
+      reason: "This action requires human approval before execution"
+    };
+  }
+  if (constraints.timeWindow) {
+    const now = /* @__PURE__ */ new Date();
+    const hours = now.getHours();
+    const minutes = now.getMinutes();
+    const currentTime = `${String(hours).padStart(2, "0")}:${String(minutes).padStart(2, "0")}`;
+    if (currentTime < constraints.timeWindow.start || currentTime > constraints.timeWindow.end) {
+      return {
+        allowed: false,
+        reason: `Action is only allowed between ${constraints.timeWindow.start} and ${constraints.timeWindow.end}`
+      };
+    }
+  }
+  if (constraints.ipAllowlist && constraints.ipAllowlist.length > 0) {
+    if (!input.ip) {
+      return {
+        allowed: false,
+        reason: "IP_NOT_ALLOWED: No IP address provided; resource requires an IP allowlist match"
+      };
+    }
+    if (!isIPAllowed(constraints.ipAllowlist, input.ip)) {
+      return {
+        allowed: false,
+        reason: `IP_NOT_ALLOWED: IP "${input.ip}" is not in the allowlist for this resource`
+      };
+    }
+  }
+  return { allowed: true };
+}
+
+// src/permission/engine.ts
+function createPermissionEngine(config) {
+  const { db, auditAll } = config;
+  async function authorize(agent, request) {
+    const startTime = performance.now();
+    const auditId = generateId();
+    const matchingPermission = agent.permissions.find(
+      (p) => matchResource(p.resource, request.resource) && matchAction(p.actions, request.action)
+    );
+    if (!matchingPermission) {
+      const result2 = {
+        allowed: false,
+        reason: `No permission grants agent "${agent.name}" access to "${request.action}" on "${request.resource}"`,
+        auditId
+      };
+      if (auditAll) {
+        await writeAuditLog(db, agent, request, result2, startTime, auditId);
+      }
+      return result2;
+    }
+    if (matchingPermission.constraints) {
+      const constraintResult = await evaluateConstraints(
+        db,
+        {
+          subjectId: agent.id,
+          resource: request.resource,
+          arguments: request.arguments,
+          ip: request.ip
+        },
+        matchingPermission.constraints
+      );
+      if (!constraintResult.allowed) {
+        const result2 = {
+          allowed: false,
+          reason: constraintResult.reason,
+          auditId
+        };
+        if (auditAll) {
+          await writeAuditLog(db, agent, request, result2, startTime, auditId);
+        }
+        return result2;
+      }
+    }
+    const result = { allowed: true, auditId };
+    if (auditAll) {
+      await writeAuditLog(db, agent, request, result, startTime, auditId);
+    }
+    return result;
+  }
+  return { authorize };
+}
+async function writeAuditLog(db, agent, request, result, startTime, auditId) {
+  const durationMs = Math.round(performance.now() - startTime);
+  await db.insert(auditLogs).values({
+    id: auditId,
+    agentId: agent.id,
+    userId: agent.ownerId,
+    action: request.action,
+    resource: request.resource,
+    parameters: request.arguments ?? {},
+    result: result.allowed ? "allowed" : "denied",
+    reason: result.reason ?? null,
+    durationMs,
+    timestamp: /* @__PURE__ */ new Date(),
+    ip: request.context?.ip ?? null,
+    userAgent: request.context?.userAgent ?? null
+  });
+}
+
+// src/permission/templates.ts
+var permissionTemplates = {
+  /** Read-only access to all resources */
+  readonly: [{ resource: "*", actions: ["read"] }],
+  /** Read and write access to all resources */
+  readwrite: [{ resource: "*", actions: ["read", "write"] }],
+  /** Full access to all resources and actions */
+  admin: [{ resource: "*", actions: ["*"] }],
+  /** Standard MCP tool access - read + execute */
+  mcpBasic: [{ resource: "mcp:*", actions: ["read", "execute"] }],
+  /** MCP tool access with write - read + write + execute */
+  mcpFull: [{ resource: "mcp:*", actions: ["read", "write", "execute"] }],
+  /** Rate-limited read access (100 calls/hour) */
+  rateLimitedRead: [
+    {
+      resource: "*",
+      actions: ["read"],
+      constraints: { maxCallsPerHour: 100 }
+    }
+  ],
+  /** Approval-required access (human-in-the-loop for everything) */
+  approvalRequired: [
+    {
+      resource: "*",
+      actions: ["*"],
+      constraints: { requireApproval: true }
+    }
+  ],
+  /** Business hours only access (9am-5pm) */
+  businessHours: [
+    {
+      resource: "*",
+      actions: ["read", "write", "execute"],
+      constraints: { timeWindow: { start: "09:00", end: "17:00" } }
+    }
+  ]
+};
+function getPermissionTemplate(name) {
+  return JSON.parse(JSON.stringify(permissionTemplates[name]));
+}
+
+export { createPermissionEngine, getPermissionTemplate, permissionTemplates };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map