@glinr/theauth 0.4.2

package/dist/audit/index.js

@@ -0,0 +1,641 @@
+import { eq, gte, lte, desc, and, lt } from 'drizzle-orm';
+import { sqliteTable, integer, text } from 'drizzle-orm/sqlite-core';
+
+// src/audit/audit.ts
+var users = sqliteTable("kavach_users", {
+  id: text("id").primaryKey(),
+  email: text("email").notNull().unique(),
+  name: text("name"),
+  username: text("username").unique(),
+  externalId: text("external_id"),
+  // ID from external auth (better-auth, Auth.js, etc.)
+  externalProvider: text("external_provider"),
+  // "better-auth", "authjs", "clerk", etc.
+  metadata: text("metadata", { mode: "json" }).$type(),
+  // Admin ban fields (populated by admin module)
+  banned: integer("banned").notNull().default(0),
+  banReason: text("ban_reason"),
+  banExpiresAt: integer("ban_expires_at", { mode: "timestamp" }),
+  forcePasswordReset: integer("force_password_reset").notNull().default(0),
+  emailVerified: integer("email_verified").notNull().default(0),
+  // Stripe integration fields (populated by kavach-stripe plugin)
+  stripeCustomerId: text("stripe_customer_id").unique(),
+  stripeSubscriptionId: text("stripe_subscription_id"),
+  stripeSubscriptionStatus: text("stripe_subscription_status"),
+  stripePriceId: text("stripe_price_id"),
+  stripeCurrentPeriodEnd: integer("stripe_current_period_end", { mode: "timestamp" }),
+  stripeCancelAtPeriodEnd: integer("stripe_cancel_at_period_end", { mode: "boolean" }).notNull().default(false),
+  // Polar integration fields (populated by kavach-polar plugin)
+  polarCustomerId: text("polar_customer_id").unique(),
+  polarSubscriptionId: text("polar_subscription_id"),
+  polarSubscriptionStatus: text("polar_subscription_status"),
+  polarProductId: text("polar_product_id"),
+  polarCurrentPeriodEnd: integer("polar_current_period_end", { mode: "timestamp" }),
+  polarCancelAtPeriodEnd: integer("polar_cancel_at_period_end", { mode: "boolean" }).notNull().default(false),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+var tenants = sqliteTable("kavach_tenants", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  slug: text("slug").notNull().unique(),
+  settings: text("settings", { mode: "json" }).$type(),
+  status: text("status", { enum: ["active", "suspended"] }).notNull().default("active"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+var agents = sqliteTable("kavach_agents", {
+  id: text("id").primaryKey(),
+  ownerId: text("owner_id").notNull().references(() => users.id),
+  tenantId: text("tenant_id").references(() => tenants.id),
+  // nullable, for multi-tenant scoping
+  name: text("name").notNull(),
+  type: text("type", { enum: ["autonomous", "delegated", "service"] }).notNull(),
+  status: text("status", { enum: ["active", "revoked", "expired"] }).notNull().default("active"),
+  tokenHash: text("token_hash").notNull(),
+  // hashed agent token
+  tokenPrefix: text("token_prefix").notNull(),
+  // first 8 chars for identification
+  expiresAt: integer("expires_at", { mode: "timestamp" }),
+  lastActiveAt: integer("last_active_at", { mode: "timestamp" }),
+  metadata: text("metadata", { mode: "json" }).$type(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_permissions", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+  resource: text("resource").notNull(),
+  // e.g. "mcp:github:*", "tool:file_read"
+  actions: text("actions", { mode: "json" }).notNull().$type(),
+  // ["read", "write", "execute"]
+  constraints: text("constraints", { mode: "json" }).$type(),
+  // When set, the policy engine consults the ReBAC graph for this permission.
+  relation: text("relation"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_delegation_chains", {
+  id: text("id").primaryKey(),
+  fromAgentId: text("from_agent_id").notNull().references(() => agents.id),
+  toAgentId: text("to_agent_id").notNull().references(() => agents.id),
+  permissions: text("permissions", { mode: "json" }).notNull().$type(),
+  depth: integer("depth").notNull().default(1),
+  maxDepth: integer("max_depth").notNull().default(3),
+  status: text("status", { enum: ["active", "revoked", "expired"] }).notNull().default("active"),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+var auditLogs = sqliteTable("kavach_audit_logs", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id),
+  userId: text("user_id").notNull().references(() => users.id),
+  action: text("action").notNull(),
+  // "execute", "read", "write", "delete"
+  resource: text("resource").notNull(),
+  // "mcp:github:create_issue"
+  parameters: text("parameters", { mode: "json" }).$type(),
+  result: text("result", { enum: ["allowed", "denied", "rate_limited"] }).notNull(),
+  reason: text("reason"),
+  // why denied/rate_limited
+  durationMs: integer("duration_ms").notNull(),
+  tokensCost: integer("tokens_cost"),
+  ip: text("ip"),
+  userAgent: text("user_agent"),
+  // True when this audit row corresponds to a policy-engine cache-hit evaluation.
+  cacheHit: integer("cache_hit", { mode: "boolean" }).notNull().default(false),
+  timestamp: integer("timestamp", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_rate_limits", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+  resource: text("resource").notNull(),
+  windowStart: integer("window_start", { mode: "timestamp" }).notNull(),
+  count: integer("count").notNull().default(0)
+});
+sqliteTable("kavach_mcp_servers", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  endpoint: text("endpoint").notNull().unique(),
+  tools: text("tools", { mode: "json" }).notNull().$type(),
+  authRequired: integer("auth_required", { mode: "boolean" }).notNull().default(true),
+  rateLimitRpm: integer("rate_limit_rpm"),
+  status: text("status", { enum: ["active", "inactive"] }).notNull().default("active"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_sessions", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  metadata: text("metadata", { mode: "json" }).$type(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+var oauthClients = sqliteTable("kavach_oauth_clients", {
+  id: text("id").primaryKey(),
+  clientId: text("client_id").notNull().unique(),
+  clientSecret: text("client_secret"),
+  // null for public clients
+  clientName: text("client_name"),
+  clientUri: text("client_uri"),
+  redirectUris: text("redirect_uris", { mode: "json" }).notNull().$type(),
+  grantTypes: text("grant_types", { mode: "json" }).notNull().$type().default(["authorization_code"]),
+  responseTypes: text("response_types", { mode: "json" }).notNull().$type().default(["code"]),
+  tokenEndpointAuthMethod: text("token_endpoint_auth_method").notNull().default("client_secret_basic"),
+  type: text("type", { enum: ["public", "confidential"] }).notNull().default("confidential"),
+  disabled: integer("disabled", { mode: "boolean" }).notNull().default(false),
+  metadata: text("metadata", { mode: "json" }).$type(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_oauth_access_tokens", {
+  id: text("id").primaryKey(),
+  accessToken: text("access_token").notNull().unique(),
+  refreshToken: text("refresh_token").unique(),
+  clientId: text("client_id").notNull().references(() => oauthClients.clientId),
+  userId: text("user_id").notNull().references(() => users.id),
+  scopes: text("scopes").notNull(),
+  // space-separated
+  resource: text("resource"),
+  // RFC 8707 - audience binding
+  accessTokenExpiresAt: integer("access_token_expires_at", { mode: "timestamp" }).notNull(),
+  refreshTokenExpiresAt: integer("refresh_token_expires_at", { mode: "timestamp" }),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_oauth_authorization_codes", {
+  id: text("id").primaryKey(),
+  code: text("code").notNull().unique(),
+  clientId: text("client_id").notNull().references(() => oauthClients.clientId),
+  userId: text("user_id").notNull().references(() => users.id),
+  redirectUri: text("redirect_uri").notNull(),
+  scopes: text("scopes").notNull(),
+  codeChallenge: text("code_challenge"),
+  // PKCE
+  codeChallengeMethod: text("code_challenge_method"),
+  // "S256"
+  resource: text("resource"),
+  // RFC 8707
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_budget_policies", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").references(() => agents.id, { onDelete: "cascade" }),
+  // nullable
+  userId: text("user_id").references(() => users.id),
+  // nullable
+  tenantId: text("tenant_id").references(() => tenants.id),
+  // nullable
+  limits: text("limits", { mode: "json" }).notNull().$type(),
+  currentUsage: text("current_usage", { mode: "json" }).notNull().$type(),
+  action: text("action", { enum: ["warn", "throttle", "block", "revoke"] }).notNull().default("warn"),
+  status: text("status", { enum: ["active", "triggered", "disabled"] }).notNull().default("active"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_agent_cards", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  description: text("description"),
+  version: text("version").notNull(),
+  protocols: text("protocols", { mode: "json" }).notNull().$type(),
+  capabilities: text("capabilities", { mode: "json" }).notNull().$type(),
+  authRequirements: text("auth_requirements", { mode: "json" }).notNull().$type(),
+  endpoint: text("endpoint"),
+  metadata: text("metadata", { mode: "json" }).$type(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_approval_requests", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+  userId: text("user_id").notNull().references(() => users.id),
+  action: text("action").notNull(),
+  resource: text("resource").notNull(),
+  arguments: text("arguments", { mode: "json" }).$type(),
+  status: text("status", { enum: ["pending", "approved", "denied", "expired"] }).notNull().default("pending"),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  respondedAt: integer("responded_at", { mode: "timestamp" }),
+  respondedBy: text("responded_by"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_trust_scores", {
+  agentId: text("agent_id").primaryKey().references(() => agents.id, { onDelete: "cascade" }),
+  score: integer("score").notNull(),
+  level: text("level", {
+    enum: ["untrusted", "limited", "standard", "trusted", "elevated"]
+  }).notNull(),
+  factors: text("factors", { mode: "json" }).notNull().$type(),
+  computedAt: integer("computed_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_magic_links", {
+  id: text("id").primaryKey(),
+  email: text("email").notNull(),
+  token: text("token").notNull().unique(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  used: integer("used", { mode: "boolean" }).notNull().default(false),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_email_otps", {
+  id: text("id").primaryKey(),
+  email: text("email").notNull(),
+  codeHash: text("code_hash").notNull(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  attempts: integer("attempts").notNull().default(0),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_totp", {
+  userId: text("user_id").primaryKey().references(() => users.id),
+  secret: text("secret").notNull(),
+  // base32-encoded TOTP secret
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(false),
+  backupCodes: text("backup_codes", { mode: "json" }).notNull().$type(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+var organizations = sqliteTable("kavach_organizations", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  slug: text("slug").notNull().unique(),
+  ownerId: text("owner_id").notNull().references(() => users.id),
+  metadata: text("metadata", { mode: "json" }).$type(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_org_members", {
+  id: text("id").primaryKey(),
+  orgId: text("org_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  userId: text("user_id").notNull().references(() => users.id),
+  role: text("role").notNull().default("member"),
+  joinedAt: integer("joined_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_org_invitations", {
+  id: text("id").primaryKey(),
+  orgId: text("org_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  email: text("email").notNull(),
+  role: text("role").notNull().default("member"),
+  invitedBy: text("invited_by").notNull().references(() => users.id),
+  status: text("status", { enum: ["pending", "accepted", "expired"] }).notNull().default("pending"),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_org_roles", {
+  id: text("id").primaryKey(),
+  orgId: text("org_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  permissions: text("permissions", { mode: "json" }).notNull().$type()
+});
+sqliteTable("kavach_passkey_credentials", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id),
+  credentialId: text("credential_id").notNull().unique(),
+  publicKey: text("public_key").notNull(),
+  // base64url-encoded COSE key
+  counter: integer("counter").notNull().default(0),
+  deviceName: text("device_name"),
+  transports: text("transports"),
+  // JSON array, e.g. '["internal","usb"]'
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  lastUsedAt: integer("last_used_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_sso_connections", {
+  id: text("id").primaryKey(),
+  orgId: text("org_id").notNull(),
+  providerId: text("provider_id").notNull(),
+  type: text("type", { enum: ["saml", "oidc"] }).notNull(),
+  domain: text("domain").notNull().unique(),
+  enabled: integer("enabled").notNull().default(1),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_api_keys", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id),
+  name: text("name").notNull(),
+  keyHash: text("key_hash").notNull(),
+  keyPrefix: text("key_prefix").notNull(),
+  permissions: text("permissions", { mode: "json" }).notNull().$type(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }),
+  lastUsedAt: integer("last_used_at", { mode: "timestamp" }),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_passkey_challenges", {
+  id: text("id").primaryKey(),
+  challenge: text("challenge").notNull().unique(),
+  userId: text("user_id"),
+  // null for discoverable credential flows
+  type: text("type", { enum: ["registration", "authentication"] }).notNull(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_username_accounts", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  username: text("username").notNull().unique(),
+  passwordHash: text("password_hash").notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_phone_verifications", {
+  id: text("id").primaryKey(),
+  phoneNumber: text("phone_number").notNull(),
+  codeHash: text("code_hash").notNull(),
+  attempts: integer("attempts").notNull().default(0),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_trusted_devices", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  fingerprint: text("fingerprint").notNull(),
+  // HMAC-SHA256 of stable request headers
+  label: text("label").notNull(),
+  // human-readable, e.g. "Mac", "iPhone"
+  trustedAt: integer("trusted_at", { mode: "timestamp" }).notNull(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_one_time_tokens", {
+  id: text("id").primaryKey(),
+  tokenHash: text("token_hash").notNull().unique(),
+  // SHA-256 hex of the raw token
+  purpose: text("purpose", {
+    enum: ["email-verify", "password-reset", "invitation", "custom"]
+  }).notNull(),
+  identifier: text("identifier").notNull(),
+  // email, userId, or any caller-supplied key
+  metadata: text("metadata", { mode: "json" }).$type(),
+  used: integer("used", { mode: "boolean" }).notNull().default(false),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_login_history", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  method: text("method").notNull(),
+  // LoginMethod — kept as text to support oauth:{provider} variants
+  ip: text("ip"),
+  userAgent: text("user_agent"),
+  timestamp: integer("timestamp", { mode: "timestamp_ms" }).notNull()
+});
+sqliteTable("kavach_agent_dids", {
+  agentId: text("agent_id").primaryKey().references(() => agents.id, { onDelete: "cascade" }),
+  did: text("did").notNull().unique(),
+  method: text("method", { enum: ["key", "web"] }).notNull(),
+  publicKeyJwk: text("public_key_jwk").notNull(),
+  // JSON-serialised JWK (public key only)
+  didDocument: text("did_document").notNull(),
+  // JSON-serialised DID Document
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_oidc_clients", {
+  id: text("id").primaryKey(),
+  clientId: text("client_id").notNull().unique(),
+  clientSecretHash: text("client_secret_hash").notNull(),
+  // SHA-256 hex of the raw secret
+  clientName: text("client_name").notNull(),
+  redirectUris: text("redirect_uris", { mode: "json" }).notNull().$type(),
+  grantTypes: text("grant_types", { mode: "json" }).notNull().$type(),
+  responseTypes: text("response_types", { mode: "json" }).notNull().$type(),
+  scopes: text("scopes", { mode: "json" }).notNull().$type(),
+  tokenEndpointAuthMethod: text("token_endpoint_auth_method").notNull().default("client_secret_post"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_oidc_auth_codes", {
+  id: text("id").primaryKey(),
+  codeHash: text("code_hash").notNull().unique(),
+  // SHA-256 hex of the raw code
+  clientId: text("client_id").notNull(),
+  userId: text("user_id").notNull(),
+  redirectUri: text("redirect_uri").notNull(),
+  scopes: text("scopes").notNull(),
+  // space-separated
+  nonce: text("nonce"),
+  codeChallenge: text("code_challenge"),
+  // PKCE S256
+  codeChallengeMethod: text("code_challenge_method"),
+  used: integer("used", { mode: "boolean" }).notNull().default(false),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_oidc_refresh_tokens", {
+  id: text("id").primaryKey(),
+  tokenHash: text("token_hash").notNull().unique(),
+  // SHA-256 hex of the raw token
+  clientId: text("client_id").notNull(),
+  userId: text("user_id").notNull(),
+  scopes: text("scopes").notNull(),
+  // space-separated
+  revoked: integer("revoked", { mode: "boolean" }).notNull().default(false),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_cost_events", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+  tool: text("tool").notNull(),
+  // e.g. 'openai:gpt-4o', 'anthropic:claude-3-5-sonnet', 'mcp:github'
+  inputTokens: integer("input_tokens"),
+  outputTokens: integer("output_tokens"),
+  /** Cost stored as integer microdollars (costUsd × 1_000_000) to avoid float drift */
+  costMicros: integer("cost_micros").notNull(),
+  currency: text("currency").notNull().default("USD"),
+  metadata: text("metadata", { mode: "json" }).$type(),
+  delegationChainId: text("delegation_chain_id"),
+  // null when not part of a chain
+  recordedAt: integer("recorded_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_ephemeral_sessions", {
+  id: text("id").primaryKey(),
+  agentId: text("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+  ownerId: text("owner_id").notNull().references(() => users.id),
+  tokenHash: text("token_hash").notNull().unique(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  maxActions: integer("max_actions"),
+  // null = unlimited
+  actionsUsed: integer("actions_used").notNull().default(0),
+  status: text("status", { enum: ["active", "expired", "exhausted", "revoked"] }).notNull().default("active"),
+  auditGroupId: text("audit_group_id").notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_stream_events", {
+  id: text("id").primaryKey(),
+  type: text("type").notNull(),
+  timestamp: integer("timestamp", { mode: "timestamp" }).notNull(),
+  data: text("data", { mode: "json" }).notNull().$type(),
+  agentId: text("agent_id"),
+  userId: text("user_id")
+});
+sqliteTable("kavach_jwt_refresh_tokens", {
+  id: text("id").primaryKey(),
+  /** SHA-256 hex of the raw refresh token. The raw token is never stored. */
+  tokenHash: text("token_hash").notNull().unique(),
+  /** The user who owns this session. */
+  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  /** True once the token has been used in a refresh or explicit revocation. */
+  used: integer("used", { mode: "boolean" }).notNull().default(false),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_rebac_resources", {
+  id: text("id").notNull().primaryKey(),
+  type: text("type").notNull(),
+  // 'org', 'workspace', 'project', 'document', etc.
+  parentId: text("parent_id"),
+  parentType: text("parent_type"),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_rebac_relationships", {
+  id: text("id").primaryKey(),
+  subjectType: text("subject_type").notNull(),
+  // 'user', 'agent', 'team', 'role'
+  subjectId: text("subject_id").notNull(),
+  relation: text("relation").notNull(),
+  // 'owner', 'editor', 'viewer', 'member', 'parent'
+  objectType: text("object_type").notNull(),
+  objectId: text("object_id").notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_federation_instances", {
+  id: text("id").primaryKey(),
+  instanceId: text("instance_id").notNull().unique(),
+  instanceUrl: text("instance_url").notNull(),
+  publicKeyJwk: text("public_key_jwk"),
+  // JSON-serialised JWK (public key only)
+  trustLevel: text("trust_level", { enum: ["full", "limited", "verify-only"] }).notNull().default("verify-only"),
+  discoveredAt: integer("discovered_at", { mode: "timestamp" }),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_federation_tokens", {
+  id: text("id").primaryKey(),
+  tokenJti: text("token_jti").notNull().unique(),
+  // JWT ID for dedup
+  agentId: text("agent_id").notNull(),
+  sourceInstanceId: text("source_instance_id").notNull(),
+  targetInstanceId: text("target_instance_id"),
+  direction: text("direction", { enum: ["issued", "received"] }).notNull(),
+  permissions: text("permissions", { mode: "json" }).notNull().$type(),
+  trustScore: integer("trust_score"),
+  // stored as integer 0-100
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+var refreshTokenFamilies = sqliteTable("kavach_refresh_token_families", {
+  id: text("id").primaryKey(),
+  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  /** Absolute session expiry — no rotation can extend beyond this date. */
+  absoluteExpiresAt: integer("absolute_expires_at", { mode: "timestamp" }).notNull(),
+  /** 0 = active, 1 = revoked (reuse detection or explicit logout). */
+  revoked: integer("revoked").notNull().default(0),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+sqliteTable("kavach_refresh_tokens", {
+  id: text("id").primaryKey(),
+  familyId: text("family_id").notNull().references(() => refreshTokenFamilies.id, { onDelete: "cascade" }),
+  /** SHA-256 hash of the opaque token — never store the raw token. */
+  tokenHash: text("token_hash").notNull().unique(),
+  /** 0 = unused, 1 = already consumed (one-time use). */
+  used: integer("used").notNull().default(0),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
+
+// src/audit/audit.ts
+function createAuditModule(config) {
+  const { db } = config;
+  async function query(filter) {
+    const conditions = [];
+    if (filter.agentId) conditions.push(eq(auditLogs.agentId, filter.agentId));
+    if (filter.userId) conditions.push(eq(auditLogs.userId, filter.userId));
+    if (filter.since) conditions.push(gte(auditLogs.timestamp, filter.since));
+    if (filter.until) conditions.push(lte(auditLogs.timestamp, filter.until));
+    if (filter.result) conditions.push(eq(auditLogs.result, filter.result));
+    let q = db.select().from(auditLogs).orderBy(desc(auditLogs.timestamp)).$dynamic();
+    if (conditions.length > 0) {
+      q = q.where(and(...conditions));
+    }
+    if (filter.limit) {
+      q = q.limit(filter.limit);
+    }
+    if (filter.offset) {
+      q = q.offset(filter.offset);
+    }
+    const rows = await q;
+    return rows.filter((row) => {
+      if (filter.actions && filter.actions.length > 0) {
+        return filter.actions.includes(row.action);
+      }
+      return true;
+    }).map(toAuditEntry);
+  }
+  async function exportLogs(options) {
+    const entries = await query({
+      since: options.since,
+      until: options.until,
+      limit: 1e4
+      // cap exports
+    });
+    if (options.format === "json") {
+      return JSON.stringify(entries, null, 2);
+    }
+    const headers = [
+      "id",
+      "agentId",
+      "userId",
+      "action",
+      "resource",
+      "result",
+      "reason",
+      "durationMs",
+      "tokensCost",
+      "timestamp"
+    ];
+    const csvRows = [headers.join(",")];
+    for (const entry of entries) {
+      csvRows.push(
+        [
+          entry.id,
+          entry.agentId,
+          entry.userId,
+          entry.action,
+          entry.resource,
+          entry.result,
+          `"${entry.reason ?? ""}"`,
+          entry.durationMs,
+          entry.tokensCost ?? "",
+          entry.timestamp.toISOString()
+        ].join(",")
+      );
+    }
+    return csvRows.join("\n");
+  }
+  async function cleanup(options) {
+    const cutoff = new Date(Date.now() - options.retentionDays * 24 * 60 * 60 * 1e3);
+    const toDelete = await db.select({ id: auditLogs.id }).from(auditLogs).where(lt(auditLogs.timestamp, cutoff));
+    if (toDelete.length === 0) {
+      return { deleted: 0 };
+    }
+    await db.delete(auditLogs).where(lt(auditLogs.timestamp, cutoff));
+    return { deleted: toDelete.length };
+  }
+  return { query, export: exportLogs, cleanup };
+}
+function toAuditEntry(row) {
+  return {
+    id: row.id,
+    agentId: row.agentId,
+    userId: row.userId,
+    action: row.action,
+    resource: row.resource,
+    parameters: row.parameters ?? {},
+    result: row.result,
+    reason: row.reason ?? void 0,
+    durationMs: row.durationMs,
+    tokensCost: row.tokensCost ?? void 0,
+    timestamp: row.timestamp
+  };
+}
+
+export { createAuditModule };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map