kavachos 0.0.1

package/dist/index.js

@@ -0,0 +1,862 @@
+import { createAgentModule } from './chunk-DTCKF26N.js';
+export { createAgentModule } from './chunk-DTCKF26N.js';
+import { createPermissionEngine } from './chunk-D2LJLY7F.js';
+export { createPermissionEngine, getPermissionTemplate, permissionTemplates } from './chunk-D2LJLY7F.js';
+import { createAuditModule } from './chunk-XW2X3O53.js';
+export { createAuditModule } from './chunk-XW2X3O53.js';
+import { schema_exports, delegationChains } from './chunk-XSYYQH75.js';
+export { agents, auditLogs, delegationChains, mcpServers, oauthAccessTokens, oauthAuthorizationCodes, oauthClients, permissions, rateLimits, users } from './chunk-XSYYQH75.js';
+import './chunk-PZ5AY32C.js';
+import BetterSqlite3 from 'better-sqlite3';
+import { drizzle } from 'drizzle-orm/better-sqlite3';
+import { randomUUID } from 'crypto';
+import { and, eq } from 'drizzle-orm';
+
+async function createDatabase(config) {
+  if (config.provider === "sqlite") {
+    const sqlite = new BetterSqlite3(config.url);
+    sqlite.pragma("journal_mode = WAL");
+    sqlite.pragma("foreign_keys = ON");
+    return drizzle(sqlite, { schema: schema_exports });
+  }
+  if (config.provider === "postgres") {
+    const { Pool } = await import('pg').catch(() => {
+      throw new Error(
+        'KavachOS: provider "postgres" requires the "pg" package. Install it with: npm install pg'
+      );
+    });
+    const { drizzle } = await import('drizzle-orm/node-postgres');
+    const pool = new Pool({ connectionString: config.url });
+    return drizzle(pool);
+  }
+  if (config.provider === "mysql") {
+    const mysql2 = await import('mysql2/promise').catch(() => {
+      throw new Error(
+        'KavachOS: provider "mysql" requires the "mysql2" package. Install it with: npm install mysql2'
+      );
+    });
+    const { drizzle } = await import('drizzle-orm/mysql2');
+    const pool = mysql2.createPool(config.url);
+    return drizzle(pool);
+  }
+  throw new Error(
+    `KavachOS: unsupported database provider "${config.provider}". Valid values are "sqlite", "postgres", "mysql".`
+  );
+}
+function createDatabaseSync(config) {
+  if (config.provider !== "sqlite") {
+    throw new Error(
+      `createDatabaseSync() only supports SQLite. Use the async createDatabase() for provider "${config.provider}".`
+    );
+  }
+  const sqlite = new BetterSqlite3(config.url);
+  sqlite.pragma("journal_mode = WAL");
+  sqlite.pragma("foreign_keys = ON");
+  return drizzle(sqlite, { schema: schema_exports });
+}
+
+// src/db/migrations.ts
+function buildStatements(provider) {
+  const isPostgres = provider === "postgres";
+  const isMysql = provider === "mysql";
+  const ts = isPostgres ? "TIMESTAMPTZ" : isMysql ? "DATETIME(3)" : "INTEGER";
+  const tsNull = ts;
+  const json = isPostgres ? "JSONB" : isMysql ? "JSON" : "TEXT";
+  const bool = isPostgres ? "BOOLEAN" : isMysql ? "TINYINT(1)" : "INTEGER";
+  const ifne = "IF NOT EXISTS";
+  return [
+    // ------------------------------------------------------------------
+    // kavach_users
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_users (
+  id          TEXT        NOT NULL PRIMARY KEY,
+  email       TEXT        NOT NULL UNIQUE,
+  name        TEXT,
+  external_id TEXT,
+  external_provider TEXT,
+  metadata    ${json},
+  created_at  ${ts}       NOT NULL,
+  updated_at  ${ts}       NOT NULL
+)`,
+    // ------------------------------------------------------------------
+    // kavach_agents
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_agents (
+  id              TEXT  NOT NULL PRIMARY KEY,
+  owner_id        TEXT  NOT NULL REFERENCES kavach_users(id),
+  name            TEXT  NOT NULL,
+  type            TEXT  NOT NULL,
+  status          TEXT  NOT NULL DEFAULT 'active',
+  token_hash      TEXT  NOT NULL,
+  token_prefix    TEXT  NOT NULL,
+  expires_at      ${tsNull},
+  last_active_at  ${tsNull},
+  metadata        ${json},
+  created_at      ${ts} NOT NULL,
+  updated_at      ${ts} NOT NULL
+)`,
+    // ------------------------------------------------------------------
+    // kavach_permissions
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_permissions (
+  id          TEXT  NOT NULL PRIMARY KEY,
+  agent_id    TEXT  NOT NULL REFERENCES kavach_agents(id) ON DELETE CASCADE,
+  resource    TEXT  NOT NULL,
+  actions     ${json} NOT NULL,
+  constraints ${json},
+  created_at  ${ts} NOT NULL
+)`,
+    // ------------------------------------------------------------------
+    // kavach_delegation_chains
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_delegation_chains (
+  id            TEXT    NOT NULL PRIMARY KEY,
+  from_agent_id TEXT    NOT NULL REFERENCES kavach_agents(id),
+  to_agent_id   TEXT    NOT NULL REFERENCES kavach_agents(id),
+  permissions   ${json} NOT NULL,
+  depth         INTEGER NOT NULL DEFAULT 1,
+  max_depth     INTEGER NOT NULL DEFAULT 3,
+  status        TEXT    NOT NULL DEFAULT 'active',
+  expires_at    ${ts}   NOT NULL,
+  created_at    ${ts}   NOT NULL
+)`,
+    // ------------------------------------------------------------------
+    // kavach_audit_logs
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_audit_logs (
+  id           TEXT    NOT NULL PRIMARY KEY,
+  agent_id     TEXT    NOT NULL REFERENCES kavach_agents(id),
+  user_id      TEXT    NOT NULL REFERENCES kavach_users(id),
+  action       TEXT    NOT NULL,
+  resource     TEXT    NOT NULL,
+  parameters   ${json},
+  result       TEXT    NOT NULL,
+  reason       TEXT,
+  duration_ms  INTEGER NOT NULL,
+  tokens_cost  INTEGER,
+  ip           TEXT,
+  user_agent   TEXT,
+  timestamp    ${ts}   NOT NULL
+)`,
+    // ------------------------------------------------------------------
+    // kavach_rate_limits
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_rate_limits (
+  id           TEXT    NOT NULL PRIMARY KEY,
+  agent_id     TEXT    NOT NULL REFERENCES kavach_agents(id) ON DELETE CASCADE,
+  resource     TEXT    NOT NULL,
+  window_start ${ts}   NOT NULL,
+  count        INTEGER NOT NULL DEFAULT 0
+)`,
+    // ------------------------------------------------------------------
+    // kavach_mcp_servers
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_mcp_servers (
+  id               TEXT    NOT NULL PRIMARY KEY,
+  name             TEXT    NOT NULL,
+  endpoint         TEXT    NOT NULL UNIQUE,
+  tools            ${json} NOT NULL,
+  auth_required    ${bool} NOT NULL DEFAULT ${isPostgres ? "TRUE" : "1"},
+  rate_limit_rpm   INTEGER,
+  status           TEXT    NOT NULL DEFAULT 'active',
+  created_at       ${ts}   NOT NULL,
+  updated_at       ${ts}   NOT NULL
+)`,
+    // ------------------------------------------------------------------
+    // kavach_oauth_clients
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_oauth_clients (
+  id                          TEXT    NOT NULL PRIMARY KEY,
+  client_id                   TEXT    NOT NULL UNIQUE,
+  client_secret               TEXT,
+  client_name                 TEXT,
+  client_uri                  TEXT,
+  redirect_uris               ${json} NOT NULL,
+  grant_types                 ${json} NOT NULL,
+  response_types              ${json} NOT NULL,
+  token_endpoint_auth_method  TEXT    NOT NULL DEFAULT 'client_secret_basic',
+  type                        TEXT    NOT NULL DEFAULT 'confidential',
+  disabled                    ${bool} NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
+  metadata                    ${json},
+  created_at                  ${ts}   NOT NULL,
+  updated_at                  ${ts}   NOT NULL
+)`,
+    // ------------------------------------------------------------------
+    // kavach_oauth_access_tokens
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_oauth_access_tokens (
+  id                        TEXT NOT NULL PRIMARY KEY,
+  access_token              TEXT NOT NULL UNIQUE,
+  refresh_token             TEXT UNIQUE,
+  client_id                 TEXT NOT NULL REFERENCES kavach_oauth_clients(client_id),
+  user_id                   TEXT NOT NULL REFERENCES kavach_users(id),
+  scopes                    TEXT NOT NULL,
+  resource                  TEXT,
+  access_token_expires_at   ${ts} NOT NULL,
+  refresh_token_expires_at  ${tsNull},
+  created_at                ${ts} NOT NULL
+)`,
+    // ------------------------------------------------------------------
+    // kavach_oauth_authorization_codes
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_oauth_authorization_codes (
+  id                     TEXT NOT NULL PRIMARY KEY,
+  code                   TEXT NOT NULL UNIQUE,
+  client_id              TEXT NOT NULL REFERENCES kavach_oauth_clients(client_id),
+  user_id                TEXT NOT NULL REFERENCES kavach_users(id),
+  redirect_uri           TEXT NOT NULL,
+  scopes                 TEXT NOT NULL,
+  code_challenge         TEXT,
+  code_challenge_method  TEXT,
+  resource               TEXT,
+  expires_at             ${ts} NOT NULL,
+  created_at             ${ts} NOT NULL
+)`
+  ];
+}
+async function createTables(db, provider) {
+  const statements = buildStatements(provider);
+  if (provider === "sqlite") {
+    const session = db.session;
+    if (session?.client?.exec) {
+      session.client.exec(statements.join(";\n") + ";");
+      return;
+    }
+    const anyDb2 = db;
+    for (const sql of statements) {
+      await anyDb2.run(sql);
+    }
+    return;
+  }
+  const anyDb = db;
+  if (provider === "postgres") {
+    const client = anyDb.$client ?? anyDb.session?.client;
+    if (!client) {
+      throw new Error(
+        "KavachOS createTables: cannot access underlying pg client from Drizzle instance."
+      );
+    }
+    for (const sql of statements) {
+      await client.query(sql);
+    }
+    return;
+  }
+  if (provider === "mysql") {
+    const client = anyDb.$client ?? anyDb.session?.client;
+    if (!client) {
+      throw new Error(
+        "KavachOS createTables: cannot access underlying mysql2 client from Drizzle instance."
+      );
+    }
+    for (const sql of statements) {
+      await client.execute(sql);
+    }
+    return;
+  }
+  throw new Error(`createTables: unsupported provider "${provider}"`);
+}
+function isPermissionSubset(parentPerms, childPerms) {
+  for (const childPerm of childPerms) {
+    const parentMatch = parentPerms.find((p) => {
+      if (!isResourceSubset(p.resource, childPerm.resource)) return false;
+      for (const action of childPerm.actions) {
+        if (!p.actions.includes(action) && !p.actions.includes("*")) return false;
+      }
+      return true;
+    });
+    if (!parentMatch) return false;
+  }
+  return true;
+}
+function isResourceSubset(parentResource, childResource) {
+  if (parentResource === "*") return true;
+  if (parentResource === childResource) return true;
+  const parentParts = parentResource.split(":");
+  const childParts = childResource.split(":");
+  for (let i = 0; i < parentParts.length; i++) {
+    if (parentParts[i] === "*") return true;
+    if (parentParts[i] !== childParts[i]) return false;
+  }
+  return parentParts.length <= childParts.length;
+}
+function createDelegationModule(config) {
+  const { db } = config;
+  async function delegate(input, parentPermissions) {
+    if (!isPermissionSubset(parentPermissions, input.permissions)) {
+      throw new Error(
+        "Delegated permissions must be a subset of the parent agent's permissions. A child agent cannot have more access than its parent."
+      );
+    }
+    const existingChains = await db.select().from(delegationChains).where(
+      and(eq(delegationChains.toAgentId, input.fromAgent), eq(delegationChains.status, "active"))
+    );
+    const currentDepth = existingChains.length > 0 ? Math.max(...existingChains.map((c) => c.depth)) + 1 : 1;
+    const maxDepth = input.maxDepth ?? 3;
+    if (currentDepth > maxDepth) {
+      throw new Error(
+        `Delegation depth ${currentDepth} exceeds maximum allowed depth of ${maxDepth}. This prevents infinite delegation chains.`
+      );
+    }
+    const id = randomUUID();
+    const now = /* @__PURE__ */ new Date();
+    await db.insert(delegationChains).values({
+      id,
+      fromAgentId: input.fromAgent,
+      toAgentId: input.toAgent,
+      permissions: input.permissions.map((p) => ({
+        resource: p.resource,
+        actions: p.actions
+      })),
+      depth: currentDepth,
+      maxDepth,
+      status: "active",
+      expiresAt: input.expiresAt,
+      createdAt: now
+    });
+    return {
+      id,
+      fromAgent: input.fromAgent,
+      toAgent: input.toAgent,
+      permissions: input.permissions,
+      expiresAt: input.expiresAt,
+      depth: currentDepth,
+      createdAt: now
+    };
+  }
+  async function revokeDelegation(chainId) {
+    const chain = await db.select().from(delegationChains).where(eq(delegationChains.id, chainId)).limit(1);
+    if (!chain[0]) throw new Error(`Delegation chain ${chainId} not found.`);
+    await db.update(delegationChains).set({ status: "revoked" }).where(eq(delegationChains.id, chainId));
+    const childChains = await db.select().from(delegationChains).where(
+      and(
+        eq(delegationChains.fromAgentId, chain[0].toAgentId),
+        eq(delegationChains.status, "active")
+      )
+    );
+    for (const child of childChains) {
+      await revokeDelegation(child.id);
+    }
+  }
+  async function getEffectivePermissions(agentId) {
+    const chains = await db.select().from(delegationChains).where(and(eq(delegationChains.toAgentId, agentId), eq(delegationChains.status, "active")));
+    const now = /* @__PURE__ */ new Date();
+    const activeChains = chains.filter((c) => c.expiresAt > now);
+    const delegatedPerms = [];
+    for (const chain of activeChains) {
+      for (const perm of chain.permissions) {
+        delegatedPerms.push({
+          resource: perm.resource,
+          actions: perm.actions
+        });
+      }
+    }
+    return delegatedPerms;
+  }
+  async function listChains(agentId) {
+    const chains = await db.select().from(delegationChains).where(eq(delegationChains.fromAgentId, agentId));
+    return chains.map((c) => ({
+      id: c.id,
+      fromAgent: c.fromAgentId,
+      toAgent: c.toAgentId,
+      permissions: c.permissions.map((p) => ({
+        resource: p.resource,
+        actions: p.actions
+      })),
+      expiresAt: c.expiresAt,
+      depth: c.depth,
+      createdAt: c.createdAt
+    }));
+  }
+  return { delegate, revokeDelegation, getEffectivePermissions, listChains };
+}
+
+// src/kavach.ts
+async function createKavach(config) {
+  const db = await createDatabase(config.database);
+  if (!config.database.skipMigrations) {
+    await createTables(db, config.database.provider);
+  }
+  const agentConfig = {
+    db,
+    maxPerUser: config.agents?.maxPerUser ?? 10,
+    defaultPermissions: config.agents?.defaultPermissions ?? [],
+    tokenExpiry: config.agents?.tokenExpiry ?? "24h"
+  };
+  const agentModule = createAgentModule(agentConfig);
+  const permissionEngine = createPermissionEngine({
+    db,
+    auditAll: config.agents?.auditAll ?? true
+  });
+  const auditModule = createAuditModule({ db });
+  const delegationModule = createDelegationModule({ db });
+  async function authorize(agentId, request) {
+    const agent = await agentModule.get(agentId);
+    if (!agent) {
+      return {
+        allowed: false,
+        reason: `Agent "${agentId}" not found`,
+        auditId: ""
+      };
+    }
+    if (agent.status !== "active") {
+      return {
+        allowed: false,
+        reason: `Agent "${agent.name}" is ${agent.status}`,
+        auditId: ""
+      };
+    }
+    return permissionEngine.authorize(agent, request);
+  }
+  async function authorizeByToken(token, request) {
+    const agent = await agentModule.validateToken(token);
+    if (!agent) {
+      return {
+        allowed: false,
+        reason: "Invalid or expired agent token",
+        auditId: ""
+      };
+    }
+    return permissionEngine.authorize(agent, request);
+  }
+  async function delegate(input) {
+    const parentAgent = await agentModule.get(input.fromAgent);
+    if (!parentAgent) throw new Error(`Parent agent "${input.fromAgent}" not found`);
+    if (parentAgent.status !== "active") {
+      throw new Error(`Parent agent "${parentAgent.name}" is ${parentAgent.status}`);
+    }
+    return delegationModule.delegate(input, parentAgent.permissions);
+  }
+  return {
+    agent: {
+      create: agentModule.create,
+      get: agentModule.get,
+      list: agentModule.list,
+      update: agentModule.update,
+      revoke: agentModule.revoke,
+      rotate: agentModule.rotate,
+      validateToken: agentModule.validateToken
+    },
+    authorize,
+    authorizeByToken,
+    delegate,
+    delegation: {
+      revoke: delegationModule.revokeDelegation,
+      getEffectivePermissions: delegationModule.getEffectivePermissions,
+      listChains: delegationModule.listChains
+    },
+    audit: {
+      query: (filter) => auditModule.query(filter),
+      export: (options) => auditModule.export(options)
+    },
+    /** Direct database access for advanced usage */
+    db
+  };
+}
+
+// src/openapi.ts
+function generateOpenAPISpec(options) {
+  const baseUrl = options?.baseUrl ?? "http://localhost:3000";
+  const version = options?.version ?? "0.0.1";
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "KavachOS API",
+      version,
+      description: "The Auth OS for AI Agents. Identity, permissions, delegation, and audit for the agentic era."
+    },
+    servers: [{ url: baseUrl, description: "KavachOS API Server" }],
+    paths: {
+      "/agents": {
+        post: {
+          summary: "Create a new agent",
+          operationId: "createAgent",
+          tags: ["Agents"],
+          security: [{ BearerAuth: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": { schema: { $ref: "#/components/schemas/CreateAgentInput" } }
+            }
+          },
+          responses: {
+            "201": {
+              description: "Agent created",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/AgentWithToken" }
+                }
+              }
+            },
+            "400": { description: "Invalid input" },
+            "429": { description: "Max agents per user exceeded" }
+          }
+        },
+        get: {
+          summary: "List agents",
+          operationId: "listAgents",
+          tags: ["Agents"],
+          security: [{ BearerAuth: [] }],
+          parameters: [
+            { name: "userId", in: "query", required: false, schema: { type: "string" } },
+            {
+              name: "status",
+              in: "query",
+              required: false,
+              schema: { type: "string", enum: ["active", "revoked", "expired"] }
+            },
+            {
+              name: "type",
+              in: "query",
+              required: false,
+              schema: { type: "string", enum: ["autonomous", "delegated", "service"] }
+            }
+          ],
+          responses: {
+            "200": {
+              description: "List of agents",
+              content: {
+                "application/json": {
+                  schema: { type: "array", items: { $ref: "#/components/schemas/Agent" } }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/agents/{id}": {
+        get: {
+          summary: "Get agent by ID",
+          operationId: "getAgent",
+          tags: ["Agents"],
+          security: [{ BearerAuth: [] }],
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          responses: {
+            "200": {
+              description: "Agent details",
+              content: { "application/json": { schema: { $ref: "#/components/schemas/Agent" } } }
+            },
+            "404": { description: "Agent not found" }
+          }
+        },
+        patch: {
+          summary: "Update agent",
+          operationId: "updateAgent",
+          tags: ["Agents"],
+          security: [{ BearerAuth: [] }],
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": { schema: { $ref: "#/components/schemas/UpdateAgentInput" } }
+            }
+          },
+          responses: {
+            "200": {
+              description: "Agent updated",
+              content: { "application/json": { schema: { $ref: "#/components/schemas/Agent" } } }
+            }
+          }
+        },
+        delete: {
+          summary: "Revoke agent",
+          operationId: "revokeAgent",
+          tags: ["Agents"],
+          security: [{ BearerAuth: [] }],
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          responses: { "204": { description: "Agent revoked" } }
+        }
+      },
+      "/agents/{id}/rotate": {
+        post: {
+          summary: "Rotate agent token",
+          operationId: "rotateAgentToken",
+          tags: ["Agents"],
+          security: [{ BearerAuth: [] }],
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          responses: {
+            "200": {
+              description: "New token issued",
+              content: {
+                "application/json": { schema: { $ref: "#/components/schemas/AgentWithToken" } }
+              }
+            }
+          }
+        }
+      },
+      "/authorize": {
+        post: {
+          summary: "Authorize an agent action",
+          operationId: "authorize",
+          tags: ["Authorization"],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": { schema: { $ref: "#/components/schemas/AuthorizeRequest" } }
+            }
+          },
+          responses: {
+            "200": {
+              description: "Authorization result",
+              content: {
+                "application/json": { schema: { $ref: "#/components/schemas/AuthorizeResult" } }
+              }
+            }
+          }
+        }
+      },
+      "/authorize/token": {
+        post: {
+          summary: "Authorize by agent token",
+          operationId: "authorizeByToken",
+          tags: ["Authorization"],
+          security: [{ AgentToken: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    action: { type: "string" },
+                    resource: { type: "string" },
+                    arguments: { type: "object" }
+                  },
+                  required: ["action", "resource"]
+                }
+              }
+            }
+          },
+          responses: {
+            "200": {
+              description: "Authorization result",
+              content: {
+                "application/json": { schema: { $ref: "#/components/schemas/AuthorizeResult" } }
+              }
+            }
+          }
+        }
+      },
+      "/audit": {
+        get: {
+          summary: "Query audit logs",
+          operationId: "queryAudit",
+          tags: ["Audit"],
+          security: [{ BearerAuth: [] }],
+          parameters: [
+            { name: "agentId", in: "query", required: false, schema: { type: "string" } },
+            { name: "userId", in: "query", required: false, schema: { type: "string" } },
+            {
+              name: "since",
+              in: "query",
+              required: false,
+              schema: { type: "string", format: "date-time" }
+            },
+            {
+              name: "until",
+              in: "query",
+              required: false,
+              schema: { type: "string", format: "date-time" }
+            },
+            {
+              name: "result",
+              in: "query",
+              required: false,
+              schema: { type: "string", enum: ["allowed", "denied", "rate_limited"] }
+            },
+            { name: "limit", in: "query", required: false, schema: { type: "integer" } },
+            { name: "offset", in: "query", required: false, schema: { type: "integer" } }
+          ],
+          responses: {
+            "200": {
+              description: "Audit log entries",
+              content: {
+                "application/json": {
+                  schema: { type: "array", items: { $ref: "#/components/schemas/AuditEntry" } }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/delegations": {
+        post: {
+          summary: "Create delegation chain",
+          operationId: "createDelegation",
+          tags: ["Delegation"],
+          security: [{ BearerAuth: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": { schema: { $ref: "#/components/schemas/DelegateInput" } }
+            }
+          },
+          responses: {
+            "201": {
+              description: "Delegation created",
+              content: {
+                "application/json": { schema: { $ref: "#/components/schemas/DelegationChain" } }
+              }
+            }
+          }
+        }
+      }
+    },
+    components: {
+      schemas: {
+        CreateAgentInput: {
+          type: "object",
+          required: ["ownerId", "name", "type", "permissions"],
+          properties: {
+            ownerId: { type: "string" },
+            name: { type: "string" },
+            type: { type: "string", enum: ["autonomous", "delegated", "service"] },
+            permissions: { type: "array", items: { $ref: "#/components/schemas/Permission" } },
+            expiresAt: { type: "string", format: "date-time", nullable: true },
+            metadata: { type: "object" }
+          }
+        },
+        UpdateAgentInput: {
+          type: "object",
+          properties: {
+            name: { type: "string" },
+            permissions: { type: "array", items: { $ref: "#/components/schemas/Permission" } },
+            expiresAt: { type: "string", format: "date-time", nullable: true },
+            metadata: { type: "object" }
+          }
+        },
+        Agent: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            ownerId: { type: "string" },
+            name: { type: "string" },
+            type: { type: "string", enum: ["autonomous", "delegated", "service"] },
+            status: { type: "string", enum: ["active", "revoked", "expired"] },
+            permissions: { type: "array", items: { $ref: "#/components/schemas/Permission" } },
+            expiresAt: { type: "string", format: "date-time", nullable: true },
+            createdAt: { type: "string", format: "date-time" },
+            updatedAt: { type: "string", format: "date-time" }
+          }
+        },
+        AgentWithToken: {
+          type: "object",
+          description: "Agent identity with the token (only returned on create/rotate)",
+          properties: {
+            id: { type: "string" },
+            token: {
+              type: "string",
+              description: "Agent token (kv_ prefix). Store securely - not retrievable after creation."
+            },
+            name: { type: "string" },
+            type: { type: "string" },
+            status: { type: "string" },
+            permissions: { type: "array", items: { $ref: "#/components/schemas/Permission" } }
+          }
+        },
+        Permission: {
+          type: "object",
+          required: ["resource", "actions"],
+          properties: {
+            resource: {
+              type: "string",
+              description: "Resource pattern (e.g. mcp:github:*, tool:file_read)"
+            },
+            actions: {
+              type: "array",
+              items: { type: "string" },
+              description: "Allowed actions (read, write, execute, delete, *)"
+            },
+            constraints: { $ref: "#/components/schemas/PermissionConstraints" }
+          }
+        },
+        PermissionConstraints: {
+          type: "object",
+          properties: {
+            maxCallsPerHour: { type: "integer" },
+            allowedArgPatterns: { type: "array", items: { type: "string" } },
+            requireApproval: { type: "boolean" },
+            timeWindow: {
+              type: "object",
+              properties: {
+                start: { type: "string", description: "HH:MM format" },
+                end: { type: "string", description: "HH:MM format" }
+              }
+            },
+            ipAllowlist: { type: "array", items: { type: "string" } }
+          }
+        },
+        AuthorizeRequest: {
+          type: "object",
+          required: ["agentId", "action", "resource"],
+          properties: {
+            agentId: { type: "string" },
+            action: { type: "string" },
+            resource: { type: "string" },
+            arguments: { type: "object" }
+          }
+        },
+        AuthorizeResult: {
+          type: "object",
+          properties: {
+            allowed: { type: "boolean" },
+            reason: { type: "string", nullable: true },
+            auditId: { type: "string" }
+          }
+        },
+        AuditEntry: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            agentId: { type: "string" },
+            userId: { type: "string" },
+            action: { type: "string" },
+            resource: { type: "string" },
+            parameters: { type: "object" },
+            result: { type: "string", enum: ["allowed", "denied", "rate_limited"] },
+            durationMs: { type: "integer" },
+            timestamp: { type: "string", format: "date-time" }
+          }
+        },
+        DelegateInput: {
+          type: "object",
+          required: ["fromAgent", "toAgent", "permissions", "expiresAt"],
+          properties: {
+            fromAgent: { type: "string" },
+            toAgent: { type: "string" },
+            permissions: { type: "array", items: { $ref: "#/components/schemas/Permission" } },
+            expiresAt: { type: "string", format: "date-time" },
+            maxDepth: { type: "integer" }
+          }
+        },
+        DelegationChain: {
+          type: "object",
+          properties: {
+            id: { type: "string" },
+            fromAgent: { type: "string" },
+            toAgent: { type: "string" },
+            permissions: { type: "array", items: { $ref: "#/components/schemas/Permission" } },
+            depth: { type: "integer" },
+            expiresAt: { type: "string", format: "date-time" },
+            createdAt: { type: "string", format: "date-time" }
+          }
+        }
+      },
+      securitySchemes: {
+        BearerAuth: {
+          type: "http",
+          scheme: "bearer",
+          bearerFormat: "JWT"
+        },
+        AgentToken: {
+          type: "http",
+          scheme: "bearer",
+          bearerFormat: "KavachOS Agent Token (kv_...)"
+        }
+      }
+    }
+  };
+}
+
+export { createDatabase, createDatabaseSync, createDelegationModule, createKavach, createTables, generateOpenAPISpec };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map