kavachos 0.0.4 → 0.0.6

package/dist/index.js

@@ -1,18 +1,18 @@
-import { createAgentModule } from './chunk-5DT4DN4Y.js';
-export { createAgentModule } from './chunk-5DT4DN4Y.js';
-import { createSessionManager, createMagicLinkModule, createEmailOtpModule, createTotpModule, createPasskeyModule, createOrgModule, createSsoModule, createAdminModule, createApiKeyManagerModule, createUsernameAuthModule, createPhoneAuthModule, createCaptchaModule, createWebhookModule } from './chunk-KL6XW4S4.js';
-export { HibpApiError, HibpBreachedError, OAuthProxyError, OneTapVerifyError, SSO_ERROR, SsoError, additionalFields, admin, anonymousAuth, apiKeys, bearerAuth, createAdditionalFieldsModule, createAdminModule, createAnonymousAuthModule, createApiKeyManagerModule, createCaptchaModule, createCustomSessionModule, createDeviceAuthModule, createEmailOtpModule, createGdprModule, createHibpModule, createJwtSessionModule, createLastLoginModule, createMagicLinkModule, createOAuthProxyModule, createOidcProviderModule, createOneTapModule, createOneTimeTokenModule, createOpenApiModule, createOrgModule, createPasskeyModule, createPhoneAuthModule, createPolarModule, createRateLimiter, createScimModule, createSessionManager, createSiweModule, createSsoModule, createStripeModule, createTotpModule, createTrustedDeviceModule, createUsernameAuthModule, customAuth, customSession, deviceAuth, deviceLabelFromRequest, emailOtp, gdpr, headerAuth, magicLink, oauthProxy, oneTap, organization, passkey, polar, scim, siwe, stripe, twoFactor, withRateLimit } from './chunk-KL6XW4S4.js';
-import { createPermissionEngine } from './chunk-OVGNZ5OX.js';
-export { createPermissionEngine, getPermissionTemplate, permissionTemplates } from './chunk-OVGNZ5OX.js';
-import { createAuditModule } from './chunk-SJGSPIAD.js';
-export { createAuditModule } from './chunk-SJGSPIAD.js';
-import { schema_exports, approvalRequests, sessions, delegationChains, agentDids, mcpServers, budgetPolicies, agents, permissions, auditLogs, tenants, trustScores } from './chunk-V66UUIA7.js';
-export { agentCards, agentDids, agents, apiKeys as apiKeysTable, approvalRequests, auditLogs, budgetPolicies, delegationChains, emailOtps, magicLinks, mcpServers, oauthAccessTokens, oauthAuthorizationCodes, oauthClients, orgInvitations, orgMembers, orgRoles, organizations, passkeyChallenges, passkeyCredentials, permissions, rateLimits, sessions, ssoConnections, tenants, totpRecords, trustScores, users } from './chunk-V66UUIA7.js';
-import './chunk-PZ5AY32C.js';
+import { createAgentModule } from './chunk-IKTOSJ4O.js';
+export { createAgentModule } from './chunk-IKTOSJ4O.js';
+import { createSessionManager, createMagicLinkModule, createEmailOtpModule, createTotpModule, createPasskeyModule, createOrgModule, createSsoModule, createAdminModule, createApiKeyManagerModule, createUsernameAuthModule, createOneTimeTokenModule, createPasswordResetModule, createEmailVerificationModule, createPhoneAuthModule, createCaptchaModule, createWebhookModule } from './chunk-FKVAXCNJ.js';
+export { EVENT_TYPES, HibpApiError, HibpBreachedError, OAuthProxyError, OneTapVerifyError, SSO_ERROR, SsoError, additionalFields, admin, anonymousAuth, apiKeys, bearerAuth, createAdditionalFieldsModule, createAdminModule, createAnonymousAuthModule, createApiKeyManagerModule, createCaptchaModule, createCostAttributionModule, createCustomSessionModule, createDeviceAuthModule, createEmailOtpModule, createEmailVerificationModule, createEphemeralSessionModule, createEventStreamModule, createFederationModule, createGdprModule, createHibpModule, createJwtSessionModule, createLastLoginModule, createMagicLinkModule, createOAuthProxyModule, createOidcProviderModule, createOneTapModule, createOneTimeTokenModule, createOpenApiModule, createOrgModule, createPasskeyModule, createPasswordResetModule, createPhoneAuthModule, createPolarModule, createRateLimiter, createReBACModule, createScimModule, createSessionManager, createSiweModule, createSsoModule, createStripeModule, createTotpModule, createTrustedDeviceModule, createUsernameAuthModule, customAuth, customSession, deviceAuth, deviceLabelFromRequest, emailOtp, gdpr, headerAuth, magicLink, oauthProxy, oneTap, organization, passkey, polar, scim, siwe, stripe, twoFactor, withRateLimit } from './chunk-FKVAXCNJ.js';
+import { createPermissionEngine } from './chunk-VHKZARMM.js';
+export { createPermissionEngine, getPermissionTemplate, permissionTemplates } from './chunk-VHKZARMM.js';
+import { createAuditModule } from './chunk-Y3OWAJHK.js';
+export { createAuditModule } from './chunk-Y3OWAJHK.js';
+import { schema_exports, approvalRequests, sessions, delegationChains, agentDids, mcpServers, budgetPolicies, agents, permissions, auditLogs, tenants, trustScores } from './chunk-KDL6A76K.js';
+export { agentCards, agentDids, agents, apiKeys as apiKeysTable, approvalRequests, auditLogs, budgetPolicies, delegationChains, emailOtps, magicLinks, mcpServers, oauthAccessTokens, oauthAuthorizationCodes, oauthClients, orgInvitations, orgMembers, orgRoles, organizations, passkeyChallenges, passkeyCredentials, permissions, rateLimits, sessions, ssoConnections, tenants, totpRecords, trustScores, users } from './chunk-KDL6A76K.js';
+export { CredentialStatusSchema, CredentialSubjectSchema, KAVACH_AGENT_CREDENTIAL, KAVACH_DELEGATION_CREDENTIAL, KAVACH_PERMISSION_CREDENTIAL, ProofSchema, VC_CONTEXT_V1, VC_CONTEXT_V2, VC_TYPE_CREDENTIAL, VC_TYPE_PRESENTATION, VerifiableCredentialSchema, VerifiablePresentationSchema, createVCIssuer, createVCVerifier } from './chunk-NSTER7KE.js';
+import { generateId } from './chunk-QCRHJMDX.js';
+export { constantTimeEqual, fromBase64Url, fromHex, generateId, hmacSha1Raw, hmacSha256, hmacSha256Raw, importHmacKey, pbkdf2Hash, pbkdf2Verify, randomBytes, randomBytesHex, sha1, sha256, sha256Raw, toBase64Url, toHex } from './chunk-QCRHJMDX.js';
+import { __require } from './chunk-NSBPE2FW.js';
 import { eq, and, lt, ne, or, isNull, gte } from 'drizzle-orm';
-import { randomUUID } from 'crypto';
-import BetterSqlite3 from 'better-sqlite3';
-import { drizzle } from 'drizzle-orm/better-sqlite3';
 import { generateKeyPair, exportJWK, importJWK, SignJWT, jwtVerify } from 'jose';
 
 var DEFAULT_LOOKBACK_DAYS = 30;
@@ -226,7 +226,7 @@ function createApprovalModule(config, db) {
   const ttlSeconds = config.ttl ?? 300;
   async function request(input) {
     const now = /* @__PURE__ */ new Date();
-    const id = `apr_${randomUUID()}`;
+    const id = `apr_${generateId()}`;
     const expiresAt = new Date(now.getTime() + ttlSeconds * 1e3);
     await db.insert(approvalRequests).values({
       id,
@@ -314,12 +314,20 @@ function createApprovalModule(config, db) {
     cleanup
   };
 }
+
+// src/db/database.ts
 async function createDatabase(config) {
   if (config.provider === "sqlite") {
+    const BetterSqlite3 = (await import('better-sqlite3').catch(() => {
+      throw new Error(
+        'KavachOS: provider "sqlite" requires the "better-sqlite3" package. Install it with: npm install better-sqlite3'
+      );
+    })).default;
+    const { drizzle: drizzleSqlite } = await import('drizzle-orm/better-sqlite3');
     const sqlite = new BetterSqlite3(config.url);
     sqlite.pragma("journal_mode = WAL");
     sqlite.pragma("foreign_keys = ON");
-    return drizzle(sqlite, { schema: schema_exports });
+    return drizzleSqlite(sqlite, { schema: schema_exports });
   }
   if (config.provider === "postgres") {
     const { Pool } = await import('pg').catch(() => {
@@ -341,8 +349,12 @@ async function createDatabase(config) {
     const pool = mysql2.createPool(config.url);
     return drizzle(pool);
   }
+  if (config.provider === "d1") {
+    const { drizzle } = await import('drizzle-orm/d1');
+    return drizzle(config.binding, { schema: schema_exports });
+  }
   throw new Error(
-    `KavachOS: unsupported database provider "${config.provider}". Valid values are "sqlite", "postgres", "mysql".`
+    `KavachOS: unsupported database provider "${config.provider}". Valid values are "sqlite", "postgres", "mysql", "d1".`
   );
 }
 function createDatabaseSync(config) {
@@ -351,10 +363,14 @@ function createDatabaseSync(config) {
       `createDatabaseSync() only supports SQLite. Use the async createDatabase() for provider "${config.provider}".`
     );
   }
-  const sqlite = new BetterSqlite3(config.url);
+  const { createRequire } = __require("module");
+  const req = createRequire(import.meta.url);
+  const BetterSqlite3Mod = req("better-sqlite3");
+  const { drizzle: drizzleSqliteMod } = req("drizzle-orm/better-sqlite3");
+  const sqlite = new BetterSqlite3Mod(config.url);
   sqlite.pragma("journal_mode = WAL");
   sqlite.pragma("foreign_keys = ON");
-  return drizzle(sqlite, { schema: schema_exports });
+  return drizzleSqliteMod(sqlite, { schema: schema_exports });
 }
 
 // src/db/migrations.ts
@@ -382,6 +398,7 @@ function buildStatements(provider) {
   ban_reason           TEXT,
   ban_expires_at       ${tsNull},
   force_password_reset         ${bool}     NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
+  email_verified               ${bool}     NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
   stripe_customer_id           TEXT        UNIQUE,
   stripe_subscription_id       TEXT,
   stripe_subscription_status   TEXT,
@@ -857,6 +874,45 @@ function buildStatements(provider) {
   expires_at  ${ts}   NOT NULL,
   created_at  ${ts}   NOT NULL
 )`,
+    // ------------------------------------------------------------------
+    // kavach_cost_events  (per-agent cost attribution)
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_cost_events (
+  id                  TEXT    NOT NULL PRIMARY KEY,
+  agent_id            TEXT    NOT NULL REFERENCES kavach_agents(id) ON DELETE CASCADE,
+  tool                TEXT    NOT NULL,
+  input_tokens        INTEGER,
+  output_tokens       INTEGER,
+  cost_micros         INTEGER NOT NULL,
+  currency            TEXT    NOT NULL DEFAULT 'USD',
+  metadata            ${json},
+  delegation_chain_id TEXT,
+  recorded_at         ${ts}   NOT NULL
+)`,
+    `CREATE INDEX ${ifne} kavach_cost_events_agent_recorded
+  ON kavach_cost_events (agent_id, recorded_at DESC)`,
+    `CREATE INDEX ${ifne} kavach_cost_events_chain_id
+  ON kavach_cost_events (delegation_chain_id)`,
+    // ------------------------------------------------------------------
+    // kavach_ephemeral_sessions  (short-lived agent credentials)
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_ephemeral_sessions (
+  id             TEXT    NOT NULL PRIMARY KEY,
+  agent_id       TEXT    NOT NULL REFERENCES kavach_agents(id) ON DELETE CASCADE,
+  owner_id       TEXT    NOT NULL REFERENCES kavach_users(id),
+  token_hash     TEXT    NOT NULL UNIQUE,
+  expires_at     ${ts}   NOT NULL,
+  max_actions    INTEGER,
+  actions_used   INTEGER NOT NULL DEFAULT 0,
+  status         TEXT    NOT NULL DEFAULT 'active',
+  audit_group_id TEXT    NOT NULL,
+  created_at     ${ts}   NOT NULL,
+  updated_at     ${ts}   NOT NULL
+)`,
+    `CREATE INDEX ${ifne} kavach_ephemeral_sessions_owner_status
+  ON kavach_ephemeral_sessions (owner_id, status)`,
+    `CREATE INDEX ${ifne} kavach_ephemeral_sessions_expires_at
+  ON kavach_ephemeral_sessions (expires_at)`,
     // ------------------------------------------------------------------
     // kavach_jwt_refresh_tokens  (JWT session plugin — general purpose)
     // ------------------------------------------------------------------
@@ -869,7 +925,84 @@ function buildStatements(provider) {
   created_at  ${ts}   NOT NULL
 )`,
     `CREATE INDEX ${ifne} kavach_jwt_refresh_tokens_user_id
-  ON kavach_jwt_refresh_tokens (user_id)`
+  ON kavach_jwt_refresh_tokens (user_id)`,
+    // ------------------------------------------------------------------
+    // kavach_stream_events  (persisted SSE events for replay)
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_stream_events (
+  id        TEXT    NOT NULL PRIMARY KEY,
+  type      TEXT    NOT NULL,
+  timestamp ${ts}   NOT NULL,
+  data      ${json} NOT NULL,
+  agent_id  TEXT,
+  user_id   TEXT
+)`,
+    `CREATE INDEX ${ifne} kavach_stream_events_timestamp
+  ON kavach_stream_events (timestamp DESC)`,
+    `CREATE INDEX ${ifne} kavach_stream_events_type_timestamp
+  ON kavach_stream_events (type, timestamp DESC)`,
+    // ------------------------------------------------------------------
+    // kavach_rebac_resources  (ReBAC resource hierarchy)
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_rebac_resources (
+  id          TEXT NOT NULL PRIMARY KEY,
+  type        TEXT NOT NULL,
+  parent_id   TEXT,
+  parent_type TEXT,
+  created_at  ${ts} NOT NULL
+)`,
+    `CREATE INDEX ${ifne} kavach_rebac_resources_parent
+  ON kavach_rebac_resources (parent_id, parent_type)`,
+    // ------------------------------------------------------------------
+    // kavach_rebac_relationships  (Zanzibar-style subject-relation-object tuples)
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_rebac_relationships (
+  id           TEXT NOT NULL PRIMARY KEY,
+  subject_type TEXT NOT NULL,
+  subject_id   TEXT NOT NULL,
+  relation     TEXT NOT NULL,
+  object_type  TEXT NOT NULL,
+  object_id    TEXT NOT NULL,
+  created_at   ${ts} NOT NULL
+)`,
+    `CREATE INDEX ${ifne} kavach_rebac_relationships_subject
+  ON kavach_rebac_relationships (subject_type, subject_id)`,
+    `CREATE INDEX ${ifne} kavach_rebac_relationships_object
+  ON kavach_rebac_relationships (object_type, object_id)`,
+    `CREATE UNIQUE INDEX ${ifne} kavach_rebac_relationships_tuple
+  ON kavach_rebac_relationships (subject_type, subject_id, relation, object_type, object_id)`,
+    // ------------------------------------------------------------------
+    // kavach_federation_instances  (trusted remote KavachOS instances)
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_federation_instances (
+  id            TEXT NOT NULL PRIMARY KEY,
+  instance_id   TEXT NOT NULL UNIQUE,
+  instance_url  TEXT NOT NULL,
+  public_key_jwk TEXT,
+  trust_level   TEXT NOT NULL DEFAULT 'verify-only',
+  discovered_at ${tsNull},
+  created_at    ${ts} NOT NULL,
+  updated_at    ${ts} NOT NULL
+)`,
+    // ------------------------------------------------------------------
+    // kavach_federation_tokens  (issued/received federation tokens)
+    // ------------------------------------------------------------------
+    `CREATE TABLE ${ifne} kavach_federation_tokens (
+  id                  TEXT    NOT NULL PRIMARY KEY,
+  token_jti           TEXT    NOT NULL UNIQUE,
+  agent_id            TEXT    NOT NULL,
+  source_instance_id  TEXT    NOT NULL,
+  target_instance_id  TEXT,
+  direction           TEXT    NOT NULL,
+  permissions         ${json} NOT NULL,
+  trust_score         INTEGER,
+  expires_at          ${ts}   NOT NULL,
+  created_at          ${ts}   NOT NULL
+)`,
+    `CREATE INDEX ${ifne} kavach_federation_tokens_agent
+  ON kavach_federation_tokens (agent_id)`,
+    `CREATE INDEX ${ifne} kavach_federation_tokens_source
+  ON kavach_federation_tokens (source_instance_id)`
     // ------------------------------------------------------------------
     // kavach_users ban columns  (ALTER TABLE IF NOT EXISTS — safe no-ops)
     // These are appended as separate ALTER statements for existing DBs.
@@ -960,7 +1093,7 @@ function createDelegationModule(config) {
         `Delegation depth ${currentDepth} exceeds maximum allowed depth of ${maxDepth}. This prevents infinite delegation chains.`
       );
     }
-    const id = randomUUID();
+    const id = generateId();
     const now = /* @__PURE__ */ new Date();
     await db.insert(delegationChains).values({
       id,
@@ -2107,7 +2240,7 @@ function isExceeded(limits, usage) {
 }
 function createPolicyModule(db) {
   async function create(input) {
-    const id = `pol_${randomUUID().replace(/-/g, "")}`;
+    const id = `pol_${generateId().replace(/-/g, "")}`;
     const now = /* @__PURE__ */ new Date();
     const usage = emptyUsage();
     await db.insert(budgetPolicies).values({
@@ -2262,6 +2395,334 @@ function createPolicyModule(db) {
   }
   return { create, get, list, update, remove, checkBudget, recordUsage, resetDaily, resetMonthly };
 }
+
+// src/redirect/chain.ts
+var DEFAULT_COOKIE_NAME = "kavach_redirect";
+var DEFAULT_MAX_AGE = 600;
+var DEFAULT_PATH = "/";
+var DEFAULT_MAX_DEPTH = 10;
+var DEFAULT_EXCLUDE_PATHS = [
+  "/sign-in",
+  "/sign-up",
+  "/forgot-password",
+  "/reset-password",
+  "/verify-email",
+  "/api/"
+];
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function encodeState(state) {
+  const json = JSON.stringify(state);
+  const bytes = encoder.encode(json);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function decodeState(encoded) {
+  try {
+    let base64 = encoded.replace(/-/g, "+").replace(/_/g, "/");
+    while (base64.length % 4 !== 0) {
+      base64 += "=";
+    }
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    const json = decoder.decode(bytes);
+    const parsed = JSON.parse(json);
+    if (!isValidChainState(parsed)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isValidChainState(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  if (typeof obj.createdAt !== "number") return false;
+  if (!isValidEntry(obj.origin)) return false;
+  if (!Array.isArray(obj.steps)) return false;
+  for (const step of obj.steps) {
+    if (!isValidEntry(step)) return false;
+  }
+  return true;
+}
+function isValidEntry(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  return typeof obj.id === "string" && typeof obj.path === "string" && typeof obj.query === "object" && obj.query !== null && typeof obj.hash === "string" && typeof obj.createdAt === "number";
+}
+function parseCookies(request) {
+  const header = request.headers.get("cookie");
+  if (!header) return {};
+  const cookies = {};
+  for (const pair of header.split(";")) {
+    const eqIdx = pair.indexOf("=");
+    if (eqIdx === -1) continue;
+    const key = pair.slice(0, eqIdx).trim();
+    const val = pair.slice(eqIdx + 1).trim();
+    cookies[key] = val;
+  }
+  return cookies;
+}
+function isExcluded(path, excludePaths) {
+  for (const excluded of excludePaths) {
+    if (excluded.endsWith("/")) {
+      if (path.startsWith(excluded) || path === excluded.slice(0, -1)) return true;
+    } else {
+      if (path === excluded) return true;
+    }
+  }
+  return false;
+}
+function createRedirectChain(config) {
+  const cookieName = config?.cookieName ?? DEFAULT_COOKIE_NAME;
+  const maxAge = config?.maxAge ?? DEFAULT_MAX_AGE;
+  const defaultPath = config?.defaultPath ?? DEFAULT_PATH;
+  const excludePaths = config?.excludePaths ?? DEFAULT_EXCLUDE_PATHS;
+  const preserveQuery = config?.preserveQuery ?? true;
+  const preserveHash = config?.preserveHash ?? true;
+  const maxDepth = config?.maxDepth ?? DEFAULT_MAX_DEPTH;
+  const cookieOpts = {
+    httpOnly: config?.cookie?.httpOnly ?? true,
+    secure: config?.cookie?.secure ?? true,
+    sameSite: config?.cookie?.sameSite ?? "lax",
+    path: config?.cookie?.path ?? "/",
+    domain: config?.cookie?.domain
+  };
+  let currentState = null;
+  function buildCookieHeader(value, age) {
+    const parts = [`${cookieName}=${value}`, `Path=${cookieOpts.path}`, `Max-Age=${age}`];
+    if (cookieOpts.httpOnly) parts.push("HttpOnly");
+    if (cookieOpts.secure) parts.push("Secure");
+    parts.push(
+      `SameSite=${cookieOpts.sameSite.charAt(0).toUpperCase()}${cookieOpts.sameSite.slice(1)}`
+    );
+    if (cookieOpts.domain) parts.push(`Domain=${cookieOpts.domain}`);
+    return parts.join("; ");
+  }
+  function buildClearCookie() {
+    return buildCookieHeader("", 0);
+  }
+  function serializeAndSetCookie(state) {
+    currentState = state;
+    const encoded = encodeState(state);
+    return buildCookieHeader(encoded, maxAge);
+  }
+  function parseFromRequest(request) {
+    const cookies = parseCookies(request);
+    const raw = cookies[cookieName];
+    if (!raw) return null;
+    const state = decodeState(raw);
+    if (!state) return null;
+    const elapsed = Date.now() - state.createdAt;
+    if (elapsed > maxAge * 1e3) return null;
+    currentState = state;
+    return state;
+  }
+  function createEntryFromUrl(url, label) {
+    let parsed;
+    if (typeof url === "string") {
+      if (url.startsWith("/")) {
+        parsed = new URL(url, "http://localhost");
+      } else {
+        parsed = new URL(url);
+      }
+    } else {
+      parsed = new URL(url.url);
+    }
+    const query = {};
+    if (preserveQuery) {
+      parsed.searchParams.forEach((value, key) => {
+        query[key] = value;
+      });
+    }
+    return {
+      id: generateId(),
+      path: parsed.pathname,
+      query,
+      hash: preserveHash ? parsed.hash.replace(/^#/, "") : "",
+      createdAt: Date.now(),
+      label
+    };
+  }
+  function buildUrlFromEntry(entry) {
+    let url = entry.path;
+    const params = Object.entries(entry.query);
+    if (params.length > 0) {
+      const searchParams = new URLSearchParams();
+      for (const [key, value] of params) {
+        searchParams.set(key, value);
+      }
+      url += `?${searchParams.toString()}`;
+    }
+    if (entry.hash) {
+      url += `#${entry.hash}`;
+    }
+    return url;
+  }
+  const manager = {
+    capture(request) {
+      const existing = parseFromRequest(request);
+      if (existing) {
+        return serializeAndSetCookie(existing);
+      }
+      const entry = createEntryFromUrl(request);
+      if (isExcluded(entry.path, excludePaths)) {
+        entry.path = defaultPath;
+        entry.query = {};
+        entry.hash = "";
+      }
+      const state = {
+        origin: entry,
+        steps: [],
+        createdAt: Date.now()
+      };
+      return serializeAndSetCookie(state);
+    },
+    push(path, options) {
+      if (!currentState) {
+        currentState = {
+          origin: {
+            id: generateId(),
+            path: defaultPath,
+            query: {},
+            hash: "",
+            createdAt: Date.now()
+          },
+          steps: [],
+          createdAt: Date.now()
+        };
+      }
+      if (currentState.steps.length >= maxDepth) {
+        return serializeAndSetCookie(currentState);
+      }
+      const entry = {
+        id: generateId(),
+        path,
+        query: options?.query ?? {},
+        hash: "",
+        createdAt: Date.now(),
+        label: options?.label
+      };
+      currentState.steps.push(entry);
+      return serializeAndSetCookie(currentState);
+    },
+    pop(request) {
+      const state = parseFromRequest(request);
+      if (!state) {
+        return { url: defaultPath, done: true, clearCookie: buildClearCookie() };
+      }
+      if (state.steps.length > 0) {
+        const next = state.steps.shift();
+        const url2 = buildUrlFromEntry(next);
+        if (state.steps.length === 0) {
+          currentState = state;
+          return {
+            url: url2,
+            done: false,
+            clearCookie: null
+          };
+        }
+        return {
+          url: url2,
+          done: false,
+          clearCookie: null
+        };
+      }
+      const url = buildUrlFromEntry(state.origin);
+      currentState = null;
+      return {
+        url,
+        done: true,
+        clearCookie: buildClearCookie()
+      };
+    },
+    peek(request) {
+      const state = parseFromRequest(request);
+      if (!state) return null;
+      if (state.steps.length > 0) {
+        const next = state.steps[0];
+        return {
+          url: buildUrlFromEntry(next),
+          remaining: state.steps.length
+          // +origin is implicit
+        };
+      }
+      return {
+        url: buildUrlFromEntry(state.origin),
+        remaining: 0
+      };
+    },
+    getOrigin(request) {
+      const state = parseFromRequest(request);
+      if (!state) return null;
+      return state.origin;
+    },
+    clear() {
+      currentState = null;
+      return buildClearCookie();
+    },
+    parse(request) {
+      return parseFromRequest(request);
+    },
+    buildUrl(entry) {
+      return buildUrlFromEntry(entry);
+    },
+    createEntry(url, label) {
+      return createEntryFromUrl(url, label);
+    }
+  };
+  return manager;
+}
+
+// src/session/freshness.ts
+var DEFAULT_FRESH_AGE_SECONDS = 300;
+function createSessionFreshnessModule(config = {}) {
+  const freshAge = config.freshAge ?? DEFAULT_FRESH_AGE_SECONDS;
+  function isFresh(session) {
+    const now = Date.now();
+    const createdAt = session.createdAt.getTime();
+    return now - createdAt < freshAge * 1e3;
+  }
+  function requireFresh(session) {
+    if (isFresh(session)) {
+      const freshUntil = new Date(session.createdAt.getTime() + freshAge * 1e3);
+      return { success: true, data: { freshUntil } };
+    }
+    return {
+      success: false,
+      error: {
+        code: "SESSION_NOT_FRESH",
+        message: "Session is not fresh. Please re-authenticate to perform this action.",
+        details: {
+          createdAt: session.createdAt.toISOString(),
+          freshAge,
+          requiredAfter: new Date(session.createdAt.getTime() + freshAge * 1e3).toISOString()
+        }
+      }
+    };
+  }
+  function guard(session) {
+    if (isFresh(session)) return null;
+    return new Response(
+      JSON.stringify({
+        error: {
+          code: "SESSION_NOT_FRESH",
+          message: "Session is not fresh. Please re-authenticate to perform this action."
+        }
+      }),
+      {
+        status: 403,
+        headers: { "Content-Type": "application/json" }
+      }
+    );
+  }
+  return { isFresh, requireFresh, guard };
+}
 function slugRegex() {
   return /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 }
@@ -2287,7 +2748,7 @@ function createTenantModule(db) {
     if (existing.length > 0) {
       throw new Error(`Tenant with slug "${input.slug}" already exists.`);
     }
-    const id = `tnt_${randomUUID().replace(/-/g, "")}`;
+    const id = `tnt_${generateId().replace(/-/g, "")}`;
     const now = /* @__PURE__ */ new Date();
     const settings = input.settings ?? {};
     await db.insert(tenants).values({
@@ -2529,8 +2990,12 @@ async function createKavach(config) {
   const adminModule = config.admin ? createAdminModule(config.admin, db, sessionManager) : null;
   const apiKeyManagerModule = config.apiKeys ? createApiKeyManagerModule(config.apiKeys, db) : null;
   const usernameModule = config.username && sessionManager ? createUsernameAuthModule(config.username, db, sessionManager) : null;
+  const oneTimeTokenModule = createOneTimeTokenModule({}, db);
+  const passwordResetModule = config.passwordReset && sessionManager ? createPasswordResetModule(config.passwordReset, db, sessionManager, oneTimeTokenModule) : null;
+  const emailVerificationModule = config.emailVerification ? createEmailVerificationModule(config.emailVerification, db, oneTimeTokenModule) : null;
   const phoneModule = config.phone && sessionManager ? createPhoneAuthModule(config.phone, db, sessionManager) : null;
   const captchaModule = config.captcha ? createCaptchaModule(config.captcha) : null;
+  const redirectChain = createRedirectChain(config.redirects);
   const webhookModule = config.webhooks && config.webhooks.length > 0 ? createWebhookModule(config.webhooks) : null;
   const pluginRegistry = await initializePlugins(config.plugins ?? [], db, config);
   const endpointCtx = {
@@ -2673,7 +3138,7 @@ async function createKavach(config) {
      */
     async register(input) {
       const now = /* @__PURE__ */ new Date();
-      const id = randomUUID();
+      const id = generateId();
       await db.insert(mcpServers).values({
         id,
         name: input.name,
@@ -2967,6 +3432,65 @@ async function createKavach(config) {
      * ```
      */
     username: usernameModule,
+    /**
+     * Password reset (forgot password + reset password).
+     *
+     * Null when `passwordReset` config was not provided or `auth.session`
+     * is not configured.
+     *
+     * @example
+     * ```typescript
+     * // In your route handler
+     * const response = await kavach.passwordReset?.handleRequest(request);
+     * if (response) return response;
+     *
+     * // Or programmatically
+     * await kavach.passwordReset?.requestReset('alice@example.com');
+     * await kavach.passwordReset?.resetPassword(token, 'new-password');
+     * ```
+     */
+    passwordReset: passwordResetModule,
+    /**
+     * Email address verification.
+     *
+     * Null when `emailVerification` config was not provided.
+     *
+     * @example
+     * ```typescript
+     * // Send a verification email after sign-up
+     * await kavach.emailVerification?.sendVerification(userId, email);
+     *
+     * // Confirm from the link in the email
+     * const result = await kavach.emailVerification?.verify(token);
+     *
+     * // Check status
+     * const verified = await kavach.emailVerification?.isVerified(userId);
+     * ```
+     */
+    emailVerification: emailVerificationModule,
+    /**
+     * One-time tokens (email verify, password reset, invitations, custom).
+     *
+     * Always available. Used internally by password reset but exposed for
+     * custom flows (email verification, invitation links, etc.).
+     */
+    oneTimeTokens: oneTimeTokenModule,
+    /**
+     * Session freshness enforcement for sensitive operations.
+     *
+     * Use as middleware before password changes, passkey registration,
+     * billing updates, or any action that requires a recently-authenticated
+     * session rather than an auto-refreshed one.
+     *
+     * @example
+     * ```typescript
+     * const stale = kavach.sessionFreshness.guard(session);
+     * if (stale) return stale; // 403 SESSION_NOT_FRESH
+     * ```
+     */
+    sessionFreshness: createSessionFreshnessModule(
+      config.sessionFreshness
+    ),
     /**
      * Phone number (SMS OTP) authentication.
      *
@@ -3003,6 +3527,27 @@ async function createKavach(config) {
      * ```
      */
     webhooks: webhookModule,
+    /**
+     * Redirect chain manager.
+     *
+     * Capture the user's original destination before auth redirects, push
+     * intermediate steps (onboarding, email verification), and pop them
+     * back in order. Cookie-based, works across page transitions and tabs.
+     *
+     * @example
+     * ```typescript
+     * // In auth middleware — save where the user was going
+     * const setCookie = kavach.redirects.capture(request);
+     * return new Response(null, { status: 302, headers: { Location: '/sign-in', 'Set-Cookie': setCookie } });
+     *
+     * // After sign-in — send user to their original destination
+     * const { url, clearCookie } = kavach.redirects.pop(request);
+     * const headers: Record<string, string> = { Location: url };
+     * if (clearCookie) headers['Set-Cookie'] = clearCookie;
+     * return new Response(null, { status: 302, headers });
+     * ```
+     */
+    redirects: redirectChain,
     /**
      * Plugin system.
      *
@@ -3479,7 +4024,7 @@ function serializeCookieDeletion(name, options) {
     expires: /* @__PURE__ */ new Date(0)
   });
 }
-function parseCookies(header) {
+function parseCookies2(header) {
   const result = {};
   if (!header || !header.trim()) return result;
   for (const pair of header.split(";")) {
@@ -3496,10 +4041,10 @@ function parseCookies(header) {
   return result;
 }
 function getCookie(header, name) {
-  return parseCookies(header)[name];
+  return parseCookies2(header)[name];
 }
 function parseCookiesFromRequest(request) {
-  return parseCookies(request.headers.get("cookie") ?? "");
+  return parseCookies2(request.headers.get("cookie") ?? "");
 }
 function capitalize(s) {
   return s.charAt(0).toUpperCase() + s.slice(1);
@@ -3793,15 +4338,15 @@ function buildSessionMetadata(request, extra) {
 }
 
 // src/webhooks/webhook.ts
-function generateId() {
+function generateId2() {
   const bytes = new Uint8Array(16);
   crypto.getRandomValues(bytes);
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
 async function signPayload2(secret, body) {
-  const encoder = new TextEncoder();
-  const keyData = encoder.encode(secret);
-  const messageData = encoder.encode(body);
+  const encoder2 = new TextEncoder();
+  const keyData = encoder2.encode(secret);
+  const messageData = encoder2.encode(body);
   const key = await crypto.subtle.importKey(
     "raw",
     keyData,
@@ -3838,7 +4383,7 @@ async function deliverWebhook(url, event, payload, deliveryId, timestamp, signat
   }
 }
 async function dispatchWithRetry(url, event, payload, config) {
-  const deliveryId = generateId();
+  const deliveryId = generateId2();
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
   const body = JSON.stringify(payload);
   const signature = await signPayload2(config.secret, body);
@@ -3870,7 +4415,7 @@ function createWebhookModule2(config) {
   const subscriptions = /* @__PURE__ */ new Map();
   async function subscribe(url, events) {
     const sub = {
-      id: generateId(),
+      id: generateId2(),
       url,
       events,
       active: true,
@@ -3898,7 +4443,7 @@ function createWebhookModule2(config) {
     if (!sub) {
       return { success: false, error: "Subscription not found" };
     }
-    const deliveryId = generateId();
+    const deliveryId = generateId2();
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
     const pingPayload = { event: "ping", subscriptionId, timestamp };
     const body = JSON.stringify(pingPayload);
@@ -3928,6 +4473,6 @@ async function verifyWebhookSignature(secret, rawBody, signature) {
   return diff === 0;
 }
 
-export { MultiSessionLimitError, buildDidDocument, buildSessionMetadata, classifyViolation, createApprovalModule, createCookieSessionManager, createDatabase, createDatabaseSync, createDelegationModule, createDidModule, createEmailTemplates, createI18n, createKavach, createMultiSessionModule, createPluginRouter, createPolicyModule, createPresentation, createPrivilegeAnalyzer, createTables, createTenantModule, createTrustModule, createWebhookModule2 as createWebhookModule, de, en, es, fr, generateCsrfToken, generateDidKey, generateDidWeb, generateOpenAPISpec, getCookie, getDidWebUrl, initializePlugins, ja, parseCookies, parseCookiesFromRequest, resolveDidKey, resolveDidWeb, serializeCookie, serializeCookieDeletion, signPayload, validateCsrfToken, validateOrigin, verifyPayload, verifyPresentation, verifyWebhookSignature, zh };
+export { MultiSessionLimitError, buildDidDocument, buildSessionMetadata, classifyViolation, createApprovalModule, createCookieSessionManager, createDatabase, createDatabaseSync, createDelegationModule, createDidModule, createEmailTemplates, createI18n, createKavach, createMultiSessionModule, createPluginRouter, createPolicyModule, createPresentation, createPrivilegeAnalyzer, createRedirectChain, createSessionFreshnessModule, createTables, createTenantModule, createTrustModule, createWebhookModule2 as createWebhookModule, de, en, es, fr, generateCsrfToken, generateDidKey, generateDidWeb, generateOpenAPISpec, getCookie, getDidWebUrl, initializePlugins, ja, parseCookies2 as parseCookies, parseCookiesFromRequest, resolveDidKey, resolveDidWeb, serializeCookie, serializeCookieDeletion, signPayload, validateCsrfToken, validateOrigin, verifyPayload, verifyPresentation, verifyWebhookSignature, zh };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map