kavachos 0.0.4 → 0.0.6

package/dist/{types-Xk83hv4O.d.ts → types-W8X0PXE7.d.ts}

@@ -1,6 +1,6 @@
-import { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
 import * as drizzle_orm_sqlite_core from 'drizzle-orm/sqlite-core';
-import { f as McpConfig } from './types-mwupB57A.js';
+import { BaseSQLiteDatabase } from 'drizzle-orm/sqlite-core';
+import { R as Result, f as McpConfig } from './types-BuHrZcjE.js';
 
 declare const users: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
     name: "kavach_users";
@@ -209,6 +209,23 @@ declare const users: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        emailVerified: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "email_verified";
+            tableName: "kavach_users";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         stripeCustomerId: drizzle_orm_sqlite_core.SQLiteColumn<{
             name: "stripe_customer_id";
             tableName: "kavach_users";
@@ -5923,13 +5940,13 @@ declare const oidcRefreshTokens: drizzle_orm_sqlite_core.SQLiteTableWithColumns<
     };
     dialect: "sqlite";
 }>;
-declare const jwtRefreshTokens: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
-    name: "kavach_jwt_refresh_tokens";
+declare const costEvents: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
+    name: "kavach_cost_events";
     schema: undefined;
     columns: {
         id: drizzle_orm_sqlite_core.SQLiteColumn<{
             name: "id";
-            tableName: "kavach_jwt_refresh_tokens";
+            tableName: "kavach_cost_events";
             dataType: "string";
             columnType: "SQLiteText";
             data: string;
@@ -5946,9 +5963,9 @@ declare const jwtRefreshTokens: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
         }, {}, {
             length: number | undefined;
         }>;
-        tokenHash: drizzle_orm_sqlite_core.SQLiteColumn<{
-            name: "token_hash";
-            tableName: "kavach_jwt_refresh_tokens";
+        agentId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "agent_id";
+            tableName: "kavach_cost_events";
             dataType: "string";
             columnType: "SQLiteText";
             data: string;
@@ -5965,9 +5982,9 @@ declare const jwtRefreshTokens: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
         }, {}, {
             length: number | undefined;
         }>;
-        userId: drizzle_orm_sqlite_core.SQLiteColumn<{
-            name: "user_id";
-            tableName: "kavach_jwt_refresh_tokens";
+        tool: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "tool";
+            tableName: "kavach_cost_events";
             dataType: "string";
             columnType: "SQLiteText";
             data: string;
@@ -5984,15 +6001,49 @@ declare const jwtRefreshTokens: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
         }, {}, {
             length: number | undefined;
         }>;
-        used: drizzle_orm_sqlite_core.SQLiteColumn<{
-            name: "used";
-            tableName: "kavach_jwt_refresh_tokens";
-            dataType: "boolean";
-            columnType: "SQLiteBoolean";
-            data: boolean;
+        inputTokens: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "input_tokens";
+            tableName: "kavach_cost_events";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        outputTokens: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "output_tokens";
+            tableName: "kavach_cost_events";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        costMicros: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "cost_micros";
+            tableName: "kavach_cost_events";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
             driverParam: number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -6001,9 +6052,66 @@ declare const jwtRefreshTokens: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        expiresAt: drizzle_orm_sqlite_core.SQLiteColumn<{
-            name: "expires_at";
-            tableName: "kavach_jwt_refresh_tokens";
+        currency: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "currency";
+            tableName: "kavach_cost_events";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        metadata: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "metadata";
+            tableName: "kavach_cost_events";
+            dataType: "json";
+            columnType: "SQLiteTextJson";
+            data: Record<string, unknown>;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        delegationChainId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "delegation_chain_id";
+            tableName: "kavach_cost_events";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        recordedAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "recorded_at";
+            tableName: "kavach_cost_events";
             dataType: "date";
             columnType: "SQLiteTimestamp";
             data: Date;
@@ -6018,9 +6126,92 @@ declare const jwtRefreshTokens: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        createdAt: drizzle_orm_sqlite_core.SQLiteColumn<{
-            name: "created_at";
-            tableName: "kavach_jwt_refresh_tokens";
+    };
+    dialect: "sqlite";
+}>;
+declare const ephemeralSessions: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
+    name: "kavach_ephemeral_sessions";
+    schema: undefined;
+    columns: {
+        id: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "id";
+            tableName: "kavach_ephemeral_sessions";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        agentId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "agent_id";
+            tableName: "kavach_ephemeral_sessions";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        ownerId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "owner_id";
+            tableName: "kavach_ephemeral_sessions";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        tokenHash: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "token_hash";
+            tableName: "kavach_ephemeral_sessions";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        expiresAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "expires_at";
+            tableName: "kavach_ephemeral_sessions";
             dataType: "date";
             columnType: "SQLiteTimestamp";
             data: Date;
@@ -6035,78 +6226,1037 @@ declare const jwtRefreshTokens: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-    };
-    dialect: "sqlite";
-}>;
-
-declare const schema_agentCards: typeof agentCards;
-declare const schema_agentDids: typeof agentDids;
-declare const schema_agents: typeof agents;
-declare const schema_apiKeys: typeof apiKeys;
-declare const schema_approvalRequests: typeof approvalRequests;
-declare const schema_auditLogs: typeof auditLogs;
-declare const schema_budgetPolicies: typeof budgetPolicies;
-declare const schema_delegationChains: typeof delegationChains;
-declare const schema_emailOtps: typeof emailOtps;
-declare const schema_jwtRefreshTokens: typeof jwtRefreshTokens;
-declare const schema_loginHistory: typeof loginHistory;
-declare const schema_magicLinks: typeof magicLinks;
-declare const schema_mcpServers: typeof mcpServers;
-declare const schema_oauthAccessTokens: typeof oauthAccessTokens;
-declare const schema_oauthAuthorizationCodes: typeof oauthAuthorizationCodes;
-declare const schema_oauthClients: typeof oauthClients;
-declare const schema_oidcAuthCodes: typeof oidcAuthCodes;
-declare const schema_oidcClients: typeof oidcClients;
-declare const schema_oidcRefreshTokens: typeof oidcRefreshTokens;
-declare const schema_oneTimeTokens: typeof oneTimeTokens;
-declare const schema_orgInvitations: typeof orgInvitations;
-declare const schema_orgMembers: typeof orgMembers;
-declare const schema_orgRoles: typeof orgRoles;
-declare const schema_organizations: typeof organizations;
-declare const schema_passkeyChallenges: typeof passkeyChallenges;
-declare const schema_passkeyCredentials: typeof passkeyCredentials;
-declare const schema_permissions: typeof permissions;
-declare const schema_phoneVerifications: typeof phoneVerifications;
-declare const schema_rateLimits: typeof rateLimits;
-declare const schema_sessions: typeof sessions;
-declare const schema_ssoConnections: typeof ssoConnections;
-declare const schema_tenants: typeof tenants;
-declare const schema_totpRecords: typeof totpRecords;
-declare const schema_trustScores: typeof trustScores;
-declare const schema_trustedDevices: typeof trustedDevices;
-declare const schema_usernameAccounts: typeof usernameAccounts;
-declare const schema_users: typeof users;
-declare namespace schema {
-  export { schema_agentCards as agentCards, schema_agentDids as agentDids, schema_agents as agents, schema_apiKeys as apiKeys, schema_approvalRequests as approvalRequests, schema_auditLogs as auditLogs, schema_budgetPolicies as budgetPolicies, schema_delegationChains as delegationChains, schema_emailOtps as emailOtps, schema_jwtRefreshTokens as jwtRefreshTokens, schema_loginHistory as loginHistory, schema_magicLinks as magicLinks, schema_mcpServers as mcpServers, schema_oauthAccessTokens as oauthAccessTokens, schema_oauthAuthorizationCodes as oauthAuthorizationCodes, schema_oauthClients as oauthClients, schema_oidcAuthCodes as oidcAuthCodes, schema_oidcClients as oidcClients, schema_oidcRefreshTokens as oidcRefreshTokens, schema_oneTimeTokens as oneTimeTokens, schema_orgInvitations as orgInvitations, schema_orgMembers as orgMembers, schema_orgRoles as orgRoles, schema_organizations as organizations, schema_passkeyChallenges as passkeyChallenges, schema_passkeyCredentials as passkeyCredentials, schema_permissions as permissions, schema_phoneVerifications as phoneVerifications, schema_rateLimits as rateLimits, schema_sessions as sessions, schema_ssoConnections as ssoConnections, schema_tenants as tenants, schema_totpRecords as totpRecords, schema_trustScores as trustScores, schema_trustedDevices as trustedDevices, schema_usernameAccounts as usernameAccounts, schema_users as users };
-}
-
-/**
- * The fully-typed SQLite Drizzle database.
- * Postgres and MySQL connections are represented as `AnyDatabase` at the
- * adapter boundary because drizzle-orm exposes separate schema builders
- * (pg-core / mysql-core) that are incompatible with the SQLite schema
- * defined in schema.ts. Full multi-dialect Drizzle schema support is
- * planned for v0.2.0.
- */
-type Database = BetterSQLite3Database<typeof schema>;
-interface DatabaseConfig$1 {
-    provider: "sqlite" | "postgres" | "mysql";
-    url: string;
-    /** Skip automatic table creation on init (default: false) */
-    skipMigrations?: boolean;
+        maxActions: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "max_actions";
+            tableName: "kavach_ephemeral_sessions";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actionsUsed: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "actions_used";
+            tableName: "kavach_ephemeral_sessions";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "status";
+            tableName: "kavach_ephemeral_sessions";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: "active" | "revoked" | "expired" | "exhausted";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["active", "expired", "exhausted", "revoked"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        auditGroupId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "audit_group_id";
+            tableName: "kavach_ephemeral_sessions";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        createdAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "created_at";
+            tableName: "kavach_ephemeral_sessions";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "updated_at";
+            tableName: "kavach_ephemeral_sessions";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
+declare const streamEvents: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
+    name: "kavach_stream_events";
+    schema: undefined;
+    columns: {
+        id: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "id";
+            tableName: "kavach_stream_events";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        type: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "type";
+            tableName: "kavach_stream_events";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        timestamp: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "timestamp";
+            tableName: "kavach_stream_events";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        data: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "data";
+            tableName: "kavach_stream_events";
+            dataType: "json";
+            columnType: "SQLiteTextJson";
+            data: Record<string, unknown>;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        agentId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "agent_id";
+            tableName: "kavach_stream_events";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        userId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "user_id";
+            tableName: "kavach_stream_events";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+declare const jwtRefreshTokens: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
+    name: "kavach_jwt_refresh_tokens";
+    schema: undefined;
+    columns: {
+        id: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "id";
+            tableName: "kavach_jwt_refresh_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        tokenHash: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "token_hash";
+            tableName: "kavach_jwt_refresh_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        userId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "user_id";
+            tableName: "kavach_jwt_refresh_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        used: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "used";
+            tableName: "kavach_jwt_refresh_tokens";
+            dataType: "boolean";
+            columnType: "SQLiteBoolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "expires_at";
+            tableName: "kavach_jwt_refresh_tokens";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "created_at";
+            tableName: "kavach_jwt_refresh_tokens";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
+declare const rebacResources: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
+    name: "kavach_rebac_resources";
+    schema: undefined;
+    columns: {
+        id: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "id";
+            tableName: "kavach_rebac_resources";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        type: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "type";
+            tableName: "kavach_rebac_resources";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        parentId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "parent_id";
+            tableName: "kavach_rebac_resources";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        parentType: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "parent_type";
+            tableName: "kavach_rebac_resources";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        createdAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "created_at";
+            tableName: "kavach_rebac_resources";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
+declare const rebacRelationships: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
+    name: "kavach_rebac_relationships";
+    schema: undefined;
+    columns: {
+        id: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "id";
+            tableName: "kavach_rebac_relationships";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        subjectType: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "subject_type";
+            tableName: "kavach_rebac_relationships";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        subjectId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "subject_id";
+            tableName: "kavach_rebac_relationships";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        relation: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "relation";
+            tableName: "kavach_rebac_relationships";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        objectType: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "object_type";
+            tableName: "kavach_rebac_relationships";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        objectId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "object_id";
+            tableName: "kavach_rebac_relationships";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        createdAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "created_at";
+            tableName: "kavach_rebac_relationships";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
+declare const federationInstances: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
+    name: "kavach_federation_instances";
+    schema: undefined;
+    columns: {
+        id: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "id";
+            tableName: "kavach_federation_instances";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        instanceId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "instance_id";
+            tableName: "kavach_federation_instances";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        instanceUrl: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "instance_url";
+            tableName: "kavach_federation_instances";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        publicKeyJwk: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "public_key_jwk";
+            tableName: "kavach_federation_instances";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        trustLevel: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "trust_level";
+            tableName: "kavach_federation_instances";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: "limited" | "full" | "verify-only";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["full", "limited", "verify-only"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        discoveredAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "discovered_at";
+            tableName: "kavach_federation_instances";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "created_at";
+            tableName: "kavach_federation_instances";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "updated_at";
+            tableName: "kavach_federation_instances";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
+declare const federationTokens: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
+    name: "kavach_federation_tokens";
+    schema: undefined;
+    columns: {
+        id: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "id";
+            tableName: "kavach_federation_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        tokenJti: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "token_jti";
+            tableName: "kavach_federation_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        agentId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "agent_id";
+            tableName: "kavach_federation_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        sourceInstanceId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "source_instance_id";
+            tableName: "kavach_federation_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        targetInstanceId: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "target_instance_id";
+            tableName: "kavach_federation_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        direction: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "direction";
+            tableName: "kavach_federation_tokens";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: "issued" | "received";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["issued", "received"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        permissions: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "permissions";
+            tableName: "kavach_federation_tokens";
+            dataType: "json";
+            columnType: "SQLiteTextJson";
+            data: string[];
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        trustScore: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "trust_score";
+            tableName: "kavach_federation_tokens";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "expires_at";
+            tableName: "kavach_federation_tokens";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: "created_at";
+            tableName: "kavach_federation_tokens";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
+
+declare const schema_agentCards: typeof agentCards;
+declare const schema_agentDids: typeof agentDids;
+declare const schema_agents: typeof agents;
+declare const schema_apiKeys: typeof apiKeys;
+declare const schema_approvalRequests: typeof approvalRequests;
+declare const schema_auditLogs: typeof auditLogs;
+declare const schema_budgetPolicies: typeof budgetPolicies;
+declare const schema_costEvents: typeof costEvents;
+declare const schema_delegationChains: typeof delegationChains;
+declare const schema_emailOtps: typeof emailOtps;
+declare const schema_ephemeralSessions: typeof ephemeralSessions;
+declare const schema_federationInstances: typeof federationInstances;
+declare const schema_federationTokens: typeof federationTokens;
+declare const schema_jwtRefreshTokens: typeof jwtRefreshTokens;
+declare const schema_loginHistory: typeof loginHistory;
+declare const schema_magicLinks: typeof magicLinks;
+declare const schema_mcpServers: typeof mcpServers;
+declare const schema_oauthAccessTokens: typeof oauthAccessTokens;
+declare const schema_oauthAuthorizationCodes: typeof oauthAuthorizationCodes;
+declare const schema_oauthClients: typeof oauthClients;
+declare const schema_oidcAuthCodes: typeof oidcAuthCodes;
+declare const schema_oidcClients: typeof oidcClients;
+declare const schema_oidcRefreshTokens: typeof oidcRefreshTokens;
+declare const schema_oneTimeTokens: typeof oneTimeTokens;
+declare const schema_orgInvitations: typeof orgInvitations;
+declare const schema_orgMembers: typeof orgMembers;
+declare const schema_orgRoles: typeof orgRoles;
+declare const schema_organizations: typeof organizations;
+declare const schema_passkeyChallenges: typeof passkeyChallenges;
+declare const schema_passkeyCredentials: typeof passkeyCredentials;
+declare const schema_permissions: typeof permissions;
+declare const schema_phoneVerifications: typeof phoneVerifications;
+declare const schema_rateLimits: typeof rateLimits;
+declare const schema_rebacRelationships: typeof rebacRelationships;
+declare const schema_rebacResources: typeof rebacResources;
+declare const schema_sessions: typeof sessions;
+declare const schema_ssoConnections: typeof ssoConnections;
+declare const schema_streamEvents: typeof streamEvents;
+declare const schema_tenants: typeof tenants;
+declare const schema_totpRecords: typeof totpRecords;
+declare const schema_trustScores: typeof trustScores;
+declare const schema_trustedDevices: typeof trustedDevices;
+declare const schema_usernameAccounts: typeof usernameAccounts;
+declare const schema_users: typeof users;
+declare namespace schema {
+  export { schema_agentCards as agentCards, schema_agentDids as agentDids, schema_agents as agents, schema_apiKeys as apiKeys, schema_approvalRequests as approvalRequests, schema_auditLogs as auditLogs, schema_budgetPolicies as budgetPolicies, schema_costEvents as costEvents, schema_delegationChains as delegationChains, schema_emailOtps as emailOtps, schema_ephemeralSessions as ephemeralSessions, schema_federationInstances as federationInstances, schema_federationTokens as federationTokens, schema_jwtRefreshTokens as jwtRefreshTokens, schema_loginHistory as loginHistory, schema_magicLinks as magicLinks, schema_mcpServers as mcpServers, schema_oauthAccessTokens as oauthAccessTokens, schema_oauthAuthorizationCodes as oauthAuthorizationCodes, schema_oauthClients as oauthClients, schema_oidcAuthCodes as oidcAuthCodes, schema_oidcClients as oidcClients, schema_oidcRefreshTokens as oidcRefreshTokens, schema_oneTimeTokens as oneTimeTokens, schema_orgInvitations as orgInvitations, schema_orgMembers as orgMembers, schema_orgRoles as orgRoles, schema_organizations as organizations, schema_passkeyChallenges as passkeyChallenges, schema_passkeyCredentials as passkeyCredentials, schema_permissions as permissions, schema_phoneVerifications as phoneVerifications, schema_rateLimits as rateLimits, schema_rebacRelationships as rebacRelationships, schema_rebacResources as rebacResources, schema_sessions as sessions, schema_ssoConnections as ssoConnections, schema_streamEvents as streamEvents, schema_tenants as tenants, schema_totpRecords as totpRecords, schema_trustScores as trustScores, schema_trustedDevices as trustedDevices, schema_usernameAccounts as usernameAccounts, schema_users as users };
+}
+
+/** Minimal Cloudflare D1 interface for type compatibility */
+interface D1DatabaseBinding {
+    prepare(query: string): D1PreparedStatement;
+    batch<T = unknown>(statements: D1PreparedStatement[]): Promise<D1Result<T>[]>;
+    exec(query: string): Promise<D1ExecResult>;
+}
+interface D1PreparedStatement {
+    bind(...values: unknown[]): D1PreparedStatement;
+    first<T = unknown>(colName?: string): Promise<T | null>;
+    run<T = unknown>(): Promise<D1Result<T>>;
+    all<T = unknown>(): Promise<D1Result<T>>;
+    raw<T = unknown>(): Promise<T[]>;
+}
+interface D1Result<T = unknown> {
+    results: T[];
+    success: boolean;
+    meta: Record<string, unknown>;
+}
+interface D1ExecResult {
+    count: number;
+    duration: number;
 }
+/**
+ * The fully-typed SQLite Drizzle database.
+ * Postgres and MySQL connections are represented as `AnyDatabase` at the
+ * adapter boundary because drizzle-orm exposes separate schema builders
+ * (pg-core / mysql-core) that are incompatible with the SQLite schema
+ * defined in schema.ts. Full multi-dialect Drizzle schema support is
+ * planned for v0.2.0.
+ */
+type Database = BaseSQLiteDatabase<"sync" | "async", Record<string, unknown>, typeof schema>;
+type DatabaseConfig = {
+    provider: "sqlite" | "postgres" | "mysql";
+    /** Connection URL. Required for sqlite, postgres, and mysql. */
+    url: string;
+    /** Skip automatic table creation on init (default: false) */
+    skipMigrations?: boolean;
+} | {
+    provider: "d1";
+    /** Cloudflare D1 binding from the Worker environment. Required when provider is "d1". */
+    binding: D1DatabaseBinding;
+    /** Skip automatic table creation on init (default: false) */
+    skipMigrations?: boolean;
+};
 /**
  * Create a database connection.
  *
  * - **SQLite** – fully typed Drizzle ORM via `better-sqlite3` (current default).
  * - **Postgres** – Drizzle connection via `drizzle-orm/node-postgres` + `pg` (peer dep).
  * - **MySQL** – Drizzle connection via `drizzle-orm/mysql2` + `mysql2` (peer dep).
+ * - **D1** – Drizzle connection via `drizzle-orm/d1` for Cloudflare Workers (peer dep).
  *
- * For Postgres and MySQL the return value is typed as `Database` for source
+ * For Postgres, MySQL, and D1 the return value is typed as `Database` for source
  * compatibility; the underlying Drizzle instance is created against the
  * correct driver. Full pg-core / mysql-core schema typings are planned for v0.2.0.
  */
-declare function createDatabase(config: DatabaseConfig$1): Promise<Database>;
+declare function createDatabase(config: DatabaseConfig): Promise<Database>;
 /**
  * Synchronous SQLite-only factory kept for backwards compatibility with code
  * that cannot use async initialisation. Throws if a non-SQLite provider is
@@ -6114,7 +7264,7 @@ declare function createDatabase(config: DatabaseConfig$1): Promise<Database>;
  *
  * @deprecated Prefer the async `createDatabase()` which supports all providers.
  */
-declare function createDatabaseSync(config: DatabaseConfig$1): Database;
+declare function createDatabaseSync(config: DatabaseConfig): Database;
 
 interface AgentConfig {
     /** Enable agent identity management */
@@ -6538,6 +7688,199 @@ interface EmailOtpModule {
 }
 declare function createEmailOtpModule(config: EmailOtpConfig, db: Database, sessionManager: SessionManager): EmailOtpModule;
 
+/**
+ * One-time token module for KavachOS.
+ *
+ * Issues single-use tokens for email verification, password resets,
+ * invitations, and custom flows. The raw token is returned to the caller
+ * once and never persisted — only a SHA-256 hash is stored. Tokens are
+ * invalidated on first use or when they expire.
+ *
+ * @example
+ * ```typescript
+ * const tokens = createOneTimeTokenModule({}, db);
+ *
+ * // Create a password-reset token
+ * const result = await tokens.createToken({
+ *   purpose: 'password-reset',
+ *   identifier: 'alice@example.com',
+ *   ttlSeconds: 1800,
+ * });
+ * if (result.success) {
+ *   await mailer.send({ to: 'alice@example.com', token: result.data.token });
+ * }
+ *
+ * // Validate (and consume) on the reset page
+ * const validation = await tokens.validateToken(incomingToken, 'password-reset');
+ * if (validation.success) {
+ *   // validation.data.identifier === 'alice@example.com'
+ * }
+ * ```
+ */
+
+/** Token purpose discriminator. Use 'custom' for any application-specific flow. */
+type OneTimeTokenPurpose = "email-verify" | "password-reset" | "invitation" | "custom";
+interface OneTimeTokenConfig {
+    /** Default TTL in seconds when none is specified per-call. Default: 3600 (1 hour). */
+    defaultTtlSeconds?: number;
+}
+interface CreateTokenInput {
+    purpose: OneTimeTokenPurpose;
+    /** Email address, user ID, or any caller-supplied key that scopes the token. */
+    identifier: string;
+    /** Arbitrary data to associate with the token (e.g. org ID, invited role). */
+    metadata?: Record<string, unknown>;
+    /** Override the module-level default TTL for this token only. */
+    ttlSeconds?: number;
+}
+interface ValidateTokenResult {
+    identifier: string;
+    metadata?: Record<string, unknown>;
+}
+interface RevokeTokensResult {
+    count: number;
+}
+interface OneTimeTokenModule {
+    /**
+     * Create a new one-time token.
+     *
+     * Returns the raw token (hex string) exactly once. Store it in your email
+     * or link — it cannot be recovered from the database afterwards.
+     */
+    createToken(input: CreateTokenInput): Promise<Result<{
+        token: string;
+        expiresAt: Date;
+    }>>;
+    /**
+     * Validate a token and mark it as used.
+     *
+     * Fails when the token is unknown, already used, expired, or belongs to a
+     * different purpose. On success the token is consumed immediately.
+     */
+    validateToken(token: string, purpose: string): Promise<Result<ValidateTokenResult>>;
+    /**
+     * Revoke all active tokens for an identifier, optionally scoped to a purpose.
+     *
+     * Useful for invalidating outstanding password-reset links when a user
+     * changes their password through another flow, or for cleaning up on account
+     * deletion.
+     */
+    revokeTokens(identifier: string, purpose?: string): Promise<Result<RevokeTokensResult>>;
+}
+/**
+ * Create a one-time token module backed by the provided database.
+ *
+ * The module is stateless — no in-memory caches — so multiple instances
+ * sharing the same database are safe.
+ */
+declare function createOneTimeTokenModule(config: OneTimeTokenConfig, db: Database): OneTimeTokenModule;
+
+/**
+ * Email verification module for KavachOS.
+ *
+ * Handles the full email address verification flow: generating single-use
+ * tokens, sending verification emails, and marking user addresses as verified
+ * in the database. Composes the one-time token module so tokens are stored as
+ * SHA-256 hashes and consumed on first use.
+ *
+ * Security properties:
+ * - Tokens are 256-bit random, stored as SHA-256 hashes (never in plaintext).
+ * - Single-use: consumed on first validation.
+ * - Configurable TTL (default 24 hours).
+ * - Outstanding verify tokens are revoked after successful verification.
+ * - Sending to an already-verified address returns success without sending.
+ *
+ * @example
+ * ```typescript
+ * const kavach = await createKavach({
+ *   database: { provider: 'sqlite', url: 'kavach.db' },
+ *   auth: { session: { secret: process.env.SESSION_SECRET } },
+ *   emailVerification: {
+ *     sendVerificationEmail: async (email, token, verifyUrl) => {
+ *       await resend.emails.send({
+ *         to: email,
+ *         subject: 'Verify your email',
+ *         html: `<a href="${verifyUrl}">Verify email</a>`,
+ *       });
+ *     },
+ *     verifyUrl: 'https://app.example.com/verify-email',
+ *   },
+ * });
+ *
+ * // Send verification email
+ * await kavach.emailVerification.sendVerification(userId, 'alice@example.com');
+ *
+ * // Verify the token from the link
+ * const result = await kavach.emailVerification.verify(token);
+ * if (result.success) console.log('Verified:', result.data.userId);
+ * ```
+ */
+
+interface EmailVerificationConfig {
+    /**
+     * Callback to send the verification email.
+     *
+     * KavachOS generates the token and constructs the verify URL. Your job is
+     * to deliver it (Resend, SES, SMTP, Postmark, whatever you use).
+     */
+    sendVerificationEmail: (email: string, token: string, verifyUrl: string) => Promise<void>;
+    /**
+     * Base URL for the verify page in your app.
+     *
+     * The token is appended as `?token=<token>`. Example:
+     * `https://app.example.com/verify-email` produces
+     * `https://app.example.com/verify-email?token=abc123...`
+     */
+    verifyUrl: string;
+    /**
+     * Token TTL in seconds. Default: 86400 (24 hours).
+     */
+    tokenTtlSeconds?: number;
+    /**
+     * When true, call `sendVerification` automatically after sign-up.
+     * Default: false.
+     *
+     * The caller is still responsible for calling `sendVerification` directly
+     * if this is false. This flag is informational — KavachOS uses it to
+     * signal intent to integrations (e.g. the username module).
+     */
+    autoVerifyOnSignUp?: boolean;
+}
+interface EmailVerificationModule {
+    /**
+     * Create a verification token and send the verification email.
+     *
+     * Returns `{ sent: true }` when the email was dispatched.
+     * Returns `{ sent: false }` when the email is already verified — no
+     * email is sent and no token is created in that case.
+     */
+    sendVerification(userId: string, email: string): Promise<Result<{
+        sent: boolean;
+    }>>;
+    /**
+     * Validate a verification token and mark the user's email as verified.
+     *
+     * The token is consumed on success. All outstanding verify tokens for
+     * the address are revoked after successful verification.
+     */
+    verify(token: string): Promise<Result<{
+        userId: string;
+        email: string;
+    }>>;
+    /**
+     * Check whether a user's email address has been verified.
+     */
+    isVerified(userId: string): Promise<boolean>;
+    /**
+     * Handle HTTP requests for email verification endpoints.
+     *
+     * - POST /auth/verify-email/send    — { userId, email }
+     * - POST /auth/verify-email/confirm — { token }
+     */
+    handleRequest(request: Request): Promise<Response | null>;
+}
+declare function createEmailVerificationModule(config: EmailVerificationConfig, db: Database, tokenModule: OneTimeTokenModule): EmailVerificationModule;
+
 /**
  * Magic link authentication for KavachOS.
  *
@@ -6702,7 +8045,7 @@ declare function createOrgModule(config: OrgConfig, db: Database): OrgModule;
  * Passkey / WebAuthn authentication for KavachOS.
  *
  * Implements server-side WebAuthn (Level 2) without external libraries.
- * Uses Web Crypto API (via node:crypto's webcrypto) for signature verification
+ * Uses the Web Crypto API for signature verification
  * and a minimal CBOR decoder for attestation object parsing.
  *
  * Flow:
@@ -6814,6 +8157,121 @@ interface PasskeyModule {
 }
 declare function createPasskeyModule(config: PasskeyConfig, db: Database): PasskeyModule;
 
+/**
+ * Password reset module for KavachOS.
+ *
+ * Composes the one-time token module with the username auth module to provide
+ * a complete forgot-password and reset-password flow. The caller supplies an
+ * email-sending callback; KavachOS handles token generation, validation,
+ * password hashing, and session revocation.
+ *
+ * Security properties:
+ * - Tokens are 256-bit random, stored as SHA-256 hashes (never in plaintext).
+ * - Single-use: consumed on first validation.
+ * - Configurable TTL (default 1 hour).
+ * - All existing sessions are revoked on successful reset.
+ * - Email enumeration resistant: always returns success, even for unknown emails.
+ * - Outstanding reset tokens are revoked when a new one is requested.
+ *
+ * @example
+ * ```typescript
+ * const kavach = await createKavach({
+ *   database: { provider: 'sqlite', url: 'kavach.db' },
+ *   auth: { session: { secret: process.env.SESSION_SECRET } },
+ *   username: { password: { minLength: 8 } },
+ *   passwordReset: {
+ *     sendResetEmail: async (email, token, resetUrl) => {
+ *       await resend.emails.send({
+ *         to: email,
+ *         subject: 'Reset your password',
+ *         html: `<a href="${resetUrl}">Reset password</a>`,
+ *       });
+ *     },
+ *     resetUrl: 'https://app.example.com/reset-password',
+ *   },
+ * });
+ *
+ * // Forgot password (always succeeds — no email enumeration)
+ * await kavach.passwordReset.requestReset('alice@example.com');
+ *
+ * // Reset password (from the link in the email)
+ * const result = await kavach.passwordReset.resetPassword(token, 'new-password-123');
+ * ```
+ */
+
+interface PasswordResetConfig {
+    /**
+     * Callback to send the password reset email.
+     *
+     * KavachOS generates the token and constructs the reset URL. Your job is
+     * to deliver it (Resend, SES, SMTP, Postmark, whatever you use).
+     *
+     * The function should not throw for unknown emails. KavachOS already
+     * handles that by silently succeeding.
+     */
+    sendResetEmail: (email: string, token: string, resetUrl: string) => Promise<void>;
+    /**
+     * Base URL for the reset page in your app.
+     *
+     * The token is appended as `?token=<token>`. Example:
+     * `https://app.example.com/reset-password` produces
+     * `https://app.example.com/reset-password?token=abc123...`
+     */
+    resetUrl: string;
+    /**
+     * Token TTL in seconds. Default: 3600 (1 hour).
+     *
+     * Keep this short. Password reset tokens are high-value targets.
+     */
+    tokenTtlSeconds?: number;
+    /**
+     * Revoke all existing sessions on successful password reset.
+     * Default: true.
+     *
+     * If someone's password was compromised, you want to kick out the
+     * attacker's sessions too.
+     */
+    revokeSessionsOnReset?: boolean;
+    /**
+     * Minimum password length for the new password.
+     * Default: 8 (matches username module default).
+     */
+    minPasswordLength?: number;
+    /**
+     * Maximum password length for the new password.
+     * Default: 128 (matches username module default).
+     */
+    maxPasswordLength?: number;
+}
+interface PasswordResetModule {
+    /**
+     * Request a password reset for the given email.
+     *
+     * Always returns success to prevent email enumeration. If the email
+     * is not associated with any account, nothing happens (no email sent).
+     */
+    requestReset(email: string): Promise<Result<{
+        sent: boolean;
+    }>>;
+    /**
+     * Reset a password using a token from the reset email.
+     *
+     * Validates the token, updates the password hash, and optionally
+     * revokes all sessions. The token is consumed on success.
+     */
+    resetPassword(token: string, newPassword: string): Promise<Result<{
+        userId: string;
+    }>>;
+    /**
+     * Handle HTTP requests for password reset endpoints.
+     *
+     * - POST /auth/forgot-password — { email }
+     * - POST /auth/reset-password  — { token, password }
+     */
+    handleRequest(request: Request): Promise<Response | null>;
+}
+declare function createPasswordResetModule(config: PasswordResetConfig, db: Database, sessionManager: SessionManager, tokenModule: OneTimeTokenModule): PasswordResetModule;
+
 /**
  * Phone number (SMS OTP) authentication for KavachOS.
  *
@@ -7032,7 +8490,7 @@ declare function createSsoModule(config: SsoConfig, db: Database): SsoModule;
  * TOTP two-factor authentication for KavachOS.
  *
  * Implements RFC 6238 (TOTP) and RFC 4226 (HOTP) from scratch using
- * node:crypto — no external dependencies.
+ * the Web Crypto API — no external dependencies.
  *
  * Flow:
  *   1. `setup(userId)`  — generate secret + backup codes (not yet active)
@@ -7436,6 +8894,192 @@ interface PluginInitResult {
     context?: Record<string, unknown>;
 }
 
+interface RedirectConfig {
+    /** Cookie name for storing the redirect chain (default: "kavach_redirect") */
+    cookieName?: string;
+    /** Max age in seconds for the redirect cookie (default: 600 = 10 min) */
+    maxAge?: number;
+    /** Default path when no redirect is stored (default: "/") */
+    defaultPath?: string;
+    /** Paths that should never be stored as destinations (auth pages, etc.) */
+    excludePaths?: string[];
+    /** Whether to preserve query params from the original URL (default: true) */
+    preserveQuery?: boolean;
+    /** Whether to preserve hash fragments (default: true) */
+    preserveHash?: boolean;
+    /** Max chain depth to prevent infinite loops (default: 10) */
+    maxDepth?: number;
+    /** Custom cookie options */
+    cookie?: {
+        httpOnly?: boolean;
+        secure?: boolean;
+        sameSite?: "lax" | "strict" | "none";
+        path?: string;
+        domain?: string;
+    };
+}
+interface RedirectEntry {
+    /** Unique ID for this entry */
+    id: string;
+    /** The URL path (e.g., "/dashboard/project/abc") */
+    path: string;
+    /** Query parameters as a record */
+    query: Record<string, string>;
+    /** Hash fragment without # */
+    hash: string;
+    /** When this entry was created (epoch ms) */
+    createdAt: number;
+    /** Optional label for debugging ("onboarding", "verify-email", etc.) */
+    label?: string;
+}
+interface RedirectChainState {
+    /** The original destination the user was trying to reach */
+    origin: RedirectEntry;
+    /** Stack of intermediate steps (LIFO -- last pushed = first popped) */
+    steps: RedirectEntry[];
+    /** Chain creation time */
+    createdAt: number;
+}
+interface RedirectChainManager {
+    /**
+     * Capture the current request's URL as the origin destination.
+     * Call this in your auth middleware when redirecting to sign-in.
+     * Returns the Set-Cookie header value.
+     *
+     * If a chain already exists (user refreshed sign-in page), keeps the existing origin.
+     */
+    capture(request: Request): string;
+    /**
+     * Push an intermediate step onto the chain.
+     * Use this after sign-up to add onboarding, email verification, etc.
+     * Returns the updated Set-Cookie header value.
+     *
+     * Example: after sign-up, push "/onboarding" then "/complete-profile"
+     * When onboarding completes, pop() returns "/complete-profile"
+     * When profile completes, pop() returns the original destination
+     */
+    push(path: string, options?: {
+        label?: string;
+        query?: Record<string, string>;
+    }): string;
+    /**
+     * Pop the next destination from the chain.
+     * If there are intermediate steps, returns the next step.
+     * If no steps remain, returns the original destination.
+     * If chain is empty, returns the defaultPath.
+     *
+     * Returns { url, done, clearCookie }
+     * - url: the full URL path with query params
+     * - done: true when the chain is fully consumed
+     * - clearCookie: Set-Cookie header to clear the cookie (only when chain is fully consumed)
+     */
+    pop(request: Request): {
+        url: string;
+        done: boolean;
+        clearCookie: string | null;
+    };
+    /**
+     * Peek at the next destination without consuming it.
+     */
+    peek(request: Request): {
+        url: string;
+        remaining: number;
+    } | null;
+    /**
+     * Get the original destination (the URL the user first tried to visit).
+     * Returns null if no chain exists.
+     */
+    getOrigin(request: Request): RedirectEntry | null;
+    /**
+     * Clear the entire chain. Returns the Set-Cookie header to clear the cookie.
+     */
+    clear(): string;
+    /**
+     * Parse the chain state from a request's cookies.
+     * Returns null if no chain exists or if it's expired.
+     */
+    parse(request: Request): RedirectChainState | null;
+    /**
+     * Build a full URL from a RedirectEntry (path + query + hash).
+     */
+    buildUrl(entry: RedirectEntry): string;
+    /**
+     * Create a RedirectEntry from a URL string or Request.
+     */
+    createEntry(url: string | Request, label?: string): RedirectEntry;
+}
+/** Create a redirect chain manager with the given config. */
+declare function createRedirectChain(config?: RedirectConfig): RedirectChainManager;
+
+/**
+ * Session freshness enforcement for KavachOS.
+ *
+ * Sensitive operations (password change, passkey registration, billing updates)
+ * should require a "fresh" session -- one where the user authenticated recently,
+ * not just one that was auto-refreshed hours ago.
+ *
+ * This module adds freshness checks without touching the core session schema.
+ * It works by comparing the session's `createdAt` timestamp against a
+ * configurable freshness window.
+ *
+ * @example
+ * ```typescript
+ * const freshness = createSessionFreshnessModule({ freshAge: 300 }); // 5 minutes
+ *
+ * // In a sensitive endpoint
+ * const session = await sessionManager.validate(token);
+ * if (!freshness.isFresh(session)) {
+ *   return new Response(JSON.stringify({
+ *     error: 'Session is not fresh. Please re-authenticate.',
+ *     code: 'SESSION_NOT_FRESH',
+ *   }), { status: 403 });
+ * }
+ * ```
+ */
+
+interface SessionFreshnessConfig {
+    /**
+     * Maximum age in seconds for a session to be considered "fresh".
+     * Default: 300 (5 minutes).
+     *
+     * After this window, the user must re-authenticate before performing
+     * sensitive operations.
+     */
+    freshAge?: number;
+}
+interface SessionFreshnessModule {
+    /**
+     * Check if a session was created within the freshness window.
+     *
+     * Uses `session.createdAt` -- not `expiresAt` or last activity.
+     * A session that was auto-refreshed is not considered fresh unless
+     * the user actually re-authenticated.
+     */
+    isFresh(session: Session): boolean;
+    /**
+     * Assert that a session is fresh, returning a Result type.
+     *
+     * Returns `{ success: true }` if fresh, or an error result if stale.
+     * Use this in request handlers for cleaner error propagation.
+     */
+    requireFresh(session: Session): Result<{
+        freshUntil: Date;
+    }>;
+    /**
+     * Middleware-style function that returns a Response if the session
+     * is not fresh, or null if it passes.
+     *
+     * @example
+     * ```typescript
+     * const staleResponse = freshness.guard(session);
+     * if (staleResponse) return staleResponse;
+     * // ...proceed with sensitive operation
+     * ```
+     */
+    guard(session: Session): Response | null;
+}
+declare function createSessionFreshnessModule(config?: SessionFreshnessConfig): SessionFreshnessModule;
+
 /**
  * Main configuration for KavachOS
  */
@@ -7496,6 +9140,15 @@ interface KavachConfig {
      * configured so that sessions can be issued on successful verification.
      */
     emailOtp?: EmailOtpConfig;
+    /**
+     * Email verification flow.
+     *
+     * When provided, `kavach.emailVerification` is available with
+     * `sendVerification`, `verify`, `isVerified`, and `handleRequest`.
+     * The caller provides a `sendVerificationEmail` callback to deliver the
+     * link.
+     */
+    emailVerification?: EmailVerificationConfig;
     /**
      * TOTP two-factor authentication.
      *
@@ -7549,6 +9202,15 @@ interface KavachConfig {
      * `auth.session` to be configured so that sessions can be issued.
      */
     username?: UsernameAuthConfig;
+    /**
+     * Password reset (forgot password) flow.
+     *
+     * When provided, `kavach.passwordReset` is available with `requestReset`,
+     * `resetPassword`, and `handleRequest`. Requires `username` and
+     * `auth.session` to be configured. The caller provides a `sendResetEmail`
+     * callback to deliver the reset link.
+     */
+    passwordReset?: PasswordResetConfig;
     /**
      * Phone number (SMS OTP) authentication.
      *
@@ -7570,18 +9232,21 @@ interface KavachConfig {
      * to. Deliveries are fire-and-forget with exponential backoff retries.
      */
     webhooks?: WebhookConfig[];
-}
-interface DatabaseConfig {
-    /** Database provider */
-    provider: "sqlite" | "postgres" | "mysql";
-    /** Connection URL (sqlite: file path, postgres/mysql: connection string) */
-    url: string;
     /**
-     * Skip automatic `CREATE TABLE IF NOT EXISTS` on init.
-     * Useful when you manage migrations externally (e.g. Flyway, Liquibase,
-     * drizzle-kit push). Defaults to `false`.
+     * Redirect chain configuration.
+     *
+     * When provided, `kavach.redirects` is available for capturing the user's
+     * original destination before auth flows and restoring it afterwards,
+     * with support for intermediate steps (onboarding, email verification, etc.).
+     */
+    redirects?: RedirectConfig;
+    /**
+     * Session freshness configuration.
+     *
+     * Controls the maximum session age (in seconds) for sensitive operations.
+     * When omitted, defaults to 300 seconds (5 minutes).
      */
-    skipMigrations?: boolean;
+    sessionFreshness?: SessionFreshnessConfig;
 }
 /**
  * The main KavachOS instance returned by createKavach()
@@ -7756,4 +9421,4 @@ interface TokenValidationResult {
 }
 type McpMiddleware = (request: Request) => Promise<Response | undefined>;
 
-export { type CaptchaVerifyResult as $, type AgentDid as A, type EndpointContext as B, type CreateAgentInput as C, type Database as D, type EmailOtpModule as E, type KavachPlugin as F, type SessionConfig as G, type Session as H, type AdminConfig as I, type AdminUser as J, type KavachConfig as K, type AgentConfig as L, type McpServerInput as M, type ApiKey as N, type OrgModule as O, type Permission as P, type ApiKeyManagerConfig as Q, type RequestContext as R, type SignedPayload as S, type TotpModule as T, type UpdateAgentInput as U, type VerificationResult as V, type WebhookModule as W, type ApprovalConfig as X, type ApprovalModule as Y, type AuthAdapter as Z, type CaptchaConfig as _, type DatabaseConfig$1 as a, organizations as a$, type DatabaseConfig as a0, type EmailOtpConfig as a1, type KavachHooks as a2, type KavachInstance as a3, type MagicLinkConfig as a4, type McpMiddleware as a5, type OidcProvider as a6, type OrgConfig as a7, type OrgInvitation as a8, type OrgMember as a9, budgetPolicies as aA, classifyViolation as aB, createAdminModule as aC, createApiKeyManagerModule as aD, createApprovalModule as aE, createCaptchaModule as aF, createDatabase as aG, createDatabaseSync as aH, createEmailOtpModule as aI, createMagicLinkModule as aJ, createOrgModule as aK, createPasskeyModule as aL, createPhoneAuthModule as aM, createSessionManager as aN, createSsoModule as aO, createTotpModule as aP, createUsernameAuthModule as aQ, delegationChains as aR, emailOtps as aS, magicLinks as aT, mcpServers as aU, oauthAccessTokens as aV, oauthAuthorizationCodes as aW, oauthClients as aX, orgInvitations as aY, orgMembers as aZ, orgRoles as a_, type OrgRole as aa, type Organization as ab, type PasskeyConfig as ac, type PasskeyCredential as ad, type PermissionConstraints as ae, type PhoneAuthConfig as af, type PluginContext as ag, type PluginInitResult as ah, SSO_ERROR as ai, type SamlProvider as aj, type ServiceEndpoint as ak, type SsoAuditEvent as al, type SsoConfig as am, type SsoConnection as an, SsoError as ao, type TokenValidationResult as ap, type TotpConfig as aq, type TotpSetup as ar, type UsernameAuthConfig as as, type VerificationMethod as at, agentCards as au, agentDids as av, agents as aw, apiKeys as ax, approvalRequests as ay, auditLogs as az, type DelegateInput as b, passkeyChallenges as b0, passkeyCredentials as b1, permissions as b2, rateLimits as b3, sessions as b4, ssoConnections as b5, tenants as b6, totpRecords as b7, trustScores as b8, users as b9, type WebhookConfig as ba, type WebhookEvent as bb, createWebhookModule as bc, type DelegationChain as c, type DidDocument as d, type DidKeyPair as e, type DidWebConfig as f, type AgentIdentity as g, type AgentFilter as h, type AuthorizeRequest as i, type AuthorizeResult as j, type AuditFilter as k, type AuditEntry as l, type AuditExportOptions as m, type McpServer as n, type ResolvedUser as o, type SessionManager as p, type ApprovalRequest as q, type MagicLinkModule as r, type PasskeyModule as s, type SsoModule as t, type AdminModule as u, type ApiKeyManagerModule as v, type UsernameAuthModule as w, type PhoneAuthModule as x, type CaptchaModule as y, type PluginEndpoint as z };
+export { type ApiKeyManagerConfig as $, type AgentIdentity as A, type SessionFreshnessModule as B, type CreateAgentInput as C, type Database as D, type EmailOtpModule as E, type PhoneAuthModule as F, type CaptchaModule as G, type RedirectChainManager as H, type PluginEndpoint as I, type EndpointContext as J, type KavachConfig as K, type KavachPlugin as L, type McpServerInput as M, type SessionConfig as N, type OrgModule as O, type Permission as P, type Session as Q, type RequestContext as R, type SignedPayload as S, type TotpModule as T, type UpdateAgentInput as U, type VerificationResult as V, type WebhookModule as W, type AdminConfig as X, type AdminUser as Y, type AgentConfig as Z, type ApiKey as _, type DatabaseConfig as a, createOneTimeTokenModule as a$, type ApprovalConfig as a0, type ApprovalModule as a1, type AuthAdapter as a2, type CaptchaConfig as a3, type CaptchaVerifyResult as a4, type CreateTokenInput as a5, type D1DatabaseBinding as a6, type EmailOtpConfig as a7, type EmailVerificationConfig as a8, type KavachHooks as a9, type SsoAuditEvent as aA, type SsoConfig as aB, type SsoConnection as aC, SsoError as aD, type TokenValidationResult as aE, type TotpConfig as aF, type TotpSetup as aG, type UsernameAuthConfig as aH, type ValidateTokenResult as aI, type VerificationMethod as aJ, agentCards as aK, agentDids as aL, agents as aM, apiKeys as aN, approvalRequests as aO, auditLogs as aP, budgetPolicies as aQ, classifyViolation as aR, createAdminModule as aS, createApiKeyManagerModule as aT, createApprovalModule as aU, createCaptchaModule as aV, createDatabase as aW, createDatabaseSync as aX, createEmailOtpModule as aY, createEmailVerificationModule as aZ, createMagicLinkModule as a_, type KavachInstance as aa, type MagicLinkConfig as ab, type McpMiddleware as ac, type OidcProvider as ad, type OneTimeTokenConfig as ae, type OneTimeTokenPurpose as af, type OrgConfig as ag, type OrgInvitation as ah, type OrgMember as ai, type OrgRole as aj, type Organization as ak, type PasskeyConfig as al, type PasskeyCredential as am, type PasswordResetConfig as an, type PermissionConstraints as ao, type PhoneAuthConfig as ap, type PluginContext as aq, type PluginInitResult as ar, type RedirectChainState as as, type RedirectConfig as at, type RedirectEntry as au, type RevokeTokensResult as av, SSO_ERROR as aw, type SamlProvider as ax, type ServiceEndpoint as ay, type SessionFreshnessConfig as az, type DelegateInput as b, createOrgModule as b0, createPasskeyModule as b1, createPasswordResetModule as b2, createPhoneAuthModule as b3, createRedirectChain as b4, createSessionFreshnessModule as b5, createSessionManager as b6, createSsoModule as b7, createTotpModule as b8, createUsernameAuthModule as b9, delegationChains as ba, emailOtps as bb, magicLinks as bc, mcpServers as bd, oauthAccessTokens as be, oauthAuthorizationCodes as bf, oauthClients as bg, orgInvitations as bh, orgMembers as bi, orgRoles as bj, organizations as bk, passkeyChallenges as bl, passkeyCredentials as bm, permissions as bn, rateLimits as bo, sessions as bp, ssoConnections as bq, tenants as br, totpRecords as bs, trustScores as bt, users as bu, type WebhookConfig as bv, type WebhookEvent as bw, createWebhookModule as bx, type DelegationChain as c, type DidDocument as d, type DidKeyPair as e, type DidWebConfig as f, type AgentDid as g, type AgentFilter as h, type AuthorizeRequest as i, type AuthorizeResult as j, type AuditFilter as k, type AuditEntry as l, type AuditExportOptions as m, type McpServer as n, type ResolvedUser as o, type SessionManager as p, type ApprovalRequest as q, type MagicLinkModule as r, type PasskeyModule as s, type SsoModule as t, type AdminModule as u, type ApiKeyManagerModule as v, type UsernameAuthModule as w, type PasswordResetModule as x, type EmailVerificationModule as y, type OneTimeTokenModule as z };