kavachos 0.2.0 → 0.3.0

package/dist/index.js

@@ -1912,8 +1912,16 @@ function getCookie(request, name) {
   const match = header.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
   return match?.[1] ? decodeURIComponent(match[1]) : null;
 }
-function buildSetCookie(name, value, maxAge, path = "/") {
-  return `${name}=${encodeURIComponent(value)}; HttpOnly; Secure; SameSite=Lax; Path=${path}; Max-Age=${maxAge}`;
+function buildSetCookie(name, value, maxAge, path = "/", secure = true) {
+  const parts = [
+    `${name}=${encodeURIComponent(value)}`,
+    "HttpOnly",
+    "SameSite=Lax",
+    `Path=${path}`,
+    `Max-Age=${maxAge}`
+  ];
+  if (secure) parts.splice(1, 0, "Secure");
+  return parts.join("; ");
 }
 function buildClearCookie(name, path = "/") {
   return `${name}=; HttpOnly; Secure; SameSite=Lax; Path=${path}; Max-Age=0`;
@@ -5764,7 +5772,8 @@ function oauth(config) {
             if (userId !== "__pending__") {
               const { session, token } = await sessionManager.create(userId);
               const maxAge = Math.floor((session.expiresAt.getTime() - Date.now()) / 1e3);
-              const cookie = buildSetCookie("kavach_session", token, maxAge);
+              const isSecure = baseUrl.startsWith("https://");
+              const cookie = buildSetCookie("kavach_session", token, maxAge, "/", isSecure);
               const userInfo = encodeURIComponent(JSON.stringify({ id: userId, email }));
               const callbackUrl = `${baseUrl}/?auth_user=${userInfo}`;
               return new Response(null, {
@@ -6068,13 +6077,14 @@ function createGithubProvider(config) {
     });
     return `${AUTHORIZATION_URL3}?${params.toString()}`;
   }
-  async function exchangeCode(code2, _codeVerifier, redirectUri) {
+  async function exchangeCode(code2, codeVerifier, redirectUri) {
     const effectiveRedirectUri = config.redirectUri ?? redirectUri;
     const body = new URLSearchParams({
       client_id: config.clientId,
       client_secret: config.clientSecret,
       code: code2,
-      redirect_uri: effectiveRedirectUri
+      redirect_uri: effectiveRedirectUri,
+      code_verifier: codeVerifier
     });
     const response = await fetch(TOKEN_URL3, {
       method: "POST",
@@ -6370,14 +6380,15 @@ function createLinkedInProvider(config) {
     });
     return `${AUTHORIZATION_URL6}?${params.toString()}`;
   }
-  async function exchangeCode(code2, _codeVerifier, redirectUri) {
+  async function exchangeCode(code2, codeVerifier, redirectUri) {
     const effectiveRedirectUri = config.redirectUri ?? redirectUri;
     const body = new URLSearchParams({
       grant_type: "authorization_code",
       client_id: config.clientId,
       client_secret: config.clientSecret,
       code: code2,
-      redirect_uri: effectiveRedirectUri
+      redirect_uri: effectiveRedirectUri,
+      code_verifier: codeVerifier
     });
     const response = await fetch(TOKEN_URL6, {
       method: "POST",
@@ -6561,14 +6572,15 @@ function createSlackProvider(config) {
     });
     return `${AUTHORIZATION_URL8}?${params.toString()}`;
   }
-  async function exchangeCode(code2, _codeVerifier, redirectUri) {
+  async function exchangeCode(code2, codeVerifier, redirectUri) {
     const effectiveRedirectUri = config.redirectUri ?? redirectUri;
     const body = new URLSearchParams({
       grant_type: "authorization_code",
       client_id: config.clientId,
       client_secret: config.clientSecret,
       code: code2,
-      redirect_uri: effectiveRedirectUri
+      redirect_uri: effectiveRedirectUri,
+      code_verifier: codeVerifier
     });
     const response = await fetch(TOKEN_URL8, {
       method: "POST",
@@ -10680,7 +10692,13 @@ function passkey(config) {
                   status: 200,
                   headers: {
                     "Content-Type": "application/json",
-                    "Set-Cookie": buildSetCookie("kavach_session", token, maxAge)
+                    "Set-Cookie": buildSetCookie(
+                      "kavach_session",
+                      token,
+                      maxAge,
+                      "/",
+                      (ctx.config.baseUrl ?? "").startsWith("https://")
+                    )
                   }
                 }
               );
@@ -15412,6 +15430,70 @@ function createDatabaseSync(config) {
 }
 
 // src/db/migrations.ts
+var ALL_FEATURES_ENABLED = {
+  core: true,
+  session: true,
+  agent: true,
+  audit: true,
+  oauth: true,
+  tenant: true,
+  mcp: true,
+  org: true,
+  rateLimit: true,
+  budget: true,
+  magicLink: true,
+  emailOtp: true,
+  totp: true,
+  passkey: true,
+  sso: true,
+  apiKey: true,
+  username: true,
+  phone: true,
+  device: true,
+  oneTimeToken: true,
+  loginHistory: true,
+  oidcProvider: true,
+  jwt: true,
+  rebac: true,
+  federation: true
+};
+function resolveEnabledFeatures(config) {
+  if (!config) {
+    return ALL_FEATURES_ENABLED;
+  }
+  const hasAgents = !!config.agents || !!config.did;
+  const hasSession = !!config.auth?.session;
+  const hasOAuth = config.plugins?.some((p2) => p2.id === "kavach-oauth") ?? false;
+  const hasOidc = config.plugins?.some((p2) => p2.id === "kavach-oidc-provider") ?? false;
+  return {
+    core: true,
+    session: hasSession,
+    agent: hasAgents,
+    audit: hasAgents,
+    oauth: hasOAuth,
+    tenant: hasAgents,
+    mcp: !!config.mcp,
+    org: !!config.org,
+    rateLimit: hasAgents,
+    budget: hasAgents,
+    magicLink: !!config.magicLink,
+    emailOtp: !!config.emailOtp,
+    totp: !!config.totp,
+    passkey: !!config.passkey,
+    sso: !!config.sso,
+    apiKey: !!config.apiKeys,
+    username: !!config.username,
+    phone: !!config.phone,
+    device: hasSession,
+    oneTimeToken: !!config.magicLink || !!config.emailOtp || !!config.passwordReset,
+    loginHistory: hasSession,
+    oidcProvider: hasOidc,
+    jwt: hasSession,
+    rebac: hasAgents,
+    federation: false
+    // only when explicitly configured (no config key yet)
+  };
+}
 function buildStatements(provider) {
   const isPostgres = provider === "postgres";
   const isMysql = provider === "mysql";
@@ -15424,7 +15506,9 @@ function buildStatements(provider) {
     // ------------------------------------------------------------------
     // kavach_users
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_users (
+    {
+      feature: "core",
+      sql: `CREATE TABLE ${ifne} kavach_users (
   id                   TEXT        NOT NULL PRIMARY KEY,
   email                TEXT        NOT NULL UNIQUE,
   username             TEXT        UNIQUE,
@@ -15451,11 +15535,14 @@ function buildStatements(provider) {
   polar_cancel_at_period_end   ${bool}     NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
   created_at                   ${ts}       NOT NULL,
   updated_at                   ${ts}       NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_tenants  (must come before kavach_agents – agents FK to tenants)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_tenants (
+    {
+      feature: "tenant",
+      sql: `CREATE TABLE ${ifne} kavach_tenants (
   id         TEXT NOT NULL PRIMARY KEY,
   name       TEXT NOT NULL,
   slug       TEXT NOT NULL UNIQUE,
@@ -15463,11 +15550,14 @@ function buildStatements(provider) {
   status     TEXT NOT NULL DEFAULT 'active',
   created_at ${ts} NOT NULL,
   updated_at ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_agents
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_agents (
+    {
+      feature: "agent",
+      sql: `CREATE TABLE ${ifne} kavach_agents (
   id              TEXT  NOT NULL PRIMARY KEY,
   owner_id        TEXT  NOT NULL REFERENCES kavach_users(id),
   tenant_id       TEXT  REFERENCES kavach_tenants(id),
@@ -15481,22 +15571,28 @@ function buildStatements(provider) {
   metadata        ${json2},
   created_at      ${ts} NOT NULL,
   updated_at      ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_permissions
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_permissions (
+    {
+      feature: "agent",
+      sql: `CREATE TABLE ${ifne} kavach_permissions (
   id          TEXT  NOT NULL PRIMARY KEY,
   agent_id    TEXT  NOT NULL REFERENCES kavach_agents(id) ON DELETE CASCADE,
   resource    TEXT  NOT NULL,
   actions     ${json2} NOT NULL,
   constraints ${json2},
   created_at  ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_delegation_chains
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_delegation_chains (
+    {
+      feature: "agent",
+      sql: `CREATE TABLE ${ifne} kavach_delegation_chains (
   id            TEXT    NOT NULL PRIMARY KEY,
   from_agent_id TEXT    NOT NULL REFERENCES kavach_agents(id),
   to_agent_id   TEXT    NOT NULL REFERENCES kavach_agents(id),
@@ -15506,11 +15602,14 @@ function buildStatements(provider) {
   status        TEXT    NOT NULL DEFAULT 'active',
   expires_at    ${ts}   NOT NULL,
   created_at    ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_audit_logs
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_audit_logs (
+    {
+      feature: "audit",
+      sql: `CREATE TABLE ${ifne} kavach_audit_logs (
   id           TEXT    NOT NULL PRIMARY KEY,
   agent_id     TEXT    NOT NULL REFERENCES kavach_agents(id),
   user_id      TEXT    NOT NULL REFERENCES kavach_users(id),
@@ -15524,21 +15623,27 @@ function buildStatements(provider) {
   ip           TEXT,
   user_agent   TEXT,
   timestamp    ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_rate_limits
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_rate_limits (
+    {
+      feature: "rateLimit",
+      sql: `CREATE TABLE ${ifne} kavach_rate_limits (
   id           TEXT    NOT NULL PRIMARY KEY,
   agent_id     TEXT    NOT NULL REFERENCES kavach_agents(id) ON DELETE CASCADE,
   resource     TEXT    NOT NULL,
   window_start ${ts}   NOT NULL,
   count        INTEGER NOT NULL DEFAULT 0
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_mcp_servers
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_mcp_servers (
+    {
+      feature: "mcp",
+      sql: `CREATE TABLE ${ifne} kavach_mcp_servers (
   id               TEXT    NOT NULL PRIMARY KEY,
   name             TEXT    NOT NULL,
   endpoint         TEXT    NOT NULL UNIQUE,
@@ -15548,21 +15653,27 @@ function buildStatements(provider) {
   status           TEXT    NOT NULL DEFAULT 'active',
   created_at       ${ts}   NOT NULL,
   updated_at       ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_sessions
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_sessions (
+    {
+      feature: "session",
+      sql: `CREATE TABLE ${ifne} kavach_sessions (
   id         TEXT    NOT NULL PRIMARY KEY,
   user_id    TEXT    NOT NULL REFERENCES kavach_users(id),
   expires_at ${ts}   NOT NULL,
   metadata   ${json2},
   created_at ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_oauth_clients
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_oauth_clients (
+    {
+      feature: "oauth",
+      sql: `CREATE TABLE ${ifne} kavach_oauth_clients (
   id                          TEXT    NOT NULL PRIMARY KEY,
   client_id                   TEXT    NOT NULL UNIQUE,
   client_secret               TEXT,
@@ -15577,11 +15688,14 @@ function buildStatements(provider) {
   metadata                    ${json2},
   created_at                  ${ts}   NOT NULL,
   updated_at                  ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_oauth_access_tokens
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_oauth_access_tokens (
+    {
+      feature: "oauth",
+      sql: `CREATE TABLE ${ifne} kavach_oauth_access_tokens (
   id                        TEXT NOT NULL PRIMARY KEY,
   access_token              TEXT NOT NULL UNIQUE,
   refresh_token             TEXT UNIQUE,
@@ -15592,11 +15706,14 @@ function buildStatements(provider) {
   access_token_expires_at   ${ts} NOT NULL,
   refresh_token_expires_at  ${tsNull},
   created_at                ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_oauth_authorization_codes
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_oauth_authorization_codes (
+    {
+      feature: "oauth",
+      sql: `CREATE TABLE ${ifne} kavach_oauth_authorization_codes (
   id                     TEXT NOT NULL PRIMARY KEY,
   code                   TEXT NOT NULL UNIQUE,
   client_id              TEXT NOT NULL REFERENCES kavach_oauth_clients(client_id),
@@ -15608,11 +15725,14 @@ function buildStatements(provider) {
   resource               TEXT,
   expires_at             ${ts} NOT NULL,
   created_at             ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_oauth_accounts (provider account linking)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_oauth_accounts (
+    {
+      feature: "oauth",
+      sql: `CREATE TABLE ${ifne} kavach_oauth_accounts (
   id                   TEXT NOT NULL PRIMARY KEY,
   user_id              TEXT NOT NULL,
   provider             TEXT NOT NULL,
@@ -15622,22 +15742,28 @@ function buildStatements(provider) {
   expires_at           ${tsNull},
   created_at           ${ts} NOT NULL,
   updated_at           ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_oauth_states (PKCE state for CSRF protection)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_oauth_states (
+    {
+      feature: "oauth",
+      sql: `CREATE TABLE ${ifne} kavach_oauth_states (
   state          TEXT NOT NULL PRIMARY KEY,
   code_verifier  TEXT NOT NULL,
   redirect_uri   TEXT NOT NULL,
   provider       TEXT NOT NULL,
   expires_at     ${ts} NOT NULL,
   created_at     ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_budget_policies
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_budget_policies (
+    {
+      feature: "budget",
+      sql: `CREATE TABLE ${ifne} kavach_budget_policies (
   id            TEXT    NOT NULL PRIMARY KEY,
   agent_id      TEXT    REFERENCES kavach_agents(id) ON DELETE CASCADE,
   user_id       TEXT    REFERENCES kavach_users(id),
@@ -15647,11 +15773,14 @@ function buildStatements(provider) {
   action        TEXT    NOT NULL DEFAULT 'warn',
   status        TEXT    NOT NULL DEFAULT 'active',
   created_at    ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_agent_cards  (A2A discovery)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_agent_cards (
+    {
+      feature: "agent",
+      sql: `CREATE TABLE ${ifne} kavach_agent_cards (
   id                TEXT    NOT NULL PRIMARY KEY,
   agent_id          TEXT    NOT NULL REFERENCES kavach_agents(id) ON DELETE CASCADE,
   name              TEXT    NOT NULL,
@@ -15664,11 +15793,14 @@ function buildStatements(provider) {
   metadata          ${json2},
   created_at        ${ts}   NOT NULL,
   updated_at        ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_approval_requests  (CIBA async approval flows)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_approval_requests (
+    {
+      feature: "agent",
+      sql: `CREATE TABLE ${ifne} kavach_approval_requests (
   id            TEXT NOT NULL PRIMARY KEY,
   agent_id      TEXT NOT NULL REFERENCES kavach_agents(id) ON DELETE CASCADE,
   user_id       TEXT NOT NULL REFERENCES kavach_users(id),
@@ -15680,21 +15812,27 @@ function buildStatements(provider) {
   responded_at  ${tsNull},
   responded_by  TEXT,
   created_at    ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_trust_scores  (graduated autonomy scoring)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_trust_scores (
+    {
+      feature: "agent",
+      sql: `CREATE TABLE ${ifne} kavach_trust_scores (
   agent_id    TEXT    NOT NULL PRIMARY KEY REFERENCES kavach_agents(id) ON DELETE CASCADE,
   score       INTEGER NOT NULL,
   level       TEXT    NOT NULL,
   factors     ${json2} NOT NULL,
   computed_at ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_organizations
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_organizations (
+    {
+      feature: "org",
+      sql: `CREATE TABLE ${ifne} kavach_organizations (
   id         TEXT    NOT NULL PRIMARY KEY,
   name       TEXT    NOT NULL,
   slug       TEXT    NOT NULL UNIQUE,
@@ -15702,22 +15840,28 @@ function buildStatements(provider) {
   metadata   ${json2},
   created_at ${ts}   NOT NULL,
   updated_at ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_org_members
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_org_members (
+    {
+      feature: "org",
+      sql: `CREATE TABLE ${ifne} kavach_org_members (
   id        TEXT    NOT NULL PRIMARY KEY,
   org_id    TEXT    NOT NULL REFERENCES kavach_organizations(id) ON DELETE CASCADE,
   user_id   TEXT    NOT NULL REFERENCES kavach_users(id),
   role      TEXT    NOT NULL DEFAULT 'member',
   joined_at ${ts}   NOT NULL,
   UNIQUE(org_id, user_id)
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_org_invitations
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_org_invitations (
+    {
+      feature: "org",
+      sql: `CREATE TABLE ${ifne} kavach_org_invitations (
   id         TEXT    NOT NULL PRIMARY KEY,
   org_id     TEXT    NOT NULL REFERENCES kavach_organizations(id) ON DELETE CASCADE,
   email      TEXT    NOT NULL,
@@ -15726,21 +15870,27 @@ function buildStatements(provider) {
   status     TEXT    NOT NULL DEFAULT 'pending',
   expires_at ${ts}   NOT NULL,
   created_at ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_org_roles
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_org_roles (
+    {
+      feature: "org",
+      sql: `CREATE TABLE ${ifne} kavach_org_roles (
   id          TEXT    NOT NULL PRIMARY KEY,
   org_id      TEXT    NOT NULL REFERENCES kavach_organizations(id) ON DELETE CASCADE,
   name        TEXT    NOT NULL,
   permissions ${json2} NOT NULL,
   UNIQUE(org_id, name)
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_passkey_credentials  (WebAuthn / FIDO2 passkeys)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_passkey_credentials (
+    {
+      feature: "passkey",
+      sql: `CREATE TABLE ${ifne} kavach_passkey_credentials (
   id            TEXT    NOT NULL PRIMARY KEY,
   user_id       TEXT    NOT NULL REFERENCES kavach_users(id),
   credential_id TEXT    NOT NULL UNIQUE,
@@ -15750,22 +15900,28 @@ function buildStatements(provider) {
   transports    TEXT,
   created_at    ${ts}   NOT NULL,
   last_used_at  ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_passkey_challenges  (short-lived WebAuthn challenges)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_passkey_challenges (
+    {
+      feature: "passkey",
+      sql: `CREATE TABLE ${ifne} kavach_passkey_challenges (
   id         TEXT NOT NULL PRIMARY KEY,
   challenge  TEXT NOT NULL UNIQUE,
   user_id    TEXT,
   type       TEXT NOT NULL,
   expires_at ${ts} NOT NULL,
   created_at ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_one_time_tokens  (email verify, password reset, invitation)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_one_time_tokens (
+    {
+      feature: "oneTimeToken",
+      sql: `CREATE TABLE ${ifne} kavach_one_time_tokens (
   id          TEXT    NOT NULL PRIMARY KEY,
   token_hash  TEXT    NOT NULL UNIQUE,
   purpose     TEXT    NOT NULL,
@@ -15774,55 +15930,70 @@ function buildStatements(provider) {
   used        ${bool} NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
   expires_at  ${ts}   NOT NULL,
   created_at  ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_agent_dids  (W3C Decentralized Identifiers per agent)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_agent_dids (
+    {
+      feature: "agent",
+      sql: `CREATE TABLE ${ifne} kavach_agent_dids (
   agent_id       TEXT NOT NULL PRIMARY KEY REFERENCES kavach_agents(id) ON DELETE CASCADE,
   did            TEXT NOT NULL UNIQUE,
   method         TEXT NOT NULL,
   public_key_jwk TEXT NOT NULL,
   did_document   TEXT NOT NULL,
   created_at     ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_magic_links  (passwordless email login)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_magic_links (
+    {
+      feature: "magicLink",
+      sql: `CREATE TABLE ${ifne} kavach_magic_links (
   id         TEXT    NOT NULL PRIMARY KEY,
   email      TEXT    NOT NULL,
   token      TEXT    NOT NULL UNIQUE,
   expires_at ${ts}   NOT NULL,
   used       ${bool} NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
   created_at ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_email_otps  (one-time password login)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_email_otps (
+    {
+      feature: "emailOtp",
+      sql: `CREATE TABLE ${ifne} kavach_email_otps (
   id         TEXT    NOT NULL PRIMARY KEY,
   email      TEXT    NOT NULL,
   code_hash  TEXT    NOT NULL,
   expires_at ${ts}   NOT NULL,
   attempts   INTEGER NOT NULL DEFAULT 0,
   created_at ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_totp  (TOTP two-factor authentication)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_totp (
+    {
+      feature: "totp",
+      sql: `CREATE TABLE ${ifne} kavach_totp (
   user_id      TEXT    NOT NULL PRIMARY KEY REFERENCES kavach_users(id),
   secret       TEXT    NOT NULL,
   enabled      ${bool} NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
   backup_codes ${json2} NOT NULL,
   created_at   ${ts}   NOT NULL,
   updated_at   ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_sso_connections  (SAML 2.0 / OIDC enterprise SSO)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_sso_connections (
+    {
+      feature: "sso",
+      sql: `CREATE TABLE ${ifne} kavach_sso_connections (
   id          TEXT    NOT NULL PRIMARY KEY,
   org_id      TEXT    NOT NULL,
   provider_id TEXT    NOT NULL,
@@ -15830,11 +16001,14 @@ function buildStatements(provider) {
   domain      TEXT    NOT NULL UNIQUE,
   enabled     INTEGER NOT NULL DEFAULT 1,
   created_at  ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_api_keys  (static bearer tokens with permission scopes)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_api_keys (
+    {
+      feature: "apiKey",
+      sql: `CREATE TABLE ${ifne} kavach_api_keys (
   id           TEXT    NOT NULL PRIMARY KEY,
   user_id      TEXT    NOT NULL REFERENCES kavach_users(id),
   name         TEXT    NOT NULL,
@@ -15844,57 +16018,75 @@ function buildStatements(provider) {
   expires_at   ${tsNull},
   last_used_at ${tsNull},
   created_at   ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_username_accounts  (username + password auth)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_username_accounts (
+    {
+      feature: "username",
+      sql: `CREATE TABLE ${ifne} kavach_username_accounts (
   id            TEXT NOT NULL PRIMARY KEY,
   user_id       TEXT NOT NULL REFERENCES kavach_users(id) ON DELETE CASCADE,
   username      TEXT NOT NULL UNIQUE,
   password_hash TEXT NOT NULL,
   created_at    ${ts} NOT NULL,
   updated_at    ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_phone_verifications  (SMS OTP)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_phone_verifications (
+    {
+      feature: "phone",
+      sql: `CREATE TABLE ${ifne} kavach_phone_verifications (
   id           TEXT    NOT NULL PRIMARY KEY,
   phone_number TEXT    NOT NULL,
   code_hash    TEXT    NOT NULL,
   attempts     INTEGER NOT NULL DEFAULT 0,
   expires_at   ${ts}   NOT NULL,
   created_at   ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_trusted_devices  (skip 2FA on trusted devices for a window)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_trusted_devices (
+    {
+      feature: "device",
+      sql: `CREATE TABLE ${ifne} kavach_trusted_devices (
   id          TEXT NOT NULL PRIMARY KEY,
   user_id     TEXT NOT NULL REFERENCES kavach_users(id) ON DELETE CASCADE,
   fingerprint TEXT NOT NULL,
   label       TEXT NOT NULL,
   trusted_at  ${ts} NOT NULL,
   expires_at  ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_login_history  (last-login method tracking per user)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_login_history (
+    {
+      feature: "loginHistory",
+      sql: `CREATE TABLE ${ifne} kavach_login_history (
   id         TEXT NOT NULL PRIMARY KEY,
   user_id    TEXT NOT NULL REFERENCES kavach_users(id) ON DELETE CASCADE,
   method     TEXT NOT NULL,
   ip         TEXT,
   user_agent TEXT,
   timestamp  ${ts} NOT NULL
-)`,
-    `CREATE INDEX ${ifne} kavach_login_history_user_ts
-  ON kavach_login_history (user_id, timestamp DESC)`,
+)`
+    },
+    {
+      feature: "loginHistory",
+      sql: `CREATE INDEX ${ifne} kavach_login_history_user_ts
+  ON kavach_login_history (user_id, timestamp DESC)`
+    },
     // ------------------------------------------------------------------
     // kavach_oidc_clients  (OIDC Provider — registered relying parties)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_oidc_clients (
+    {
+      feature: "oidcProvider",
+      sql: `CREATE TABLE ${ifne} kavach_oidc_clients (
   id                          TEXT    NOT NULL PRIMARY KEY,
   client_id                   TEXT    NOT NULL UNIQUE,
   client_secret_hash          TEXT    NOT NULL,
@@ -15906,11 +16098,14 @@ function buildStatements(provider) {
   token_endpoint_auth_method  TEXT    NOT NULL DEFAULT 'client_secret_post',
   created_at                  ${ts}   NOT NULL,
   updated_at                  ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_oidc_auth_codes  (OIDC Provider — authorization codes)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_oidc_auth_codes (
+    {
+      feature: "oidcProvider",
+      sql: `CREATE TABLE ${ifne} kavach_oidc_auth_codes (
   id                     TEXT    NOT NULL PRIMARY KEY,
   code_hash              TEXT    NOT NULL UNIQUE,
   client_id              TEXT    NOT NULL,
@@ -15923,11 +16118,14 @@ function buildStatements(provider) {
   used                   ${bool} NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
   expires_at             ${ts}   NOT NULL,
   created_at             ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_oidc_refresh_tokens  (OIDC Provider — refresh tokens)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_oidc_refresh_tokens (
+    {
+      feature: "oidcProvider",
+      sql: `CREATE TABLE ${ifne} kavach_oidc_refresh_tokens (
   id          TEXT    NOT NULL PRIMARY KEY,
   token_hash  TEXT    NOT NULL UNIQUE,
   client_id   TEXT    NOT NULL,
@@ -15936,11 +16134,14 @@ function buildStatements(provider) {
   revoked     ${bool} NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
   expires_at  ${ts}   NOT NULL,
   created_at  ${ts}   NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_cost_events  (per-agent cost attribution)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_cost_events (
+    {
+      feature: "audit",
+      sql: `CREATE TABLE ${ifne} kavach_cost_events (
   id                  TEXT    NOT NULL PRIMARY KEY,
   agent_id            TEXT    NOT NULL REFERENCES kavach_agents(id) ON DELETE CASCADE,
   tool                TEXT    NOT NULL,
@@ -15951,15 +16152,24 @@ function buildStatements(provider) {
   metadata            ${json2},
   delegation_chain_id TEXT,
   recorded_at         ${ts}   NOT NULL
-)`,
-    `CREATE INDEX ${ifne} kavach_cost_events_agent_recorded
-  ON kavach_cost_events (agent_id, recorded_at DESC)`,
-    `CREATE INDEX ${ifne} kavach_cost_events_chain_id
-  ON kavach_cost_events (delegation_chain_id)`,
+)`
+    },
+    {
+      feature: "audit",
+      sql: `CREATE INDEX ${ifne} kavach_cost_events_agent_recorded
+  ON kavach_cost_events (agent_id, recorded_at DESC)`
+    },
+    {
+      feature: "audit",
+      sql: `CREATE INDEX ${ifne} kavach_cost_events_chain_id
+  ON kavach_cost_events (delegation_chain_id)`
+    },
     // ------------------------------------------------------------------
     // kavach_ephemeral_sessions  (short-lived agent credentials)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_ephemeral_sessions (
+    {
+      feature: "agent",
+      sql: `CREATE TABLE ${ifne} kavach_ephemeral_sessions (
   id             TEXT    NOT NULL PRIMARY KEY,
   agent_id       TEXT    NOT NULL REFERENCES kavach_agents(id) ON DELETE CASCADE,
   owner_id       TEXT    NOT NULL REFERENCES kavach_users(id),
@@ -15971,55 +16181,85 @@ function buildStatements(provider) {
   audit_group_id TEXT    NOT NULL,
   created_at     ${ts}   NOT NULL,
   updated_at     ${ts}   NOT NULL
-)`,
-    `CREATE INDEX ${ifne} kavach_ephemeral_sessions_owner_status
-  ON kavach_ephemeral_sessions (owner_id, status)`,
-    `CREATE INDEX ${ifne} kavach_ephemeral_sessions_expires_at
-  ON kavach_ephemeral_sessions (expires_at)`,
+)`
+    },
+    {
+      feature: "agent",
+      sql: `CREATE INDEX ${ifne} kavach_ephemeral_sessions_owner_status
+  ON kavach_ephemeral_sessions (owner_id, status)`
+    },
+    {
+      feature: "agent",
+      sql: `CREATE INDEX ${ifne} kavach_ephemeral_sessions_expires_at
+  ON kavach_ephemeral_sessions (expires_at)`
+    },
     // ------------------------------------------------------------------
     // kavach_jwt_refresh_tokens  (JWT session plugin — general purpose)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_jwt_refresh_tokens (
+    {
+      feature: "jwt",
+      sql: `CREATE TABLE ${ifne} kavach_jwt_refresh_tokens (
   id          TEXT    NOT NULL PRIMARY KEY,
   token_hash  TEXT    NOT NULL UNIQUE,
   user_id     TEXT    NOT NULL REFERENCES kavach_users(id) ON DELETE CASCADE,
   used        ${bool} NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
   expires_at  ${ts}   NOT NULL,
   created_at  ${ts}   NOT NULL
-)`,
-    `CREATE INDEX ${ifne} kavach_jwt_refresh_tokens_user_id
-  ON kavach_jwt_refresh_tokens (user_id)`,
+)`
+    },
+    {
+      feature: "jwt",
+      sql: `CREATE INDEX ${ifne} kavach_jwt_refresh_tokens_user_id
+  ON kavach_jwt_refresh_tokens (user_id)`
+    },
     // ------------------------------------------------------------------
     // kavach_stream_events  (persisted SSE events for replay)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_stream_events (
+    {
+      feature: "audit",
+      sql: `CREATE TABLE ${ifne} kavach_stream_events (
   id        TEXT    NOT NULL PRIMARY KEY,
   type      TEXT    NOT NULL,
   timestamp ${ts}   NOT NULL,
   data      ${json2} NOT NULL,
   agent_id  TEXT,
   user_id   TEXT
-)`,
-    `CREATE INDEX ${ifne} kavach_stream_events_timestamp
-  ON kavach_stream_events (timestamp DESC)`,
-    `CREATE INDEX ${ifne} kavach_stream_events_type_timestamp
-  ON kavach_stream_events (type, timestamp DESC)`,
+)`
+    },
+    {
+      feature: "audit",
+      sql: `CREATE INDEX ${ifne} kavach_stream_events_timestamp
+  ON kavach_stream_events (timestamp DESC)`
+    },
+    {
+      feature: "audit",
+      sql: `CREATE INDEX ${ifne} kavach_stream_events_type_timestamp
+  ON kavach_stream_events (type, timestamp DESC)`
+    },
     // ------------------------------------------------------------------
     // kavach_rebac_resources  (ReBAC resource hierarchy)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_rebac_resources (
+    {
+      feature: "rebac",
+      sql: `CREATE TABLE ${ifne} kavach_rebac_resources (
   id          TEXT NOT NULL PRIMARY KEY,
   type        TEXT NOT NULL,
   parent_id   TEXT,
   parent_type TEXT,
   created_at  ${ts} NOT NULL
-)`,
-    `CREATE INDEX ${ifne} kavach_rebac_resources_parent
-  ON kavach_rebac_resources (parent_id, parent_type)`,
+)`
+    },
+    {
+      feature: "rebac",
+      sql: `CREATE INDEX ${ifne} kavach_rebac_resources_parent
+  ON kavach_rebac_resources (parent_id, parent_type)`
+    },
     // ------------------------------------------------------------------
     // kavach_rebac_relationships  (Zanzibar-style subject-relation-object tuples)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_rebac_relationships (
+    {
+      feature: "rebac",
+      sql: `CREATE TABLE ${ifne} kavach_rebac_relationships (
   id           TEXT NOT NULL PRIMARY KEY,
   subject_type TEXT NOT NULL,
   subject_id   TEXT NOT NULL,
@@ -16027,17 +16267,29 @@ function buildStatements(provider) {
   object_type  TEXT NOT NULL,
   object_id    TEXT NOT NULL,
   created_at   ${ts} NOT NULL
-)`,
-    `CREATE INDEX ${ifne} kavach_rebac_relationships_subject
-  ON kavach_rebac_relationships (subject_type, subject_id)`,
-    `CREATE INDEX ${ifne} kavach_rebac_relationships_object
-  ON kavach_rebac_relationships (object_type, object_id)`,
-    `CREATE UNIQUE INDEX ${ifne} kavach_rebac_relationships_tuple
-  ON kavach_rebac_relationships (subject_type, subject_id, relation, object_type, object_id)`,
+)`
+    },
+    {
+      feature: "rebac",
+      sql: `CREATE INDEX ${ifne} kavach_rebac_relationships_subject
+  ON kavach_rebac_relationships (subject_type, subject_id)`
+    },
+    {
+      feature: "rebac",
+      sql: `CREATE INDEX ${ifne} kavach_rebac_relationships_object
+  ON kavach_rebac_relationships (object_type, object_id)`
+    },
+    {
+      feature: "rebac",
+      sql: `CREATE UNIQUE INDEX ${ifne} kavach_rebac_relationships_tuple
+  ON kavach_rebac_relationships (subject_type, subject_id, relation, object_type, object_id)`
+    },
     // ------------------------------------------------------------------
     // kavach_federation_instances  (trusted remote KavachOS instances)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_federation_instances (
+    {
+      feature: "federation",
+      sql: `CREATE TABLE ${ifne} kavach_federation_instances (
   id            TEXT NOT NULL PRIMARY KEY,
   instance_id   TEXT NOT NULL UNIQUE,
   instance_url  TEXT NOT NULL,
@@ -16046,11 +16298,14 @@ function buildStatements(provider) {
   discovered_at ${tsNull},
   created_at    ${ts} NOT NULL,
   updated_at    ${ts} NOT NULL
-)`,
+)`
+    },
     // ------------------------------------------------------------------
     // kavach_federation_tokens  (issued/received federation tokens)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_federation_tokens (
+    {
+      feature: "federation",
+      sql: `CREATE TABLE ${ifne} kavach_federation_tokens (
   id                  TEXT    NOT NULL PRIMARY KEY,
   token_jti           TEXT    NOT NULL UNIQUE,
   agent_id            TEXT    NOT NULL,
@@ -16061,45 +16316,61 @@ function buildStatements(provider) {
   trust_score         INTEGER,
   expires_at          ${ts}   NOT NULL,
   created_at          ${ts}   NOT NULL
-)`,
-    `CREATE INDEX ${ifne} kavach_federation_tokens_agent
-  ON kavach_federation_tokens (agent_id)`,
-    `CREATE INDEX ${ifne} kavach_federation_tokens_source
-  ON kavach_federation_tokens (source_instance_id)`,
+)`
+    },
+    {
+      feature: "federation",
+      sql: `CREATE INDEX ${ifne} kavach_federation_tokens_agent
+  ON kavach_federation_tokens (agent_id)`
+    },
+    {
+      feature: "federation",
+      sql: `CREATE INDEX ${ifne} kavach_federation_tokens_source
+  ON kavach_federation_tokens (source_instance_id)`
+    },
     // ------------------------------------------------------------------
     // kavach_refresh_token_families  (token rotation / reuse detection)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_refresh_token_families (
+    {
+      feature: "jwt",
+      sql: `CREATE TABLE ${ifne} kavach_refresh_token_families (
   id                   TEXT    NOT NULL PRIMARY KEY,
   user_id              TEXT    NOT NULL REFERENCES kavach_users(id) ON DELETE CASCADE,
   absolute_expires_at  ${ts}   NOT NULL,
   revoked              ${bool} NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
   created_at           ${ts}   NOT NULL
-)`,
-    `CREATE INDEX ${ifne} kavach_refresh_token_families_user_id
-  ON kavach_refresh_token_families (user_id)`,
+)`
+    },
+    {
+      feature: "jwt",
+      sql: `CREATE INDEX ${ifne} kavach_refresh_token_families_user_id
+  ON kavach_refresh_token_families (user_id)`
+    },
     // ------------------------------------------------------------------
     // kavach_refresh_tokens  (individual one-time-use tokens per family)
     // ------------------------------------------------------------------
-    `CREATE TABLE ${ifne} kavach_refresh_tokens (
+    {
+      feature: "jwt",
+      sql: `CREATE TABLE ${ifne} kavach_refresh_tokens (
   id          TEXT    NOT NULL PRIMARY KEY,
   family_id   TEXT    NOT NULL REFERENCES kavach_refresh_token_families(id) ON DELETE CASCADE,
   token_hash  TEXT    NOT NULL UNIQUE,
   used        ${bool} NOT NULL DEFAULT ${isPostgres ? "FALSE" : "0"},
   expires_at  ${ts}   NOT NULL,
   created_at  ${ts}   NOT NULL
-)`,
-    `CREATE INDEX ${ifne} kavach_refresh_tokens_family_id
+)`
+    },
+    {
+      feature: "jwt",
+      sql: `CREATE INDEX ${ifne} kavach_refresh_tokens_family_id
   ON kavach_refresh_tokens (family_id)`
-    // ------------------------------------------------------------------
-    // kavach_users ban columns  (ALTER TABLE IF NOT EXISTS — safe no-ops)
-    // These are appended as separate ALTER statements for existing DBs.
-    // For SQLite we use a separate migration path since SQLite ALTER is limited.
-    // ------------------------------------------------------------------
+    }
   ];
 }
-async function createTables(db, provider) {
-  const statements = buildStatements(provider);
+async function createTables(db, provider, config) {
+  const allStatements = buildStatements(provider);
+  const features = resolveEnabledFeatures(config);
+  const statements = allStatements.filter((s) => features[s.feature]).map((s) => s.sql);
   if (provider === "sqlite" || provider === "sqlite-native") {
     const session = db.session;
     if (session?.client?.exec) {
@@ -18281,7 +18552,7 @@ async function createKavach(config) {
   const authAdapter = config.auth?.adapter ?? null;
   const db = await createDatabase(config.database);
   if (!config.database.skipMigrations) {
-    await createTables(db, config.database.provider);
+    await createTables(db, config.database.provider, config);
   }
   const agentConfig = {
     db,