@adonis-agora/authkit-client 0.14.0 → 0.15.0

package/build/commands/configure.js

@@ -4,13 +4,15 @@ export async function configure(command) {
     await codemods.makeUsingStub(stubsRoot, 'config/authkit_client.stub', {});
     await codemods.makeUsingStub(stubsRoot, 'controllers/oidc_session_controller.stub', {});
     await codemods.updateRcFile((rc) => rc.addProvider('@adonis-agora/authkit-client/authkit_client_provider'));
-    await codemods.registerMiddleware('router', [{ path: '@adonis-agora/authkit-client/authkit_middleware' }]);
+    await codemods.registerMiddleware('router', [
+        { path: '@adonis-agora/authkit-client/authkit_middleware' },
+    ]);
     await codemods.defineEnvValidations({
         leadingComment: 'Variáveis do @adonis-agora/authkit-client (OIDC client)',
         variables: {
             AUTHKIT_ISSUER: `Env.schema.string({ format: 'url', tld: false })`,
-            AUTHKIT_CLIENT_ID: `Env.schema.string()`,
-            AUTHKIT_CLIENT_SECRET: `Env.schema.string.optional()`,
+            AUTHKIT_CLIENT_ID: 'Env.schema.string()',
+            AUTHKIT_CLIENT_SECRET: 'Env.schema.string.optional()',
             AUTHKIT_REDIRECT_URI: `Env.schema.string({ format: 'url', tld: false })`,
         },
     });

package/build/index.d.ts

@@ -1,28 +1,32 @@
-export { defineConfig, resolvers } from "./src/define_config.js";
-export { Authenticator } from "./src/authenticator.js";
-export { identityToUser, createUserinfoResolver, } from "./src/user_resolvers.js";
-export type { ClaimsUser, ResolveUserContext, UserinfoResolverOptions, } from "./src/user_resolvers.js";
-export { buildAuthorizeUrl, buildEndSessionUrl, exchangeCode, exchangeToken, refreshTokens, generatePkce, } from "./src/oidc_login.js";
-export type { EndSessionParams, RefreshParams } from "./src/oidc_login.js";
-export { discoverEndpoints, conventionEndpoints } from "./src/discovery.js";
-export type { OidcEndpoints, DiscoverOptions } from "./src/discovery.js";
-export { resilientFetch } from "./src/http/resilient_fetch.js";
-export type { ResiliencePolicy } from "./src/http/resilient_fetch.js";
-export { AuthkitClientManager } from "./providers/authkit_client_provider.js";
-export type { ResolvedClientConfig, ClientConfigInput, BackchannelLogoutCallback, BackchannelLogoutInput, } from "./src/define_config.js";
-export { lucidRevocationStore, DEFAULT_REVOCATION_TABLE, } from "./src/revocation/revocation_store.js";
-export type { RevocationStore, LucidRevocationStoreOptions, } from "./src/revocation/revocation_store.js";
-export { default as BackchannelRevocationMiddleware } from "./src/middleware/backchannel_revocation_middleware.js";
-export { lucidMirror } from "./src/lucid_mirror.js";
-export type { LucidMirrorOptions } from "./src/lucid_mirror.js";
-export { registerOidcClient } from "./src/register_oidc_client.js";
-export type { RegisterOidcClientOptions, PostLoginRedirects, } from "./src/register_oidc_client.js";
-export { validateLogoutToken, InvalidLogoutTokenError, InMemorySessionIndex, BACKCHANNEL_LOGOUT_EVENT, } from "./src/backchannel_logout.js";
-export type { ValidateLogoutTokenOptions, ValidatedLogoutToken, SessionIndex, SessionIndexEntry, } from "./src/backchannel_logout.js";
-export { generateDpopKeyPair, createDpopProof, dpopJwkThumbprint, } from "./src/dpop.js";
-export type { DpopKeyPair, CreateDpopProofInput } from "./src/dpop.js";
-export { verifyJwtAccessToken, clearJwksCache, } from "./src/verify_access_token.js";
-export type { VerifyJwtAccessTokenOptions, JwtAccessTokenClaims, } from "./src/verify_access_token.js";
-export type { TokenSet } from "./src/types.js";
-export type { Identity } from "@adonis-agora/authkit-core";
-export { configure } from "./commands/configure.js";
+export { defineConfig, resolvers } from './src/define_config.js';
+export { Authenticator } from './src/authenticator.js';
+export { identityToUser, createUserinfoResolver, } from './src/user_resolvers.js';
+export type { ClaimsUser, ResolveUserContext, UserinfoResolverOptions, } from './src/user_resolvers.js';
+export { buildAuthorizeUrl, buildEndSessionUrl, exchangeCode, exchangeToken, refreshTokens, generatePkce, } from './src/oidc_login.js';
+export type { EndSessionParams, RefreshParams } from './src/oidc_login.js';
+export { discoverEndpoints, conventionEndpoints } from './src/discovery.js';
+export type { OidcEndpoints, DiscoverOptions } from './src/discovery.js';
+export { resilientFetch } from './src/http/resilient_fetch.js';
+export type { ResiliencePolicy } from './src/http/resilient_fetch.js';
+export { AuthkitClientManager } from './providers/authkit_client_provider.js';
+export type { ResolvedClientConfig, ClientConfigInput, BackchannelLogoutCallback, BackchannelLogoutInput, } from './src/define_config.js';
+export { lucidRevocationStore, DEFAULT_REVOCATION_TABLE, } from './src/revocation/revocation_store.js';
+export type { RevocationStore, LucidRevocationStoreOptions, } from './src/revocation/revocation_store.js';
+export { default as BackchannelRevocationMiddleware } from './src/middleware/backchannel_revocation_middleware.js';
+export { authkitClientGuard, AuthkitClientGuard } from './src/host/authkit_client_guard.js';
+export type { UnauthorizedAccessConstructor } from './src/host/authkit_client_guard.js';
+export { getAuthkit } from './src/host/request_authenticator.js';
+export { default as AuthkitContextMiddleware } from './src/middleware/authkit_context_middleware.js';
+export { lucidMirror } from './src/lucid_mirror.js';
+export type { LucidMirrorOptions } from './src/lucid_mirror.js';
+export { registerOidcClient } from './src/register_oidc_client.js';
+export type { RegisterOidcClientOptions, PostLoginRedirects, } from './src/register_oidc_client.js';
+export { validateLogoutToken, InvalidLogoutTokenError, InMemorySessionIndex, BACKCHANNEL_LOGOUT_EVENT, } from './src/backchannel_logout.js';
+export type { ValidateLogoutTokenOptions, ValidatedLogoutToken, SessionIndex, SessionIndexEntry, } from './src/backchannel_logout.js';
+export { generateDpopKeyPair, createDpopProof, dpopJwkThumbprint, } from './src/dpop.js';
+export type { DpopKeyPair, CreateDpopProofInput } from './src/dpop.js';
+export { verifyJwtAccessToken, clearJwksCache, } from './src/verify_access_token.js';
+export type { VerifyJwtAccessTokenOptions, JwtAccessTokenClaims, } from './src/verify_access_token.js';
+export type { TokenSet } from './src/types.js';
+export type { Identity } from '@adonis-agora/authkit-core';
+export { configure } from './commands/configure.js';

package/build/index.js

@@ -1,15 +1,18 @@
-export { defineConfig, resolvers } from "./src/define_config.js";
-export { Authenticator } from "./src/authenticator.js";
-export { identityToUser, createUserinfoResolver, } from "./src/user_resolvers.js";
-export { buildAuthorizeUrl, buildEndSessionUrl, exchangeCode, exchangeToken, refreshTokens, generatePkce, } from "./src/oidc_login.js";
-export { discoverEndpoints, conventionEndpoints } from "./src/discovery.js";
-export { resilientFetch } from "./src/http/resilient_fetch.js";
-export { AuthkitClientManager } from "./providers/authkit_client_provider.js";
-export { lucidRevocationStore, DEFAULT_REVOCATION_TABLE, } from "./src/revocation/revocation_store.js";
-export { default as BackchannelRevocationMiddleware } from "./src/middleware/backchannel_revocation_middleware.js";
-export { lucidMirror } from "./src/lucid_mirror.js";
-export { registerOidcClient } from "./src/register_oidc_client.js";
-export { validateLogoutToken, InvalidLogoutTokenError, InMemorySessionIndex, BACKCHANNEL_LOGOUT_EVENT, } from "./src/backchannel_logout.js";
-export { generateDpopKeyPair, createDpopProof, dpopJwkThumbprint, } from "./src/dpop.js";
-export { verifyJwtAccessToken, clearJwksCache, } from "./src/verify_access_token.js";
-export { configure } from "./commands/configure.js";
+export { defineConfig, resolvers } from './src/define_config.js';
+export { Authenticator } from './src/authenticator.js';
+export { identityToUser, createUserinfoResolver, } from './src/user_resolvers.js';
+export { buildAuthorizeUrl, buildEndSessionUrl, exchangeCode, exchangeToken, refreshTokens, generatePkce, } from './src/oidc_login.js';
+export { discoverEndpoints, conventionEndpoints } from './src/discovery.js';
+export { resilientFetch } from './src/http/resilient_fetch.js';
+export { AuthkitClientManager } from './providers/authkit_client_provider.js';
+export { lucidRevocationStore, DEFAULT_REVOCATION_TABLE, } from './src/revocation/revocation_store.js';
+export { default as BackchannelRevocationMiddleware } from './src/middleware/backchannel_revocation_middleware.js';
+export { authkitClientGuard, AuthkitClientGuard } from './src/host/authkit_client_guard.js';
+export { getAuthkit } from './src/host/request_authenticator.js';
+export { default as AuthkitContextMiddleware } from './src/middleware/authkit_context_middleware.js';
+export { lucidMirror } from './src/lucid_mirror.js';
+export { registerOidcClient } from './src/register_oidc_client.js';
+export { validateLogoutToken, InvalidLogoutTokenError, InMemorySessionIndex, BACKCHANNEL_LOGOUT_EVENT, } from './src/backchannel_logout.js';
+export { generateDpopKeyPair, createDpopProof, dpopJwkThumbprint, } from './src/dpop.js';
+export { verifyJwtAccessToken, clearJwksCache, } from './src/verify_access_token.js';
+export { configure } from './commands/configure.js';

package/build/providers/authkit_client_provider.d.ts

@@ -1,7 +1,7 @@
-import type { HttpContext } from "@adonisjs/core/http";
-import type { ApplicationService } from "@adonisjs/core/types";
-import { Authenticator } from "../src/authenticator.js";
-import type { ResolvedClientConfig } from "../src/define_config.js";
+import type { HttpContext } from '@adonisjs/core/http';
+import type { ApplicationService } from '@adonisjs/core/types';
+import { Authenticator } from '../src/authenticator.js';
+import type { ResolvedClientConfig } from '../src/define_config.js';
 /** Deps injetáveis (relógio/fetch) para testar `maybeRefresh` sem rede/tempo real. */
 export interface RefreshDeps {
     now?: () => number;
@@ -49,9 +49,9 @@ export declare class AuthkitClientManager {
     isImpersonating(ctx: HttpContext): boolean;
     createAuthenticator(ctx: HttpContext): Promise<Authenticator>;
 }
-declare module "@adonisjs/core/types" {
+declare module '@adonisjs/core/types' {
     interface ContainerBindings {
-        "authkit.client": AuthkitClientManager;
+        'authkit.client': AuthkitClientManager;
     }
 }
 export default class AuthkitClientProvider {

package/build/providers/authkit_client_provider.js

@@ -1,8 +1,8 @@
-import { configProvider } from "@adonisjs/core";
-import { RuntimeException } from "@adonisjs/core/exceptions";
-import { Authenticator } from "../src/authenticator.js";
-import { validateLogoutToken } from "../src/backchannel_logout.js";
-import { exchangeToken, refreshTokens } from "../src/oidc_login.js";
+import { configProvider } from '@adonisjs/core';
+import { RuntimeException } from '@adonisjs/core/exceptions';
+import { Authenticator } from '../src/authenticator.js';
+import { validateLogoutToken } from '../src/backchannel_logout.js';
+import { exchangeToken, refreshTokens } from '../src/oidc_login.js';
 /** Margem (ms) antes do `expiresAt` em que o access token é renovado proativamente. */
 const REFRESH_SKEW_MS = 60_000;
 export class AuthkitClientManager {
@@ -84,10 +84,10 @@ export class AuthkitClientManager {
      */
     async handleBackchannelLogout(ctx) {
         const { request, response } = ctx;
-        response.header("Cache-Control", "no-store");
-        const token = request.input("logout_token");
-        if (!token || typeof token !== "string") {
-            return response.badRequest({ error: "invalid_request" });
+        response.header('Cache-Control', 'no-store');
+        const token = request.input('logout_token');
+        if (!token || typeof token !== 'string') {
+            return response.badRequest({ error: 'invalid_request' });
         }
         let validated;
         try {
@@ -97,7 +97,7 @@ export class AuthkitClientManager {
             });
         }
         catch {
-            return response.badRequest({ error: "invalid_request" });
+            return response.badRequest({ error: 'invalid_request' });
         }
         // Atualiza o índice local (se configurado) — revoga as sessões mapeadas.
         const index = this.config.sessionIndex;
@@ -126,9 +126,11 @@ export class AuthkitClientManager {
      */
     async impersonate(ctx, requestedSubject) {
         const session = ctx.session;
-        const current = session?.get(this.config.sessionKey);
+        if (!session)
+            throw new Error('Sem sessão ativa para impersonar a partir dela');
+        const current = session.get(this.config.sessionKey);
         if (!current?.accessToken) {
-            throw new Error("Sem sessão ativa para impersonar a partir dela");
+            throw new Error('Sem sessão ativa para impersonar a partir dela');
         }
         const impersonated = await exchangeToken({
             issuer: this.config.issuer,
@@ -144,7 +146,9 @@ export class AuthkitClientManager {
     /** Encerra a impersonação restaurando o token set original. Retorna false se não havia impersonação. */
     async stopImpersonating(ctx) {
         const session = ctx.session;
-        const original = session?.get(this.#impersonatorKey);
+        if (!session)
+            return false;
+        const original = session.get(this.#impersonatorKey);
         if (!original)
             return false;
         session.put(this.config.sessionKey, original);
@@ -174,8 +178,8 @@ export default class AuthkitClientProvider {
         this.app = app;
     }
     register() {
-        this.app.container.singleton("authkit.client", async () => {
-            const value = this.app.config.get("authkit_client");
+        this.app.container.singleton('authkit.client', async () => {
+            const value = this.app.config.get('authkit_client');
             const config = (await configProvider.resolve(this.app, value));
             if (!config) {
                 throw new RuntimeException('Config inválido em "config/authkit_client.ts". Use defineConfig de @adonis-agora/authkit-client.');

package/build/services/main.d.ts

@@ -1,4 +1,4 @@
-import type { AuthkitClientManager } from "../providers/authkit_client_provider.js";
+import type { AuthkitClientManager } from '../providers/authkit_client_provider.js';
 /**
  * Singleton accessor for the {@link AuthkitClientManager}, following the Adonis `services/main`
  * convention (like `db`, `mail`, `drive`). Lets an app write

package/build/services/main.js

@@ -1,4 +1,4 @@
-import app from "@adonisjs/core/services/app";
+import app from '@adonisjs/core/services/app';
 /**
  * Singleton accessor for the {@link AuthkitClientManager}, following the Adonis `services/main`
  * convention (like `db`, `mail`, `drive`). Lets an app write
@@ -8,6 +8,6 @@ import app from "@adonisjs/core/services/app";
  */
 let manager;
 await app.booted(async () => {
-    manager = await app.container.make("authkit.client");
+    manager = await app.container.make('authkit.client');
 });
 export { manager as default };

package/build/src/authenticator.d.ts

@@ -1,6 +1,6 @@
-import type { Identity, SessionResolver } from "@adonis-agora/authkit-core";
-import { type MetricsRecorder } from "@adonis-agora/authkit-core";
-import type { HttpContext } from "@adonisjs/core/http";
+import type { Identity, SessionResolver } from '@adonis-agora/authkit-core';
+import { type MetricsRecorder } from '@adonis-agora/authkit-core';
+import type { HttpContext } from '@adonisjs/core/http';
 /** Contexto opcional repassado a `resolveUser` (extensão backward-compatible). */
 export interface ResolveUserContext {
     accessToken?: string;

package/build/src/authenticator.js

@@ -1,5 +1,5 @@
-import { AUTHKIT_METRICS, NoopRecorder, } from "@adonis-agora/authkit-core";
-import { populateContext } from "./observability/context_bridge.js";
+import { AUTHKIT_METRICS, NoopRecorder } from '@adonis-agora/authkit-core';
+import { populateContext } from './observability/context_bridge.js';
 /**
  * Autenticador do request. O parâmetro `TUser` é o tipo do usuário do app que `resolveUser`
  * devolve — o app o fixa via augmentation de `HttpContext.auth` (`auth: Authenticator<AppUser>`),
@@ -47,7 +47,7 @@ export class Authenticator {
     async authenticate() {
         const identity = await this.getIdentity();
         if (!identity)
-            throw new Error("Not authenticated");
+            throw new Error('Not authenticated');
         return identity;
     }
     async check() {
@@ -84,7 +84,7 @@ export class Authenticator {
     async getUserOrFail() {
         const user = await this.getUser();
         if (user === null) {
-            throw new Error("Not authenticated: no user for the current session");
+            throw new Error('Not authenticated: no user for the current session');
         }
         return user;
     }

package/build/src/define_config.d.ts

@@ -1,8 +1,8 @@
-import type { Identity } from "@adonis-agora/authkit-core";
-import type { SessionIndex } from "./backchannel_logout.js";
-import type { ResiliencePolicy } from "./http/resilient_fetch.js";
-import { type ResolverFactory, resolvers } from "./resolvers/factory.js";
-import type { RevocationStore } from "./revocation/revocation_store.js";
+import type { Identity } from '@adonis-agora/authkit-core';
+import type { SessionIndex } from './backchannel_logout.js';
+import type { ResiliencePolicy } from './http/resilient_fetch.js';
+import { type ResolverFactory, resolvers } from './resolvers/factory.js';
+import type { RevocationStore } from './revocation/revocation_store.js';
 export { resolvers };
 /** Callback invocado quando um logout_token válido chega via Back-Channel Logout. */
 export type BackchannelLogoutCallback = (event: {

package/build/src/define_config.js

@@ -1,5 +1,5 @@
-import { configProvider } from "@adonisjs/core";
-import { resolvers } from "./resolvers/factory.js";
+import { configProvider } from '@adonisjs/core';
+import { resolvers } from './resolvers/factory.js';
 export { resolvers };
 export function defineConfig(config) {
     return configProvider.create(async () => {
@@ -22,9 +22,9 @@ export function defineConfig(config) {
             redirectUri: config.redirectUri,
             resolverFactory: config.resolver,
             resolveUser: config.resolveUser,
-            sessionKey: config.sessionKey ?? "authkit",
-            scopes: config.scopes ?? ["openid", "profile", "email", "offline_access", "roles"],
-            globalRolesClaim: config.globalRolesClaim ?? "roles",
+            sessionKey: config.sessionKey ?? 'authkit',
+            scopes: config.scopes ?? ['openid', 'profile', 'email', 'offline_access', 'roles'],
+            globalRolesClaim: config.globalRolesClaim ?? 'roles',
             onBackchannelLogout,
             sessionIndex: config.sessionIndex,
             backchannelStore: store,

package/build/src/discovery.d.ts

@@ -16,7 +16,7 @@
  * const tokens = await exchangeCode({ issuer, tokenEndpoint: endpoints.tokenEndpoint, ... })
  * ```
  */
-import { type ResiliencePolicy } from "./http/resilient_fetch.js";
+import { type ResiliencePolicy } from './http/resilient_fetch.js';
 export interface OidcEndpoints {
     authorizationEndpoint: string;
     tokenEndpoint: string;

package/build/src/discovery.js

@@ -16,13 +16,13 @@
  * const tokens = await exchangeCode({ issuer, tokenEndpoint: endpoints.tokenEndpoint, ... })
  * ```
  */
-import { resilientFetch, } from "./http/resilient_fetch.js";
+import { resilientFetch } from './http/resilient_fetch.js';
 /**
  * Convenção do oidc-provider (authkit-server) — usada como fallback quando o
  * documento de discovery não está acessível.
  */
 export function conventionEndpoints(issuer) {
-    const base = issuer.replace(/\/$/, "");
+    const base = issuer.replace(/\/$/, '');
     return {
         authorizationEndpoint: `${base}/auth`,
         tokenEndpoint: `${base}/token`,
@@ -43,7 +43,7 @@ const cache = new Map();
  * - `overrides` sempre vencem, campo a campo.
  */
 export async function discoverEndpoints(issuer, options = {}) {
-    const base = issuer.replace(/\/$/, "");
+    const base = issuer.replace(/\/$/, '');
     const ttl = options.cacheTtlMs ?? DEFAULT_TTL_MS;
     const cached = cache.get(base);
     let endpoints;
@@ -66,11 +66,11 @@ export async function discoverEndpoints(issuer, options = {}) {
 async function fetchDiscovery(base, fetchImpl, resilience) {
     const fallback = conventionEndpoints(base);
     try {
-        const res = await resilientFetch(`${base}/.well-known/openid-configuration`, { headers: { accept: "application/json" } }, resilience, fetchImpl);
+        const res = await resilientFetch(`${base}/.well-known/openid-configuration`, { headers: { accept: 'application/json' } }, resilience, fetchImpl);
         if (!res.ok)
             return fallback;
         const doc = (await res.json());
-        const str = (v) => typeof v === "string" && v ? v : undefined;
+        const str = (v) => (typeof v === 'string' && v ? v : undefined);
         return {
             authorizationEndpoint: str(doc.authorization_endpoint) ?? fallback.authorizationEndpoint,
             tokenEndpoint: str(doc.token_endpoint) ?? fallback.tokenEndpoint,

package/build/src/dpop.js

@@ -1,5 +1,5 @@
-import { SignJWT, exportJWK, generateKeyPair, calculateJwkThumbprint, base64url, } from 'jose';
 import { createHash, randomUUID } from 'node:crypto';
+import { SignJWT, base64url, calculateJwkThumbprint, exportJWK, generateKeyPair, } from 'jose';
 /**
  * Gera um par de chaves DPoP ES256 (P-256), exportável como JWK. ES256 é o alg
  * recomendado pelo RFC 9449 e o que o oidc-provider do authkit-server aceita.

package/build/src/host/authkit_client_guard.d.ts

@@ -0,0 +1,100 @@
+import type { symbols } from '@adonisjs/auth';
+import type { AuthClientResponse, GuardConfigProvider } from '@adonisjs/auth/types';
+import type { SessionUserProviderContract } from '@adonisjs/auth/types/session';
+import type { HttpContext } from '@adonisjs/core/http';
+import type { ConfigProvider } from '@adonisjs/core/types';
+import type { Authenticator } from '../authenticator.js';
+/**
+ * Construtor do `E_UNAUTHORIZED_ACCESS` do `@adonisjs/auth`, capturado no boot
+ * (ver {@link authkitClientGuard}) para que `getUserOrFail()` — que o contrato
+ * exige SÍNCRONO — possa lançá-lo sem um `await import()`.
+ */
+export type UnauthorizedAccessConstructor = new (message: string, options: {
+    guardDriverName: string;
+    redirectTo?: string;
+}) => Error;
+/** O tipo de usuário REAL por trás de um user provider do `@adonisjs/auth`. */
+type RealUser<UserProvider> = UserProvider extends SessionUserProviderContract<infer User> ? User : never;
+/**
+ * Guard de `@adonisjs/auth` apoiado na sessão OIDC do `@adonis-agora/authkit-client`.
+ *
+ * A fonte da verdade de "quem está logado" é o `SessionResolver` do authkit
+ * (JWT/opaco/PAT, conforme `config/authkit_client.ts`) — o guard NÃO reimplementa
+ * resolução de sessão nem lê a sessão por conta própria. Ele só faz a ponte:
+ * pega o `sub` da `Identity` (`identity.userId`) e pede o usuário do app ao
+ * `provider`, exatamente como o `sessionGuard` nativo faria com o id que ele
+ * guarda na sessão.
+ *
+ * Consequência: `middleware.auth()`, `ctx.auth.user`, `auth.check()` e o Bouncer
+ * passam a funcionar sobre uma sessão do authkit.
+ */
+export declare class AuthkitClientGuard<UserProvider extends SessionUserProviderContract<unknown>> {
+    #private;
+    /** Eventos do guard. Não emitimos nenhum (ainda) — o slot existe pro contrato. */
+    [symbols.GUARD_KNOWN_EVENTS]: unknown;
+    readonly driverName = "authkit_client";
+    authenticationAttempted: boolean;
+    isAuthenticated: boolean;
+    user?: RealUser<UserProvider>;
+    constructor(_name: string, ctx: HttpContext, userProvider: UserProvider, unauthorized: UnauthorizedAccessConstructor);
+    /**
+     * O {@link Authenticator} do authkit desta request (a `Identity` crua,
+     * `hasGlobalRole`, `toSharedProps`). Só existe depois de uma tentativa de
+     * autenticação; use `ctx.authkit` (via `authkit_context_middleware`) quando
+     * precisar dele em rota pública.
+     */
+    get authkit(): Authenticator | undefined;
+    /**
+     * Autentica a request: resolve a sessão do authkit e mapeia o `sub` para o
+     * usuário do app via `provider.findById`. Lança `E_UNAUTHORIZED_ACCESS` (o
+     * MESMO erro dos guards nativos, então o `middleware.auth()` e o handler de
+     * exceção do host tratam igual) quando não há sessão OU quando a sessão é
+     * válida mas não existe usuário local correspondente (fail-closed).
+     */
+    authenticate(): Promise<RealUser<UserProvider>>;
+    /** Igual aos guards nativos: `authenticate()` sem lançar. */
+    check(): Promise<boolean>;
+    /** O usuário autenticado, ou `E_UNAUTHORIZED_ACCESS`. */
+    getUserOrFail(): RealUser<UserProvider>;
+    /**
+     * Não implementado de propósito: a sessão deste guard é um TokenSet OIDC, e
+     * forjar um `id_token` assinado pelo IdP não é algo que a lib possa fazer a
+     * partir de um objeto de usuário. Use `@adonis-agora/authkit-testing`
+     * (`mintTestIdToken`) e plante o TokenSet na sessão, ou injete um
+     * `fakeAuthenticator()` em `ctx.authkit`.
+     */
+    authenticateAsClient(): Promise<AuthClientResponse>;
+}
+/**
+ * Configura o {@link AuthkitClientGuard} em `config/auth.ts`:
+ *
+ * ```ts
+ * import { defineConfig } from '@adonisjs/auth'
+ * import { sessionUserProvider } from '@adonisjs/auth/session'
+ * import { authkitClientGuard } from '@adonis-agora/authkit-client'
+ *
+ * export default defineConfig({
+ *   default: 'web',
+ *   guards: {
+ *     web: authkitClientGuard({
+ *       provider: sessionUserProvider({ model: () => import('#models/user') }),
+ *     }),
+ *   },
+ * })
+ * ```
+ *
+ * O `provider` é o MESMO contrato do `sessionGuard` nativo, então qualquer user
+ * provider de session serve. O `findById` recebe `identity.userId` (a claim
+ * `sub`) — a coluna de id do model precisa ser essa (é o que o `lucidMirror()`
+ * grava).
+ *
+ * Precedência com `resolveUser` de `config/authkit_client.ts`: são superfícies
+ * SEPARADAS e ambas continuam valendo. `ctx.auth.user` (framework) vem SEMPRE do
+ * `provider`; `ctx.authkit.getUser()` (authkit) continua vindo do `resolveUser`.
+ * O guard nunca chama `resolveUser`. Com o guard configurado, o normal é apagar
+ * o `resolveUser` e deixar só o `provider`.
+ */
+export declare function authkitClientGuard<UserProvider extends SessionUserProviderContract<unknown>>(config: {
+    provider: UserProvider | ConfigProvider<UserProvider>;
+}): GuardConfigProvider<(ctx: HttpContext) => AuthkitClientGuard<UserProvider>>;
+export {};

package/build/src/host/authkit_client_guard.js

@@ -0,0 +1,153 @@
+import { RuntimeException } from '@adonisjs/core/exceptions';
+import { getAuthkit } from './request_authenticator.js';
+/**
+ * Guard de `@adonisjs/auth` apoiado na sessão OIDC do `@adonis-agora/authkit-client`.
+ *
+ * A fonte da verdade de "quem está logado" é o `SessionResolver` do authkit
+ * (JWT/opaco/PAT, conforme `config/authkit_client.ts`) — o guard NÃO reimplementa
+ * resolução de sessão nem lê a sessão por conta própria. Ele só faz a ponte:
+ * pega o `sub` da `Identity` (`identity.userId`) e pede o usuário do app ao
+ * `provider`, exatamente como o `sessionGuard` nativo faria com o id que ele
+ * guarda na sessão.
+ *
+ * Consequência: `middleware.auth()`, `ctx.auth.user`, `auth.check()` e o Bouncer
+ * passam a funcionar sobre uma sessão do authkit.
+ */
+export class AuthkitClientGuard {
+    #ctx;
+    #userProvider;
+    #unauthorized;
+    #authkit;
+    driverName = 'authkit_client';
+    authenticationAttempted = false;
+    isAuthenticated = false;
+    user;
+    constructor(_name, ctx, userProvider, unauthorized) {
+        this.#ctx = ctx;
+        this.#userProvider = userProvider;
+        this.#unauthorized = unauthorized;
+    }
+    /**
+     * O {@link Authenticator} do authkit desta request (a `Identity` crua,
+     * `hasGlobalRole`, `toSharedProps`). Só existe depois de uma tentativa de
+     * autenticação; use `ctx.authkit` (via `authkit_context_middleware`) quando
+     * precisar dele em rota pública.
+     */
+    get authkit() {
+        return this.#authkit;
+    }
+    #failed() {
+        this.isAuthenticated = false;
+        this.user = undefined;
+        return new this.#unauthorized('Invalid or expired user session', {
+            guardDriverName: this.driverName,
+        });
+    }
+    /**
+     * Autentica a request: resolve a sessão do authkit e mapeia o `sub` para o
+     * usuário do app via `provider.findById`. Lança `E_UNAUTHORIZED_ACCESS` (o
+     * MESMO erro dos guards nativos, então o `middleware.auth()` e o handler de
+     * exceção do host tratam igual) quando não há sessão OU quando a sessão é
+     * válida mas não existe usuário local correspondente (fail-closed).
+     */
+    async authenticate() {
+        if (this.authenticationAttempted)
+            return this.getUserOrFail();
+        this.authenticationAttempted = true;
+        const authkit = await getAuthkit(this.#ctx);
+        this.#authkit = authkit;
+        const identity = await authkit.getIdentity();
+        if (!identity)
+            throw this.#failed();
+        // `identity.userId` É a claim `sub` — o único id estável por conta que a
+        // `Identity` tem. (Ela NÃO tem `id`.)
+        const providerUser = await this.#userProvider.findById(identity.userId);
+        if (!providerUser)
+            throw this.#failed();
+        this.user = providerUser.getOriginal();
+        this.isAuthenticated = true;
+        return this.user;
+    }
+    /** Igual aos guards nativos: `authenticate()` sem lançar. */
+    async check() {
+        try {
+            await this.authenticate();
+            return true;
+        }
+        catch (error) {
+            if (error instanceof this.#unauthorized)
+                return false;
+            throw error;
+        }
+    }
+    /** O usuário autenticado, ou `E_UNAUTHORIZED_ACCESS`. */
+    getUserOrFail() {
+        if (!this.user) {
+            throw new this.#unauthorized('Invalid or expired user session', {
+                guardDriverName: this.driverName,
+            });
+        }
+        return this.user;
+    }
+    /**
+     * Não implementado de propósito: a sessão deste guard é um TokenSet OIDC, e
+     * forjar um `id_token` assinado pelo IdP não é algo que a lib possa fazer a
+     * partir de um objeto de usuário. Use `@adonis-agora/authkit-testing`
+     * (`mintTestIdToken`) e plante o TokenSet na sessão, ou injete um
+     * `fakeAuthenticator()` em `ctx.authkit`.
+     */
+    async authenticateAsClient() {
+        throw new RuntimeException('authkitClientGuard não suporta "loginAs" nos plugins de teste: a sessão é um TokenSet OIDC ' +
+            'assinado pelo IdP. Use mintTestIdToken() de @adonis-agora/authkit-testing e plante o ' +
+            'TokenSet na sessão, ou injete fakeAuthenticator() em ctx.authkit.');
+    }
+}
+/**
+ * Configura o {@link AuthkitClientGuard} em `config/auth.ts`:
+ *
+ * ```ts
+ * import { defineConfig } from '@adonisjs/auth'
+ * import { sessionUserProvider } from '@adonisjs/auth/session'
+ * import { authkitClientGuard } from '@adonis-agora/authkit-client'
+ *
+ * export default defineConfig({
+ *   default: 'web',
+ *   guards: {
+ *     web: authkitClientGuard({
+ *       provider: sessionUserProvider({ model: () => import('#models/user') }),
+ *     }),
+ *   },
+ * })
+ * ```
+ *
+ * O `provider` é o MESMO contrato do `sessionGuard` nativo, então qualquer user
+ * provider de session serve. O `findById` recebe `identity.userId` (a claim
+ * `sub`) — a coluna de id do model precisa ser essa (é o que o `lucidMirror()`
+ * grava).
+ *
+ * Precedência com `resolveUser` de `config/authkit_client.ts`: são superfícies
+ * SEPARADAS e ambas continuam valendo. `ctx.auth.user` (framework) vem SEMPRE do
+ * `provider`; `ctx.authkit.getUser()` (authkit) continua vindo do `resolveUser`.
+ * O guard nunca chama `resolveUser`. Com o guard configurado, o normal é apagar
+ * o `resolveUser` e deixar só o `provider`.
+ */
+export function authkitClientGuard(config) {
+    return {
+        async resolver(name, app) {
+            let unauthorized;
+            try {
+                const auth = (await import('@adonisjs/auth'));
+                unauthorized = auth.errors.E_UNAUTHORIZED_ACCESS;
+            }
+            catch (error) {
+                throw new RuntimeException('authkitClientGuard() precisa de "@adonisjs/auth" instalado (é um peer opcional do ' +
+                    '@adonis-agora/authkit-client, só necessário se você plugar este guard em config/auth.ts). ' +
+                    'Rode `npm i @adonisjs/auth` (ou pnpm/yarn).', { cause: error });
+            }
+            const provider = 'resolver' in config.provider
+                ? (await config.provider.resolver(app))
+                : config.provider;
+            return (ctx) => new AuthkitClientGuard(name, ctx, provider, unauthorized);
+        },
+    };
+}

package/build/src/host/request_authenticator.d.ts

@@ -0,0 +1,31 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { Authenticator } from '../authenticator.js';
+/**
+ * Resolve (uma vez por request) o {@link Authenticator} do authkit e o memoiza
+ * em `ctx.authkit`.
+ *
+ * É o ÚNICO caminho de resolução de sessão da lib: passa pelo
+ * `AuthkitClientManager`, então o refresh proativo do token (`maybeRefresh`), o
+ * `SessionResolver` configurado, as métricas e a ponte do `@agora/context`
+ * continuam valendo — tanto para quem usa `authkit_middleware` (legado) quanto
+ * para quem usa o `authkitClientGuard` de `@adonisjs/auth`.
+ *
+ * Memoiza em `ctx.authkit` de propósito: quando o host registra o
+ * `authkit_context_middleware` E o guard, os dois compartilham a MESMA
+ * instância, e a sessão é resolvida (e o token renovado) uma vez só.
+ */
+export declare function getAuthkit(ctx: HttpContext): Promise<Authenticator>;
+declare module '@adonisjs/core/http' {
+    interface HttpContext {
+        /**
+         * Superfície específica do authkit (`getIdentity`, `hasGlobalRole`, a
+         * `Identity` crua). Populada pelo `authkit_context_middleware` e, no
+         * caminho do guard, pelo próprio `authkitClientGuard` ao autenticar.
+         *
+         * Existe para que o `@adonisjs/auth` possa ser o dono de `ctx.auth` sem que
+         * o host perca o que só o authkit sabe. Quem NÃO usa o guard continua com o
+         * `Authenticator` do authkit direto em `ctx.auth` (ver `types.ts`).
+         */
+        authkit: Authenticator;
+    }
+}

package/build/src/host/request_authenticator.js

@@ -0,0 +1,24 @@
+/**
+ * Resolve (uma vez por request) o {@link Authenticator} do authkit e o memoiza
+ * em `ctx.authkit`.
+ *
+ * É o ÚNICO caminho de resolução de sessão da lib: passa pelo
+ * `AuthkitClientManager`, então o refresh proativo do token (`maybeRefresh`), o
+ * `SessionResolver` configurado, as métricas e a ponte do `@agora/context`
+ * continuam valendo — tanto para quem usa `authkit_middleware` (legado) quanto
+ * para quem usa o `authkitClientGuard` de `@adonisjs/auth`.
+ *
+ * Memoiza em `ctx.authkit` de propósito: quando o host registra o
+ * `authkit_context_middleware` E o guard, os dois compartilham a MESMA
+ * instância, e a sessão é resolvida (e o token renovado) uma vez só.
+ */
+export async function getAuthkit(ctx) {
+    const existing = ctx.authkit;
+    if (existing)
+        return existing;
+    const manager = await ctx.containerResolver.make('authkit.client');
+    await manager.maybeRefresh(ctx);
+    const authenticator = await manager.createAuthenticator(ctx);
+    ctx.authkit = authenticator;
+    return authenticator;
+}

package/build/src/middleware/authkit_context_middleware.d.ts

@@ -0,0 +1,28 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { NextFn } from '@adonisjs/core/types/http';
+/**
+ * Popula `ctx.authkit` (o `Authenticator` do authkit) e renova o token
+ * proativamente — SEM tocar em `ctx.auth`.
+ *
+ * É o par do `authkitClientGuard`: quem adota o guard entrega `ctx.auth` ao
+ * `@adonisjs/auth` (via `@adonisjs/auth/initialize_auth_middleware`) e registra
+ * ESTE middleware para continuar alcançando a superfície específica do authkit
+ * (`hasGlobalRole`, a `Identity` crua, `toSharedProps`) em qualquer rota,
+ * inclusive nas públicas.
+ *
+ * ```ts
+ * // start/kernel.ts
+ * router.use([
+ *   () => import('@adonisjs/auth/initialize_auth_middleware'),
+ *   () => import('@adonis-agora/authkit-client/authkit_context_middleware'),
+ * ])
+ * ```
+ *
+ * Não substitui o `authkit_middleware`: quem NÃO usa `@adonisjs/auth` continua
+ * com o `authkit_middleware`, que segue colocando o `Authenticator` em
+ * `ctx.auth` como sempre. Registrar os dois não faz sentido (e resolveria a
+ * sessão duas vezes em objetos distintos).
+ */
+export default class AuthkitContextMiddleware {
+    handle(ctx: HttpContext, next: NextFn): Promise<any>;
+}

package/build/src/middleware/authkit_context_middleware.js

@@ -0,0 +1,30 @@
+import { getAuthkit } from '../host/request_authenticator.js';
+/**
+ * Popula `ctx.authkit` (o `Authenticator` do authkit) e renova o token
+ * proativamente — SEM tocar em `ctx.auth`.
+ *
+ * É o par do `authkitClientGuard`: quem adota o guard entrega `ctx.auth` ao
+ * `@adonisjs/auth` (via `@adonisjs/auth/initialize_auth_middleware`) e registra
+ * ESTE middleware para continuar alcançando a superfície específica do authkit
+ * (`hasGlobalRole`, a `Identity` crua, `toSharedProps`) em qualquer rota,
+ * inclusive nas públicas.
+ *
+ * ```ts
+ * // start/kernel.ts
+ * router.use([
+ *   () => import('@adonisjs/auth/initialize_auth_middleware'),
+ *   () => import('@adonis-agora/authkit-client/authkit_context_middleware'),
+ * ])
+ * ```
+ *
+ * Não substitui o `authkit_middleware`: quem NÃO usa `@adonisjs/auth` continua
+ * com o `authkit_middleware`, que segue colocando o `Authenticator` em
+ * `ctx.auth` como sempre. Registrar os dois não faz sentido (e resolveria a
+ * sessão duas vezes em objetos distintos).
+ */
+export default class AuthkitContextMiddleware {
+    async handle(ctx, next) {
+        await getAuthkit(ctx);
+        return next();
+    }
+}

package/build/src/middleware/backchannel_revocation_middleware.js

@@ -26,7 +26,6 @@ export default class BackchannelRevocationMiddleware {
             const authTime = typeof claims?.iat === 'number' ? claims.iat : undefined;
             if ((sid || sub) && (await store.isRevoked({ sid, sub, authTime }))) {
                 // session é augmentado por @adonisjs/session no app host; na lib usamos cast.
-                ;
                 ctx.session?.forget(sessionKey);
             }
         }

package/build/src/observability/context_bridge.d.ts

@@ -1,4 +1,4 @@
-import type { Identity } from "@adonis-agora/authkit-core";
+import type { Identity } from '@adonis-agora/authkit-core';
 /**
  * Popula o contexto do Agora a partir de uma identidade recém-resolvida:
  * `userRef` ({ type: 'user', id: userId }), os `globalRoles` da identidade e,

package/build/src/observability/context_bridge.js

@@ -4,17 +4,17 @@
  * nunca importa `@adonis-agora/context` — e degrada para no-op quando o context
  * não está instalado. Mesmo idioma da `diagnostics_bridge`.
  */
-const SET_SLOT = Symbol.for("@agora/context:set");
+const SET_SLOT = Symbol.for('@agora/context:set');
 /**
  * Claims OIDC candidatas a "organização/tenant ativo". A primeira presente (e
  * string não vazia) vira o `tenantId`. Não falha se nenhuma existir.
  */
 const TENANT_CLAIMS = [
-    "active_organization_id",
-    "org_id",
-    "organization_id",
-    "tenant_id",
-    "tid",
+    'active_organization_id',
+    'org_id',
+    'organization_id',
+    'tenant_id',
+    'tid',
 ];
 /** Deriva o tenant ativo das claims cruas, ou `undefined` quando ausente. */
 function deriveTenant(raw) {
@@ -22,7 +22,7 @@ function deriveTenant(raw) {
         return undefined;
     for (const claim of TENANT_CLAIMS) {
         const value = raw[claim];
-        if (typeof value === "string" && value.length > 0)
+        if (typeof value === 'string' && value.length > 0)
             return value;
     }
     return undefined;
@@ -40,7 +40,7 @@ export function populateContext(identity) {
             return;
         const tenant = deriveTenant(identity.raw);
         set({
-            userRef: { type: "user", id: identity.userId },
+            userRef: { type: 'user', id: identity.userId },
             globalRoles: identity.globalRoles,
             ...(tenant ? { tenantId: tenant } : {}),
         });

package/build/src/oidc_login.d.ts

@@ -1,5 +1,5 @@
-import type { TokenSet } from "./types.js";
-import { type ResiliencePolicy } from "./http/resilient_fetch.js";
+import { type ResiliencePolicy } from './http/resilient_fetch.js';
+import type { TokenSet } from './types.js';
 /**
  * Gera um par PKCE (code_verifier + code_challenge) usando o método S256.
  *

package/build/src/oidc_login.js

@@ -1,6 +1,6 @@
-import { createHash, randomBytes } from "node:crypto";
-import { base64url } from "jose";
-import { resilientFetch, } from "./http/resilient_fetch.js";
+import { createHash, randomBytes } from 'node:crypto';
+import { base64url } from 'jose';
+import { resilientFetch } from './http/resilient_fetch.js';
 /**
  * Gera um par PKCE (code_verifier + code_challenge) usando o método S256.
  *
@@ -11,18 +11,18 @@ import { resilientFetch, } from "./http/resilient_fetch.js";
  */
 export async function generatePkce() {
     const verifier = base64url.encode(randomBytes(32));
-    const challenge = base64url.encode(createHash("sha256").update(verifier).digest());
-    return { verifier, challenge, method: "S256" };
+    const challenge = base64url.encode(createHash('sha256').update(verifier).digest());
+    return { verifier, challenge, method: 'S256' };
 }
 export function buildAuthorizeUrl(p) {
     const url = new URL(p.authorizationEndpoint ?? `${p.issuer}/auth`);
-    url.searchParams.set("client_id", p.clientId);
-    url.searchParams.set("response_type", "code");
-    url.searchParams.set("redirect_uri", p.redirectUri);
-    url.searchParams.set("scope", p.scopes.join(" "));
-    url.searchParams.set("state", p.state);
-    url.searchParams.set("code_challenge", p.codeChallenge);
-    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set('client_id', p.clientId);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('redirect_uri', p.redirectUri);
+    url.searchParams.set('scope', p.scopes.join(' '));
+    url.searchParams.set('state', p.state);
+    url.searchParams.set('code_challenge', p.codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
     if (p.extraParams) {
         for (const [key, value] of Object.entries(p.extraParams)) {
             if (value !== undefined && value !== null)
@@ -41,14 +41,14 @@ export function buildAuthorizeUrl(p) {
 export function buildEndSessionUrl(p) {
     const url = new URL(p.endSessionEndpoint ?? `${p.issuer}/session/end`);
     if (p.idToken)
-        url.searchParams.set("id_token_hint", p.idToken);
+        url.searchParams.set('id_token_hint', p.idToken);
     if (p.postLogoutRedirectUri) {
-        url.searchParams.set("post_logout_redirect_uri", p.postLogoutRedirectUri);
+        url.searchParams.set('post_logout_redirect_uri', p.postLogoutRedirectUri);
     }
     if (p.clientId)
-        url.searchParams.set("client_id", p.clientId);
+        url.searchParams.set('client_id', p.clientId);
     if (p.state)
-        url.searchParams.set("state", p.state);
+        url.searchParams.set('state', p.state);
     return url.toString();
 }
 /**
@@ -58,32 +58,30 @@ export function buildEndSessionUrl(p) {
  */
 async function tokenEndpoint(issuer, body, fetchImpl = fetch, endpoint, resilience) {
     const res = await resilientFetch(endpoint ?? `${issuer}/token`, {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
         body: body.toString(),
     }, resilience, fetchImpl);
     if (!res.ok)
         throw new Error(`Token endpoint returned ${res.status}`);
     const json = (await res.json());
     return {
-        idToken: json.id_token ?? "",
+        idToken: json.id_token ?? '',
         accessToken: json.access_token,
         refreshToken: json.refresh_token,
-        expiresAt: json.expires_in
-            ? Date.now() + json.expires_in * 1000
-            : undefined,
+        expiresAt: json.expires_in ? Date.now() + json.expires_in * 1000 : undefined,
     };
 }
 export async function exchangeCode(p) {
     const body = new URLSearchParams({
-        grant_type: "authorization_code",
+        grant_type: 'authorization_code',
         code: p.code,
         redirect_uri: p.redirectUri,
         client_id: p.clientId,
         code_verifier: p.codeVerifier,
     });
     if (p.clientSecret)
-        body.set("client_secret", p.clientSecret);
+        body.set('client_secret', p.clientSecret);
     return tokenEndpoint(p.issuer, body, p.fetchImpl, p.tokenEndpoint, p.resilience);
 }
 /**
@@ -96,28 +94,28 @@ export async function exchangeCode(p) {
  */
 export async function refreshTokens(p) {
     const body = new URLSearchParams({
-        grant_type: "refresh_token",
+        grant_type: 'refresh_token',
         refresh_token: p.refreshToken,
         client_id: p.clientId,
     });
     if (p.scope)
-        body.set("scope", p.scope);
+        body.set('scope', p.scope);
     if (p.clientSecret)
-        body.set("client_secret", p.clientSecret);
+        body.set('client_secret', p.clientSecret);
     return tokenEndpoint(p.issuer, body, p.fetchImpl, p.tokenEndpoint, p.resilience);
 }
 /** Troca o token do ator por um token do usuário-alvo (RFC 8693), p/ impersonation. */
 export async function exchangeToken(p) {
     const body = new URLSearchParams({
-        grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+        grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
         subject_token: p.subjectToken,
-        subject_token_type: "urn:ietf:params:oauth:token-type:access_token",
+        subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',
         requested_subject: p.requestedSubject,
         client_id: p.clientId,
     });
     if (p.scope)
-        body.set("scope", p.scope);
+        body.set('scope', p.scope);
     if (p.clientSecret)
-        body.set("client_secret", p.clientSecret);
+        body.set('client_secret', p.clientSecret);
     return tokenEndpoint(p.issuer, body, p.fetchImpl, p.tokenEndpoint, p.resilience);
 }

package/build/src/register_oidc_client.d.ts

@@ -17,7 +17,7 @@ export interface RegisterOidcClientOptions {
      * Hook após troca de code bem-sucedida. Retorne uma STRING para redirecionar
      * para uma rota específica; retorne void para cair em `redirects`/`/`.
      */
-    afterLogin?: (ctx: HttpContext, identity: Identity | null) => Promise<string | void> | string | void;
+    afterLogin?: (ctx: HttpContext, identity: Identity | null) => Promise<string | undefined> | string | undefined;
     /** Redirect pós-login por papel (usado quando `afterLogin` não retorna string). */
     redirects?: PostLoginRedirects;
     /** Destino pós-logout. Default: origem do redirectUri + '/'. */

package/build/src/register_oidc_client.js

@@ -52,7 +52,6 @@ export function registerOidcClient(router, options = {}) {
         const pkce = ctx.session?.get(pkceKey);
         // Callback velho/expirado (state perdido ou code ausente) → recomeça o login.
         if (!pkce || pkce.state !== state || !code) {
-            ;
             ctx.session?.forget(pkceKey);
             return ctx.response.redirect(`${prefix}/login`);
         }
@@ -85,7 +84,7 @@ export function registerOidcClient(router, options = {}) {
         ctx.session?.forget(cfg.sessionKey);
         const postLogoutRedirectUri = typeof options.postLogoutRedirect === 'function'
             ? options.postLogoutRedirect(ctx)
-            : (options.postLogoutRedirect ?? new URL(cfg.redirectUri).origin + '/');
+            : (options.postLogoutRedirect ?? `${new URL(cfg.redirectUri).origin}/`);
         const endSessionUrl = buildEndSessionUrl({
             issuer: cfg.issuer,
             idToken,

package/build/src/resolvers/factory.js

@@ -1,7 +1,7 @@
+import { getTokenFromSource } from '../token_source.js';
 import { JwtResolver } from './jwt_resolver.js';
-import { PatResolver } from './pat_resolver.js';
 import { OpaqueResolver } from './opaque_resolver.js';
-import { getTokenFromSource } from '../token_source.js';
+import { PatResolver } from './pat_resolver.js';
 export const resolvers = {
     jwt(config = {}) {
         const tokenSource = config.tokenSource ?? 'session';

package/build/src/resolvers/jwt_resolver.d.ts

@@ -1,5 +1,5 @@
-import type { HttpContext } from '@adonisjs/core/http';
 import type { Identity, SessionResolver } from '@adonis-agora/authkit-core';
+import type { HttpContext } from '@adonisjs/core/http';
 export interface JwtResolverConfig {
     issuer: string;
     jwksUri: string;

package/build/src/resolvers/jwt_resolver.js

@@ -1,6 +1,17 @@
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 import { buildIdentityFromClaims } from './identity.js';
-const DEFAULT_ALGS = ['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512', 'ES256', 'ES384', 'ES512', 'EdDSA'];
+const DEFAULT_ALGS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'PS256',
+    'PS384',
+    'PS512',
+    'ES256',
+    'ES384',
+    'ES512',
+    'EdDSA',
+];
 export class JwtResolver {
     config;
     #jwks;

package/build/src/resolvers/opaque_resolver.d.ts

@@ -1,5 +1,5 @@
-import type { HttpContext } from '@adonisjs/core/http';
 import type { Identity, SessionResolver } from '@adonis-agora/authkit-core';
+import type { HttpContext } from '@adonisjs/core/http';
 import { type TokenSource } from '../token_source.js';
 type FetchImpl = (url: string, init: any) => Promise<{
     ok: boolean;

package/build/src/resolvers/pat_resolver.d.ts

@@ -1,5 +1,5 @@
-import type { HttpContext } from '@adonisjs/core/http';
 import type { Identity, SessionResolver } from '@adonis-agora/authkit-core';
+import type { HttpContext } from '@adonisjs/core/http';
 type FetchImpl = (url: string, init: any) => Promise<{
     ok: boolean;
     json: () => Promise<any>;

package/build/types.d.ts

@@ -1,5 +1,5 @@
-import type { Authenticator } from './src/authenticator.js';
 import type { AuthkitClientManager } from './providers/authkit_client_provider.js';
+import type { Authenticator } from './src/authenticator.js';
 declare module '@adonisjs/core/http' {
     interface HttpContext {
         auth: Authenticator;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-client",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "AdonisJS OIDC/OAuth2 relying-party (client) toolkit: session-based authentication against an OpenID Connect identity provider, with JWT/PAT user resolvers and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -38,7 +38,9 @@
     "./types": "./build/index.js",
     "./services/main": "./build/services/main.js",
     "./authkit_client_provider": "./build/providers/authkit_client_provider.js",
+    "./auth": "./build/src/host/authkit_client_guard.js",
     "./authkit_middleware": "./build/src/middleware/authkit_middleware.js",
+    "./authkit_context_middleware": "./build/src/middleware/authkit_context_middleware.js",
     "./backchannel_revocation_middleware": "./build/src/middleware/backchannel_revocation_middleware.js",
     "./auth_middleware": "./build/src/middleware/auth_middleware.js",
     "./silent_auth_middleware": "./build/src/middleware/silent_auth_middleware.js",
@@ -54,12 +56,16 @@
     ]
   },
   "peerDependencies": {
+    "@adonisjs/auth": "^10.1.0",
     "@adonisjs/core": "^7.3.3",
     "@adonisjs/session": "^8.1.0",
     "@adonisjs/lucid": "^22.4.2",
     "@adonis-agora/resilience": "^0.1.0"
   },
   "peerDependenciesMeta": {
+    "@adonisjs/auth": {
+      "optional": true
+    },
     "@adonisjs/lucid": {
       "optional": true
     },
@@ -72,6 +78,7 @@
     "@adonis-agora/authkit-core": "0.7.0"
   },
   "devDependencies": {
+    "@adonisjs/auth": "10.1.0",
     "@adonisjs/core": "7.3.5",
     "@adonis-agora/resilience": "^0.1.0",
     "@adonisjs/session": "8.1.0",
@@ -83,11 +90,11 @@
     "ioredis-mock": "^8.9.0",
     "@types/node": "25.9.1",
     "typescript": "6.0.3",
-    "@adonis-agora/authkit-server": "0.36.0"
+    "@adonis-agora/authkit-server": "0.55.0"
   },
   "scripts": {
     "build": "tsc && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\"",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.tests.json",
     "test": "node --import=@poppinss/ts-exec bin/test.ts"
   }
 }

package/stubs/main.ts

@@ -1,2 +1,2 @@
-import { fileURLToPath } from 'node:url'
-export const stubsRoot = fileURLToPath(new URL('./', import.meta.url))
+import { fileURLToPath } from 'node:url';
+export const stubsRoot = fileURLToPath(new URL('./', import.meta.url));