@adonis-agora/authkit-core 0.10.1 → 1.0.0-rc.0

package/CHANGELOG.md

@@ -0,0 +1,221 @@
+# @adonis-agora/authkit-core
+
+## 1.0.0-rc.0
+
+### Major Changes
+
+- [#436](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/436) [`c942fe3`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/c942fe30483346217c9c89112e13db0d4a65c647) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - AuthKit 1.0. See the [Migrating to 1.0](https://github.com/DavideCarvalho/adonis-agora-authkit/blob/main/apps/docs/content/docs/migrating-to-1-0.mdx) guide.
+  
+  Breaking changes (`@adonis-agora/authkit-server`):
+  
+  - `withMfa` is removed. MFA state lives in the lib-owned `auth_mfa` table, so drop the mixin from your `AuthUser` model's `compose(...)`.
+  - `markSudo` is no longer exported. Grant sudo with `completeSudo(sudoContextFrom(ctx), methodId)`, which also writes the `sudo.confirmed` audit event, remembers the method and redirects to the validated `return_to`.
+  - The email-change confirmation link is sent through `mail.onEmailChangeConfirm` only. Without it, AuthKit sends its built-in email; `onEmailVerification` no longer receives email-change confirmations.
+  - The `clients` option of `defineConfig` is removed. Create clients in the admin console, through the Admin API or with `node ace authkit:clients:create` (new `--client-secret` flag keeps an existing secret). `buildImpersonationPanel(cfg, targetId, clients)` now requires `clients`, and the impersonation curl always shows the `<CLIENT_SECRET>` placeholder.
+  - `inertiaRenderer({ prefix, views })`: `views` is required. Screens not listed render with the built-in Edge view. `AuthkitScreen` is now the exact union of the screens AuthKit renders (adds `throttled`, `agents/consent`, `agents/done`; no arbitrary strings), and every screen's props are exported: `AuthkitScreenProps['<view>']` plus named types (`LoginProps`, `SessionExpiredProps`, …). The controllers are checked against them. Hosts declare screens of their own by augmenting `AuthkitScreenProps` (`declare module '@adonis-agora/authkit-server'`).
+  - The Admin API client body reads `grantTypes` only; the `grants` alias is gone (responses still return `grants`).
+  - `lucidAccountStore` always mounts password history over the model's connection (`auth_password_history`).
+  - `/account/orgs/json`, `/account/orgs/invitations/json` and `/account/orgs/:id/json` are removed; use `/account/api/orgs/*`.
+  - `GET /account/api/apps` entries gain `name` and `logoUrl`.
+  
+  - The admin console reads its config from a `<script type="application/json" id="authkit-admin-config">` data block (CSP-safe) instead of an inline `window.__AUTHKIT__` script; the dev fallback is gone.
+  - The admin client DTO returns `grantTypes` (was `grants`), plus `clientName` and `logoUri`, which the console and the Admin API can now set (`null` removes them, as it does `backchannelLogoutUri`). `GET {admin}/api/clients/:id` exists.
+  - Anonymous JSON callers of the admin and account JSON APIs get `401` (and `403` without an admin role) instead of a redirect to the login page.
+  - Fixes: the Redis adapter's `list()` honours the connection `keyPrefix` (sessions, apps and admin lists were empty); a password login posted without a password is an invalid-credentials answer, not a 500.
+  
+  Breaking changes (`@adonis-agora/authkit-core`):
+  
+  - `ClientConfig` and `ResolvedAuthServerConfig.clients` are removed.
+  
+  Breaking changes (`@adonis-agora/authkit-client`):
+  
+  - `@adonisjs/auth` is a required peer. `ctx.auth` is `@adonisjs/auth`, backed by the AuthKit session through `authkitClientGuard`; `ctx.authkit` (from `authkit_context_middleware`) carries the AuthKit-only data (identity, `hasGlobalRole`, active org, `toSharedProps`).
+  - `authkit_middleware`, `auth_middleware` and `silent_auth_middleware` (and their subpaths) are removed: `ctx.auth` comes from `@adonisjs/auth`, and `middleware.auth()` / `silentAuth` are the `#middleware/auth_middleware` / `#middleware/silent_auth_middleware` files `node ace configure` publishes. `require_org_middleware` stays. `@adonis-agora/authkit-client/types` no longer declares `HttpContext.auth`; type `ctx.authkit.getUser()` through the `AuthkitUserType` interface.
+  - `node ace configure @adonis-agora/authkit-client` installs `@adonisjs/auth` when missing (`--no-install` prints the command), writes `config/auth.ts` with `authkitClientGuard` + `sessionUserProvider` (`--model`, default `#models/user`; an existing file is left alone and the guard to add is printed), registers `@adonisjs/auth/auth_provider`, `initialize_auth_middleware` + `authkit_context_middleware`, and publishes the named `auth` / `silentAuth` middleware.
+  - `authkitClientGuard` takes its user from `resolveUser` when one is configured (so `lucidMirror` provisions the row on first login, and what it loads is on `ctx.auth.user`, the same instance as `ctx.authkit.getUser()`), with the provider as the fallback.
+  - New `authkitIdentityProvider()`: a user provider with no database; `ctx.auth.user` is the AuthKit `Identity`.
+  - New `authkitClientGuard({ provider, resolver })` option: a per-guard resolver for API routes (bearer JWT, opaque, PAT).
+  - `resolvers.jwt({ tokenSource: 'bearer' })` accepts `Authorization: DPoP <jwt>` with a valid `DPoP` proof for `cnf.jkt`-bound tokens, and refuses DPoP-bound tokens sent as `Bearer`.
+  - `UnauthorizedAccessConstructor` is no longer exported, and `AuthkitClientGuard` no longer takes an exception class; it always throws `@adonisjs/auth`'s `E_UNAUTHORIZED_ACCESS`.
+  
+  Breaking changes (`@adonis-agora/authkit-sdk`):
+  
+  - `clients.*` return `grantTypes` (was `grants`), plus `clientName` and `logoUri`.
+  
+  Breaking changes (`@adonis-agora/authkit-react`):
+  
+  - `createAuthkitClient()` no longer reads `window.__AUTHKIT__`: pass `baseUrl` for `client.admin.*` and `csrfToken`.
+  - Admin response types match the server: `users.remove` / `clients.remove` → `{ ok, deleted }`, `users.resetPassword` → `{ ok, email }`, `users.disable` / `enable` → the user, `SettingListResult.locked`; `AdminClient.grants` → `grantTypes` (+ `clientName`, `logoUri`); `UpdateUserInput` is `{ globalRoles? }`, `CreateUserInput` takes no `null`.
+  - New: `client.account.agents.list()` / `revoke()`, `useAccountAgentsQueryOptions`, `useRevokeAccountAgentMutationOptions`.
+  - Peers: `react` / `react-dom` `^19.0.0`, `@inertiajs/react` `^2.0.0 || ^3.0.0`.
+  
+  - `useProfile`, `useSessions`, `useAuthorizedApps`, `useOrganizations`, `useOrganization`, `useOrgInvitations`, `useSwitchOrganization` and their types are removed, with the `profile`, `sessions`, `apps`, `orgs` and `orgInvitations` keys of `endpoints`. Use the query options (`useMeQueryOptions`, `useAccountSessionsQueryOptions`, `useAppsQueryOptions`, `useAccountOrgsQueryOptions`, …).
+  - `UserProfile`, `AuthorizedApps`, `OrganizationSwitcher` and `OrganizationProfile` need `QueryClientProvider` and `AuthkitClientProvider`.
+  
+  All packages:
+  
+  - `@adonis-agora/*` peer ranges accept 1.x and its release candidates (`<2.0.0 || >=1.0.0-rc.0 <2.0.0`): `durable`, `media`, `telescope` (authkit-server), `resilience` (authkit-client), `authkit-server` (authkit-sdk).
+  - Node.js `>=24` is required (tested on 24 and 26).
+
+## 0.10.1
+
+### Patch Changes
+
+- [#361](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/361) [`1b9c90c`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/1b9c90ced4356d2c754e850e307954455ddeeb3a) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Declare `"sideEffects": false` so bundlers can tree-shake the package in client bundles. It has no module-level side effects.
+
+## 0.10.0
+
+### Minor Changes
+
+- [#269](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/269) [`b0ca480`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/b0ca4802419aba93a9f913775f697cc4075cff88) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Drop Node 20, which reached end-of-life on 2026-04-30, and Node 22, which AdonisJS 7 does not support (it requires Node >=24): `engines.node` is now `>=24`. The supported Node lines are 24 and 26, and CI runs the test suite on each of them.
+
+## 0.9.0
+
+### Minor Changes
+
+- [#233](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/233) [`94644e6`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/94644e6b1d8d10e0fd3c4b57706cce46b70412cb) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - `applicationType?: 'web' | 'native'` nos tipos de client
+  
+  `ClientConfig` (core) e `AdminClient`/`CreateClientInput` (react) ganham o campo opcional
+  `applicationType`, para os clientes nativos (RFC 8252) do `@adonis-agora/authkit-server`.
+
+## 0.8.0
+
+### Minor Changes
+
+- 813a321: Multi-tenancy: `orgId` de primeira classe no evento, `orgId`/`orgSlug`/`orgRole` na `Identity`, e o middleware `requireOrg`
+
+  Três buracos no caminho de multi-tenancy por organização, achados ao seguir o
+  fluxo inteiro (org criada → claim → contexto → RBAC escopado):
+
+  **1. O barramento de diagnostics não dizia QUAL org.** `redactAuditEventForDiagnostics`
+  dropa `metadata` inteiro por LGPD (é campo livre e carrega PII — o e-mail do
+  convidado, por exemplo). Só que o `orgId` dos eventos de organização vivia
+  justamente ali. Resultado: um assinante de `agora:authkit:organization.created`
+  — o provisioning do `@adonis-agora/authz`, entre outros — recebia o tipo do
+  evento e nada mais, o que torna o hook inútil na prática. Além disso o
+  `organization.created` self-service auditava só `{ slug }`, sem id nenhum.
+
+  `orgId` agora é campo de primeira classe do `AuditEvent`, preenchido nos 15
+  call-sites de eventos de organização (`organization.deactivated` não tem org, é
+  a limpeza), preservado na projeção de diagnostics junto dos demais ids opacos
+  (`accountId`/`actorId`/`clientId`) e incluído no corpo do webhook. A redação de
+  PII continua intacta: `email`, `ip` e `metadata` seguem fora do barramento.
+
+  **2. A `Identity` não expunha a org.** O tenant ativo só existia em
+  `identity.raw.org_id`, sem tipo, e cada app reescrevia a derivação. Agora
+  `identity.orgId`, `identity.orgSlug` e `identity.orgRole` são campos da
+  `Identity`, preenchidos por `buildIdentityFromClaims` (portanto nos três
+  resolvers: jwt, pat e opaque). A tabela de claims aceitas — que já existia
+  duplicada dentro da ponte de contexto — virou `ORG_ID_CLAIMS` +
+  `deriveOrgId`/`deriveOrgSlug`/`deriveOrgRole` no `authkit-core`, e a ponte
+  passou a consumi-la. Os aliases de IdPs de terceiros (`tid`,
+  `organization_id`, `tenant_id`, `active_organization_id`) continuam valendo,
+  agora num lugar só.
+
+  **3. Não havia como exigir org ativa.** `RequireOrgMiddleware`
+  (`@adonis-agora/authkit-client/require_org_middleware`) barra request
+  autenticada mas sem tenant. Isso importa porque "logado" e "dentro de um
+  tenant" são coisas distintas: sem a barreira, a request chega no controller com
+  tenant indefinido e a checagem escopada do authz cai no escopo GLOBAL — o pior
+  lugar para se cair por acidente. Fail-closed, com `mode: 'api'` (403
+  `no_active_organization` em vez de redirect) e `oneOf` para restringir a um
+  conjunto conhecido de orgs.
+
+## 0.7.1
+
+### Patch Changes
+
+- 1f15367: Point `homepage` and `bugs.url` at the repository's current name.
+
+  The repository was renamed to `adonis-agora-authkit`; `repository.url` followed,
+  `homepage` and `bugs.url` did not. Every package therefore shipped a manifest
+  that disagreed with itself, and the "Repository"/"Homepage" links on npm leaned
+  on GitHub's rename redirect — which lasts only until someone claims the old
+  name. All three fields now name the same repository.
+
+## 0.7.0
+
+### Minor Changes
+
+- 0542665: Re-scope to @adonis-agora/authkit-\* (join the Agora ecosystem)
+
+## 0.6.0
+
+### Minor Changes
+
+- 93eaf69: feat: cofre do keystore JWKS no HashiCorp Vault (KV v2). Novo driver
+  `{ driver: 'hashicorp-vault', endpoint, path, token?, mount?, field? }` — usa a API
+  HTTP do Vault (sem SDK), então mora em core como file/drive/lucid/redis. Encryption
+  at-rest fica OFF por default (o Vault tem cifra/ACL próprios; ligável p/ envelope).
+- e2582b8: feat: cofres do keystore JWKS em Lucid e Redis. Novos drivers `jwks.store`:
+  `{ driver: 'lucid' }` (tabela dedicada `authkit_keystore`, auto-criada) e
+  `{ driver: 'redis' }` (uma key). Diferente de `file`, ambos são COMPARTILHADOS entre
+  instâncias — o melhor default para multi-instância + hot-reload (o poll lê um `head`
+  barato). Encryption at-rest (APP_KEY) ON por default nos dois. Warning no boot quando
+  `redis` é usado (exige persistência RDB/AOF). `resolveKeystoreVault` agora recebe um
+  contexto com acesso ao container (mudança de assinatura interna).
+
+## 0.5.0
+
+### Minor Changes
+
+- df4b41f: feat: keystore JWKS managed com cofre pluggável + encryption at-rest (Fatia A+B)
+
+  O keystore managed deixa de ser fs-síncrono-num-path e passa por uma abstração de
+  cofre (`KeystoreVault`): `file` (default) e `drive` (`@adonisjs/drive`, bucket), com
+  contrato para cofres custom. O keystore PRIVADO agora é encriptado em repouso por
+  default (APP_KEY) para file/drive via um envelope versionado; decrypt falho lança
+  (nunca regenera em silêncio). O boot e o comando `authkit:keys:rotate` usam o mesmo
+  stack (defaults de encryption idênticos). Novidades: aviso no boot quando
+  `jwks: 'auto'` cai no fallback de disco, e idade da chave de assinatura no
+  `authkit:doctor`. Config: `jwks.store` aceita `{ driver: 'file' | 'drive' | ... }`
+  além de string, e novo `jwks.encrypt`.
+
+  Nota (0.x): sem migração de keystore legado — um `tmp/authkit_jwks.json` plaintext
+  pré-existente deve ser apagado uma vez (regenera encriptado).
+
+## 0.4.0
+
+### Minor Changes
+
+- Breaking cleanup (0.x, no external consumers): every deprecation shim is gone.
+  - Policy now lives ONLY in runtime settings (DB) with library defaults — removed from config: static `clients`, lockout policy fields (`store` stays), rate-limit buckets (`enabled`/`store` stay), `notifications`, trusted-devices `enabled`/`days`, `admin.impersonation`, organizations `roles`/`allowSelfCreate`/`invitationTtlHours`, and `password.policy`/`password.checkPwned` store options (`legacyVerifier`/`pepper`/`pwnedTimeoutMs` stay — they are code/infra).
+  - Removed commands `authkit:clients:import` and the legacy `authkit:rotate-keys` alias. New `authkit:clients:create` creates OIDC clients programmatically through the configured storage (confidential secret printed once; `--public`, repeatable `--redirect-uri`/`--grant`, `--json`).
+  - Removed the no-op `passthroughParsed` option from `jsonColumn` and the `checkLegacyPolicyConfig` doctor check.
+
+## 0.3.1
+
+### Patch Changes
+
+- Runtime-first administration:
+  - **Three new runtime toggles** (auth_settings-backed, with admin console cards showing effective state): `registration` (open/close self-service signup without affecting org invites or admin-created users; static fallback `registration.enabled`), `require_verified_email` (overrides `login.requireVerifiedEmail` across password/magic-link/passkey flows), and `maintenance_mode` (`{ enabled, message? }` — blocks login/signup/forgot for non-admins with a maintenance page while admin accounts keep logging in; userinfo/introspection/existing sessions keep working; the Admin API is never blocked, providing a guaranteed escape hatch). Audit events `maintenance.enabled`/`maintenance.disabled`.
+  - **Clients are now managed at runtime** (admin console + Admin REST API are the canonical path): the static `clients` config field is optional and deprecated (boot warning, doctor warning, console banner). New `authkit:clients:import` ace command (`--dry-run`) migrates config clients to the adapter preserving secrets and skipping existing ones. Booting with zero configured clients is fully supported. New doctor check warns when clients live in a volatile adapter. Backchannel logout URI/session-required are now editable via console and API.
+
+## 0.3.0
+
+### Minor Changes
+
+- Round 7 — production pack + multi-tenancy:
+  - **Organizations (multi-tenancy)**: optional capability-probed tables (`auth_organizations`, `auth_organization_members`, `auth_organization_invitations`), per-org roles (owner/admin/member), email invitations with hashed tokens, active-org session cookie with `org_id`/`org_slug`/`org_role` claims in id_token/userinfo/JWT access tokens, `/account/orgs` page, admin console section, Admin REST API (`/api/authkit/v1/organizations`), SDK `organizations.*` namespace (remote + embedded), React `useOrganizations`/`useOrganization`/`useSwitchOrganization`/`useOrgInvitations` hooks plus `<OrganizationSwitcher />` and `<OrganizationProfile />` components.
+  - **LGPD/GDPR compliance**: self-service and admin account deletion with full cascade (sessions, grants, PATs, passkeys, identities, MFA, avatar) and audit anonymization (stable pseudonym), data export endpoint (`GET /account/security/export`), `login.requireVerifiedEmail` gate across password/magic-link/passkey flows, SDK `users.delete()`.
+  - **User migration & password hygiene**: transparent lazy password rehash on login, `password.legacyVerifier` hook for foreign hash formats, `authkit:users:import` ace command (JSON/NDJSON, `--dry-run`), configurable `password.policy`, HaveIBeenPwned k-anonymity breach check (fail-safe), React `usePasswordStrength` + `<PasswordStrengthMeter />`.
+  - **JWT access tokens (RFC 9068)**: `accessTokens: { format: 'jwt' }` with per-resource overrides, `verifyJwtAccessToken` local validation in the client package, `authkit:keys:rotate` command with grace-period JWKS rotation.
+  - **Bot protection**: pluggable vendor-agnostic `botProtection` config (Turnstile/hCaptcha-ready, fail-safe) on login/signup/reset.
+  - **New-device login notification**: `notifications.newDeviceEmail` + `mail.onNewDeviceLogin` hook driven by the trusted-device signal.
+  - **Console polish**: session context (user-agent/OS/IP/geo via pluggable `resolveGeo`), RFC 8693 impersonation panel (`admin.impersonation`, default off), dashboard with MAU/daily sign-ins, `GET /api/authkit/v1/stats` + SDK `stats()`.
+
+## 0.2.0
+
+### Minor Changes
+
+- 1872a30: DX & ops infra:
+  - New package `@adonis-agora/authkit-testing` — test helpers for host apps:
+    `createTestIdentity`, `mintTestIdToken` + `serveJwks`/`testJwks`/`jwksFromKey`
+    (real RS256 tokens validated by a local JWKS), `fakeAuthenticator`, and a
+    capability-aware `fakeAccountStore`.
+  - `node ace authkit:doctor` — validates host config and prints ✅/⚠️/❌ findings
+    (issuer/mountPath, clients, accountStore capabilities, session, shield, ally,
+    rate-limit, admin, webauthn, jwks). Non-zero exit on errors.
+  - `node ace authkit:rotate-keys` — rotates managed JWKS signing keys via a new
+    file-backed keystore (`jwks: { source: 'managed', store }`), keeping the last
+    N public keys so pre-rotation tokens still verify.

package/build/index.d.ts

@@ -4,4 +4,4 @@ export type { MetricsRecorder, MetricsSnapshot } from './src/metrics_recorder.js
 export { InMemorySnapshot, NoopRecorder } from './src/metrics_recorder.js';
 export type { Identity, SessionResolver } from './src/types/identity.js';
 export { deriveOrgId, deriveOrgRole, deriveOrgSlug, ORG_ID_CLAIMS, } from './src/types/identity.js';
-export type { AccessTokenFormat, AccessTokenResourceConfig, AccessTokensConfig, ClientConfig, JwksConfig, KeystoreStoreConfig, ObservabilityConfig, ResolvedAuthServerConfig, TtlConfig, } from './src/types/server_config.js';
+export type { AccessTokenFormat, AccessTokenResourceConfig, AccessTokensConfig, JwksConfig, KeystoreStoreConfig, ObservabilityConfig, ResolvedAuthServerConfig, TtlConfig, } from './src/types/server_config.js';

package/build/src/types/server_config.d.ts

@@ -1,36 +1,3 @@
-/**
- * Client OIDC persistido no adapter/DB, gerenciável via console admin ou Admin API
- * em runtime. Usado internamente pela lib para representar clients em memória.
- */
-export interface ClientConfig {
-    clientId: string;
-    clientSecret?: string;
-    redirectUris: string[];
-    postLogoutRedirectUris?: string[];
-    grants?: string[];
-    /** 'none' para public clients (SPA com PKCE) */
-    tokenEndpointAuthMethod?: 'client_secret_basic' | 'client_secret_post' | 'none';
-    /**
-     * Tipo de aplicação (OIDC Registration §2, `application_type`). Default `'web'`.
-     *
-     * `'native'` (RFC 8252 — OAuth 2.0 for Native Apps) libera os redirects de app
-     * mobile/desktop: esquema privado (`com.example.app:/callback`), URL https
-     * "claimed" (universal/app links) e loopback `http://127.0.0.1` com qualquer
-     * porta. Client nativo é SEMPRE público (sem `clientSecret`,
-     * `tokenEndpointAuthMethod: 'none'`) — PKCE já é obrigatório no issuer.
-     */
-    applicationType?: 'web' | 'native';
-    /**
-     * Endpoint do RP que recebe o POST de OIDC Back-Channel Logout. Quando definido,
-     * o IdP envia um `logout_token` para esta URI ao encerrar a sessão/grant do usuário.
-     */
-    backchannelLogoutUri?: string;
-    /**
-     * Exige que o `logout_token` inclua a claim `sid` (session id). Mapeado para
-     * `backchannel_logout_session_required` do oidc-provider. Default: false.
-     */
-    backchannelLogoutSessionRequired?: boolean;
-}
 export interface TtlConfig {
     accessToken?: string | number;
     refreshToken?: string | number;
@@ -146,7 +113,6 @@ export interface AccessTokensConfig {
 /** Forma normalizada do config do server (pós-`defineConfig`). */
 export interface ResolvedAuthServerConfig {
     issuer: string;
-    clients: ClientConfig[];
     ttl: Required<TtlConfig>;
     jwks: JwksConfig;
     globalRolesClaim: string;

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@adonis-agora/authkit-core",
-  "version": "0.10.1",
+  "version": "1.0.0-rc.0",
   "description": "Shared core types and utilities for AuthKit — the AdonisJS OIDC/OAuth2 server and client toolkits.",
   "license": "MIT",
   "author": "dudousxd",
   "repository": {
     "type": "git",
-    "url": "https://github.com/DavideCarvalho/adonis-agora-authkit.git",
+    "url": "git+https://github.com/DavideCarvalho/adonis-agora-authkit.git",
     "directory": "packages/authkit-core"
   },
   "homepage": "https://davidecarvalho.github.io/agora/docs/authkit",
@@ -28,7 +28,8 @@
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
   "files": [
-    "build"
+    "build",
+    "CHANGELOG.md"
   ],
   "exports": {
     ".": "./build/index.js",
@@ -43,7 +44,7 @@
     "@adonisjs/tsconfig": "2.0.0",
     "@japa/assert": "4.2.0",
     "@japa/runner": "5.4.0",
-    "@poppinss/ts-exec": "1.5.1",
+    "@poppinss/ts-exec": "1.5.2",
     "@types/node": "26.6.5",
     "typescript": "7.0.2"
   },