@adonis-agora/authkit-react 0.26.0 → 1.0.0-rc.1

package/CHANGELOG.md

@@ -0,0 +1,699 @@
+# @adonis-agora/authkit-react
+
+## 1.0.0-rc.1
+
+### Major Changes
+
+- [#456](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/456) [`9c12ef9`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/9c12ef9c1c49db9d54a7da6d241264499ad76e18) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Poppy (the Personal Agent Protocol) moves out of `@adonis-agora/authkit-server` into the new `@adonis-agora/authkit-poppy` package, and authkit-server gains a stable extension surface for personal-agent protocols. See [Install `@adonis-agora/authkit-poppy` for Poppy](https://github.com/DavideCarvalho/adonis-agora-authkit/blob/main/apps/docs/content/docs/migrating-to-1-0.mdx#install-adonis-agoraauthkit-poppy-for-poppy).
+  
+  Breaking changes (`@adonis-agora/authkit-server`):
+  
+  - `personalAgents.poppy` is removed: install `@adonis-agora/authkit-poppy` and use `personalAgents: { extensions: [poppy({ ... })] }` with the same options. A config that still has `personalAgents.poppy` fails at boot. Routes, tables, tokens and sessions are unchanged, so no data migration is needed.
+  - Every Poppy export (`PoppyConfigInput` and the other `Poppy*` types, `poppyEmailCodeSignIn`, `verifyPoppyRequest`, `poppyAuth`, `poppyOf`, `poppyWebSession`, `poppyWebSessionOf`, `installPoppySlots`, `POPPY_AUTHENTICATE_SLOT`, `POPPY_WEB_SESSION_KEY`, `PoppyError`, `verifyDpopProof`, `accessTokenHash`, `hmacNonceSource`, `databaseReplayStore`, `memoryReplayStore`, `redisReplayStore`, `safeFetchJson`, `isBlockedAddress`, `SafeFetchError`, `maskEmail`) now comes from `@adonis-agora/authkit-poppy`.
+  - `mail.onPoppySignInCode` is removed: pass `sendCode` to `poppyEmailCodeSignIn()`.
+  - `authkitCsrfExceptions` no longer takes `poppyPrefix`; extensions' endpoints are exempted from the config (`personalAgentExtensions: false` turns that off).
+  - `ensureAuthkitSchema()` no longer creates the `auth_poppy_*` tables (the extension's tables are ensured at boot; `ensurePoppySchema()` for migrations).
+  - Admin console API: an extension's `protocols` entry is `{ label, requireRegistration, hostResolver, allowHttpIdentifiers, identifierLabel, identifierPlaceholder }`.
+  
+  New, stable for 1.x: `personalAgents.extensions` and the types `PersonalAgentExtension`, `PersonalAgentExtensionDefinition`, `PersonalAgentExtensionContext`, `PersonalAgentRouteKit`, `PersonalAgentHost`, `PersonalAgentGrantLedger`, `PersonalAgentGrant`, `PersonalAgentRefreshToken`, `PersonalAgentAccessTokens`, `PersonalAgentProtocolRuntime`, `PersonalAgentGrantSummary`, `PersonalAgentConsoleSummary`, `ResolvedPersonalAgentExtension`, `AuthkitTable`; the functions `personalAgentExtensionRuntime`, `ensureAuthkitTables`, `sendAuthkitCodeEmail`, `signInAccountSession` and `signOutAccountSession`; and the `tables` option of `ensureAuthkitSchema`.
+  
+  Breaking changes (`@adonis-agora/authkit-react`):
+  
+  - `PersonalAgentProtocol` is `'pact'` or any extension id, and `PersonalAgentsOverview.protocols` has one entry per extension (`PersonalAgentExtensionOverview`) instead of a fixed `poppy` key. `AccountAgentGrant.protocol` uses `PersonalAgentProtocol`.
+
+## 1.0.0-rc.0
+
+### Major Changes
+
+- [#436](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/436) [`c942fe3`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/c942fe30483346217c9c89112e13db0d4a65c647) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - AuthKit 1.0. See the [Migrating to 1.0](https://github.com/DavideCarvalho/adonis-agora-authkit/blob/main/apps/docs/content/docs/migrating-to-1-0.mdx) guide.
+  
+  Breaking changes (`@adonis-agora/authkit-server`):
+  
+  - `withMfa` is removed. MFA state lives in the lib-owned `auth_mfa` table, so drop the mixin from your `AuthUser` model's `compose(...)`.
+  - `markSudo` is no longer exported. Grant sudo with `completeSudo(sudoContextFrom(ctx), methodId)`, which also writes the `sudo.confirmed` audit event, remembers the method and redirects to the validated `return_to`.
+  - The email-change confirmation link is sent through `mail.onEmailChangeConfirm` only. Without it, AuthKit sends its built-in email; `onEmailVerification` no longer receives email-change confirmations.
+  - The `clients` option of `defineConfig` is removed. Create clients in the admin console, through the Admin API or with `node ace authkit:clients:create` (new `--client-secret` flag keeps an existing secret). `buildImpersonationPanel(cfg, targetId, clients)` now requires `clients`, and the impersonation curl always shows the `<CLIENT_SECRET>` placeholder.
+  - `inertiaRenderer({ prefix, views })`: `views` is required. Screens not listed render with the built-in Edge view. `AuthkitScreen` is now the exact union of the screens AuthKit renders (adds `throttled`, `agents/consent`, `agents/done`; no arbitrary strings), and every screen's props are exported: `AuthkitScreenProps['<view>']` plus named types (`LoginProps`, `SessionExpiredProps`, …). The controllers are checked against them. Hosts declare screens of their own by augmenting `AuthkitScreenProps` (`declare module '@adonis-agora/authkit-server'`).
+  - The Admin API client body reads `grantTypes` only; the `grants` alias is gone (responses still return `grants`).
+  - `lucidAccountStore` always mounts password history over the model's connection (`auth_password_history`).
+  - `/account/orgs/json`, `/account/orgs/invitations/json` and `/account/orgs/:id/json` are removed; use `/account/api/orgs/*`.
+  - `GET /account/api/apps` entries gain `name` and `logoUrl`.
+  
+  - The admin console reads its config from a `<script type="application/json" id="authkit-admin-config">` data block (CSP-safe) instead of an inline `window.__AUTHKIT__` script; the dev fallback is gone.
+  - The admin client DTO returns `grantTypes` (was `grants`), plus `clientName` and `logoUri`, which the console and the Admin API can now set (`null` removes them, as it does `backchannelLogoutUri`). `GET {admin}/api/clients/:id` exists.
+  - Anonymous JSON callers of the admin and account JSON APIs get `401` (and `403` without an admin role) instead of a redirect to the login page.
+  - Fixes: the Redis adapter's `list()` honours the connection `keyPrefix` (sessions, apps and admin lists were empty); a password login posted without a password is an invalid-credentials answer, not a 500.
+  
+  Breaking changes (`@adonis-agora/authkit-core`):
+  
+  - `ClientConfig` and `ResolvedAuthServerConfig.clients` are removed.
+  
+  Breaking changes (`@adonis-agora/authkit-client`):
+  
+  - `@adonisjs/auth` is a required peer. `ctx.auth` is `@adonisjs/auth`, backed by the AuthKit session through `authkitClientGuard`; `ctx.authkit` (from `authkit_context_middleware`) carries the AuthKit-only data (identity, `hasGlobalRole`, active org, `toSharedProps`).
+  - `authkit_middleware`, `auth_middleware` and `silent_auth_middleware` (and their subpaths) are removed: `ctx.auth` comes from `@adonisjs/auth`, and `middleware.auth()` / `silentAuth` are the `#middleware/auth_middleware` / `#middleware/silent_auth_middleware` files `node ace configure` publishes. `require_org_middleware` stays. `@adonis-agora/authkit-client/types` no longer declares `HttpContext.auth`; type `ctx.authkit.getUser()` through the `AuthkitUserType` interface.
+  - `node ace configure @adonis-agora/authkit-client` installs `@adonisjs/auth` when missing (`--no-install` prints the command), writes `config/auth.ts` with `authkitClientGuard` + `sessionUserProvider` (`--model`, default `#models/user`; an existing file is left alone and the guard to add is printed), registers `@adonisjs/auth/auth_provider`, `initialize_auth_middleware` + `authkit_context_middleware`, and publishes the named `auth` / `silentAuth` middleware.
+  - `authkitClientGuard` takes its user from `resolveUser` when one is configured (so `lucidMirror` provisions the row on first login, and what it loads is on `ctx.auth.user`, the same instance as `ctx.authkit.getUser()`), with the provider as the fallback.
+  - New `authkitIdentityProvider()`: a user provider with no database; `ctx.auth.user` is the AuthKit `Identity`.
+  - New `authkitClientGuard({ provider, resolver })` option: a per-guard resolver for API routes (bearer JWT, opaque, PAT).
+  - `resolvers.jwt({ tokenSource: 'bearer' })` accepts `Authorization: DPoP <jwt>` with a valid `DPoP` proof for `cnf.jkt`-bound tokens, and refuses DPoP-bound tokens sent as `Bearer`.
+  - `UnauthorizedAccessConstructor` is no longer exported, and `AuthkitClientGuard` no longer takes an exception class; it always throws `@adonisjs/auth`'s `E_UNAUTHORIZED_ACCESS`.
+  
+  Breaking changes (`@adonis-agora/authkit-sdk`):
+  
+  - `clients.*` return `grantTypes` (was `grants`), plus `clientName` and `logoUri`.
+  
+  Breaking changes (`@adonis-agora/authkit-react`):
+  
+  - `createAuthkitClient()` no longer reads `window.__AUTHKIT__`: pass `baseUrl` for `client.admin.*` and `csrfToken`.
+  - Admin response types match the server: `users.remove` / `clients.remove` → `{ ok, deleted }`, `users.resetPassword` → `{ ok, email }`, `users.disable` / `enable` → the user, `SettingListResult.locked`; `AdminClient.grants` → `grantTypes` (+ `clientName`, `logoUri`); `UpdateUserInput` is `{ globalRoles? }`, `CreateUserInput` takes no `null`.
+  - New: `client.account.agents.list()` / `revoke()`, `useAccountAgentsQueryOptions`, `useRevokeAccountAgentMutationOptions`.
+  - Peers: `react` / `react-dom` `^19.0.0`, `@inertiajs/react` `^2.0.0 || ^3.0.0`.
+  
+  - `useProfile`, `useSessions`, `useAuthorizedApps`, `useOrganizations`, `useOrganization`, `useOrgInvitations`, `useSwitchOrganization` and their types are removed, with the `profile`, `sessions`, `apps`, `orgs` and `orgInvitations` keys of `endpoints`. Use the query options (`useMeQueryOptions`, `useAccountSessionsQueryOptions`, `useAppsQueryOptions`, `useAccountOrgsQueryOptions`, …).
+  - `UserProfile`, `AuthorizedApps`, `OrganizationSwitcher` and `OrganizationProfile` need `QueryClientProvider` and `AuthkitClientProvider`.
+  
+  All packages:
+  
+  - `@adonis-agora/*` peer ranges accept 1.x and its release candidates (`<2.0.0 || >=1.0.0-rc.0 <2.0.0`): `durable`, `media`, `telescope` (authkit-server), `resilience` (authkit-client), `authkit-server` (authkit-sdk).
+  - Node.js `>=24` is required (tested on 24 and 26).
+
+### Patch Changes
+
+- Updated dependencies [[`c942fe3`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/c942fe30483346217c9c89112e13db0d4a65c647)]:
+  - @adonis-agora/authkit-core@1.0.0-rc.0
+
+## 0.26.0
+
+### Minor Changes
+
+- [#369](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/369) [`431e9aa`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/431e9aa99fb1b28e4f0d9ceeac1f3d15f9f7106e) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - "Last used" badge on the login screen. The server remembers, in a cookie on the device (`authkit_last_login`, httpOnly, no identity in it), the primary method the last login used — password, magic link, email code, passkey, a social provider or a custom method — and passes it as `lastUsedLoginMethod` to every `login` render. The built-in Edge screen marks the matching button; Inertia hosts use the new `<LastUsedBadge>` / `isLastUsedLoginMethod()` from authkit-react. It is per device on purpose: a per-account hint would tell anyone who types an email how that account signs in. Opt out with `login: { lastUsedMethod: false }`.
+  
+  Also fixes cookies written during the final login request being dropped: `interactionFinished` ends the raw response before AdonisJS flushes its headers, so `completeLogin` now relays pending `Set-Cookie` headers first. This affected the "trust this device" cookie set after a successful second factor.
+
+## 0.25.2
+
+### Patch Changes
+
+- [#368](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/368) [`b7870c2`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/b7870c2bbd0fbdc347b91eb585f70e76a7c27143) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - feat(admin): roles are read-only in the console and the Admin API when they come from outside authkit.
+  
+  With `resolveTokenRoles` configured (roles kept in `@adonis-agora/authz` or the host's own table), `globalRoles` decides nothing, but the console and `PATCH /users/:id` still wrote to it and answered "saved". Now:
+  
+  - User DTOs (console and Admin API) carry `roles`: the effective roles from `resolveAccountRoles`, the same source as the `roles` claim. Without the hook it equals `globalRoles`. `globalRoles` keeps meaning the stored column.
+  - Editing roles answers `409 roles_managed_externally` (console `PATCH /api/users/:id/roles`, Admin API `PATCH /users/:id` with `globalRoles`). Other fields stay editable.
+  - The console shows the effective roles as read-only, with a note that the application manages them (`features.rolesManagedExternally` in the injected config).
+  - `AdminUser.roles?: string[]` in `@adonis-agora/authkit-react`.
+  
+  Hosts without `resolveTokenRoles` keep editing `globalRoles` as before.
+
+## 0.25.1
+
+### Patch Changes
+
+- [#361](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/361) [`1b9c90c`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/1b9c90ced4356d2c754e850e307954455ddeeb3a) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Performance: smaller bundles and fewer re-renders.
+  
+  - The package declares `"sideEffects": ["*.css"]`, so bundlers drop the modules an app doesn't import. A bundle that imports only `useAuth` went from 3.1 kB to 0.8 kB minified. `styles.css` is still kept as a side effect.
+  - `AuthkitProvider` memoizes the resolved config on the `config` prop, and `AuthkitClientProvider` memoizes the client it creates on the `client`/`opts` props. Before, each render of these providers produced a new context value, which re-rendered every consumer.
+- Updated dependencies [[`1b9c90c`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/1b9c90ced4356d2c754e850e307954455ddeeb3a)]:
+  - @adonis-agora/authkit-core@0.10.1
+
+## 0.25.0
+
+### Minor Changes
+
+- [#269](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/269) [`b0ca480`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/b0ca4802419aba93a9f913775f697cc4075cff88) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Drop Node 20, which reached end-of-life on 2026-04-30, and Node 22, which AdonisJS 7 does not support (it requires Node >=24): `engines.node` is now `>=24`. The supported Node lines are 24 and 26, and CI runs the test suite on each of them.
+
+### Patch Changes
+
+- Updated dependencies [[`b0ca480`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/b0ca4802419aba93a9f913775f697cc4075cff88)]:
+  - @adonis-agora/authkit-core@0.10.0
+
+## 0.24.1
+
+### Patch Changes
+
+- [#255](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/255) [`481051c`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/481051c86c67b2bf5026f7a49028d260236667c9) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Publish peer dependencies as ranges again (`^7.5.0` instead of `7.5.0`, etc.). A Renovate pinning pass had turned the peer catalogs into exact versions, so any upstream patch release (e.g. `@adonisjs/core` 7.5.1) fell outside the accepted peer range.
+
+## 0.24.0
+
+### Minor Changes
+
+- [#247](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/247) [`eba2f4d`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/eba2f4dc886cf9596a451539cff9ecce5bf6830c) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Admin console: a **Personal agents** page (PACT and Poppy). Lists every agent with its live
+  connection count, lists and revokes connections across all accounts, and allows or blocks agents
+  at runtime on top of `defineConfig` (lib-owned `auth_agent_registry` table). Blocking also revokes
+  every connection and ends the agent's Poppy sessions. Writes need sudo and are audited.
+  `@adonis-agora/authkit-react` gets the matching `client.admin.personalAgents.*` methods and query
+  options.
+
+## 0.23.0
+
+### Minor Changes
+
+- [#233](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/233) [`94644e6`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/94644e6b1d8d10e0fd3c4b57706cce46b70412cb) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - `applicationType?: 'web' | 'native'` nos tipos de client
+  
+  `ClientConfig` (core) e `AdminClient`/`CreateClientInput` (react) ganham o campo opcional
+  `applicationType`, para os clientes nativos (RFC 8252) do `@adonis-agora/authkit-server`.
+
+### Patch Changes
+
+- Updated dependencies [[`94644e6`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/94644e6b1d8d10e0fd3c4b57706cce46b70412cb)]:
+  - @adonis-agora/authkit-core@0.9.0
+
+## 0.22.0
+
+### Minor Changes
+
+- [#223](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/223) [`6adae6d`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/6adae6dff8cf9d81892a0377ee25395bf36b632f) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - feat(authkit-react): client e hooks para as escritas de conta (orgs + segundo fator)
+  
+  Lado React do espelho JSON de `/account/api/*`, para telas do próprio host.
+  
+  - `client.account.orgs` ganha `create`, `activate`, `deactivate`, `leave`, `invite`,
+    `revokeInvitation`, `updateMemberRole`, `removeMember` e `acceptInvitation`.
+  - `client.account.mfa` vira uma FUNÇÃO COM PROPRIEDADES: `mfa()` continua sendo a leitura do
+    status (assinatura preservada) e as escritas penduram nela — `mfa.enroll()`,
+    `mfa.confirm(code)`, `mfa.disable()`, `mfa.regenerateRecoveryCodes()` e
+    `mfa.passkeys.{options,verify}`.
+  - Hooks novos: `useAccount{Create,Activate,Deactivate,Leave}OrgMutationOptions`,
+    `useAccount{InviteOrgMember,RevokeOrgInvitation,AcceptOrgInvitation,UpdateOrgMemberRole,RemoveOrgMember}MutationOptions`,
+    `use{Enroll,Confirm,Disable}TotpMutationOptions`,
+    `useRegenerateRecoveryCodesMutationOptions` e `useRegisterPasskeyMutationOptions`. O
+    prefixo `useAccount…` nos de org evita colidir com os homônimos da superfície ADMIN, que
+    agem sobre qualquer org.
+  - `registerPasskeyJson(client, deps?)`: a cerimônia de registro de passkey inteira por
+    fetch (options → `startRegistration` → verify), o par headless do `usePasskeyRegistration`
+    (que é por form de página inteira e não muda). Sem React, para quem não usa TanStack.
+  - `authkitKeys.account.mutations.*`: as chaves das novas mutations, com prefixos `orgs()` e
+    `mfa()` para `useIsMutating`.
+  - `AccountMfaStatus.recovery` ganha `remaining` e `regenerable`.
+
+## 0.21.0
+
+### Minor Changes
+
+- 9231887: **BREAKING (0.x minor):** todas as listagens paginadas do authkit passam a usar `{ page, size }` no lugar de `{ page, limit }` (e de `perPage`, na API do console), alinhando a interface de paginação com `@adonis-agora/filter` e com o restante do ecossistema `@adonis-agora/*`. `page` continua **1-based** com default `1`; `limit` foi apenas **renomeado** para `size` — a semântica (itens por página) não mudou. O casamento com `@adonis-agora/filter` é **estrutural** de propósito: nenhum pacote passa a depender dele.
+  
+  Na **resposta**, as mesmas listagens passam a devolver o envelope `{ meta, data }` — com `page`, `size` e `total` dentro de `meta` — no lugar do antigo shape achatado `{ data, total, page, size }`. `meta` é a convenção do próprio `.paginate()` do Lucid (`{ meta, data }`), que é onde o caminho por offset de `@adonis-agora/filter` desemboca, e agora é o envelope de TODAS as listagens paginadas do ecossistema `@adonis-agora/*`.
+  
+  Junto vem um **teto de `size`** que antes não existia de forma unificada: toda borda HTTP (Admin REST API e API JSON do console) agora corta `size` em `ADMIN_LIST_MAX_SIZE` (200), e as varreduras internas usam `ADMIN_LIST_DEFAULT_SIZE` (100) em vez de um `100` hardcoded por serviço.
+  
+  ### O que mudou
+  
+  - **Wire HTTP** — `GET {adminApi}/users`, `GET {adminApi}/audit`, `GET {consolePrefix}/api/users` e `GET {consolePrefix}/api/audit` leem `?page=&size=` (antes `?page=&limit=`; o de usuários do console lia `?perPage=`) e respondem `{ meta: { page, size, total }, data }` (antes `{ data, total, page, size }` achatado). Endpoints de listagem NÃO paginados (`/clients`, `/settings`, `/organizations`, `/roles`, `/sessions`) continuam como estão — eles nunca tiveram metadados de paginação e não ganham envelope agora.
+  - **Tipos do servidor** — `ListAccountsParams.limit` → `.size` e `ListAuditParams.limit` → `.size`. Stores de conta e sinks de auditoria customizados precisam ler o novo campo.
+  - **SDK** (`@adonis-agora/authkit-sdk`) — `ListUsersParams` e `ListAuditParams` passam a usar `size`; `ListUsersResult` e `ListAuditResult` viram `{ meta: ListMeta; data: T[] }` (novo tipo `ListMeta` exportado), nos dois drivers (remoto e embedded).
+  - **React** (`@adonis-agora/authkit-react`) — `client.admin.users.list()`, `client.admin.audit.list()`, `useUsersQueryOptions()`, `useAuditQueryOptions()` e as query keys `authkitKeys.admin.users/audit` passam a usar `size`; `AdminUserListResult` e `AuditListResult` viram `{ meta: ListMeta; data: T[] }` (novo tipo `ListMeta` exportado). Efeito colateral: o console admin enviava `limit=` para um endpoint que lia `perPage`, então o tamanho de página pedido pela UI era silenciosamente ignorado — agora vale.
+  - **Novas constantes exportadas** — `LIST_FIRST_PAGE`, `ADMIN_LIST_DEFAULT_SIZE` (100), `ADMIN_LIST_HTTP_DEFAULT_SIZE` (20), `ADMIN_LIST_MAX_SIZE` (200), mais os helpers `resolveListPage`, `normalizeListSize`, `clampListSize`, `parseListPage` e `parseListSize` (o SDK reexporta as três primeiras constantes com os mesmos nomes).
+  - **Novos tipos exportados** — `ListMeta` (`{ page, size, total }`) e `PaginatedResponse<T>` (`{ meta, data }`) em `@adonis-agora/authkit-server`; `ListMeta` também em `@adonis-agora/authkit-sdk` e `@adonis-agora/authkit-react`.
+  - **Inalterado** — o contrato INTERNO dos stores continua `Paginated<T> = { data, total }`: `AccountStore.listAccounts()` e `AuditSink.list()` NÃO ganham envelope `meta` (quem monta o `meta` é a borda HTTP/SDK). Implementações customizadas de store/sink só precisam da renomeação `limit` → `size`.
+  
+  ### Migração
+  
+  ```diff
+    // HTTP
+  - GET /api/authkit/v1/users?page=2&limit=50
+  + GET /api/authkit/v1/users?page=2&size=50
+  
+    // HTTP — resposta
+  - { "data": [...], "total": 137, "page": 2, "size": 50 }
+  + { "meta": { "page": 2, "size": 50, "total": 137 }, "data": [...] }
+  
+    // SDK
+  - const { data, total, page, limit } = await authkit.users.list({ page: 2, limit: 50 })
+  + const { data, meta } = await authkit.users.list({ page: 2, size: 50 })
+  + // meta.page / meta.size / meta.total
+  
+    // React
+  - useUsersQueryOptions({ search, page, limit: 20 })
+  + useUsersQueryOptions({ search, page, size: 20 })
+  - const total = data?.total ?? 0
+  + const total = data?.meta.total ?? 0
+  
+    // AccountStore / AuditSink customizados
+  - async listAccounts({ search, page = 1, limit = 20 }: ListAccountsParams) {
+  -   return { data: rows.slice((page - 1) * limit, page * limit), total }
+  + async listAccounts({ search, page = 1, size = 20 }: ListAccountsParams) {
+  +   return { data: rows.slice((page - 1) * size, page * size), total }
+    }
+  ```
+  
+  Callers que pediam `limit > 200` via HTTP passam a receber 200 itens por página — pagine com `page` para cobrir o resto.
+
+### Patch Changes
+
+- bc32ea4: Bump runtime dependencies to their latest releases.
+  
+  - `@simplewebauthn/server` and `@simplewebauthn/browser` go to `14.x`. The committed
+    `src/host/assets/webauthn.js` bundle was regenerated from the new `@simplewebauthn/browser`
+    (the `check:webauthn-bundle` guard would have caught the drift otherwise). The `authkit-react`
+    peer was **widened** to `^13.3.0 || ^14.0.0` instead of moved, so apps still on 13 keep
+    installing cleanly.
+  - `oidc-provider` 9.12.0 → 9.12.2 and `jose` 6.2.10 → 6.2.12 (patch releases on the token/JWT path).
+  
+  No API change on our side: typecheck, tests, packaging smoke and the WebAuthn bundle check all pass.
+
+## 0.20.1
+
+### Patch Changes
+
+- a6d271c: Ship TanStack Intent AI-agent skills with each package (`skills/` added to `files`), add the `tanstack-intent` keyword, and take a devDependency on `@tanstack/intent` for skill validation.
+
+## 0.20.0
+
+### Minor Changes
+
+- cbc19f5: Hooks e tipos para a preferência de tipos de login por usuário
+
+  Novos hooks TanStack Query sobre a Account API `GET/PUT
+/account/api/login-methods` (requer authkit-server com a feature):
+
+  - `useLoginMethodsQueryOptions()` — preferência do usuário + estado final
+    (`available`) + o que está travado (`locked`).
+  - `useUpdateLoginMethodsMutationOptions()` — grava a preferência; `{}` volta a
+    herdar os globais.
+
+  Tipos exportados: `AccountLoginMethodsResult`, `UpdateLoginMethodsResult`,
+  `UserLoginMethodsInput`. Query key nova: `authkitKeys.account.loginMethods()`.
+
+## 0.19.1
+
+### Patch Changes
+
+- Updated dependencies [813a321]
+  - @adonis-agora/authkit-core@0.8.0
+
+## 0.19.0
+
+### Minor Changes
+
+- 8f23a85: Fix the admin console's "Impersonate" button, both halves of it.
+
+  **It could never have worked.** The panel was built from `cfg.clients`, which is
+  always `[]` in a real installation — clients live in the OIDC adapter, created
+  through the console, the Admin API or `authkit:clients:create`, and the resolved
+  config never carries them. So the endpoint answered `404 no_token_exchange_client`
+  on every host that had not kept legacy static clients. Only the test suite, which
+  declared static clients, ever saw it succeed. `buildImpersonationPanel` now takes
+  the candidate clients as an argument and the controller reads them from the
+  adapter, falling back to static config clients for legacy hosts and for adapters
+  that cannot enumerate. A confidential runtime client renders a `<CLIENT_SECRET>`
+  placeholder rather than an empty secret, because the adapter cannot hand back a
+  secret that was shown once at creation.
+
+  **And the audit trail lied about it.** The endpoint recorded
+  `impersonation.started` before the UI had done anything — so a request that then
+  404'd, or that the admin abandoned, left a record claiming an impersonation had
+  begun. Viewing the exchange parameters is not assuming an identity. The console
+  now records `impersonation.panel_viewed`, emitted only once a usable panel
+  exists; `impersonation` still belongs to the token-exchange handler, which is
+  where an identity is actually assumed. `impersonation.started` is gone from
+  `AuditEventType` — nothing emitted it under a truthful reading.
+
+  **The UI opened a field that never existed.** `result.data.url` type-checked only
+  because `ImpersonationPanel` in `@adonis-agora/authkit-react` carried an
+  `[key: string]: unknown` index signature; at runtime it was always
+  `window.open(undefined)`. The type is now closed over the real response, so that
+  line no longer compiles, and the console renders the exchange parameters with a
+  copyable request instead of trying to navigate somewhere.
+
+## 0.18.1
+
+### Patch Changes
+
+- 1f15367: Point `homepage` and `bugs.url` at the repository's current name.
+
+  The repository was renamed to `adonis-agora-authkit`; `repository.url` followed,
+  `homepage` and `bugs.url` did not. Every package therefore shipped a manifest
+  that disagreed with itself, and the "Repository"/"Homepage" links on npm leaned
+  on GitHub's rename redirect — which lasts only until someone claims the old
+  name. All three fields now name the same repository.
+
+- Updated dependencies [1f15367]
+  - @adonis-agora/authkit-core@0.7.1
+
+## 0.18.0
+
+### Minor Changes
+
+- Login OTP e anti-duplo-submit nos formulários de interaction:
+
+  - `interactionUrls` cobre `otpVerify` (e `InteractionPostStep` aceita `'otpVerify'`) + novo export `OTP_CODE_FIELD` (`'code'`). A rota existe no server desde a 0.50 e o helper ficou pra trás — hosts montavam a URL à mão e hardcodavam o nome do campo.
+  - `MagicLinkButton` aceita `channel` (`'code'` | `'link'` — o choose-first do server 0.51) e mostra `pendingChildren` durante o voo do POST.
+  - `InteractionForm` ganha trava anti-duplo-submit a nível de DOM: desabilita os botões de submit depois do dispatch do evento (botão nomeado preserva o valor; `preventDefault` não trava à toa). Cobre qualquer `children` sem mudança de API — clique repetido não vira mais POST duplicado (no `/magic`, N cliques impacientes derrubavam o usuário no throttle 429).
+
+## 0.17.0
+
+### Minor Changes
+
+- efd30df: Adiciona hooks e utilitários headless para o "dance" de sudo/passkey por form
+  clássico, para hosts com telas React próprias.
+
+  - `submitClassicForm({ action, fields, method? })`: cria um `<form>` nativo com
+    campos hidden e o submete (navegação real) — necessário porque os fluxos de
+    sudo/passkey respondem 302, que um `fetch` não segue como navegação. SSR-safe.
+  - `usePasskeyAssertion({ optionsUrl, actionUrl, csrfToken, returnTo? })` →
+    `{ run, running, error }`: pega as options (`x-csrf-token`), roda
+    `startAuthentication` e submete o `response` via form clássico (com `_csrf` e
+    `return_to` quando fornecidos).
+  - `usePasskeyRegistration(...)`: idem, com `startRegistration`.
+
+  Também exporta as peças de tier mais baixo reusadas por eles (`runPasskeyAssertion`,
+  `runPasskeyRegistration`, `registerPasskey`, `loadStartRegistration`). O
+  `submitPasskeyVerification` existente passa a delegar ao `submitClassicForm`,
+  sem mudança de comportamento.
+
+## 0.16.0
+
+### Minor Changes
+
+- 7ea3ac8: Login por senha/magic link/OAuth também nas camadas do ecossistema — some a concatenação de URL à mão e o `_csrf` repetido em cada form:
+  - **Funções (`interactionUrls`, `oauthRedirectUrl`)** — builders tipados das URLs de interaction (identifier, login, magic, signup, switch, passkey/options, passkey/verify) e do redirect OAuth. Fonte única: se o prefixo de rota do authkit-server mudar, não quebra silenciosamente em string mágica espalhada.
+  - **Primitivo (`InteractionForm`)** — `<form method="POST">` no endpoint certo + o campo escondido `_csrf`, deixando os campos e o estilo pro app. Encapsula o boilerplate que se repetia em identifier/login/magic.
+  - **Componentes prontos (`MagicLinkButton`, `OAuthButton`)** — o "faz tudo", construídos sobre o primitivo/as funções, temáveis via `className`/`children`.
+  - **Helper `buttonClass(variant, extra)`** — centraliza a mescla de className dos botões do authkit (base + variante + extra do host), que os componentes repetiam.
+
+## 0.15.0
+
+### Minor Changes
+
+- 9909753: Login por passkey disparado por clique, nas três camadas do ecossistema — o app deixa de reescrever a cerimônia à mão:
+
+  - **Função (`authenticatePasskey`, `submitPasskeyVerification`, `loadStartAuthentication`)** — a cerimônia pura (POST das options → `startAuthentication` → serializa a assertion) e o submit de página inteira no `verify`. Totalmente customizável: use só a peça que precisar.
+  - **Hook headless (`usePasskeyLogin`)** — `{ authenticate, busy, failed }`. Roda a cerimônia e faz o submit; passe `onSuccess` pra controlar a verificação você mesmo (meio-do-caminho). O app é dono do visual do botão.
+  - **Componente pronto (`PasskeyButton`)** — o "faz tudo": botão + estado + erro, temável via `className`/`children`. Construído sobre o hook.
+
+  `@simplewebauthn/browser` continua sendo import lazy (pacote local → CDN), sem virar dependência. O `usePasskeyAutofill` passa a reusar o mesmo `loadStartAuthentication` (some a duplicação do carregamento da lib).
+
+## 0.14.0
+
+### Minor Changes
+
+- c12bac9: `authkit-react` drops app-role/authorization gating — that concern moved to
+  `@adonis-agora/authz-react`.
+
+  Removed:
+
+  - `AuthUser.appRoles`, `AuthSharedProps.authkit.appRoles`.
+  - `AuthState.appRoles`/`AuthState.hasAppRole()`.
+  - `hasAppRole`, `hasAnyAppRole`, `hasAllAppRoles` (from `roles.ts` and the package barrel).
+  - The `<Can>` component (`components/can.tsx`) and its `CanProps` type — it now lives in
+    `@adonis-agora/authz-react`, backed by the Authz service instead of app roles resolved
+    on the host.
+
+  `AuthState` is now `{ user, isAuthenticated, globalRoles, hasGlobalRole, hasAnyGlobalRole,
+hasAllGlobalRoles }`.
+
+  Kept: `user`, `globalRoles`, `hasGlobalRole`/`hasAnyGlobalRole`/`hasAllGlobalRoles` — these
+  read from the IdP token via `@adonis-agora/authkit-client`, not from app-defined roles.
+  `<CanPermission>`/`useCan` (permission checks against the Authz `/authz/can` endpoint) are
+  unaffected.
+
+## 0.13.1
+
+### Patch Changes
+
+- 70f5721: Ship peer dependencies as ranges instead of exact versions
+
+  `peerDependencies` pointed at the pinned `adonis`/`frontend` catalogs, and pnpm
+  inlines a catalog's literal value at publish time — so every published peer came
+  out exact. `@adonis-agora/authkit-server@0.34.1` on npm requires
+  `"@adonisjs/core": "7.3.3"`, which no app on 7.3.5 can satisfy;
+  `@adonis-agora/authkit-react@0.13.0` requires `"react": "19.2.6"`, which locks
+  out every consumer not on that exact patch.
+
+  Peers now resolve from three new range-only catalogs (`adonisPeers`,
+  `frontendPeers`, `miscPeers`). Dependencies keep the pinned catalogs — a pin is
+  right for reproducible installs and wrong for consumer compatibility, and the
+  two were sharing one source.
+
+  No source or runtime behaviour changes.
+
+## 0.13.0
+
+### Minor Changes
+
+- 12df185: Write `globalRoles` into the @agora context from the resolved session (so the Authz global-role bridge can read them), and add Authz permission gating to authkit-react: `useCan(permission, resource?)` and `<CanPermission>`, which consult the Authz `POST <canPath>` endpoint (`{ permission, resource? }` → `{ allowed }`, credentials included) with in-memory caching/dedupe. The endpoint path is configurable via `AuthkitProvider` (`canPath` / `endpoints.can`, default `/authz/can`).
+- 4bccbe9: fix: invalidate can-permission cache on principal change (stale authz after logout/org-switch)
+
+  The in-memory `useCan`/`checkCan` cache was process-global and keyed only by
+  `(path, permission, resource)`, so resolved permission decisions kept being
+  served across logout / user-switch / org-switch — a decision could outlive the
+  session that authorized it. The current principal (`useAuth().user?.id`, or an
+  `anon` sentinel when logged out) is now folded into the cache key, so a new
+  principal naturally misses the previous principal's answers and re-checks.
+
+  Also: `UseCanResult` now exposes an optional `error?: Error` (fail-closed:
+  `allowed` stays `false` on error), symmetric with `ResourceState<T>`; a public
+  `invalidateCanCache()` is exported to force a global refetch; and the warm-cache
+  render no longer triggers a redundant second `setState`.
+
+## 0.12.0
+
+### Minor Changes
+
+- 0542665: Re-scope to @adonis-agora/authkit-\* (join the Agora ecosystem)
+
+### Patch Changes
+
+- Updated dependencies [0542665]
+  - @adonis-agora/authkit-core@0.7.0
+
+## 0.11.0
+
+### Minor Changes
+
+- a450edb: Página "Signing Keys" no console admin: ver chaves JWKS (kids/idade/ativa), configurar rotação automática (enabled/maxAgeDays/keep), rotacionar agora e desabilitar todas + criar nova. O status de keys (`GET {base}/keys`) agora inclui a lista de chaves (`KeysStatus.keys`).
+
+## 0.10.0
+
+### Minor Changes
+
+- 386a0df: feat: gestão de rotação de chave JWKS no React SDK. Novo `client.admin.keys.status()`
+  e `client.admin.keys.rotate()` (console API session-authed — sem API key no browser),
+  hooks headless TanStack `useKeysQueryOptions`/`useRotateKeysMutationOptions`, e o
+  componente `<KeyRotation>` (idade da chave, política, ETA e botão "Rotacionar agora").
+
+### Patch Changes
+
+- Updated dependencies [93eaf69]
+- Updated dependencies [e2582b8]
+  - @adonis-agora/authkit-core@0.6.0
+
+## 0.9.1
+
+### Patch Changes
+
+- Updated dependencies [df4b41f]
+  - @adonis-agora/authkit-core@0.5.0
+
+## 0.9.0
+
+### Minor Changes
+
+- a6ca8a7: Bring your own IdP — use AuthKit against any OIDC-compliant provider
+  - **client**: new `discoverEndpoints(issuer)` resolves the IdP's real endpoints from `/.well-known/openid-configuration` (cached per issuer, field-level manual overrides, silent fallback to the oidc-provider conventions when the document is unreachable). All flow helpers (`buildAuthorizeUrl`, `exchangeCode`, `refreshTokens`, `exchangeToken`, `buildEndSessionUrl`) now accept explicit endpoint params — Keycloak, Auth0, Okta, Entra et al. work out of the box.
+  - **react**: new `idp: 'authkit' | 'external'` config on `AuthkitProvider`. With an external IdP, the components that depend on authkit-server's REST surface (`UserProfile`, `OrganizationSwitcher`, `OrganizationProfile`, `AuthorizedApps`) degrade to `null` instead of calling endpoints that don't exist; sign-in/out, auth state, role gates and the password strength meter keep working.
+  - New "Bring your own IdP" docs page tying the two together.
+
+## 0.8.0
+
+### Minor Changes
+
+- feat(account): global sign-out — revoke all sessions across all devices
+
+  **Server (`@adonis-agora/authkit-server`):**
+
+  - `POST /account/api/sessions/revoke-all` — revokes all OIDC sessions/grants for the account
+    and terminates the current Adonis console session (global logout).
+    Returns `{ ok: true, signedOut: true }` so the UI can redirect to login.
+    Emits audit event `account.signed_out_all`.
+
+  **React SDK (`@adonis-agora/authkit-react`):**
+
+  - `RevokeAllResult` type (`{ ok, signedOut, ...rest }`)
+  - `client.account.sessions.revokeAll()` method
+  - `useAccountRevokeAllSessionsMutationOptions()` hook (account namespace;
+    distinct from the admin `useRevokeAllSessionsMutationOptions`)
+
+## 0.7.0
+
+### Minor Changes
+
+- feat(settings): org-scoped runtime settings (org → global → default resolution)
+  - `auth_settings` table gains `organization_id` column (nullable; NULL = global). Unique constraint on (key, organization_id).
+  - `RuntimeSettings` methods gain optional `orgId` param: `getSetting(key, orgId?)`, `setSetting(key, value, updatedBy?, orgId?)`, `deleteSetting(key, orgId?)`, `listSettings(orgId?)`. New `getEffective(key, orgId?)` helper resolves org → global → null.
+  - Cache is org-scope-aware (cache key includes orgId).
+  - `resolveEffectiveOrganizationsPolicy` and `resolveEffectiveRolesCatalog` accept optional `orgId` and resolve org → global → default. All other resolvers remain global-only.
+  - Console JSON API (`/api/settings`) and Admin REST API accept `?organizationId=` query param for scoped reads/writes/deletes.
+  - Org detail drawer in console admin shows "Organization Settings" section for org-scopable keys (`organizations_policy`, `roles_catalog`) with source badges (from org / from global / default) and inline JSON editor.
+  - `@adonis-agora/authkit-react` client: `settings.list(orgId?)`, `settings.set(key, value, orgId?)`, `settings.remove(key, orgId?)`. `authkitKeys.admin.settings(orgId?)`. `useSettingsQueryOptions(orgId?)`, `useSetSettingMutationOptions(orgId?)`, `useRemoveSettingMutationOptions(orgId?)`.
+  - `SettingEntry` type gains `organizationId: string | null` field.
+  - Existing rows default to `organization_id = NULL` (global) — no data migration needed.
+
+## 0.6.0
+
+### Minor Changes
+
+- feat(console): gestão completa de organizations no console admin React
+
+  Adiciona CRUD completo de organizações na JSON API do console React
+  (console_orgs_controller) e na SPA (Orgs.tsx + orgs.containers.tsx):
+
+  **Novos endpoints no console React JSON API (`{adminPrefix}/api/orgs/*`):**
+
+  - `POST   /api/orgs` → criar org (name + slug + ownerAccountId)
+  - `PATCH  /api/orgs/:id` → editar nome/logo
+  - `DELETE /api/orgs/:id` → remover org
+  - `POST   /api/orgs/:id/members` → adicionar membro (accountId + role)
+  - `PATCH  /api/orgs/:id/members/:accountId` → alterar role do membro
+  - `DELETE /api/orgs/:id/members/:accountId` → remover membro
+  - `POST   /api/orgs/:id/invitations` → criar convite (email + role)
+  - `DELETE /api/orgs/:id/invitations/:invitationId` → revogar convite
+
+  Todos os endpoints retornam 404 `capability_unsupported` quando o store não
+  suporta organizações. Lógica reutiliza `AdminOrgsService` (sem duplicação).
+
+  **SDK `@adonis-agora/authkit-react`:**
+
+  - `client.admin.orgs`: novos métodos `addMember`, `removeMember`,
+    `updateMemberRole`, `createInvitation`, `revokeInvitation`
+  - Novos hooks: `useAddOrgMemberMutationOptions`, `useRemoveOrgMemberMutationOptions`,
+    `useUpdateOrgMemberRoleMutationOptions`, `useCreateOrgInvitationMutationOptions`,
+    `useRevokeOrgInvitationMutationOptions`
+
+  **SPA do console:**
+
+  - Botão "New organization" na header (modal com name + slug auto-gerado + ownerAccountId)
+  - Empty state com CTA de criar
+  - Drawer da org: editar nome/logo, deletar (com confirmação), listar membros com
+    add/mudar-role/remover, convites pendentes com criar e revogar
+  - Padrão containers + skeleton + QueryBoundary + toasts
+
+  i18n: strings em inglês (interface do console); mensagens de erro do servidor em pt-BR.
+
+## 0.5.3
+
+### Patch Changes
+
+- fix(sessions): listagem global no console admin quando accountId ausente
+  - `ConsoleSessionsController.index`: sem `accountId` retorna lista global de todas as sessões ativas (todas as contas) em vez de 400
+  - `AdminSessionsService.listAllSessions()`: enumera todas as sessões via adapter, resolve email por conta com cache (evita N+1), limita a 500 entradas com flag `truncated`
+  - `AdminSession`: novo campo opcional `email`
+  - `sessionDto`: inclui `email` na projeção JSON
+  - `AdminSessionEntry` (react types): campo `email: string | null`
+  - `UserSessionsResult` (react types): campo `truncated?: boolean`; renomeia `canList` → `supported` para alinhar com a resposta real do servidor
+  - SPA `sessions.containers.tsx`: exibe email acima do accountId na coluna Account quando presente
+  - Testes: cobre listagem global, truncamento a 500, capability ausente e resolução de email
+
+## 0.5.2
+
+### Patch Changes
+
+- Fix SSR crash (500) when host React account screens use the client: the constructor threw an SSR error eagerly, breaking server-render of any page that only uses `client.account.*`. Construction is now side-effect-free; the admin base is resolved lazily and only throws if an `admin.*` call is actually made without a base. Account-only screens work with just `accountBaseUrl`.
+
+## 0.5.1
+
+### Patch Changes
+
+- Fix "Failed to execute 'fetch' on 'Window': Illegal invocation": the typed client stored `globalThis.fetch` unbound and called it as an instance method, losing the Window binding. The default fetch is now bound to `globalThis`. The admin console SPA is also refactored into per-section containers, each with its own loading skeleton and a `react-error-boundary`-backed error state with retry.
+
+## 0.5.0
+
+### Minor Changes
+
+- Typed front-end client, TanStack Query hooks, and account JSON API:
+  - **Account self-service JSON API** (`/account/api/*`): session-authed, CSRF-protected endpoints for profile, security overview, password/email change, sessions, authorized apps, MFA/passkeys, PATs and organizations — the data layer for client-side account screens. Login/consent stay postback for security.
+  - **Typed front-end client** in `@adonis-agora/authkit-react`: `createAuthkitClient()` (auto-reads `window.__AUTHKIT__`) exposing `client.admin.*` and `client.account.*`, plus `AuthkitClientError`.
+  - **TanStack Query hooks** (Tuyau-style): ready-made `use*QueryOptions`/`use*MutationOptions` for every admin and account endpoint, structured `authkitKeys` for invalidation, `AuthkitClientProvider` + `createAuthkitQueryClient()`. `@tanstack/react-query` is a new peer dependency.
+  - **Admin console SPA** now consumes these hooks internally (client-side fetching via TanStack Query) instead of a bespoke fetch wrapper.
+
+## 0.4.0
+
+### Minor Changes
+
+- Rodauth parity completion + React admin console:
+  - **Sudo mode**: `sudo_mode` setting + `/account/confirm` (password or passkey) re-confirmation with a grace window; `requireSudo` gates password/email change, account deletion, MFA/passkey management and PAT actions.
+  - **OTP lockout**: `otp_lockout` setting locks the second factor after repeated TOTP/recovery failures and unlocks via emailed link (`GET /auth/otp-unlock/:token`, `onOtpUnlock` hook).
+  - **Common-password block**: `password_policy.blockCommon` (default on) rejects the ~10k most common passwords offline, before the HIBP check.
+  - **Account expiration**: `account_expiration` setting blocks login for accounts inactive beyond N days (reactivate via password reset) + `authkit:accounts:expire-scan` command for cron with warning emails.
+  - **WebAuthn autofill**: `auth_methods.passkeyAutofill` enables conditional-mediation passkey suggestions on the login field; new `usePasskeyAutofill` React hook.
+  - **React admin console (new default)**: `admin: { ui: 'react' }` serves a real Vite-built React SPA (build-and-serve, bundled in the package — zero host setup) with a dark/light telescope-style theme, consuming a session-authed JSON API under `{prefix}/api/*`. `ui: 'edge'` keeps the classic server-rendered console.
+
+## 0.3.2
+
+### Patch Changes
+
+- Updated dependencies
+  - @adonis-agora/authkit-core@0.4.0
+
+## 0.3.1
+
+### Patch Changes
+
+- Updated dependencies
+  - @adonis-agora/authkit-core@0.3.1
+
+## 0.3.0
+
+### Minor Changes
+
+- Round 7 — production pack + multi-tenancy:
+  - **Organizations (multi-tenancy)**: optional capability-probed tables (`auth_organizations`, `auth_organization_members`, `auth_organization_invitations`), per-org roles (owner/admin/member), email invitations with hashed tokens, active-org session cookie with `org_id`/`org_slug`/`org_role` claims in id_token/userinfo/JWT access tokens, `/account/orgs` page, admin console section, Admin REST API (`/api/authkit/v1/organizations`), SDK `organizations.*` namespace (remote + embedded), React `useOrganizations`/`useOrganization`/`useSwitchOrganization`/`useOrgInvitations` hooks plus `<OrganizationSwitcher />` and `<OrganizationProfile />` components.
+  - **LGPD/GDPR compliance**: self-service and admin account deletion with full cascade (sessions, grants, PATs, passkeys, identities, MFA, avatar) and audit anonymization (stable pseudonym), data export endpoint (`GET /account/security/export`), `login.requireVerifiedEmail` gate across password/magic-link/passkey flows, SDK `users.delete()`.
+  - **User migration & password hygiene**: transparent lazy password rehash on login, `password.legacyVerifier` hook for foreign hash formats, `authkit:users:import` ace command (JSON/NDJSON, `--dry-run`), configurable `password.policy`, HaveIBeenPwned k-anonymity breach check (fail-safe), React `usePasswordStrength` + `<PasswordStrengthMeter />`.
+  - **JWT access tokens (RFC 9068)**: `accessTokens: { format: 'jwt' }` with per-resource overrides, `verifyJwtAccessToken` local validation in the client package, `authkit:keys:rotate` command with grace-period JWKS rotation.
+  - **Bot protection**: pluggable vendor-agnostic `botProtection` config (Turnstile/hCaptcha-ready, fail-safe) on login/signup/reset.
+  - **New-device login notification**: `notifications.newDeviceEmail` + `mail.onNewDeviceLogin` hook driven by the trusted-device signal.
+  - **Console polish**: session context (user-agent/OS/IP/geo via pluggable `resolveGeo`), RFC 8693 impersonation panel (`admin.impersonation`, default off), dashboard with MAU/daily sign-ins, `GET /api/authkit/v1/stats` + SDK `stats()`.
+
+### Patch Changes
+
+- Updated dependencies
+  - @adonis-agora/authkit-core@0.3.0
+
+## 0.2.0
+
+### Minor Changes
+
+- 0403b72: Add a Clerk-style frontend layer: an `<AuthkitProvider>` config context (loginUrl/logoutUrl/profileUrl/endpoints/csrfToken with host-kit defaults), headless hooks (`useSignIn`, `useSignOut`, `useUser`, `useProfile`, `useSessions`, `useAuthorizedApps` — fetch-based, no react-query), and pre-built themeable components (`SignInButton`, `SignOutButton`, `UserButton`, `UserProfile`, `AuthorizedApps`, `Avatar`) with a shipped `styles.css` (`./styles.css` export) and `--authkit-*` CSS variables.
+
+## 0.1.2
+
+### Patch Changes
+
+- Updated dependencies [1872a30]
+  - @adonis-agora/authkit-core@0.2.0
+
+## 0.1.1
+
+### Patch Changes
+
+- Refactors do code review (comportamento preservado, contratos mais limpos):
+
+  **server (minor):**
+
+  - `AccountStore` decomposto em interfaces de capacidade (`CoreAccountStore`,
+    `MfaCapability`, `WebauthnCapability`, `ProviderIdentityCapability`) com type
+    guards (`supportsMfa`/`supportsPasskeys`/`supportsProviderIdentity`). O tipo
+    `AccountStore` continua existindo (core & Partial<capacidades>) — compatível.
+    `lucidAccountStore` agora OMITE os métodos de capacidades não configuradas em
+    vez de lançar em runtime; social login sem provider-identity degrada pro login.
+  - Sequência login+lockout centralizada em `attemptPasswordLogin` (era duplicada
+    em 2 controllers).
+  - `adminGuard` agora retorna 404 quando `admin.enabled: false` (fecha bypass de
+    drift entre config e `AuthHostOptions.admin`).
+  - `dynamicRegistration.management: true` sem `enabled: true` agora falha no
+    resolve do config (RFC 7592 exige 7591).
+  - Serialização JSON dos mixins unificada em `jsonColumn()` (semântica por coluna
+    preservada).
+
+  **client (minor):**
+
+  - POST ao token endpoint unificado (`exchangeCode`/`refreshTokens`/`exchangeToken`).
+  - Introspection + claims→Identity compartilhados entre resolvers; `pat`/`opaque`
+    agora também mapeiam `picture→profile.avatarUrl` e `sid→sessionId` (alinhados
+    ao `jwt`).
+
+  **react (patch):**
+
+  - Helpers genéricos de roles; warn de dev no `useAuth` quando não há
+    `AuthProvider` nem shared prop do Inertia.