@adonis-agora/authkit-server 0.34.0

package/build/src/host/ui-dist/assets/index-DTSmD4RU.css

@@ -0,0 +1 @@
+:root{--bg0:#07070d;--bg1:#0c0c16;--bg2:#12121f;--bg3:#181828;--line:#9797c41a;--line-strong:#9797c42e;--text:#e9e9f4;--muted:#9292ac;--faint:#5b5b74;--accent:#625fff;--accent-soft:#625fff24;--accent-hover:#625fff38;--green:#3ecf8e;--green-soft:#3ecf8e1f;--red:#ff5470;--red-soft:#ff54701f;--amber:#ffb454;--amber-soft:#ffb4541f;--blue:#4cc2ff;--blue-soft:#4cc2ff1f;--sans:"Sora", system-ui, -apple-system, sans-serif;--mono:"JetBrains Mono", ui-monospace, "SF Mono", Menlo, monospace;--sidebar-w:240px;--radius:10px;--topbar-h:54px}html.light{--bg0:#f7f7fb;--bg1:#fff;--bg2:#f0f0f6;--bg3:#e7e7f0;--line:#2828461a;--line-strong:#2828462e;--text:#1c1c28;--muted:#55556c;--faint:#8a8aa0;--accent-soft:#625fff1f;--accent-hover:#625fff2e;--amber-soft:#c4821e24;--green-soft:#1ea06424;--red-soft:#dc32501f;--blue-soft:#2896d21f}*,:before,:after{box-sizing:border-box;margin:0;padding:0}html,body,#root{height:100%}body{font-family:var(--sans);background:var(--bg0);color:var(--text);-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;font-size:13px;overflow:hidden}body:before{content:"";pointer-events:none;z-index:0;background:radial-gradient(1100px 500px at 15% -10%,#625fff1a,#0000 60%),radial-gradient(900px 420px at 90% 0,#3ecf8e0a,#0000 55%);position:fixed;inset:0}html.light body:before{display:none}::selection{background:#625fff4d}::-webkit-scrollbar{width:8px;height:8px}::-webkit-scrollbar-thumb{border:2px solid var(--bg0);background:#26263a;border-radius:6px}::-webkit-scrollbar-thumb:hover{background:#33334d}::-webkit-scrollbar-track{background:0 0}html.light ::-webkit-scrollbar-thumb{background:#cfcfe0}html.light ::-webkit-scrollbar-thumb:hover{background:#b8b8cc}#root{z-index:1;position:relative}.app-shell{height:100vh;display:flex;overflow:hidden}.sidebar{width:var(--sidebar-w);border-right:1px solid var(--line);-webkit-backdrop-filter:blur(10px);background:#0a0a12bf;flex-direction:column;flex-shrink:0;display:flex;overflow:hidden}html.light .sidebar{background:#ffffffd9}.main{flex-direction:column;flex:1;min-width:0;display:flex;overflow:hidden}.topbar{height:var(--topbar-h);border-bottom:1px solid var(--line);-webkit-backdrop-filter:blur(8px);background:#09091099;flex-shrink:0;align-items:center;gap:12px;padding:0 20px;display:flex}html.light .topbar{background:#ffffffb3}.content{flex:1;padding:24px 24px 60px;overflow-y:auto}.brand{border-bottom:1px solid var(--line);flex-shrink:0;align-items:center;gap:10px;padding:18px 18px 14px;display:flex}.brand-logo{background:var(--accent-soft);border:1px solid #625fff4d;border-radius:8px;flex-shrink:0;justify-content:center;align-items:center;width:30px;height:30px;display:flex;position:relative}.brand-logo svg{width:16px;height:16px;color:var(--accent)}.brand-logo .ring{border:1px solid #625fff59;border-radius:12px;animation:3s ease-out infinite ring-pulse;position:absolute;inset:-3px}@keyframes ring-pulse{0%{opacity:.9;transform:scale(.85)}70%{opacity:0;transform:scale(1.15)}to{opacity:0;transform:scale(1.15)}}.brand-text{overflow:hidden}.brand-name{letter-spacing:.03em;font-size:14px;font-weight:700}.brand-name span{color:var(--accent)}.brand-sub{color:var(--faint);letter-spacing:.08em;text-transform:uppercase;margin-top:1px;font-size:10px;font-weight:500}.nav{flex:1;padding:10px 10px 8px;overflow-y:auto}.nav-section{letter-spacing:.14em;text-transform:uppercase;color:var(--faint);padding:12px 8px 5px;font-size:9.5px;font-weight:600}.nav-item{color:var(--muted);cursor:pointer;-webkit-user-select:none;user-select:none;border:1px solid #0000;border-radius:8px;align-items:center;gap:9px;padding:7px 9px;font-size:12.5px;font-weight:500;text-decoration:none;transition:background .12s,color .12s;display:flex}.nav-item:hover{color:var(--text);background:#9797c40f}.nav-item.active{background:var(--accent-soft);color:var(--text);border-color:#625fff38}.nav-item.active .nav-ico{color:var(--accent)}.nav-ico{width:15px;height:15px;color:var(--faint);flex-shrink:0;transition:color .12s}.nav-item:hover .nav-ico{color:var(--muted)}.sidebar-foot{border-top:1px solid var(--line);flex-direction:column;flex-shrink:0;gap:10px;padding:12px 14px;display:flex}.user-row{cursor:default;border-radius:8px;align-items:center;gap:9px;padding:6px 8px;display:flex}.avatar{background:var(--accent-soft);width:28px;height:28px;color:var(--accent);border:1px solid #625fff4d;border-radius:50%;flex-shrink:0;justify-content:center;align-items:center;font-size:10.5px;font-weight:600;display:flex}.user-info{flex:1;min-width:0}.user-email{color:var(--text);text-overflow:ellipsis;white-space:nowrap;font-size:11px;font-weight:500;overflow:hidden}.user-role{color:var(--faint);font-size:9.5px;font-family:var(--mono)}.foot-actions{gap:6px;display:flex}.topbar-title{color:var(--text);font-size:14px;font-weight:600}.topbar-spacer{flex:1}.theme-btn{border:1px solid var(--line);background:var(--bg2);width:32px;height:32px;color:var(--muted);cursor:pointer;border-radius:8px;flex-shrink:0;justify-content:center;align-items:center;transition:all .13s;display:flex}.theme-btn:hover{background:var(--bg3);color:var(--text);border-color:var(--line-strong)}.theme-btn svg{width:14px;height:14px}.btn{background:var(--bg2);border:1px solid var(--line);height:32px;color:var(--muted);font-family:var(--sans);cursor:pointer;white-space:nowrap;border-radius:8px;align-items:center;gap:7px;padding:0 13px;font-size:12px;font-weight:500;text-decoration:none;transition:all .13s;display:inline-flex}.btn:hover{color:var(--text);border-color:var(--line-strong);background:var(--bg3)}.btn svg{flex-shrink:0;width:13px;height:13px}.btn.btn-primary{background:var(--accent);color:#fff;border-color:#0000}.btn.btn-primary:hover{background:#7472ff}.btn.btn-danger:hover{color:var(--red);background:var(--red-soft);border-color:#ff547066}.btn.btn-sm{border-radius:6px;height:26px;padding:0 10px;font-size:11px}.btn.btn-ghost{background:0 0;border-color:#0000}.btn.btn-ghost:hover{background:#9797c40f}.btn:disabled,.btn[disabled]{opacity:.45;pointer-events:none}.cards{grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:12px;margin-bottom:20px;display:grid}.card{border:1px solid var(--line);border-radius:var(--radius);background:linear-gradient(#9797c40a,#9797c403);padding:16px 18px 14px;animation:.45s cubic-bezier(.2,.7,.3,1) both rise}.card:nth-child(2){animation-delay:40ms}.card:nth-child(3){animation-delay:80ms}.card:nth-child(4){animation-delay:.12s}.card:nth-child(5){animation-delay:.16s}@keyframes rise{0%{opacity:0;transform:translateY(8px)}}.card-label{letter-spacing:.12em;text-transform:uppercase;color:var(--faint);margin-bottom:10px;font-size:10px;font-weight:600}.card-value{font-family:var(--mono);letter-spacing:-.02em;color:var(--text);font-size:26px;font-weight:600;line-height:1}.card-hint{color:var(--faint);font-size:10.5px;font-family:var(--mono);margin-top:8px}.card-hint b{color:var(--muted);font-weight:500}.card.c-accent .card-value{color:var(--accent)}.card.c-green .card-value{color:var(--green)}.card.c-amber .card-value{color:var(--amber)}.card.c-red .card-value{color:var(--red)}.card.c-blue .card-value{color:var(--blue)}.panel{border:1px solid var(--line);border-radius:var(--radius);background:linear-gradient(#9797c409,#9797c403);margin-bottom:16px;animation:.5s cubic-bezier(.2,.7,.3,1) both rise;overflow:hidden}.panel-head{border-bottom:1px solid var(--line);justify-content:space-between;align-items:center;gap:10px;padding:12px 16px;display:flex}.panel-head h3{letter-spacing:.02em;font-size:12.5px;font-weight:600}.panel-head .meta{font-family:var(--mono);color:var(--faint);font-size:10.5px}.panel-body{padding:12px 16px 16px}.grid-2{grid-template-columns:1fr 1fr;gap:16px;display:grid}@media (width<=1100px){.grid-2{grid-template-columns:1fr}}.page-header{margin-bottom:20px}.page-title{letter-spacing:.01em;margin-bottom:4px;font-size:18px;font-weight:700}.page-sub{color:var(--faint);font-size:12px}.page-actions{align-items:center;gap:8px;display:flex}.page-header-row{justify-content:space-between;align-items:center;gap:16px;margin-bottom:16px;display:flex}.tbl-wrap{overflow-x:auto}table{border-collapse:collapse;width:100%;font-size:12.5px}thead th{text-align:left;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);border-bottom:1px solid var(--line);white-space:nowrap;padding:8px 12px;font-size:10px;font-weight:600}tbody tr{border-bottom:1px solid var(--line);cursor:pointer;transition:background .1s}tbody tr:last-child{border-bottom:0}tbody tr:hover{background:#9797c40a}tbody td{color:var(--muted);vertical-align:middle;padding:10px 12px}tbody td b{color:var(--text);font-weight:500}tbody td.no-click{cursor:default}.badge{height:18px;font-family:var(--mono);white-space:nowrap;border-radius:99px;align-items:center;padding:0 8px;font-size:10px;font-weight:500;display:inline-flex}.badge-accent{background:var(--accent-soft);color:var(--accent);border:1px solid #625fff38}.badge-green{background:var(--green-soft);color:var(--green);border:1px solid #3ecf8e38}.badge-red{background:var(--red-soft);color:var(--red);border:1px solid #ff547038}.badge-amber{background:var(--amber-soft);color:var(--amber);border:1px solid #ffb45438}.badge-muted{color:var(--muted);border:1px solid var(--line);background:#9797c412}.badge-blue{background:var(--blue-soft);color:var(--blue);border:1px solid #4cc2ff38}.input{background:var(--bg2);border:1px solid var(--line);width:100%;height:34px;color:var(--text);font-family:var(--sans);border-radius:8px;outline:none;padding:0 12px;font-size:13px;transition:border-color .15s,box-shadow .15s}.input:focus{border-color:#625fff80;box-shadow:0 0 0 3px #625fff1c}.input::placeholder{color:var(--faint)}.input-mono{font-family:var(--mono);font-size:12px}textarea.input{resize:vertical;height:auto;padding:10px 12px}.search-input{position:relative}.search-input input{padding-left:32px}.search-ico{width:14px;height:14px;color:var(--faint);pointer-events:none;position:absolute;top:50%;left:10px;transform:translateY(-50%)}.field{margin-bottom:14px}.field label{color:var(--muted);letter-spacing:.02em;margin-bottom:5px;font-size:11px;font-weight:500;display:block}.field .hint{color:var(--faint);margin-top:4px;font-size:10.5px}.checkbox-row{cursor:pointer;align-items:center;gap:9px;padding:7px 0;display:flex}.checkbox-row input[type=checkbox]{width:14px;height:14px;accent-color:var(--accent);cursor:pointer}.checkbox-row .chk-label{color:var(--muted);font-size:12.5px}.checkbox-row:hover .chk-label{color:var(--text)}.toggle-row{border-bottom:1px solid var(--line);justify-content:space-between;align-items:center;padding:10px 0;display:flex}.toggle-row:last-child{border-bottom:0}.toggle-info{flex:1;min-width:0}.toggle-label{color:var(--text);font-size:12.5px;font-weight:500}.toggle-desc{color:var(--faint);margin-top:2px;font-size:11px}.toggle{flex-shrink:0;width:38px;height:20px;position:relative}.toggle input{opacity:0;width:0;height:0;position:absolute}.toggle-track{background:var(--bg3);border:1px solid var(--line-strong);cursor:pointer;border-radius:99px;transition:background .2s;position:absolute;inset:0}.toggle input:checked+.toggle-track{background:var(--accent);border-color:var(--accent)}.toggle-thumb{background:var(--faint);pointer-events:none;border-radius:50%;width:14px;height:14px;transition:transform .2s,background .2s;position:absolute;top:2px;left:2px}.toggle input:checked~.toggle-thumb{background:#fff;transform:translate(18px)}.modal-overlay{z-index:100;-webkit-backdrop-filter:blur(4px);backdrop-filter:blur(4px);background:#0009;justify-content:center;align-items:center;padding:20px;animation:.15s fade-in;display:flex;position:fixed;inset:0}@keyframes fade-in{0%{opacity:0}}.modal{background:var(--bg1);border:1px solid var(--line-strong);border-radius:14px;flex-direction:column;width:100%;max-width:520px;max-height:90vh;animation:.2s cubic-bezier(.2,.8,.3,1) modal-in;display:flex;overflow:hidden}@keyframes modal-in{0%{opacity:0;transform:scale(.96)translateY(8px)}}.modal.modal-lg{max-width:760px}.modal-head{border-bottom:1px solid var(--line);flex-shrink:0;justify-content:space-between;align-items:center;padding:16px 20px;display:flex}.modal-head h2{font-size:14px;font-weight:600}.modal-close{width:28px;height:28px;color:var(--faint);cursor:pointer;background:0 0;border:none;border-radius:6px;justify-content:center;align-items:center;transition:all .12s;display:flex}.modal-close:hover{color:var(--text);background:#9797c414}.modal-close svg{width:14px;height:14px}.modal-body{flex:1;padding:20px;overflow-y:auto}.modal-foot{border-top:1px solid var(--line);flex-shrink:0;justify-content:flex-end;gap:8px;padding:14px 20px;display:flex}.drawer-overlay{z-index:100;background:#00000080;animation:.15s fade-in;position:fixed;inset:0}.drawer{z-index:101;background:var(--bg1);border-left:1px solid var(--line-strong);flex-direction:column;width:480px;max-width:95vw;animation:.22s cubic-bezier(.2,.8,.3,1) drawer-in;display:flex;position:fixed;top:0;bottom:0;right:0;overflow:hidden}@keyframes drawer-in{0%{transform:translate(100%)}}.drawer-head{border-bottom:1px solid var(--line);flex-shrink:0;justify-content:space-between;align-items:center;padding:16px 20px;display:flex}.drawer-head h2{font-size:14px;font-weight:600}.drawer-body{flex:1;padding:20px;overflow-y:auto}.pagination{justify-content:flex-end;align-items:center;gap:6px;padding-top:16px;display:flex}.pag-info{font-family:var(--mono);color:var(--faint);margin-right:4px;font-size:11px}.empty-state{text-align:center;flex-direction:column;justify-content:center;align-items:center;gap:10px;padding:48px 24px;display:flex}.empty-state svg{width:36px;height:36px;color:var(--faint);margin-bottom:4px}.empty-state h4{color:var(--muted);font-size:14px;font-weight:600}.empty-state p{color:var(--faint);max-width:300px;font-size:12px}.spinner{border:2px solid var(--bg3);border-top-color:var(--accent);border-radius:50%;flex-shrink:0;width:20px;height:20px;animation:.7s linear infinite spin}.spinner.sm{width:14px;height:14px}.spinner.lg{border-width:3px;width:28px;height:28px}@keyframes spin{to{transform:rotate(360deg)}}.loading-row{color:var(--faint);justify-content:center;align-items:center;gap:12px;padding:40px;font-size:12px;display:flex}.error-box{background:var(--red-soft);border-radius:var(--radius);color:var(--red);border:1px solid #ff547040;padding:12px 16px;font-size:12px}.settings-section{margin-bottom:24px}.settings-section-head{border-bottom:1px solid var(--line);align-items:center;gap:10px;margin-bottom:4px;padding-bottom:10px;display:flex}.settings-section-head h3{font-size:13px;font-weight:600}.settings-section-head p{color:var(--faint);margin-top:1px;font-size:11px}.settings-row{border-bottom:1px solid var(--line);justify-content:space-between;align-items:flex-start;gap:20px;padding:12px 0;display:flex}.settings-row:last-child{border-bottom:0}.settings-info{flex:1;min-width:0}.settings-key{font-family:var(--mono);color:var(--text);font-size:12px;font-weight:500}.settings-desc{color:var(--faint);margin-top:2px;font-size:11px}.settings-badge{font-family:var(--mono);color:var(--faint);border:1px solid var(--line);background:#9797c412;border-radius:4px;margin-left:6px;padding:1px 6px;font-size:9.5px}.settings-control{flex-shrink:0;align-items:center;gap:8px;display:flex}.code{font-family:var(--mono);background:var(--bg2);border:1px solid var(--line);color:var(--muted);word-break:break-all;border-radius:6px;padding:2px 8px;font-size:11.5px}.sep{background:var(--line);height:1px;margin:16px 0}.flex{display:flex}.flex-center{align-items:center;display:flex}.gap-2{gap:8px}.gap-3{gap:12px}.ml-auto{margin-left:auto}.text-accent{color:var(--accent)}.text-muted{color:var(--muted)}.text-faint{color:var(--faint)}.text-green{color:var(--green)}.text-red{color:var(--red)}.text-amber{color:var(--amber)}.mono{font-family:var(--mono)}.text-sm{font-size:11px}.text-xs{font-size:10px}.truncate{text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.secret-box{background:var(--bg2);font-family:var(--mono);color:var(--accent);word-break:break-all;border:1px solid #625fff40;border-radius:8px;margin:8px 0;padding:12px 16px;font-size:12px}.secret-box small{color:var(--faint);font-size:10.5px;font-family:var(--sans);letter-spacing:.06em;text-transform:uppercase;margin-bottom:6px;display:block}.chart-svg{width:100%;height:90px;display:block;overflow:visible}.toast-container{z-index:200;flex-direction:column-reverse;gap:8px;display:flex;position:fixed;bottom:20px;right:20px}.toast{background:var(--bg2);border:1px solid var(--line-strong);color:var(--text);border-radius:10px;align-items:center;gap:10px;min-width:260px;max-width:380px;padding:10px 14px;font-size:12.5px;animation:.22s cubic-bezier(.2,.8,.3,1) toast-in;display:flex;box-shadow:0 4px 24px #0006}.toast svg{flex-shrink:0;width:15px;height:15px}.toast.toast-success svg{color:var(--green)}.toast.toast-error svg{color:var(--red)}.toast.toast-info svg{color:var(--accent)}@keyframes toast-in{0%{opacity:0;transform:translate(16px)}}.chart-tip{background:var(--panel,var(--bg));border:1px solid var(--line);color:var(--text);border-radius:8px;padding:7px 10px;font-size:11.5px;box-shadow:0 6px 24px #00000040}.chart-tip-label{color:var(--faint);margin-bottom:4px;font-size:10px}.chart-tip-row{align-items:center;gap:6px;display:flex}.chart-tip-row b{font-weight:600}.chart-tip-dot{border-radius:2px;flex:none;width:7px;height:7px}

package/build/src/host/ui-dist/index.html

@@ -0,0 +1,17 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>AuthKit Admin</title>
+    <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><circle cx='16' cy='16' r='13' fill='none' stroke='%23625fff' stroke-width='2.5'/><path d='M11 16l4 4 7-8' fill='none' stroke='%23625fff' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'/></svg>">
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Sora:wght@400;500;600;700&family=JetBrains+Mono:ital,wght@0,400;0,500;0,600;1,400&display=swap" rel="stylesheet">
+    <script type="module" crossorigin src="/__AUTHKIT_BASE__/assets/index-CRWcmsex.js"></script>
+    <link rel="stylesheet" crossorigin href="/__AUTHKIT_BASE__/assets/index-DTSmD4RU.css">
+  </head>
+  <body>
+    <div id="root"></div>
+  </body>
+</html>

package/build/src/host/user_agent.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Parser MÍNIMO de user-agent embutido (SEM dependência externa). Reconhece as
+ * famílias de browser e SO mais comuns por regexes simples; tudo o mais cai em
+ * `'Unknown'`. NÃO é um device-detector completo — o objetivo é só dar contexto
+ * legível às sessões no console (account + admin), não fingerprinting.
+ */
+export interface ParsedUserAgent {
+    /** Família do browser (Chrome/Firefox/Safari/Edge/Opera) ou 'Unknown'. */
+    browser: string;
+    /** Sistema operacional (Windows/macOS/Linux/Android/iOS) ou 'Unknown'. */
+    os: string;
+}
+/**
+ * Extrai browser + SO de uma string de user-agent. Ordem importa: Edge/Opera
+ * contêm "Chrome" no UA, então são checados ANTES; iOS contém "like Mac OS X",
+ * então é checado ANTES do macOS. `null`/vazio → ambos 'Unknown'.
+ */
+export declare function parseUserAgent(ua: string | null | undefined): ParsedUserAgent;

package/build/src/host/user_agent.js

@@ -0,0 +1,50 @@
+/**
+ * Parser MÍNIMO de user-agent embutido (SEM dependência externa). Reconhece as
+ * famílias de browser e SO mais comuns por regexes simples; tudo o mais cai em
+ * `'Unknown'`. NÃO é um device-detector completo — o objetivo é só dar contexto
+ * legível às sessões no console (account + admin), não fingerprinting.
+ */
+/**
+ * Extrai browser + SO de uma string de user-agent. Ordem importa: Edge/Opera
+ * contêm "Chrome" no UA, então são checados ANTES; iOS contém "like Mac OS X",
+ * então é checado ANTES do macOS. `null`/vazio → ambos 'Unknown'.
+ */
+export function parseUserAgent(ua) {
+    if (!ua || typeof ua !== 'string') {
+        return { browser: 'Unknown', os: 'Unknown' };
+    }
+    return { browser: detectBrowser(ua), os: detectOs(ua) };
+}
+function detectBrowser(ua) {
+    // Edge (Chromium): "Edg/" — checar ANTES de Chrome (o UA contém "Chrome").
+    if (/\bEdg(?:e|A|iOS)?\//i.test(ua))
+        return 'Edge';
+    // Opera: "OPR/" (Chromium) ou "Opera" (legado) — também antes de Chrome.
+    if (/\bOPR\//i.test(ua) || /\bOpera\b/i.test(ua))
+        return 'Opera';
+    // Firefox.
+    if (/\bFirefox\//i.test(ua))
+        return 'Firefox';
+    // Chrome / Chromium (cobre "Chrome" e "CriOS" no iOS).
+    if (/\b(?:Chrome|CriOS|Chromium)\//i.test(ua))
+        return 'Chrome';
+    // Safari por último: o UA do Safari tem "Safari/" SEM "Chrome".
+    if (/\bSafari\//i.test(ua))
+        return 'Safari';
+    return 'Unknown';
+}
+function detectOs(ua) {
+    // iOS antes de macOS: o UA do iOS contém "like Mac OS X".
+    if (/\b(?:iPhone|iPad|iPod)\b/i.test(ua))
+        return 'iOS';
+    // Android antes de Linux: o UA do Android contém "Linux".
+    if (/\bAndroid\b/i.test(ua))
+        return 'Android';
+    if (/\bWindows\b/i.test(ua))
+        return 'Windows';
+    if (/\bMac OS X\b/i.test(ua) || /\bMacintosh\b/i.test(ua))
+        return 'macOS';
+    if (/\bLinux\b/i.test(ua) || /\bX11\b/i.test(ua))
+        return 'Linux';
+    return 'Unknown';
+}

package/build/src/host/validators.d.ts

@@ -0,0 +1,127 @@
+export declare const signupValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
+    email: import("@vinejs/vine").VineString;
+    fullName: import("@vinejs/vine").VineString;
+    password: import("@vinejs/vine").VineString;
+}, {
+    email: string;
+    password: string;
+    fullName: string;
+}, {
+    email: string;
+    password: string;
+    fullName: string;
+}, {
+    email: string;
+    password: string;
+    fullName: string;
+}>, Record<string, any> | undefined>;
+export declare const forgotPasswordValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
+    email: import("@vinejs/vine").VineString;
+}, {
+    email: string;
+}, {
+    email: string;
+}, {
+    email: string;
+}>, Record<string, any> | undefined>;
+export declare const resetPasswordValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
+    token: import("@vinejs/vine").VineString;
+    password: import("@vinejs/vine").VineString;
+}, {
+    password: string;
+    token: string;
+}, {
+    password: string;
+    token: string;
+}, {
+    password: string;
+    token: string;
+}>, Record<string, any> | undefined>;
+/**
+ * Troca de senha no console de conta. A regra da nova senha espelha o
+ * signupValidator (min 8, max 255); a senha atual é confirmada à parte via
+ * verifyCredentials.
+ */
+export declare const changePasswordValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
+    currentPassword: import("@vinejs/vine").VineString;
+    newPassword: import("@vinejs/vine").VineString;
+}, {
+    newPassword: string;
+    currentPassword: string;
+}, {
+    newPassword: string;
+    currentPassword: string;
+}, {
+    newPassword: string;
+    currentPassword: string;
+}>, Record<string, any> | undefined>;
+/**
+ * Troca de e-mail no console de conta: senha atual (opcional — pode ser
+ * dispensada pela setting `email_change.requirePassword: false`) + o novo e-mail.
+ */
+export declare const changeEmailValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
+    currentPassword: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
+    newEmail: import("@vinejs/vine").VineString;
+}, {
+    currentPassword?: string | null | undefined;
+    newEmail: string;
+}, {
+    currentPassword?: string | undefined;
+    newEmail: string;
+}, {
+    currentPassword?: string | undefined;
+    newEmail: string;
+}>, Record<string, any> | undefined>;
+/**
+ * Edição de perfil no console de conta: nome e avatarUrl, ambos opcionais.
+ * Campos vazios são normalizados para string vazia (limpa o valor).
+ */
+export declare const updateProfileValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
+    name: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
+    avatarUrl: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
+}, {
+    name?: string | null | undefined;
+    avatarUrl?: string | null | undefined;
+}, {
+    name?: string | undefined;
+    avatarUrl?: string | undefined;
+}, {
+    name?: string | undefined;
+    avatarUrl?: string | undefined;
+}>, Record<string, any> | undefined>;
+/**
+ * Deleção self-service de conta (LGPD). Aceita confirmação por senha atual
+ * (`currentPassword`) OU pelo e-mail digitado (`confirmEmail`, p/ contas
+ * passwordless). Ambos opcionais aqui; o controller exige que UM deles confirme.
+ */
+export declare const deleteAccountValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
+    currentPassword: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
+    confirmEmail: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
+}, {
+    currentPassword?: string | null | undefined;
+    confirmEmail?: string | null | undefined;
+}, {
+    currentPassword?: string | undefined;
+    confirmEmail?: string | undefined;
+}, {
+    currentPassword?: string | undefined;
+    confirmEmail?: string | undefined;
+}>, Record<string, any> | undefined>;
+/** Criação de usuário no console admin (email obrigatório; nome/senha opcionais). */
+export declare const adminCreateUserValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
+    email: import("@vinejs/vine").VineString;
+    name: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
+    password: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
+}, {
+    name?: string | null | undefined;
+    password?: string | null | undefined;
+    email: string;
+}, {
+    name?: string | undefined;
+    password?: string | undefined;
+    email: string;
+}, {
+    name?: string | undefined;
+    password?: string | undefined;
+    email: string;
+}>, Record<string, any> | undefined>;

package/build/src/host/validators.js

@@ -0,0 +1,53 @@
+import vine from '@vinejs/vine';
+export const signupValidator = vine.compile(vine.object({
+    email: vine.string().trim().email().normalizeEmail(),
+    fullName: vine.string().trim().minLength(2).maxLength(255),
+    password: vine.string().minLength(8).maxLength(255),
+}));
+export const forgotPasswordValidator = vine.compile(vine.object({
+    email: vine.string().trim().email().normalizeEmail(),
+}));
+export const resetPasswordValidator = vine.compile(vine.object({
+    token: vine.string().trim().minLength(1),
+    password: vine.string().minLength(8).maxLength(255),
+}));
+/**
+ * Troca de senha no console de conta. A regra da nova senha espelha o
+ * signupValidator (min 8, max 255); a senha atual é confirmada à parte via
+ * verifyCredentials.
+ */
+export const changePasswordValidator = vine.compile(vine.object({
+    currentPassword: vine.string().minLength(1),
+    newPassword: vine.string().minLength(8).maxLength(255),
+}));
+/**
+ * Troca de e-mail no console de conta: senha atual (opcional — pode ser
+ * dispensada pela setting `email_change.requirePassword: false`) + o novo e-mail.
+ */
+export const changeEmailValidator = vine.compile(vine.object({
+    currentPassword: vine.string().minLength(1).optional(),
+    newEmail: vine.string().trim().email().normalizeEmail(),
+}));
+/**
+ * Edição de perfil no console de conta: nome e avatarUrl, ambos opcionais.
+ * Campos vazios são normalizados para string vazia (limpa o valor).
+ */
+export const updateProfileValidator = vine.compile(vine.object({
+    name: vine.string().trim().maxLength(255).optional(),
+    avatarUrl: vine.string().trim().url().maxLength(2048).optional(),
+}));
+/**
+ * Deleção self-service de conta (LGPD). Aceita confirmação por senha atual
+ * (`currentPassword`) OU pelo e-mail digitado (`confirmEmail`, p/ contas
+ * passwordless). Ambos opcionais aqui; o controller exige que UM deles confirme.
+ */
+export const deleteAccountValidator = vine.compile(vine.object({
+    currentPassword: vine.string().optional(),
+    confirmEmail: vine.string().trim().optional(),
+}));
+/** Criação de usuário no console admin (email obrigatório; nome/senha opcionais). */
+export const adminCreateUserValidator = vine.compile(vine.object({
+    email: vine.string().trim().email().normalizeEmail(),
+    name: vine.string().trim().maxLength(255).optional(),
+    password: vine.string().minLength(8).maxLength(255).optional(),
+}));

package/build/src/keys/jwks_manager.d.ts

@@ -0,0 +1,6 @@
+export type SigningAlg = 'RS256' | 'ES256' | 'PS256' | 'EdDSA';
+export interface ManagedJwks {
+    keys: Record<string, any>[];
+}
+/** Gera um JWKS privado (1 chave) pronto para `oidc-provider`. */
+export declare function generateJwks(alg: SigningAlg): Promise<ManagedJwks>;

package/build/src/keys/jwks_manager.js

@@ -0,0 +1,11 @@
+import { generateKeyPair, exportJWK } from 'jose';
+import { randomUUID } from 'node:crypto';
+/** Gera um JWKS privado (1 chave) pronto para `oidc-provider`. */
+export async function generateJwks(alg) {
+    const { privateKey } = await generateKeyPair(alg, { extractable: true });
+    const jwk = (await exportJWK(privateKey));
+    jwk.use = 'sig';
+    jwk.alg = alg;
+    jwk.kid = randomUUID();
+    return { keys: [jwk] };
+}

package/build/src/keys/keystore.d.ts

@@ -0,0 +1,52 @@
+import type { SigningAlg } from './jwks_manager.js';
+/**
+ * Helpers PUROS do keystore managed (sem I/O). A persistência/rotação com I/O vive
+ * no {@link KeystoreManager} (compõe um cofre + codec); estas funções geram a chave,
+ * computam idade, planejam rotação (dry-run) e derivam o JWKS público.
+ *
+ * O modo `managed` "puro" gera UMA chave efêmera por boot (em {@link generateJwks})
+ * — não persiste, então rotacionar não faz sentido. Para rotação de verdade, o
+ * keystore persiste o JWKS PRIVADO (via cofre): a rotação gera um novo par (novo
+ * kid) e mantém as N chaves mais recentes; o JWKS público servido inclui todas (as
+ * antigas continuam validando), e a PRIMEIRA chave é a de assinatura corrente.
+ */
+/** Estrutura persistida: JWKS privado (chaves com `d`). */
+export interface PersistedKeystore {
+    keys: Record<string, any>[];
+}
+/** Gera uma chave de assinatura privada como JWK (com use/alg/kid + carimbo de criação). */
+export declare function generateSigningJwk(alg: SigningAlg): Promise<Record<string, any>>;
+/** Idade (em dias) da chave de assinatura corrente (primeira do keystore), ou null. */
+export declare function signingKeyAgeDays(store: PersistedKeystore | null): number | null;
+/** Info pública de uma chave managed para o painel admin (sem material privado). */
+export interface ManagedKeyInfo {
+    kid: string;
+    alg: string;
+    ageDays: number;
+    /** true para a chave de assinatura corrente (a primeira do keystore). */
+    active: boolean;
+}
+/** Mapeia o keystore privado para infos públicas (kid/alg/idade/ativa). Vazio se null. */
+export declare function listKeyInfos(store: PersistedKeystore | null): ManagedKeyInfo[];
+/** Plano de uma rotação — o que SERIA feito (dry-run) sem tocar disco. */
+export interface RotationPlan {
+    /** kid da chave de assinatura corrente (será deslocada para verificação), ou null. */
+    currentKid: string | null;
+    /** kids que permanecem no JWKS público após a rotação (a nova vem primeiro). */
+    keptKids: string[];
+    /** kids removidos do JWKS (tokens assinados por eles deixam de validar). */
+    retiredKids: string[];
+    /** Quantas chaves o keystore mantém após a rotação. */
+    keep: number;
+}
+/**
+ * Calcula o plano de rotação (PURO, sem I/O nem geração de chave). `newKidPlaceholder`
+ * representa a chave nova que entraria na frente. Período de graça = manter as
+ * `keep` chaves mais recentes; `retire: true` força `keep = 1` (remove TODAS as
+ * antigas imediatamente — só a nova valida).
+ */
+export declare function planRotation(store: PersistedKeystore | null, keep: number, retire: boolean): RotationPlan;
+/** Deriva o JWKS PÚBLICO (sem `d` e demais campos privados) a partir do privado. */
+export declare function toPublicJwks(store: PersistedKeystore): {
+    keys: Record<string, any>[];
+};

package/build/src/keys/keystore.js

@@ -0,0 +1,68 @@
+import { generateKeyPair, exportJWK } from 'jose';
+import { randomUUID } from 'node:crypto';
+/** Gera uma chave de assinatura privada como JWK (com use/alg/kid + carimbo de criação). */
+export async function generateSigningJwk(alg) {
+    const { privateKey } = await generateKeyPair(alg, { extractable: true });
+    const jwk = (await exportJWK(privateKey));
+    jwk.use = 'sig';
+    jwk.alg = alg;
+    jwk.kid = randomUUID();
+    // Metadado NÃO-padrão usado só para reportar idade da chave (doctor / rotação).
+    // O oidc-provider e o JWKS público ignoram campos desconhecidos; `toPublicJwks`
+    // remove apenas a parte privada — `iat` continua interno, não vaza nada sensível.
+    jwk.iat = Math.floor(Date.now() / 1000);
+    return jwk;
+}
+/** Idade (em dias) da chave de assinatura corrente (primeira do keystore), ou null. */
+export function signingKeyAgeDays(store) {
+    const iat = store?.keys?.[0]?.iat;
+    if (typeof iat !== 'number')
+        return null;
+    return Math.max(0, Math.floor((Date.now() / 1000 - iat) / 86400));
+}
+/** Mapeia o keystore privado para infos públicas (kid/alg/idade/ativa). Vazio se null. */
+export function listKeyInfos(store) {
+    const keys = store?.keys ?? [];
+    const now = Date.now() / 1000;
+    return keys.map((k, i) => ({
+        kid: k.kid,
+        alg: k.alg ?? 'RS256',
+        ageDays: typeof k.iat === 'number' ? Math.max(0, Math.floor((now - k.iat) / 86400)) : 0,
+        active: i === 0,
+    }));
+}
+/**
+ * Calcula o plano de rotação (PURO, sem I/O nem geração de chave). `newKidPlaceholder`
+ * representa a chave nova que entraria na frente. Período de graça = manter as
+ * `keep` chaves mais recentes; `retire: true` força `keep = 1` (remove TODAS as
+ * antigas imediatamente — só a nova valida).
+ */
+export function planRotation(store, keep, retire) {
+    const current = store?.keys ?? [];
+    const effectiveKeep = retire ? 1 : Math.max(1, keep);
+    const projected = ['<new>', ...current.map((k) => k.kid)];
+    const keptKids = projected.slice(0, effectiveKeep);
+    const retiredKids = projected.slice(effectiveKeep);
+    return {
+        currentKid: current[0]?.kid ?? null,
+        keptKids,
+        retiredKids,
+        keep: effectiveKeep,
+    };
+}
+/** Deriva o JWKS PÚBLICO (sem `d` e demais campos privados) a partir do privado. */
+export function toPublicJwks(store) {
+    // `iat` é um metadado interno do keystore (idade da chave), não um membro JWK —
+    // removido do JWKS público junto com os campos da chave privada.
+    const PRIVATE_FIELDS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'iat'];
+    return {
+        keys: store.keys.map((jwk) => {
+            const pub = {};
+            for (const [k, v] of Object.entries(jwk)) {
+                if (!PRIVATE_FIELDS.includes(k))
+                    pub[k] = v;
+            }
+            return pub;
+        }),
+    };
+}

package/build/src/keys/keystore_codec.d.ts

@@ -0,0 +1,20 @@
+import type { PersistedKeystore } from './keystore.js';
+/** Subconjunto do serviço de encryption do AdonisJS (APP_KEY). */
+export interface EncryptionLike {
+    encrypt(value: string): string;
+    decrypt<T = string>(value: string): T | null;
+}
+/**
+ * Serializa/desserializa o keystore com envelope versionado. `encrypt: true`
+ * exige um `enc` (EncryptionLike). `decode` aceita: `enc:'none'` e `enc:'aes'`.
+ * Decrypt falho → THROW (decisão: nunca regenerar).
+ */
+export declare class KeystoreCodec {
+    private opts;
+    constructor(opts: {
+        encrypt: boolean;
+        enc?: EncryptionLike;
+    });
+    encode(store: PersistedKeystore): Promise<string>;
+    decode(blob: string): Promise<PersistedKeystore>;
+}

package/build/src/keys/keystore_codec.js

@@ -0,0 +1,42 @@
+/**
+ * Serializa/desserializa o keystore com envelope versionado. `encrypt: true`
+ * exige um `enc` (EncryptionLike). `decode` aceita: `enc:'none'` e `enc:'aes'`.
+ * Decrypt falho → THROW (decisão: nunca regenerar).
+ */
+export class KeystoreCodec {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async encode(store) {
+        const json = JSON.stringify(store);
+        if (this.opts.encrypt) {
+            if (!this.opts.enc) {
+                throw new Error('AuthKit keystore: encryption pedida mas serviço de encryption indisponível.');
+            }
+            const env = { v: 2, enc: 'aes', data: this.opts.enc.encrypt(json) };
+            return JSON.stringify(env);
+        }
+        const env = { v: 2, enc: 'none', data: json };
+        return JSON.stringify(env);
+    }
+    async decode(blob) {
+        const parsed = JSON.parse(blob);
+        if (parsed?.v === 2 && typeof parsed.data === 'string') {
+            if (parsed.enc === 'none')
+                return JSON.parse(parsed.data);
+            if (parsed.enc === 'aes') {
+                if (!this.opts.enc) {
+                    throw new Error('AuthKit keystore: blob encriptado mas serviço de encryption indisponível.');
+                }
+                const json = this.opts.enc.decrypt(parsed.data);
+                if (json == null) {
+                    throw new Error('AuthKit keystore: decrypt falhou — APP_KEY mudou? Restaure a APP_KEY anterior ' +
+                        'ou regenere com `authkit:keys:rotate --force-new`.');
+                }
+                return JSON.parse(json);
+            }
+        }
+        throw new Error('AuthKit keystore: formato de blob irreconhecível.');
+    }
+}

package/build/src/keys/keystore_crypto.d.ts

@@ -0,0 +1,9 @@
+import type { EncryptionLike } from './keystore_codec.js';
+export declare function __setEncryptionServiceForTests(svc: EncryptionLike | undefined): void;
+/** Retorna o serviço injetado (testes) ou undefined. */
+export declare function getInjectedEncryptionService(): EncryptionLike | undefined;
+/**
+ * Resolve o serviço de encryption: injeção (testes) tem prioridade; senão importa
+ * `@adonisjs/core/services/encryption`. Lança se nenhum estiver disponível.
+ */
+export declare function loadEncryptionService(): Promise<EncryptionLike>;

package/build/src/keys/keystore_crypto.js

@@ -0,0 +1,27 @@
+/**
+ * Carrega o serviço de encryption do app (APP_KEY) de forma LAZY. Diferente do
+ * encrypter do TOTP (que degrada p/ plaintext), aqui o caller decide o que fazer
+ * com a ausência — o keystore exige determinismo. Em testes, injete via
+ * {@link __setEncryptionServiceForTests}.
+ */
+let injected;
+export function __setEncryptionServiceForTests(svc) {
+    injected = svc;
+}
+/** Retorna o serviço injetado (testes) ou undefined. */
+export function getInjectedEncryptionService() {
+    return injected;
+}
+/**
+ * Resolve o serviço de encryption: injeção (testes) tem prioridade; senão importa
+ * `@adonisjs/core/services/encryption`. Lança se nenhum estiver disponível.
+ */
+export async function loadEncryptionService() {
+    if (injected)
+        return injected;
+    const mod = await import('@adonisjs/core/services/encryption');
+    const svc = mod.default;
+    if (!svc)
+        throw new Error('AuthKit keystore: serviço de encryption (APP_KEY) indisponível.');
+    return svc;
+}

package/build/src/keys/keystore_manager.d.ts

@@ -0,0 +1,43 @@
+import { type PersistedKeystore, type RotationPlan } from './keystore.js';
+import type { KeystoreCodec } from './keystore_codec.js';
+import { type KeystoreVault } from './keystore_vault.js';
+import type { SigningAlg } from './jwks_manager.js';
+import type { KeystoreStoreConfig } from '@adonis-agora/authkit-core';
+/**
+ * Único caminho de I/O do keystore managed: compõe um {@link KeystoreVault} (onde
+ * o blob mora) com um {@link KeystoreCodec} (serialização + encryption). As helpers
+ * puras (gerar chave, planejar rotação) continuam em `keystore.ts`.
+ */
+export declare class KeystoreManager {
+    private vault;
+    private codec;
+    private alg;
+    constructor(vault: KeystoreVault, codec: KeystoreCodec, alg: SigningAlg);
+    /** Lê o keystore (privado) ou null se ausente. */
+    read(): Promise<PersistedKeystore | null>;
+    /** Garante que exista: gera+persiste se ausente; senão decodifica e retorna. */
+    ensure(): Promise<PersistedKeystore>;
+    /** Rotaciona: chave nova na frente, mantém as `keep` mais recentes. Persiste. */
+    rotate(keep?: number, retire?: boolean): Promise<{
+        store: PersistedKeystore;
+        newKid: string;
+        retiredKids: string[];
+    }>;
+    /** Plano de rotação (puro, sem I/O de escrita). */
+    plan(keep: number, retire: boolean): Promise<RotationPlan>;
+    /** Token barato de mudança (delegado ao vault; fallback p/ read completo). */
+    head(): Promise<string | null>;
+}
+/** Acesso mínimo ao app que o resolver precisa (paths + container p/ lucid/redis). */
+export interface KeystoreVaultContext {
+    makePath: (p: string) => string;
+    container: {
+        make: (token: string) => Promise<any>;
+    };
+}
+/**
+ * Resolve a config `store` num {@link KeystoreVault}. `ctx.makePath` = `app.makePath`
+ * (resolve paths relativos à raiz do app). Instância custom (com `read`/`write`)
+ * passa direto. Drivers de cloud lançam nesta fatia (chegam nos packages-irmãos).
+ */
+export declare function resolveKeystoreVault(store: KeystoreStoreConfig | KeystoreVault, ctx: KeystoreVaultContext): KeystoreVault;