@adonis-agora/authkit-server 0.46.0 → 0.48.0

package/build/commands/clients_create.js

@@ -47,10 +47,10 @@ export default class AuthkitClientsCreate extends BaseCommand {
         const service = await this.app.container.make('authkit.server');
         const { AdminClientsService } = await import('../src/host/admin_clients_service.js');
         const svc = new AdminClientsService(service);
-        const grantTypes = this.grant && this.grant.length > 0
-            ? this.grant
-            : ['authorization_code', 'refresh_token'];
-        const tokenEndpointAuthMethod = this.public ? 'none' : 'client_secret_basic';
+        const grantTypes = this.grant && this.grant.length > 0 ? this.grant : ['authorization_code', 'refresh_token'];
+        const tokenEndpointAuthMethod = this.public
+            ? 'none'
+            : 'client_secret_basic';
         const created = await svc.create({
             clientId: this.clientId,
             redirectUris,

package/build/commands/configure.js

@@ -9,7 +9,7 @@ function assertPresetPrereqs(preset, appRoot) {
     const pkg = existsSync(pkgPath) ? JSON.parse(readFileSync(pkgPath, 'utf8')) : {};
     const deps = { ...pkg.dependencies, ...pkg.devDependencies };
     const hasInertia = !!deps['@adonisjs/inertia'];
-    const hasReact = !!deps['react'];
+    const hasReact = !!deps.react;
     const hasVite = existsSync(join(appRoot, 'vite.config.ts')) || existsSync(join(appRoot, 'vite.config.js'));
     if (!hasInertia || !hasReact || !hasVite) {
         throw new Error('authkit --ui=react requer @adonisjs/inertia + react + Vite no app. ' +
@@ -18,7 +18,8 @@ function assertPresetPrereqs(preset, appRoot) {
 }
 export async function configure(command) {
     const flag = command.parsedFlags?.ui;
-    const chosen = flag ?? (await command.prompt.choice('UI das telas de login/consent', ['edge', 'react', 'headless']));
+    const chosen = flag ??
+        (await command.prompt.choice('UI das telas de login/consent', ['edge', 'react', 'headless']));
     const preset = resolveUiPreset(chosen);
     assertPresetPrereqs(preset, command.app.makePath());
     const codemods = await command.createCodemods();

package/build/commands/doctor.js

@@ -7,14 +7,14 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { BaseCommand } from '@adonisjs/core/ace';
-import { runAllChecks, hasErrors, signingKeyAgeFinding } from '../src/doctor/checks.js';
 import { DatabaseAdapter } from '../src/adapters/database_adapter.js';
 import { resolveAuthkitConfig } from '../src/commands/resolve_config.js';
-import { KeystoreManager, resolveKeystoreVault } from '../src/keys/keystore_manager.js';
-import { KeystoreCodec } from '../src/keys/keystore_codec.js';
-import { signingKeyAgeDays } from '../src/keys/keystore.js';
 import { defaultEncryptForStore } from '../src/define_config.js';
+import { hasErrors, runAllChecks, signingKeyAgeFinding, } from '../src/doctor/checks.js';
+import { signingKeyAgeDays } from '../src/keys/keystore.js';
+import { KeystoreCodec } from '../src/keys/keystore_codec.js';
 import { loadEncryptionService } from '../src/keys/keystore_crypto.js';
+import { KeystoreManager, resolveKeystoreVault } from '../src/keys/keystore_manager.js';
 /**
  * Tenta importar um peer; `true` se importável.
  *
@@ -77,7 +77,10 @@ export default class AuthkitDoctor extends BaseCommand {
         const jwksInput = (authkitConfig?.jwksConfig ?? authkitConfig?.jwks);
         if (jwksInput?.source === 'managed' && jwksInput?.store) {
             try {
-                const vault = resolveKeystoreVault(jwksInput.store, { makePath: (p) => this.app.makePath(p), container: this.app.container });
+                const vault = resolveKeystoreVault(jwksInput.store, {
+                    makePath: (p) => this.app.makePath(p),
+                    container: this.app.container,
+                });
                 const encrypt = jwksInput.encrypt ?? defaultEncryptForStore(jwksInput.store);
                 const enc = encrypt ? await loadEncryptionService().catch(() => undefined) : undefined;
                 const mgr = new KeystoreManager(vault, new KeystoreCodec({ encrypt, enc }), jwksInput.algorithm ?? 'RS256');

package/build/commands/eject.js

@@ -91,6 +91,6 @@ __decorate([
 ], AuthkitEject.prototype, "views", void 0);
 __decorate([
     flags.string({
-        description: `Copia um controller do host-kit (ex.: interaction) para app/controllers/authkit/`,
+        description: 'Copia um controller do host-kit (ex.: interaction) para app/controllers/authkit/',
     })
 ], AuthkitEject.prototype, "controller", void 0);

package/build/commands/expire_scan.js

@@ -62,22 +62,22 @@ export default class AuthkitExpireScan extends BaseCommand {
             this.logger.info(`[expire-scan] Deduped (already warned): ${result.deduped}`);
         }
         if (expired.length > 0) {
-            this.logger.warning(`[expire-scan] Expired accounts:`);
+            this.logger.warning('[expire-scan] Expired accounts:');
             for (const acc of expired) {
                 this.logger.warning(`  ${acc.email} (${acc.accountId}) — last activity ${acc.lastActivityDaysAgo ?? '?'} days ago`);
             }
         }
         if (warnSoon.length > 0) {
-            this.logger.info(`[expire-scan] Expiring soon:`);
+            this.logger.info('[expire-scan] Expiring soon:');
             for (const acc of warnSoon) {
                 this.logger.info(`  ${acc.email} (${acc.accountId}) — expires in ${acc.expiresInDays} days`);
             }
         }
         if (!summary.auditSupported) {
-            this.logger.warning(`[expire-scan] Audit sink does not support list(). Feature unavailable.`);
+            this.logger.warning('[expire-scan] Audit sink does not support list(). Feature unavailable.');
         }
         if (summary.dryRun) {
-            this.logger.info(`[expire-scan] DRY RUN — no emails sent, no audit events recorded.`);
+            this.logger.info('[expire-scan] DRY RUN — no emails sent, no audit events recorded.');
         }
     }
 }
@@ -85,7 +85,9 @@ __decorate([
     flags.boolean({ description: 'Reporta sem enviar e-mails nem auditar.' })
 ], AuthkitExpireScan.prototype, "dryRun", void 0);
 __decorate([
-    flags.boolean({ description: 'Envia e-mail de aviso às contas a expirar em breve (deduplicado via audit).' })
+    flags.boolean({
+        description: 'Envia e-mail de aviso às contas a expirar em breve (deduplicado via audit).',
+    })
 ], AuthkitExpireScan.prototype, "warn", void 0);
 __decorate([
     flags.boolean({ description: 'Output em JSON machine-readable (estrutura ExpireScanResult).' })

package/build/commands/import_users.js

@@ -6,7 +6,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 import { readFile } from 'node:fs/promises';
 import { BaseCommand, flags } from '@adonisjs/core/ace';
-import { parseImportFile, importUsers } from '../src/commands/import_users.js';
+import { importUsers, parseImportFile } from '../src/commands/import_users.js';
 import { resolveAuthkitConfig } from '../src/commands/resolve_config.js';
 /**
  * Importa usuários de outro sistema para o account store do AuthKit. Os hashes

package/build/commands/keys_rotate.js

@@ -5,12 +5,12 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 import { BaseCommand, flags } from '@adonisjs/core/ace';
+import { resolveAuthkitConfig } from '../src/commands/resolve_config.js';
+import { defaultEncryptForStore } from '../src/define_config.js';
 import { signingKeyAgeDays } from '../src/keys/keystore.js';
-import { KeystoreManager, resolveKeystoreVault } from '../src/keys/keystore_manager.js';
 import { KeystoreCodec } from '../src/keys/keystore_codec.js';
 import { loadEncryptionService } from '../src/keys/keystore_crypto.js';
-import { defaultEncryptForStore } from '../src/define_config.js';
-import { resolveAuthkitConfig } from '../src/commands/resolve_config.js';
+import { KeystoreManager, resolveKeystoreVault } from '../src/keys/keystore_manager.js';
 /**
  * Rotação de chaves de assinatura JWKS (padrão OIDC). Gera uma chave nova, passa a
  * ASSINAR com ela e mantém as antigas publicadas no JWKS por um período de graça
@@ -61,7 +61,10 @@ export default class AuthkitKeysRotate extends BaseCommand {
         const alg = algorithm ?? 'RS256';
         const keep = this.keep ?? 2;
         const retire = this.retire ?? false;
-        const vault = resolveKeystoreVault(store, { makePath: (p) => this.app.makePath(p), container: this.app.container });
+        const vault = resolveKeystoreVault(store, {
+            makePath: (p) => this.app.makePath(p),
+            container: this.app.container,
+        });
         const encrypt = jwksInput.encrypt ?? defaultEncryptForStore(store);
         const enc = encrypt ? await loadEncryptionService() : undefined;
         const manager = new KeystoreManager(vault, new KeystoreCodec({ encrypt, enc }), alg);

package/build/host/views/account/apps.edge

@@ -10,16 +10,16 @@
         <h1 class="text-xl font-semibold text-gray-900">{{ t('account.apps.title') }}</h1>
         <p class="mt-1 text-sm text-gray-500">{{ t('account.apps.intro') }}</p>
       </div>
-      <form method="POST" action="/account/logout">
+      <form method="POST" action="{{ accountPaths?.logout ?? '/account/logout' }}">
         <input type="hidden" name="_csrf" value="{{ csrfToken }}">
         <button type="submit" class="text-sm text-gray-500 hover:underline">{{ t('account.apps.logout') }}</button>
       </form>
     </div>
 
     <nav class="mb-6 flex gap-4 text-sm font-medium">
-      <a href="/account/tokens" class="text-gray-500 hover:underline">{{ t('account.tokens.title') }}</a>
-      <a href="/account/security" class="text-gray-500 hover:underline">{{ t('account.security.title') }}</a>
-      <a href="/account/apps" class="text-gray-900 underline">{{ t('account.apps.title') }}</a>
+      <a href="{{ accountPaths?.tokens ?? '/account/tokens' }}" class="text-gray-500 hover:underline">{{ t('account.tokens.title') }}</a>
+      <a href="{{ accountPaths?.security ?? '/account/security' }}" class="text-gray-500 hover:underline">{{ t('account.security.title') }}</a>
+      <a href="{{ accountPaths?.apps ?? '/account/apps' }}" class="text-gray-900 underline">{{ t('account.apps.title') }}</a>
     </nav>
 
     @if(revoked)
@@ -43,7 +43,7 @@
                 <p class="text-sm font-medium text-gray-900">{{ app.name }}</p>
                 <p class="text-xs text-gray-500">{{ t('account.apps.tokens', { accessTokens: app.accessTokens, refreshTokens: app.refreshTokens }) }}</p>
               </div>
-              <form method="POST" action="/account/apps/{{ app.clientId }}/revoke"
+              <form method="POST" action="{{ accountPaths?.apps ?? '/account/apps' }}/{{ app.clientId }}/revoke"
                 onsubmit="return confirm('{{ t('account.apps.revoke_confirm') }}')">
                 <input type="hidden" name="_csrf" value="{{ csrfToken }}">
                 <button type="submit" class="rounded-lg border border-red-300 px-3 py-1.5 text-sm font-semibold text-red-700 hover:bg-red-50">

package/build/host/views/account/login.edge

@@ -3,7 +3,7 @@
 @include('authkit::partials/styles')
 </head>
 <body class="min-h-screen flex items-center justify-center bg-gray-100 p-4">
-  <form method="POST" action="/account/login"
+  <form method="POST" action="{{ accountPaths?.login ?? '/account/login' }}"
     class="w-full max-w-sm rounded-2xl bg-white p-8 shadow-xl ring-1 ring-black/5">
     <input type="hidden" name="_csrf" value="{{ csrfToken }}">
     @if(returnTo)

package/build/host/views/account/mfa.edge

@@ -9,7 +9,7 @@
         <div class="text-xs font-semibold uppercase tracking-widest text-gray-400">{{ t('common.brand_eyebrow') }}</div>
         <h1 class="text-xl font-semibold text-gray-900">{{ t('account.mfa.title') }}</h1>
       </div>
-      <form method="POST" action="/account/logout">
+      <form method="POST" action="{{ accountPaths?.logout ?? '/account/logout' }}">
         <input type="hidden" name="_csrf" value="{{ csrfToken }}">
         <button type="submit" class="text-sm text-gray-500 hover:underline">{{ t('account.mfa.logout') }}</button>
       </form>
@@ -46,7 +46,7 @@
           <code class="mx-auto mt-1 block w-fit break-all rounded bg-gray-100 px-3 py-2 text-sm text-gray-800">{{ secret }}</code>
         @end
 
-        <form method="POST" action="/account/mfa/confirm" class="mt-6">
+        <form method="POST" action="{{ accountPaths?.mfa ?? '/account/mfa' }}/confirm" class="mt-6">
           <input type="hidden" name="_csrf" value="{{ csrfToken }}">
           <label for="code" class="mb-1 block text-sm font-medium text-gray-700">{{ t('account.mfa.confirm_code_label') }}</label>
           <input id="code" name="code" inputmode="numeric" pattern="[0-9]*" maxlength="6" autofocus
@@ -61,7 +61,7 @@
         <p class="text-sm text-gray-700">
           {{{ t('account.mfa.enabled_html') }}}
         </p>
-        <form method="POST" action="/account/mfa/disable" class="mt-4">
+        <form method="POST" action="{{ accountPaths?.mfa ?? '/account/mfa' }}/disable" class="mt-4">
           <input type="hidden" name="_csrf" value="{{ csrfToken }}">
           <button type="submit" class="rounded-lg border border-red-300 px-4 py-2 text-sm font-semibold text-red-600 hover:bg-red-50">
             {{ t('account.mfa.disable') }}
@@ -73,7 +73,7 @@
         <p class="text-sm text-gray-700">
           {{ t('account.mfa.disabled_intro') }}
         </p>
-        <form method="POST" action="/account/mfa/enroll" class="mt-4">
+        <form method="POST" action="{{ accountPaths?.mfa ?? '/account/mfa' }}/enroll" class="mt-4">
           <input type="hidden" name="_csrf" value="{{ csrfToken }}">
           <button type="submit" class="rounded-lg bg-gray-900 px-4 py-2 text-sm font-semibold text-white">
             {{ t('account.mfa.enable') }}
@@ -93,7 +93,7 @@
             @each(pk in passkeys)
               <li class="flex items-center justify-between rounded-lg border border-gray-200 px-3 py-2">
                 <span class="text-sm text-gray-800">{{ pk.label ? pk.label : t('mfa.passkey.unnamed') }}</span>
-                <form method="POST" action="/account/mfa/passkeys/{{ pk.id }}/remove">
+                <form method="POST" action="{{ accountPaths?.mfa ?? '/account/mfa' }}/passkeys/{{ pk.id }}/remove">
                   <input type="hidden" name="_csrf" value="{{ csrfToken }}">
                   <button type="submit" class="text-sm text-red-600 hover:underline">{{ t('mfa.passkey.remove') }}</button>
                 </form>
@@ -124,7 +124,7 @@
         btn.disabled = true
         try {
           // 1) Opções de registro (challenge guardado na sessão server-side).
-          const optsRes = await fetch('/account/mfa/passkeys/options', {
+          const optsRes = await fetch('{{ accountPaths?.mfa ?? '/account/mfa' }}/passkeys/options', {
             method: 'POST',
             headers: { 'content-type': 'application/json', 'x-csrf-token': csrf },
             body: JSON.stringify({}),
@@ -134,7 +134,7 @@
           // 2) Cerimônia de registro no authenticator.
           const attResp = await startRegistration({ optionsJSON })
           // 3) Verifica/persiste no servidor.
-          const verifyRes = await fetch('/account/mfa/passkeys/verify', {
+          const verifyRes = await fetch('{{ accountPaths?.mfa ?? '/account/mfa' }}/passkeys/verify', {
             method: 'POST',
             headers: { 'content-type': 'application/json', 'x-csrf-token': csrf },
             body: JSON.stringify({ response: attResp }),

package/build/host/views/account/orgs.edge

@@ -18,15 +18,15 @@
           <strong>{{ org.name }}</strong> ({{ org.slug }})
           @if(org.isActive)
             <span>{{ t('account.orgs.active_badge') }}</span>
-            <form method="POST" action="/account/orgs/deactivate">
+            <form method="POST" action="{{ accountPaths?.orgs ?? '/account/orgs' }}/deactivate">
               <button>{{ t('account.orgs.deactivate') }}</button>
             </form>
           @else
-            <form method="POST" action="/account/orgs/{{ org.id }}/activate">
+            <form method="POST" action="{{ accountPaths?.orgs ?? '/account/orgs' }}/{{ org.id }}/activate">
               <button>{{ t('account.orgs.activate') }}</button>
             </form>
           @end
-          <form method="POST" action="/account/orgs/{{ org.id }}/leave">
+          <form method="POST" action="{{ accountPaths?.orgs ?? '/account/orgs' }}/{{ org.id }}/leave">
             <button>{{ t('account.orgs.leave') }}</button>
           </form>
         </div>
@@ -38,7 +38,7 @@
       @each(inv in pendingInvitations)
         <div>
           {{ t('account.orgs.invitation_from', { orgName: inv.orgName, role: inv.role }) }}
-          <form method="POST" action="/account/orgs/invitations/{{ inv.id }}/accept">
+          <form method="POST" action="{{ accountPaths?.orgs ?? '/account/orgs' }}/invitations/{{ inv.id }}/accept">
             <button>{{ t('account.orgs.invitation_accept') }}</button>
           </form>
         </div>
@@ -47,7 +47,7 @@
 
     @if(allowSelfCreate)
       <h2>{{ t('account.orgs.create_section') }}</h2>
-      <form method="POST" action="/account/orgs">
+      <form method="POST" action="{{ accountPaths?.orgs ?? '/account/orgs' }}">
         <input name="name" placeholder="{{ t('account.orgs.create_name_label') }}">
         <input name="slug" placeholder="{{ t('account.orgs.create_slug_label') }}">
         <button>{{ t('account.orgs.create_submit') }}</button>

package/build/host/views/account/security.edge

@@ -12,16 +12,16 @@
           <p class="mt-1 text-sm text-gray-500">{{ t('account.security.current_email', { email: email }) }}</p>
         @end
       </div>
-      <form method="POST" action="/account/logout">
+      <form method="POST" action="{{ accountPaths?.logout ?? '/account/logout' }}">
         <input type="hidden" name="_csrf" value="{{ csrfToken }}">
         <button type="submit" class="text-sm text-gray-500 hover:underline">{{ t('account.security.logout') }}</button>
       </form>
     </div>
 
     <nav class="mb-6 flex gap-4 text-sm font-medium">
-      <a href="/account/tokens" class="text-gray-500 hover:underline">{{ t('account.tokens.title') }}</a>
-      <a href="/account/security" class="text-gray-900 underline">{{ t('account.security.title') }}</a>
-      <a href="/account/apps" class="text-gray-500 hover:underline">{{ t('account.apps.title') }}</a>
+      <a href="{{ accountPaths?.tokens ?? '/account/tokens' }}" class="text-gray-500 hover:underline">{{ t('account.tokens.title') }}</a>
+      <a href="{{ accountPaths?.security ?? '/account/security' }}" class="text-gray-900 underline">{{ t('account.security.title') }}</a>
+      <a href="{{ accountPaths?.apps ?? '/account/apps' }}" class="text-gray-500 hover:underline">{{ t('account.apps.title') }}</a>
     </nav>
 
     @if(profileUpdated)
@@ -34,7 +34,7 @@
       <div class="mb-6 rounded-xl bg-white p-6 shadow-sm ring-1 ring-black/5">
         <h2 class="mb-1 text-sm font-semibold text-gray-900">{{ t('account.profile.section') }}</h2>
         <p class="mb-4 text-xs text-gray-500">{{ t('account.profile.intro') }}</p>
-        <form method="POST" action="/account/security/profile" enctype="multipart/form-data" class="space-y-4">
+        <form method="POST" action="{{ accountPaths?.security ?? '/account/security' }}/profile" enctype="multipart/form-data" class="space-y-4">
           <input type="hidden" name="_csrf" value="{{ csrfToken }}">
           @if(avatarUrl)
             <div>
@@ -89,7 +89,7 @@
 
       <div class="mb-6 rounded-xl bg-white p-6 shadow-sm ring-1 ring-black/5">
         <h2 class="mb-4 text-sm font-semibold text-gray-900">{{ t('account.security.password_section') }}</h2>
-        <form method="POST" action="/account/security/password" class="space-y-4">
+        <form method="POST" action="{{ accountPaths?.security ?? '/account/security' }}/password" class="space-y-4">
           <input type="hidden" name="_csrf" value="{{ csrfToken }}">
           <div>
             <label class="mb-1 block text-sm font-medium text-gray-700">{{ t('account.security.current_password_label') }}</label>
@@ -110,7 +110,7 @@
       <div class="rounded-xl bg-white p-6 shadow-sm ring-1 ring-black/5">
         <h2 class="mb-1 text-sm font-semibold text-gray-900">{{ t('account.security.email_section') }}</h2>
         <p class="mb-4 text-xs text-gray-500">{{ t('account.security.email_intro') }}</p>
-        <form method="POST" action="/account/security/email" class="space-y-4">
+        <form method="POST" action="{{ accountPaths?.security ?? '/account/security' }}/email" class="space-y-4">
           <input type="hidden" name="_csrf" value="{{ csrfToken }}">
           <div>
             <label class="mb-1 block text-sm font-medium text-gray-700">{{ t('account.security.new_email_label') }}</label>
@@ -164,7 +164,7 @@
       <div class="mt-6 rounded-xl bg-white p-6 shadow-sm ring-1 ring-black/5">
         <h2 class="mb-1 text-sm font-semibold text-gray-900">{{ t('account.security.trusted_devices_section') }}</h2>
         <p class="mb-4 text-xs text-gray-500">{{ t('account.security.trusted_devices_intro') }}</p>
-        <form method="POST" action="/account/security/trusted-devices/revoke">
+        <form method="POST" action="{{ accountPaths?.security ?? '/account/security' }}/trusted-devices/revoke">
           <input type="hidden" name="_csrf" value="{{ csrfToken }}">
           <button type="submit" class="rounded-lg border border-gray-300 px-4 py-2 text-sm font-semibold text-gray-700 hover:bg-gray-50">
             {{ t('account.security.trusted_devices_revoke') }}
@@ -177,7 +177,7 @@
       <div class="mt-6 rounded-xl bg-white p-6 shadow-sm ring-1 ring-black/5">
         <h2 class="mb-1 text-sm font-semibold text-gray-900">{{ t('account.export.section') }}</h2>
         <p class="mb-4 text-xs text-gray-500">{{ t('account.export.intro') }}</p>
-        <a href="/account/security/export"
+        <a href="{{ accountPaths?.security ?? '/account/security' }}/export"
           class="inline-block rounded-lg border border-gray-300 px-4 py-2 text-sm font-semibold text-gray-700 hover:bg-gray-50">
           {{ t('account.export.submit') }}
         </a>
@@ -193,7 +193,7 @@
       <div class="mt-6 rounded-xl bg-white p-6 shadow-sm ring-1 ring-red-200">
         <h2 class="mb-1 text-sm font-semibold text-red-700">{{ t('account.delete.section') }}</h2>
         <p class="mb-4 text-xs text-gray-500">{{ t('account.delete.intro') }}</p>
-        <form method="POST" action="/account/security/delete" class="space-y-4">
+        <form method="POST" action="{{ accountPaths?.security ?? '/account/security' }}/delete" class="space-y-4">
           <input type="hidden" name="_csrf" value="{{ csrfToken }}">
           <div>
             <label class="mb-1 block text-sm font-medium text-gray-700">{{ t('account.delete.confirm_password_label') }}</label>

package/build/host/views/account/tokens.edge

@@ -10,9 +10,9 @@
         <h1 class="text-xl font-semibold text-gray-900">{{ t('account.tokens.title') }}</h1>
       </div>
       <div class="flex items-center gap-4">
-        <a href="/account/security" class="text-sm text-gray-500 hover:underline">{{ t('account.tokens.security') }}</a>
-        <a href="/account/apps" class="text-sm text-gray-500 hover:underline">{{ t('account.apps.title') }}</a>
-        <form method="POST" action="/account/logout">
+        <a href="{{ accountPaths?.security ?? '/account/security' }}" class="text-sm text-gray-500 hover:underline">{{ t('account.tokens.security') }}</a>
+        <a href="{{ accountPaths?.apps ?? '/account/apps' }}" class="text-sm text-gray-500 hover:underline">{{ t('account.apps.title') }}</a>
+        <form method="POST" action="{{ accountPaths?.logout ?? '/account/logout' }}">
           <input type="hidden" name="_csrf" value="{{ csrfToken }}">
           <button type="submit" class="text-sm text-gray-500 hover:underline">{{ t('account.tokens.logout') }}</button>
         </form>
@@ -30,7 +30,7 @@
       </div>
     @end
 
-    <form method="POST" action="/account/tokens"
+    <form method="POST" action="{{ accountPaths?.tokens ?? '/account/tokens' }}"
       class="mb-6 flex gap-2 rounded-xl bg-white p-4 shadow-sm ring-1 ring-black/5">
       <input type="hidden" name="_csrf" value="{{ csrfToken }}">
       <input name="name" placeholder="{{ t('account.tokens.name_placeholder') }}"
@@ -63,7 +63,7 @@
                 <p class="text-xs text-gray-400">{{ t('account.tokens.audience', { audience: token.audience }) }}</p>
               @end
             </div>
-            <form method="POST" action="/account/tokens/{{ token.id }}/revoke">
+            <form method="POST" action="{{ accountPaths?.tokens ?? '/account/tokens' }}/{{ token.id }}/revoke">
               <input type="hidden" name="_csrf" value="{{ csrfToken }}">
               <button type="submit" class="text-sm text-red-600 hover:underline">{{ t('account.tokens.revoke') }}</button>
             </form>

package/build/host/views/otp-unlock.edge

@@ -15,7 +15,7 @@
         </div>
         <h1 class="mb-2 text-lg font-semibold text-gray-900">{{ t('otp_unlock.ok_title') }}</h1>
         <p class="mb-6 text-sm text-gray-600">{{ t('otp_unlock.ok_body') }}</p>
-        <a href="/account/login" class="inline-block rounded-lg bg-gray-900 px-4 py-2 text-sm font-medium text-white hover:bg-gray-700">{{ t('otp_unlock.login_link') }}</a>
+        <a href="{{ loginUrl ?? '/account/login' }}" class="inline-block rounded-lg bg-gray-900 px-4 py-2 text-sm font-medium text-white hover:bg-gray-700">{{ t('otp_unlock.login_link') }}</a>
       @else
         <div class="mb-4 flex justify-center">
           <span class="inline-flex h-12 w-12 items-center justify-center rounded-full bg-red-100 text-red-600">
@@ -32,7 +32,7 @@
             {{ t('otp_unlock.invalid_body') }}
           @end
         </p>
-        <a href="/account/login" class="inline-block rounded-lg bg-gray-900 px-4 py-2 text-sm font-medium text-white hover:bg-gray-700">{{ t('otp_unlock.login_link') }}</a>
+        <a href="{{ loginUrl ?? '/account/login' }}" class="inline-block rounded-lg bg-gray-900 px-4 py-2 text-sm font-medium text-white hover:bg-gray-700">{{ t('otp_unlock.login_link') }}</a>
       @end
     </div>
   </div>

package/build/index.d.ts

@@ -11,9 +11,9 @@ export { withMfa } from './src/mixins/with_mfa.js';
 export { OidcService } from './src/provider/oidc_service.js';
 export { registerOidcRoutes } from './src/register_routes.js';
 export type { AuthServerConfigInput, ResolvedServerConfig, DynamicRegistrationConfigInput, ResolvedDynamicRegistrationConfig, AdminConfigInput, ResolvedAdminConfig, AdminApiConfigInput, ResolvedAdminApiConfig, } from './src/define_config.js';
-export { resolveAdmin, resolveAdminApi, resolveWebauthn, resolveDynamicRegistration } from './src/define_config.js';
+export { resolveAdmin, resolveAdminApi, resolveWebauthn, resolveDynamicRegistration, } from './src/define_config.js';
 export type { WebauthnConfigInput, ResolvedWebauthnConfig } from './src/define_config.js';
-export { resolvePasswordless, resolveLogin, resolveAuthMethodsConfig } from './src/define_config.js';
+export { resolvePasswordless, resolveLogin, resolveAuthMethodsConfig, } from './src/define_config.js';
 export type { PasswordlessConfigInput, ResolvedPasswordlessConfig, AuthMethodsConfigInput, ResolvedAuthMethodsConfig, LoginConfigInput, ResolvedLoginConfig, } from './src/define_config.js';
 export { resolveTrustedDevices, isTrustedDeviceValid, buildTrustedDevicePayload, TRUSTED_DEVICE_COOKIE, } from './src/host/trusted_device.js';
 export type { TrustedDevicesConfigInput, ResolvedTrustedDevicesConfig, TrustedDevicePayload, } from './src/host/trusted_device.js';
@@ -29,7 +29,7 @@ export { PasswordManager, PasswordPolicyError, } from './src/password/password_m
 export type { PasswordConfigInput, LegacyPasswordVerifier, PasswordVerifyResult, } from './src/password/password_manager.js';
 export { checkPasswordPolicy, policyViolationParams, DEFAULT_PWNED_TIMEOUT_MS, } from './src/password/policy.js';
 export type { ResolvedPasswordPolicy, ResolvedPasswordConfig, PasswordPolicyViolation, } from './src/password/policy.js';
-export { isPasswordPwned, __setFetchForTests as __setPwnedFetchForTests } from './src/password/pwned.js';
+export { isPasswordPwned, __setFetchForTests as __setPwnedFetchForTests, } from './src/password/pwned.js';
 export type { PwnedLogger, FetchLike as PwnedFetchLike } from './src/password/pwned.js';
 export { withProviderIdentity } from './src/mixins/with_provider_identity.js';
 export type { ProviderIdentityRow, ProviderIdentityClass, } from './src/mixins/with_provider_identity.js';
@@ -56,7 +56,7 @@ export { registerAuthHost } from './src/host/register_auth_host.js';
 export type { AuthHostOptions } from './src/host/register_auth_host.js';
 export { getAdminPrefix, setAdminPrefix, normalizeAdminPrefix, getAdminApiPrefix, setAdminApiPrefix, normalizeAdminApiPrefix, } from './src/host/admin_prefix.js';
 export { resolveRateLimit, resolveNotifications } from './src/define_config.js';
-export type { ResolvedNotificationsConfig, } from './src/define_config.js';
+export type { ResolvedNotificationsConfig } from './src/define_config.js';
 export type { RateLimitConfigInput, RateLimitBucket, ResolvedRateLimitConfig, } from './src/define_config.js';
 export { createAuthThrottles } from './src/host/rate_limit.js';
 export type { AuthThrottles, ThrottleMiddleware } from './src/host/rate_limit.js';
@@ -100,10 +100,10 @@ export type { OrganizationsCapability, OrgSummary, OrgMember, OrgInvitation, Act
 export { configure } from './commands/configure.js';
 export { stubsRoot } from './stubs/main.js';
 export { RuntimeSettings, supportsSettings } from './src/host/runtime_settings.js';
-export type { SettingsCapability, SettingRow, RuntimeSettingsOptions } from './src/host/runtime_settings.js';
+export type { SettingsCapability, SettingRow, RuntimeSettingsOptions, } from './src/host/runtime_settings.js';
 export { buildKeysStatus, rotateNow } from './src/host/key_rotation_actions.js';
 export type { KeysStatus as ServerKeysStatus } from './src/host/key_rotation_actions.js';
-export { resolveEffectiveBotProtection, } from './src/host/bot_protection.js';
+export { resolveEffectiveBotProtection } from './src/host/bot_protection.js';
 export type { BotProtectionSetting } from './src/host/bot_protection.js';
 export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
 export type { SettingKey, RegistrationSetting, RequireVerifiedEmailSetting, MaintenanceModeSetting, ResolvedMaintenanceMode, AuthMethodsSetting, ResolvedAuthMethods, AuthMethodsCapabilities, AuthMethodsConfigOverride, } from './src/host/runtime_toggles.js';
@@ -116,7 +116,7 @@ export type { StartImpersonationParams, ImpersonationState, } from './src/host/i
 export { SUDO_SESSION_KEY, SUDO_ACCOUNT_SESSION_KEY, SUDO_MODE_DEFAULTS, requireSudo, isSudoActive, markSudo, resolveEffectiveSudoMode, } from './src/host/sudo_mode.js';
 export type { SudoModeSetting, ResolvedSudoModeSetting, } from './src/host/sudo_mode.js';
 export { sudoMethods } from './src/host/sudo/index.js';
-export { completeSudo, fail as failSudo, LAST_METHOD_SESSION_KEY } from './src/host/sudo/runtime.js';
+export { completeSudo, fail as failSudo, LAST_METHOD_SESSION_KEY, } from './src/host/sudo/runtime.js';
 export { sudoContextFrom } from './src/host/sudo/runtime.js';
 export type { SudoMethod, SudoContext, SudoMethodDescriptor, SudoRouteHelpers, } from './src/host/sudo/types.js';
 export { authkitUserProvider } from './src/host/adonis_auth_user_provider.js';

package/build/index.js

@@ -8,8 +8,8 @@ export { withCredentials } from './src/mixins/with_credentials.js';
 export { withMfa } from './src/mixins/with_mfa.js';
 export { OidcService } from './src/provider/oidc_service.js';
 export { registerOidcRoutes } from './src/register_routes.js';
-export { resolveAdmin, resolveAdminApi, resolveWebauthn, resolveDynamicRegistration } from './src/define_config.js';
-export { resolvePasswordless, resolveLogin, resolveAuthMethodsConfig } from './src/define_config.js';
+export { resolveAdmin, resolveAdminApi, resolveWebauthn, resolveDynamicRegistration, } from './src/define_config.js';
+export { resolvePasswordless, resolveLogin, resolveAuthMethodsConfig, } from './src/define_config.js';
 export { resolveTrustedDevices, isTrustedDeviceValid, buildTrustedDevicePayload, TRUSTED_DEVICE_COOKIE, } from './src/host/trusted_device.js';
 export { resolveBotProtection, botProtectionApplies, extractBotToken, verifyBotProtection, guardBotProtection, DEFAULT_BOT_TOKEN_FIELDS, } from './src/host/bot_protection.js';
 export { lucidAccountStore, appKeyEncrypter } from './src/accounts/lucid_account_store.js';
@@ -18,7 +18,7 @@ export { supportsMfa, supportsPasskeys, supportsProviderIdentity, supportsAccoun
 // Gerência de senha: lazy rehash + legacy verifier, política e checagem de vazamento.
 export { PasswordManager, PasswordPolicyError, } from './src/password/password_manager.js';
 export { checkPasswordPolicy, policyViolationParams, DEFAULT_PWNED_TIMEOUT_MS, } from './src/password/policy.js';
-export { isPasswordPwned, __setFetchForTests as __setPwnedFetchForTests } from './src/password/pwned.js';
+export { isPasswordPwned, __setFetchForTests as __setPwnedFetchForTests, } from './src/password/pwned.js';
 export { withProviderIdentity } from './src/mixins/with_provider_identity.js';
 export { withWebauthnCredential } from './src/mixins/with_webauthn_credential.js';
 export { lucidPatStore } from './src/pat/lucid_pat_store.js';
@@ -66,7 +66,7 @@ export { stubsRoot } from './stubs/main.js';
 export { RuntimeSettings, supportsSettings } from './src/host/runtime_settings.js';
 // Key rotation actions — shared between the Admin REST API controller and the SDK embedded driver.
 export { buildKeysStatus, rotateNow } from './src/host/key_rotation_actions.js';
-export { resolveEffectiveBotProtection, } from './src/host/bot_protection.js';
+export { resolveEffectiveBotProtection } from './src/host/bot_protection.js';
 // Runtime toggles (registration, require_verified_email, maintenance_mode).
 export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
 export { resolveRegistration } from './src/define_config.js';
@@ -86,7 +86,7 @@ export { SUDO_SESSION_KEY, SUDO_ACCOUNT_SESSION_KEY, SUDO_MODE_DEFAULTS, require
 // perderia o audit `sudo.confirmed`, a preferência de método e o redirect para
 // o `return_to`.
 export { sudoMethods } from './src/host/sudo/index.js';
-export { completeSudo, fail as failSudo, LAST_METHOD_SESSION_KEY } from './src/host/sudo/runtime.js';
+export { completeSudo, fail as failSudo, LAST_METHOD_SESSION_KEY, } from './src/host/sudo/runtime.js';
 // Montador do `SudoContext` que `completeSudo`/`failSudo` recebem. Exportado
 // junto porque sem ele o host teria de montar o contexto na mão (resolver o
 // service do container, carregar a conta, validar o `return_to`) — e um

package/build/providers/authkit_server_provider.d.ts

@@ -1,8 +1,8 @@
-import type { ApplicationService } from '@adonisjs/core/types';
 import type { MetricsRecorder } from '@adonis-agora/authkit-core';
-import { OidcService } from '../src/provider/oidc_service.js';
+import type { ApplicationService } from '@adonisjs/core/types';
 import type { AccountStore } from '../src/accounts/account_store.js';
 import type { PatStore } from '../src/pat/pat_store.js';
+import { OidcService } from '../src/provider/oidc_service.js';
 declare module '@adonisjs/core/types' {
     interface ContainerBindings {
         'authkit.server': OidcService;

package/build/providers/authkit_server_provider.js

@@ -2,17 +2,18 @@ import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { configProvider } from '@adonisjs/core';
 import { RuntimeException } from '@adonisjs/core/exceptions';
-import { OidcService } from '../src/provider/oidc_service.js';
-import { KeystoreReloadPoller } from '../src/provider/keystore_reload.js';
-import { KeyRotationScheduler } from '../src/provider/key_rotation_scheduler.js';
-import { makeSingleFlightLock } from '../src/provider/single_flight_lock.js';
+import { setBootedApp } from '../services/booted_app.js';
+import { defaultEncryptForStore } from '../src/define_config.js';
+import { resolveAppKey } from '../src/host/app_key.js';
 import { resolveEffectiveKeyRotation } from '../src/host/key_rotation.js';
 import { RuntimeSettings } from '../src/host/runtime_settings.js';
-import { defaultEncryptForStore } from '../src/define_config.js';
-import { resolveKeystoreVault, KeystoreManager } from '../src/keys/keystore_manager.js';
 import { KeystoreCodec } from '../src/keys/keystore_codec.js';
 import { loadEncryptionService } from '../src/keys/keystore_crypto.js';
-import { resolveAppKey } from '../src/host/app_key.js';
+import { KeystoreManager, resolveKeystoreVault } from '../src/keys/keystore_manager.js';
+import { KeyRotationScheduler } from '../src/provider/key_rotation_scheduler.js';
+import { KeystoreReloadPoller } from '../src/provider/keystore_reload.js';
+import { OidcService } from '../src/provider/oidc_service.js';
+import { makeSingleFlightLock } from '../src/provider/single_flight_lock.js';
 export default class AuthkitServerProvider {
     app;
     constructor(app) {
@@ -85,6 +86,12 @@ export default class AuthkitServerProvider {
         }
     }
     register() {
+        // Entrega o app BOOTADO ao singleton de `services/main` (e ao
+        // `recordSubRevocation` do AdminSessionsService) para que nunca precisem
+        // `import`ar uma cópia de `@adonisjs/core`/`services/app` que pode não ser a
+        // que o `bin/server` bootou — dual-package hazard do core (ver
+        // `services/booted_app.ts`).
+        setBootedApp(this.app);
         this.app.container.singleton('authkit.server', async () => {
             const configProviderValue = this.app.config.get('authkit');
             const config = (await configProvider.resolve(this.app, configProviderValue));
@@ -105,7 +112,10 @@ export default class AuthkitServerProvider {
             if (jwksInput?.source === 'managed' && jwksInput?.store) {
                 const appRef = this.app;
                 const buildManager = async () => {
-                    const vault = resolveKeystoreVault(jwksInput.store, { makePath: (p) => appRef.makePath(p), container: appRef.container });
+                    const vault = resolveKeystoreVault(jwksInput.store, {
+                        makePath: (p) => appRef.makePath(p),
+                        container: appRef.container,
+                    });
                     const encrypt = jwksInput.encrypt ?? defaultEncryptForStore(jwksInput.store);
                     // best-effort (≠ boot, que lança): se a encryption sumir em runtime, o reload
                     // degrada para "sem hot-reload" (o onError do poller engole) em vez de derrubar o processo.
@@ -123,7 +133,11 @@ export default class AuthkitServerProvider {
                 };
                 keystoreManager = async () => buildManager();
             }
-            return new OidcService(config, appKey, metrics, { jwksLoader, keystoreHead, keystoreManager });
+            return new OidcService(config, appKey, metrics, {
+                jwksLoader,
+                keystoreHead,
+                keystoreManager,
+            });
         });
         this.app.container.singleton('authkit.metrics', async () => {
             const value = this.app.config.get('authkit');
@@ -231,7 +245,9 @@ export default class AuthkitServerProvider {
         // conexão que o resto do authkit (mesmo padrão do expire_scan_command).
         const value = this.app.config.get('authkit');
         const config = value
-            ? (await configProvider.resolve(this.app, value).catch(() => null))
+            ? (await configProvider
+                .resolve(this.app, value)
+                .catch(() => null))
             : null;
         const connection = config?.schema?.connection;
         // RuntimeSettings sem request (mesmo padrão de expire_scan_command / security_notice_service).