@adonis-agora/authkit-server 0.46.0 → 0.48.0

package/build/src/define_config.js

@@ -1,22 +1,22 @@
-import { configProvider } from "@adonisjs/core";
-import { generateJwks } from "./keys/jwks_manager.js";
-import { KeystoreManager, resolveKeystoreVault, } from "./keys/keystore_manager.js";
-import { KeystoreCodec } from "./keys/keystore_codec.js";
-import { loadEncryptionService } from "./keys/keystore_crypto.js";
-import { adapters, } from "./adapters/factory.js";
-import { composeAuditSink, resolveEvents, } from "./events/dispatcher.js";
-import { resolveMessages, } from "./host/i18n.js";
-import { resolveTrustedDevices, } from "./host/trusted_device.js";
-import { resolveBotProtection, } from "./host/bot_protection.js";
-import { deriveLockedSettingKeys } from "./host/config_locks.js";
-import { edgeRenderer } from "./host/renderers/edge_renderer.js";
+import { configProvider } from '@adonisjs/core';
+import { adapters } from './adapters/factory.js';
+import { composeAuditSink, resolveEvents } from './events/dispatcher.js';
+import { resolveBotProtection, } from './host/bot_protection.js';
+import { deriveLockedSettingKeys } from './host/config_locks.js';
+import { resolveMessages } from './host/i18n.js';
+import { edgeRenderer } from './host/renderers/edge_renderer.js';
+import { resolveTrustedDevices, } from './host/trusted_device.js';
+import { generateJwks } from './keys/jwks_manager.js';
+import { KeystoreCodec } from './keys/keystore_codec.js';
+import { loadEncryptionService } from './keys/keystore_crypto.js';
+import { KeystoreManager, resolveKeystoreVault } from './keys/keystore_manager.js';
 export { adapters };
 const RATE_LIMIT_DEFAULTS = {
-    login: { points: 10, duration: "1 min" },
-    introspection: { points: 60, duration: "1 min" },
-    adminIp: { points: 30, duration: "1 min" },
+    login: { points: 10, duration: '1 min' },
+    introspection: { points: 60, duration: '1 min' },
+    adminIp: { points: 30, duration: '1 min' },
     // Mesmos limites do login, bucket separado — ver `ResolvedRateLimitConfig.sudo`.
-    sudo: { points: 10, duration: "1 min" },
+    sudo: { points: 10, duration: '1 min' },
 };
 export function resolveRateLimit(input) {
     const enabled = input?.enabled ?? true;
@@ -54,9 +54,9 @@ export function resolveDynamicRegistration(input) {
     const enabled = input?.enabled ?? false;
     const management = input?.management ?? false;
     if (management && !enabled) {
-        throw new Error("authkit: dynamicRegistration.management (RFC 7592) requer " +
-            "dynamicRegistration.enabled: true (RFC 7591). Habilite o registro dinâmico " +
-            "ou desligue o management.");
+        throw new Error('authkit: dynamicRegistration.management (RFC 7592) requer ' +
+            'dynamicRegistration.enabled: true (RFC 7591). Habilite o registro dinâmico ' +
+            'ou desligue o management.');
     }
     return {
         enabled,
@@ -70,11 +70,11 @@ export function resolveDeviceFlow(input) {
 export function resolveUploads(input) {
     return {
         avatars: {
-            storage: input?.avatars?.storage ?? "auto",
+            storage: input?.avatars?.storage ?? 'auto',
             disk: input?.avatars?.disk,
-            directory: input?.avatars?.directory ?? "authkit/avatars",
-            collection: input?.avatars?.collection ?? "avatar",
-            ownerType: input?.avatars?.ownerType ?? "AuthAccount",
+            directory: input?.avatars?.directory ?? 'authkit/avatars',
+            collection: input?.avatars?.collection ?? 'avatar',
+            ownerType: input?.avatars?.ownerType ?? 'AuthAccount',
             maxSizeMb: input?.avatars?.maxSizeMb ?? 5,
         },
     };
@@ -89,7 +89,7 @@ export function resolvePar(input) {
     };
 }
 export function resolveStepUp(input) {
-    const mfaAcr = input?.mfaAcr ?? "urn:authkit:mfa";
+    const mfaAcr = input?.mfaAcr ?? 'urn:authkit:mfa';
     // Garante que o mfaAcr esteja sempre na lista anunciada como suportada.
     const acrValues = Array.from(new Set([...(input?.acrValues ?? []), mfaAcr]));
     return { acrValues, mfaAcr };
@@ -106,13 +106,13 @@ export function resolveAuthMethodsConfig(input) {
     if (!input)
         return {};
     const out = {};
-    if (typeof input.password === "boolean")
+    if (typeof input.password === 'boolean')
         out.password = input.password;
-    if (typeof input.magicLink === "boolean")
+    if (typeof input.magicLink === 'boolean')
         out.magicLink = input.magicLink;
-    if (typeof input.passkey === "boolean")
+    if (typeof input.passkey === 'boolean')
         out.passkey = input.passkey;
-    if (typeof input.forgotPassword === "boolean")
+    if (typeof input.forgotPassword === 'boolean')
         out.forgotPassword = input.forgotPassword;
     return out;
 }
@@ -134,7 +134,7 @@ export function resolveRegistration(input) {
  * herda o `format` raiz quando não especifica o seu.
  */
 export function resolveAccessTokens(issuer, input) {
-    const format = input?.format ?? "opaque";
+    const format = input?.format ?? 'opaque';
     const audience = input?.audience ?? issuer;
     const resources = {};
     for (const [indicator, rc] of Object.entries(input?.resources ?? {})) {
@@ -145,26 +145,26 @@ export function resolveAccessTokens(issuer, input) {
             expiresIn: rc.expiresIn,
         };
     }
-    const anyResourceJwt = Object.values(resources).some((r) => r.format === "jwt");
-    const anyJwt = format === "jwt" || anyResourceJwt;
+    const anyResourceJwt = Object.values(resources).some((r) => r.format === 'jwt');
+    const anyJwt = format === 'jwt' || anyResourceJwt;
     return { format, audience, anyJwt, resources };
 }
 export function resolveAdmin(input) {
     return {
         enabled: input?.enabled ?? false,
-        roles: input?.roles && input.roles.length > 0 ? input.roles : ["ADMIN"],
+        roles: input?.roles && input.roles.length > 0 ? input.roles : ['ADMIN'],
         impersonation: false,
     };
 }
 /** Lê API keys de `AUTHKIT_ADMIN_API_KEY` (uma ou várias, separadas por vírgula). */
 function adminApiKeysFromEnv() {
-    return (process.env.AUTHKIT_ADMIN_API_KEY ?? "")
-        .split(",")
+    return (process.env.AUTHKIT_ADMIN_API_KEY ?? '')
+        .split(',')
         .map((key) => key.trim())
         .filter(Boolean);
 }
 export function resolveAdminApi(input) {
-    const apiKeys = input?.apiKeys === "env" ? adminApiKeysFromEnv() : (input?.apiKeys ?? []);
+    const apiKeys = input?.apiKeys === 'env' ? adminApiKeysFromEnv() : (input?.apiKeys ?? []);
     return {
         // Default inteligente: liga quando há key resolvida (a menos que enabled:false explícito).
         enabled: input?.enabled ?? apiKeys.length > 0,
@@ -174,10 +174,10 @@ export function resolveAdminApi(input) {
 export function resolveOrganizations(input) {
     return {
         enabled: input?.enabled,
-        roles: ["owner", "admin", "member"],
+        roles: ['owner', 'admin', 'member'],
         allowSelfCreate: false,
         invitationTtlHours: 168,
-        claimStrategy: input?.claimStrategy ?? "active",
+        claimStrategy: input?.claimStrategy ?? 'active',
     };
 }
 /**
@@ -185,8 +185,8 @@ export function resolveOrganizations(input) {
  * `rpName` cai no `fallbackName` (branding/mfaIssuer) quando ausente.
  */
 export function resolveWebauthn(issuer, fallbackName, input) {
-    let host = "localhost";
-    let origin = "http://localhost";
+    let host = 'localhost';
+    let origin = 'http://localhost';
     try {
         const url = new URL(issuer);
         host = url.hostname;
@@ -205,7 +205,7 @@ const UNITS = { s: 1, m: 60, h: 3600, d: 86400 };
 export function toSeconds(value, fallback) {
     if (value === undefined)
         return fallback;
-    if (typeof value === "number")
+    if (typeof value === 'number')
         return value;
     const m = /^(\d+)\s*([smhd])$/.exec(value.trim());
     if (!m)
@@ -219,9 +219,9 @@ export function toSeconds(value, fallback) {
  * internamente — encrypt OFF para não duplo-encriptar.
  */
 export function defaultEncryptForStore(store) {
-    if (typeof store === "string")
+    if (typeof store === 'string')
         return true;
-    return ["file", "drive", "lucid", "redis"].includes(store.driver);
+    return ['file', 'drive', 'lucid', 'redis'].includes(store.driver);
 }
 /**
  * Mensagem de aviso quando `jwks: 'auto'` cai no fallback de disco (sem
@@ -230,55 +230,52 @@ export function defaultEncryptForStore(store) {
 export function jwksAutoFallbackWarning(storePath) {
     if (!storePath)
         return null;
-    return (`AuthKit: jwks 'auto' caiu no fallback de disco (${storePath}) — a chave privada de ` +
-        `assinatura será persistida em arquivo. Para produção, defina AUTHKIT_JWKS ` +
-        `(secret manager) ou configure jwks.store explicitamente.`);
+    return `AuthKit: jwks 'auto' caiu no fallback de disco (${storePath}) — a chave privada de assinatura será persistida em arquivo. Para produção, defina AUTHKIT_JWKS (secret manager) ou configure jwks.store explicitamente.`;
 }
 export function defineConfig(config) {
     return configProvider.create(async (app) => {
         const AdapterClass = await config.adapter.resolver(app);
         // `jwks: 'auto'` → resolve env-aware: AUTHKIT_JWKS inline, senão managed em arquivo.
-        const jwksConfig = config.jwks === "auto"
+        const jwksConfig = config.jwks === 'auto'
             ? process.env.AUTHKIT_JWKS
                 ? {
-                    source: "jwks",
+                    source: 'jwks',
                     keys: JSON.parse(process.env.AUTHKIT_JWKS).keys,
                 }
                 : {
-                    source: "managed",
-                    algorithm: "RS256",
-                    store: "tmp/authkit_jwks.json",
+                    source: 'managed',
+                    algorithm: 'RS256',
+                    store: 'tmp/authkit_jwks.json',
                 }
             : config.jwks;
-        if (config.jwks === "auto" && !process.env.AUTHKIT_JWKS) {
+        if (config.jwks === 'auto' && !process.env.AUTHKIT_JWKS) {
             const warning = jwksAutoFallbackWarning(jwksConfig.store ?? null);
             if (warning) {
                 await app.container
-                    .make("logger")
+                    .make('logger')
                     .then((l) => l?.warn(warning))
                     .catch(() => { });
             }
         }
         const storeCfg = jwksConfig.store;
-        if (jwksConfig.source === "managed" &&
+        if (jwksConfig.source === 'managed' &&
             storeCfg &&
-            typeof storeCfg === "object" &&
-            storeCfg.driver === "redis") {
+            typeof storeCfg === 'object' &&
+            storeCfg.driver === 'redis') {
             await app.container
-                .make("logger")
+                .make('logger')
                 .then((l) => l?.warn('AuthKit: keystore no driver "redis" — garanta PERSISTÊNCIA (RDB/AOF). Num Redis cache-only, um flush apaga o keystore e invalida todos os tokens.'))
                 .catch(() => { });
         }
         let jwks;
-        if (jwksConfig.source === "managed") {
-            const alg = jwksConfig.algorithm ?? "RS256";
+        if (jwksConfig.source === 'managed') {
+            const alg = jwksConfig.algorithm ?? 'RS256';
             if (jwksConfig.store) {
                 const vault = resolveKeystoreVault(jwksConfig.store, {
                     makePath: (p) => app.makePath(p),
                     container: app.container,
                 });
-                const encrypt = jwksConfig.encrypt ??
-                    defaultEncryptForStore(jwksConfig.store);
+                const encrypt = jwksConfig.encrypt ?? defaultEncryptForStore(jwksConfig.store);
                 const enc = encrypt ? await loadEncryptionService() : undefined;
                 const manager = new KeystoreManager(vault, new KeystoreCodec({ encrypt, enc }), alg);
                 const store = await manager.ensure();
@@ -295,7 +292,7 @@ export function defineConfig(config) {
         // #9: mfaIssuer efetivo — top-level do defineConfig vence; senão o do lucidAccountStore; senão default.
         const effectiveMfaIssuer = config.mfaIssuer ??
             config.accountStore?.__mfaIssuer ??
-            "AuthKit";
+            'AuthKit';
         return {
             issuer: config.issuer,
             AdapterClass,
@@ -308,7 +305,7 @@ export function defineConfig(config) {
                 idToken: toSeconds(config.ttl?.idToken, 900),
                 session: toSeconds(config.ttl?.session, 604800),
             },
-            globalRolesClaim: config.globalRolesClaim ?? "roles",
+            globalRolesClaim: config.globalRolesClaim ?? 'roles',
             resolveTokenRoles: config.resolveTokenRoles,
             cookieKeys: config.cookieKeys ?? [],
             observability: config.observability ?? {},
@@ -319,7 +316,7 @@ export function defineConfig(config) {
             },
             accountStore: config.accountStore,
             patStore: config.patStore,
-            mountPath: config.mountPath ?? "/oidc",
+            mountPath: config.mountPath ?? '/oidc',
             accountHome: config.accountHome,
             // Default de runtime: sem isso, `render` ficava `undefined` e TODA
             // request a `/account/*`/`/auth/interaction/*` estourava um 500 sem
@@ -350,9 +347,7 @@ export function defineConfig(config) {
             // #9: reusa mfaIssuer/webauthn declarados no lucidAccountStore quando o
             // top-level não os fornece — consumidor declara UMA vez. Top-level ainda vence.
             mfaIssuer: effectiveMfaIssuer,
-            webauthn: resolveWebauthn(config.issuer, effectiveMfaIssuer, config.webauthn ??
-                config.accountStore
-                    ?.__webauthn),
+            webauthn: resolveWebauthn(config.issuer, effectiveMfaIssuer, config.webauthn ?? config.accountStore?.__webauthn),
             dynamicRegistration: resolveDynamicRegistration(config.dynamicRegistration),
             deviceFlow: resolveDeviceFlow(config.deviceFlow),
             uploads: resolveUploads(config.uploads),
@@ -371,7 +366,7 @@ export function defineConfig(config) {
             organizations: resolveOrganizations(config.organizations),
             resolveGeo: config.resolveGeo,
             messages: resolveMessages(config.i18n),
-            locale: config.i18n?.locale ?? "pt-BR",
+            locale: config.i18n?.locale ?? 'pt-BR',
             schema: {
                 autoManage: config.schema?.autoManage !== false,
                 connection: config.schema?.connection,

package/build/src/doctor/checks.js

@@ -35,7 +35,9 @@ export function checkIssuer(input) {
     catch {
         return [{ level: 'error', message: `issuer is not a valid URL: "${issuer}".` }];
     }
-    const findings = [{ level: 'ok', message: `valid issuer: ${url.origin}${url.pathname}` }];
+    const findings = [
+        { level: 'ok', message: `valid issuer: ${url.origin}${url.pathname}` },
+    ];
     const normalize = (p) => (p.endsWith('/') ? p.slice(0, -1) : p) || '/';
     if (normalize(url.pathname) !== normalize(mountPath)) {
         findings.push({
@@ -143,7 +145,12 @@ export function checkSession(input) {
         ];
     }
     if (!input.sessionConfig) {
-        return [{ level: 'warn', message: "config('session') missing — the session provider may not be configured." }];
+        return [
+            {
+                level: 'warn',
+                message: "config('session') missing — the session provider may not be configured.",
+            },
+        ];
     }
     const findings = [{ level: 'ok', message: 'session provider configured.' }];
     const driver = input.sessionConfig.store ?? input.sessionConfig.driver;
@@ -158,7 +165,10 @@ export function checkSession(input) {
 /** Hint de exceções de CSRF do shield para o mountPath. */
 export function checkShield(input) {
     if (!input.peers.shield) {
-        return { level: 'error', message: '@adonisjs/shield is not importable — install it (required peer).' };
+        return {
+            level: 'error',
+            message: '@adonisjs/shield is not importable — install it (required peer).',
+        };
     }
     const mountPath = input.authkitConfig?.mountPath ?? '/oidc';
     return {
@@ -169,12 +179,18 @@ export function checkShield(input) {
 /** ally só é necessário quando social está configurado. */
 export function checkAlly(input) {
     const social = input.authkitConfig?.social;
-    const usesSocial = !!social && (Array.isArray(social.providers) ? social.providers.length > 0 : Object.keys(social).length > 0);
+    const usesSocial = !!social &&
+        (Array.isArray(social.providers)
+            ? social.providers.length > 0
+            : Object.keys(social).length > 0);
     if (!usesSocial) {
         return { level: 'ok', message: 'social login not configured — @adonisjs/ally is optional.' };
     }
     if (!input.peers.ally) {
-        return { level: 'error', message: 'social login configured, but @adonisjs/ally is not importable.' };
+        return {
+            level: 'error',
+            message: 'social login configured, but @adonisjs/ally is not importable.',
+        };
     }
     return { level: 'ok', message: 'social login configured and @adonisjs/ally available.' };
 }
@@ -198,7 +214,10 @@ export function checkOtpLockout(input) {
  * no console de conta). Apenas informa o estado.
  */
 export function checkSudoMode(_input) {
-    return { level: 'ok', message: 'sudo_mode: enabled by default (15 min grace). Configure via admin settings or sudo_mode runtime setting.' };
+    return {
+        level: 'ok',
+        message: 'sudo_mode: enabled by default (15 min grace). Configure via admin settings or sudo_mode runtime setting.',
+    };
 }
 /** rateLimit ligado mas @adonisjs/limiter ausente → warn. */
 export function checkRateLimit(input) {
@@ -246,7 +265,10 @@ export function checkRequireVerifiedEmail(input) {
             message: 'login.requireVerifiedEmail is on, but the accountStore has no `isEmailVerified` capability — the check is a no-op (nobody is blocked). Add an `email_verified_at` column (or a store that tracks it).',
         };
     }
-    return { level: 'ok', message: 'login.requireVerifiedEmail on and the accountStore can check it.' };
+    return {
+        level: 'ok',
+        message: 'login.requireVerifiedEmail on and the accountStore can check it.',
+    };
 }
 /**
  * Bot protection (informativo): ativo quando `botProtection.verify` é uma função.
@@ -362,9 +384,13 @@ export function checkAccessTokens(input) {
         return null;
     const resources = at.resources ?? {};
     const resourceCount = Object.keys(resources).length;
-    const anyJwt = at.anyJwt ?? (at.format === 'jwt' || Object.values(resources).some((r) => r?.format === 'jwt'));
+    const anyJwt = at.anyJwt ??
+        (at.format === 'jwt' || Object.values(resources).some((r) => r?.format === 'jwt'));
     if (!anyJwt) {
-        return { level: 'ok', message: 'access tokens are opaque (default) — introspect them at the introspection endpoint.' };
+        return {
+            level: 'ok',
+            message: 'access tokens are opaque (default) — introspect them at the introspection endpoint.',
+        };
     }
     const detail = resourceCount
         ? `format=${at.format}, ${resourceCount} resource(s) configured`
@@ -474,7 +500,8 @@ export function checkAuthMethodsSetting(input) {
     const allOff = s.password === false &&
         s.magicLink === false &&
         s.passkey === false &&
-        Array.isArray(s.social) && s.social.length === 0;
+        Array.isArray(s.social) &&
+        s.social.length === 0;
     if (allOff) {
         return {
             level: 'warn',
@@ -489,9 +516,7 @@ export function checkAuthMethodsSetting(input) {
         if (unknown.length > 0) {
             return {
                 level: 'warn',
-                message: `auth_methods setting references social provider(s) not in config.social.providers: [${unknown.join(', ')}]. ` +
-                    'These providers will be silently filtered out (intersection rule). ' +
-                    'Remove them from the setting or add them to config.social.providers.',
+                message: `auth_methods setting references social provider(s) not in config.social.providers: [${unknown.join(', ')}]. These providers will be silently filtered out (intersection rule). Remove them from the setting or add them to config.social.providers.`,
             };
         }
     }
@@ -567,8 +592,7 @@ export function checkPasswordPepper(input) {
     if (Array.isArray(pepper)) {
         return {
             level: 'ok',
-            message: `password.pepper rotation configured (${pepper.length} pepper(s)). ` +
-                'First pepper is current; subsequent peppers are tried on verify (lazy re-hash).',
+            message: `password.pepper rotation configured (${pepper.length} pepper(s)). First pepper is current; subsequent peppers are tried on verify (lazy re-hash).`,
         };
     }
     return null;
@@ -654,8 +678,7 @@ export function checkSessionPolicy(input) {
     if (idleMin > 0 && defaultHours > 0 && idleMin > defaultHours * 60) {
         return {
             level: 'warn',
-            message: `session_policy: idleTimeoutMinutes (${idleMin}) exceeds defaultSessionHours*60 (${defaultHours * 60}). ` +
-                'The idle timeout will never trigger — increase defaultSessionHours or reduce idleTimeoutMinutes.',
+            message: `session_policy: idleTimeoutMinutes (${idleMin}) exceeds defaultSessionHours*60 (${defaultHours * 60}). The idle timeout will never trigger — increase defaultSessionHours or reduce idleTimeoutMinutes.`,
         };
     }
     if (rememberDays > 365) {
@@ -701,8 +724,7 @@ export function checkRolesCatalog(input) {
     if (outOfCatalog.length > 0) {
         return {
             level: 'warn',
-            message: `roles_catalog: ${catalogRoles.length} role(s) in catalog, but cfg.admin.roles references [${outOfCatalog.join(', ')}] which are not in the catalog. ` +
-                'Admin access depends on these roles — add them to the catalog at /admin/roles.',
+            message: `roles_catalog: ${catalogRoles.length} role(s) in catalog, but cfg.admin.roles references [${outOfCatalog.join(', ')}] which are not in the catalog. Admin access depends on these roles — add them to the catalog at /admin/roles.`,
         };
     }
     return {
@@ -764,7 +786,10 @@ export function checkPasskeyAutofill(input) {
  */
 export function signingKeyAgeFinding(ageDays, maxAgeDays) {
     if (ageDays === null)
-        return { level: 'ok', message: 'jwks: idade da chave não aplicável (sem keystore persistido).' };
+        return {
+            level: 'ok',
+            message: 'jwks: idade da chave não aplicável (sem keystore persistido).',
+        };
     if (ageDays > maxAgeDays) {
         return {
             level: 'warn',

package/build/src/events/dispatcher.d.ts

@@ -1,4 +1,4 @@
-import type { AuditEvent, AuditSink } from "../audit/audit_sink.js";
+import type { AuditEvent, AuditSink } from '../audit/audit_sink.js';
 /**
  * Configuração de eventos/webhooks para o host observar tudo que o IdP audita.
  *

package/build/src/events/dispatcher.js

@@ -1,5 +1,5 @@
-import { createHmac } from "node:crypto";
-import { emitDiagnostic } from "../observability/diagnostics_bridge.js";
+import { createHmac } from 'node:crypto';
+import { emitDiagnostic } from '../observability/diagnostics_bridge.js';
 export function resolveEvents(input) {
     if (!input || (!input.onEvent && !input.webhook))
         return undefined;
@@ -27,7 +27,7 @@ export function buildWebhookBody(event) {
 }
 /** Calcula o header de assinatura `sha256=<hmac>` para um corpo + segredo. */
 export function signWebhookBody(body, secret) {
-    return "sha256=" + createHmac("sha256", secret).update(body).digest("hex");
+    return `sha256=${createHmac('sha256', secret).update(body).digest('hex')}`;
 }
 /**
  * Projeta um {@link AuditEvent} para o barramento `@agora/diagnostics` SEM PII
@@ -75,13 +75,13 @@ async function dispatchWebhook(webhook, event) {
     try {
         const body = buildWebhookBody(event);
         const headers = {
-            "content-type": "application/json",
+            'content-type': 'application/json',
         };
         if (webhook.secret) {
-            headers["x-authkit-signature"] = signWebhookBody(body, webhook.secret);
+            headers['x-authkit-signature'] = signWebhookBody(body, webhook.secret);
         }
         await fetch(webhook.url, {
-            method: "POST",
+            method: 'POST',
             headers,
             body,
             signal: AbortSignal.timeout(WEBHOOK_TIMEOUT_MS),
@@ -131,11 +131,11 @@ export function composeAuditSink(original, events = {}) {
         },
     };
     // Preserva a capacidade de consulta do sink original (console admin).
-    if (original && typeof original.list === "function") {
+    if (original && typeof original.list === 'function') {
         composed.list = original.list.bind(original);
     }
     // Preserva a anonimização (LGPD) do sink original (deleção de conta).
-    if (original && typeof original.anonymizeAccount === "function") {
+    if (original && typeof original.anonymizeAccount === 'function') {
         composed.anonymizeAccount = original.anonymizeAccount.bind(original);
     }
     // Preserva quaisquer propriedades extras do sink original (ex.: campos de
@@ -147,10 +147,10 @@ export function composeAuditSink(original, events = {}) {
         const src = original;
         const dst = composed;
         for (const key of Object.keys(src)) {
-            if (key === "record" || key === "list" || key === "anonymizeAccount")
+            if (key === 'record' || key === 'list' || key === 'anonymizeAccount')
                 continue;
             const value = src[key];
-            dst[key] = typeof value === "function" ? value.bind(original) : value;
+            dst[key] = typeof value === 'function' ? value.bind(original) : value;
         }
     }
     return composed;