@adonis-agora/authkit-server 0.46.0 → 0.48.0

package/build/src/host/account_api/account_api_controller.js

@@ -28,21 +28,22 @@
  *   GET  /account/api/orgs/invitations     → convites pendentes
  */
 import '../augmentations.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
-import { supportsAccountSecurity, supportsProfile, supportsPasskeys, supportsOrganizations, } from '../../accounts/account_store.js';
-import { changePasswordValidator, changeEmailValidator, updateProfileValidator, } from '../validators.js';
-import { AdminSessionsService } from '../admin_sessions_service.js';
-import { enrichSessionsWithContext } from '../session_context.js';
+import { supportsAccountSecurity, supportsOrganizations, supportsPasskeys, supportsProfile, } from '../../accounts/account_store.js';
 import { PasswordPolicyError } from '../../password/password_manager.js';
-import { resolveRuntimeSettings } from '../runtime_settings.js';
+import { accountPath } from '../account_paths.js';
+import { ACTIVE_ORG_COOKIE } from '../active_org_cookie.js';
+import { AdminSessionsService } from '../admin_sessions_service.js';
 import { syncAdonisAuthLogout } from '../adonis_auth_sync.js';
+import { AvatarUploadError, isAvatarUploadSupported, storeAvatar } from '../avatar_storage.js';
+import { sendEmailChangeConfirmationEmail, sendEmailChangeNoticeEmail } from '../default_mailer.js';
+import { translate } from '../i18n.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
+import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { resolveEffectiveEmailChange, resolveEffectivePasswordHistory, } from '../runtime_toggles.js';
 import { dispatchSecurityNotice } from '../security_notice_service.js';
-import { requireSudo, isSudoActive, SUDO_MODE_DEFAULTS, resolveEffectiveSudoMode } from '../sudo_mode.js';
-import { translate } from '../i18n.js';
-import { storeAvatar, isAvatarUploadSupported, AvatarUploadError } from '../avatar_storage.js';
-import { sendEmailChangeConfirmationEmail, sendEmailChangeNoticeEmail, } from '../default_mailer.js';
-import { ACTIVE_ORG_COOKIE } from '../active_org_cookie.js';
+import { enrichSessionsWithContext } from '../session_context.js';
+import { SUDO_MODE_DEFAULTS, isSudoActive, requireSudo, resolveEffectiveSudoMode, } from '../sudo_mode.js';
+import { changeEmailValidator, changePasswordValidator, updateProfileValidator, } from '../validators.js';
 // ---------------------------------------------------------------------------
 // Helpers (shared with existing controllers — kept local to avoid coupling)
 // ---------------------------------------------------------------------------
@@ -91,7 +92,9 @@ export default class AccountApiController {
         let sudoActive = false;
         try {
             const sudoSettings = await resolveRuntimeSettings(ctx);
-            const resolved = sudoSettings ? await resolveEffectiveSudoMode(sudoSettings) : SUDO_MODE_DEFAULTS;
+            const resolved = sudoSettings
+                ? await resolveEffectiveSudoMode(sudoSettings)
+                : SUDO_MODE_DEFAULTS;
             sudoActive = resolved.enabled ? isSudoActive(ctx, resolved.graceMinutes) : true;
         }
         catch {
@@ -212,7 +215,9 @@ export default class AccountApiController {
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsProfile(store)) {
-            return ctx.response.status(422).send(apiErr('capability_unsupported', translate(cfg.messages, 'account.profile.not_supported')));
+            return ctx.response
+                .status(422)
+                .send(apiErr('capability_unsupported', translate(cfg.messages, 'account.profile.not_supported')));
         }
         const { name, avatarUrl } = await ctx.request.validateUsing(updateProfileValidator);
         let resolvedAvatarUrl = avatarUrl ?? null;
@@ -263,30 +268,39 @@ export default class AccountApiController {
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsAccountSecurity(store)) {
-            return ctx.response.status(422).send(apiErr('capability_unsupported', translate(cfg.messages, 'account.security.not_supported')));
+            return ctx.response
+                .status(422)
+                .send(apiErr('capability_unsupported', translate(cfg.messages, 'account.security.not_supported')));
         }
         // Sudo gate.
         const sudoSettings = await resolveRuntimeSettings(ctx);
         const sudoResult = await requireSudo(ctx, sudoSettings);
         if (sudoResult !== true) {
             // Para a API JSON, devolvemos 403 em vez de redirecionar.
-            return ctx.response.status(403).send(apiErr('sudo_required', 'Identity confirmation required.'));
+            return ctx.response
+                .status(403)
+                .send(apiErr('sudo_required', 'Identity confirmation required.'));
         }
         const { currentPassword, newPassword } = await ctx.request.validateUsing(changePasswordValidator);
         const account = await store.findById(userId);
         const verified = account ? await store.verifyCredentials(account.email, currentPassword) : null;
         if (!verified) {
-            return ctx.response.status(422).send(apiErr('invalid_credentials', translate(cfg.messages, 'errors.invalid_credentials')));
+            return ctx.response
+                .status(422)
+                .send(apiErr('invalid_credentials', translate(cfg.messages, 'errors.invalid_credentials')));
         }
         // Histórico de senhas.
         const { supportsPasswordHistory } = await import('../../accounts/account_store.js');
         if (supportsPasswordHistory(store)) {
             const histSettings = await resolvePasswordHistorySettings(ctx);
             if (histSettings.enabled) {
-                const pepperedNew = cfg.accountStore.__passwordManager?.applyCurrentPepper?.(newPassword) ?? newPassword;
+                const pepperedNew = cfg.accountStore.__passwordManager?.applyCurrentPepper?.(newPassword) ??
+                    newPassword;
                 const reused = await store.isPasswordReused(userId, pepperedNew, histSettings.count);
                 if (reused) {
-                    return ctx.response.status(422).send(apiErr('password_reused', translate(cfg.messages, 'password.reused', { count: histSettings.count })));
+                    return ctx.response
+                        .status(422)
+                        .send(apiErr('password_reused', translate(cfg.messages, 'password.reused', { count: histSettings.count })));
                 }
                 const rawRow = await cfg.accountStore.__getRawRow?.(userId);
                 if (rawRow?.password) {
@@ -300,7 +314,9 @@ export default class AccountApiController {
         }
         catch (error) {
             if (error instanceof PasswordPolicyError) {
-                return ctx.response.status(422).send(apiErr('password_policy', translate(cfg.messages, error.key, error.params)));
+                return ctx.response
+                    .status(422)
+                    .send(apiErr('password_policy', translate(cfg.messages, error.key, error.params)));
             }
             throw error;
         }
@@ -327,31 +343,45 @@ export default class AccountApiController {
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsAccountSecurity(store)) {
-            return ctx.response.status(422).send(apiErr('capability_unsupported', translate(cfg.messages, 'account.security.not_supported')));
+            return ctx.response
+                .status(422)
+                .send(apiErr('capability_unsupported', translate(cfg.messages, 'account.security.not_supported')));
         }
         const sudoSettings = await resolveRuntimeSettings(ctx);
         const sudoResult = await requireSudo(ctx, sudoSettings);
         if (sudoResult !== true) {
-            return ctx.response.status(403).send(apiErr('sudo_required', 'Identity confirmation required.'));
+            return ctx.response
+                .status(403)
+                .send(apiErr('sudo_required', 'Identity confirmation required.'));
         }
         const emailChangeSettings = await resolveEmailChangeSettings(ctx);
         if (!emailChangeSettings.enabled) {
-            return ctx.response.status(422).send(apiErr('disabled', translate(cfg.messages, 'account.security.email_change_disabled')));
+            return ctx.response
+                .status(422)
+                .send(apiErr('disabled', translate(cfg.messages, 'account.security.email_change_disabled')));
         }
         const { currentPassword, newEmail } = await ctx.request.validateUsing(changeEmailValidator);
         const account = await store.findById(userId);
         if (emailChangeSettings.requirePassword) {
             if (!currentPassword) {
-                return ctx.response.status(422).send(apiErr('invalid_credentials', translate(cfg.messages, 'errors.invalid_credentials')));
+                return ctx.response
+                    .status(422)
+                    .send(apiErr('invalid_credentials', translate(cfg.messages, 'errors.invalid_credentials')));
             }
-            const verified = account ? await store.verifyCredentials(account.email, currentPassword) : null;
+            const verified = account
+                ? await store.verifyCredentials(account.email, currentPassword)
+                : null;
             if (!verified) {
-                return ctx.response.status(422).send(apiErr('invalid_credentials', translate(cfg.messages, 'errors.invalid_credentials')));
+                return ctx.response
+                    .status(422)
+                    .send(apiErr('invalid_credentials', translate(cfg.messages, 'errors.invalid_credentials')));
             }
         }
         const issued = await store.requestEmailChange(userId, newEmail);
         if (!issued) {
-            return ctx.response.status(409).send(apiErr('email_taken', translate(cfg.messages, 'errors.email_taken')));
+            return ctx.response
+                .status(409)
+                .send(apiErr('email_taken', translate(cfg.messages, 'errors.email_taken')));
         }
         await cfg.audit?.record({
             type: 'email_change.requested',
@@ -360,7 +390,7 @@ export default class AccountApiController {
             ip: ctx.request.ip?.() ?? null,
         });
         const origin = `${ctx.request.protocol()}://${ctx.request.host()}`;
-        const confirmUrl = `${origin}/account/email/confirm?token=${encodeURIComponent(issued.token)}`;
+        const confirmUrl = `${origin}${accountPath('emailConfirm')}?token=${encodeURIComponent(issued.token)}`;
         if (cfg.mail?.onEmailChangeConfirm) {
             await cfg.mail.onEmailChangeConfirm({
                 email: newEmail,
@@ -370,7 +400,11 @@ export default class AccountApiController {
             });
         }
         else if (cfg.mail?.onEmailVerification) {
-            await cfg.mail.onEmailVerification({ email: newEmail, verifyUrl: confirmUrl, token: issued.token });
+            await cfg.mail.onEmailVerification({
+                email: newEmail,
+                verifyUrl: confirmUrl,
+                token: issued.token,
+            });
         }
         else {
             await sendEmailChangeConfirmationEmail(ctx, { email: newEmail, confirmUrl });
@@ -393,7 +427,9 @@ export default class AccountApiController {
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsAccountSecurity(store)) {
-            return ctx.response.status(422).send(apiErr('capability_unsupported', translate(cfg.messages, 'account.security.not_supported')));
+            return ctx.response
+                .status(422)
+                .send(apiErr('capability_unsupported', translate(cfg.messages, 'account.security.not_supported')));
         }
         const cancelFn = store.cancelEmailChange;
         if (typeof cancelFn === 'function') {
@@ -447,7 +483,9 @@ export default class AccountApiController {
         const sessionId = ctx.request.param('id');
         const adminSessions = new AdminSessionsService(service);
         if (!adminSessions.canList) {
-            return ctx.response.status(422).send(apiErr('capability_unsupported', 'Session enumeration not supported by this adapter.'));
+            return ctx.response
+                .status(422)
+                .send(apiErr('capability_unsupported', 'Session enumeration not supported by this adapter.'));
         }
         // Verifica que a sessão pertence à conta logada.
         const sessions = await adminSessions.listSessions(userId);
@@ -475,7 +513,9 @@ export default class AccountApiController {
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         const adminSessions = new AdminSessionsService(service);
         if (!adminSessions.canList) {
-            return ctx.response.status(422).send(apiErr('capability_unsupported', 'Session enumeration not supported by this adapter.'));
+            return ctx.response
+                .status(422)
+                .send(apiErr('capability_unsupported', 'Session enumeration not supported by this adapter.'));
         }
         // Sem sessão OIDC corrente identificável aqui (o console de conta usa sessão
         // Adonis, não sessão OIDC). Revogamos TODAS as sessões OIDC da conta.
@@ -503,7 +543,9 @@ export default class AccountApiController {
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         const adminSessions = new AdminSessionsService(service);
         if (!adminSessions.canList) {
-            return ctx.response.status(422).send(apiErr('capability_unsupported', 'Session enumeration not supported by this adapter.'));
+            return ctx.response
+                .status(422)
+                .send(apiErr('capability_unsupported', 'Session enumeration not supported by this adapter.'));
         }
         // Revogar todas as sessões OIDC + grants da conta.
         const result = await adminSessions.revokeAll(userId);
@@ -550,7 +592,9 @@ export default class AccountApiController {
         const clientId = ctx.request.param('clientId');
         const adminSessions = new AdminSessionsService(service);
         if (!adminSessions.canList) {
-            return ctx.response.status(422).send(apiErr('capability_unsupported', 'Session enumeration not supported by this adapter.'));
+            return ctx.response
+                .status(422)
+                .send(apiErr('capability_unsupported', 'Session enumeration not supported by this adapter.'));
         }
         const result = await adminSessions.revokeClientGrants(userId, clientId);
         await cfg.audit?.record({
@@ -622,12 +666,16 @@ export default class AccountApiController {
         const cfg = service.config;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsPasskeys(cfg.accountStore)) {
-            return ctx.response.status(422).send(apiErr('capability_unsupported', translate(cfg.messages, 'errors.passkeys_unavailable')));
+            return ctx.response
+                .status(422)
+                .send(apiErr('capability_unsupported', translate(cfg.messages, 'errors.passkeys_unavailable')));
         }
         const sudoSettings = await resolveRuntimeSettings(ctx);
         const sudoResult = await requireSudo(ctx, sudoSettings);
         if (sudoResult !== true) {
-            return ctx.response.status(403).send(apiErr('sudo_required', 'Identity confirmation required.'));
+            return ctx.response
+                .status(403)
+                .send(apiErr('sudo_required', 'Identity confirmation required.'));
         }
         const credentialId = ctx.request.param('id');
         await cfg.accountStore.removePasskey?.(userId, credentialId);
@@ -676,13 +724,17 @@ export default class AccountApiController {
         const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         if (!cfg.patStore) {
-            return ctx.response.status(422).send(apiErr('capability_unsupported', 'PAT store not configured.'));
+            return ctx.response
+                .status(422)
+                .send(apiErr('capability_unsupported', 'PAT store not configured.'));
         }
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         const sudoSettings = await resolveRuntimeSettings(ctx);
         const sudoResult = await requireSudo(ctx, sudoSettings);
         if (sudoResult !== true) {
-            return ctx.response.status(403).send(apiErr('sudo_required', 'Identity confirmation required.'));
+            return ctx.response
+                .status(403)
+                .send(apiErr('sudo_required', 'Identity confirmation required.'));
         }
         const name = ctx.request.input('name', 'Token').trim() || 'Token';
         const { token, pat } = await cfg.patStore.issue({ accountId: userId, name });
@@ -709,13 +761,17 @@ export default class AccountApiController {
         const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         if (!cfg.patStore) {
-            return ctx.response.status(422).send(apiErr('capability_unsupported', 'PAT store not configured.'));
+            return ctx.response
+                .status(422)
+                .send(apiErr('capability_unsupported', 'PAT store not configured.'));
         }
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         const sudoSettings = await resolveRuntimeSettings(ctx);
         const sudoResult = await requireSudo(ctx, sudoSettings);
         if (sudoResult !== true) {
-            return ctx.response.status(403).send(apiErr('sudo_required', 'Identity confirmation required.'));
+            return ctx.response
+                .status(403)
+                .send(apiErr('sudo_required', 'Identity confirmation required.'));
         }
         const patId = ctx.request.param('id');
         const revoked = await cfg.patStore.revoke(userId, patId);

package/build/src/host/account_deletion_ops.d.ts

@@ -1,7 +1,7 @@
-import type { OidcService } from "../provider/oidc_service.js";
-import type { ResolvedServerConfig } from "../define_config.js";
-import type { AuthAccount } from "../accounts/account_store.js";
-import type { DeletionActor } from "./account_deletion_service.js";
+import type { AuthAccount } from '../accounts/account_store.js';
+import type { ResolvedServerConfig } from '../define_config.js';
+import type { OidcService } from '../provider/oidc_service.js';
+import type { DeletionActor } from './account_deletion_service.js';
 /**
  * As 9 etapas do cascade de deleção de conta (LGPD/GDPR) extraídas em operações
  * DISCRETAS e IDEMPOTENTES. Cada uma é chamável individualmente — re-executar uma

package/build/src/host/account_deletion_ops.js

@@ -1,6 +1,6 @@
-import { supportsAccountDeletion, supportsMfa, supportsOrganizations, supportsPasskeys, supportsProviderIdentity, } from "../accounts/account_store.js";
-import { AdminSessionsService } from "./admin_sessions_service.js";
-import { deleteAvatar } from "./avatar_storage.js";
+import { supportsAccountDeletion, supportsMfa, supportsOrganizations, supportsPasskeys, supportsProviderIdentity, } from '../accounts/account_store.js';
+import { AdminSessionsService } from './admin_sessions_service.js';
+import { deleteAvatar } from './avatar_storage.js';
 /**
  * Carrega o snapshot da conta. Retorna null se a conta não existe (ou já foi
  * deletada) — idempotente: re-executar após a deleção da linha devolve null.
@@ -22,7 +22,7 @@ export async function snapshotAccount(cfg, accountId) {
  */
 export async function auditDeleted(cfg, snapshot, actor) {
     await cfg.audit?.record({
-        type: "account.deleted",
+        type: 'account.deleted',
         accountId: snapshot.id,
         email: snapshot.email,
         actorId: actor.actorId,
@@ -99,7 +99,7 @@ export async function deleteAccountAvatar(cfg, accountId, avatarUrl) {
 }
 /** 8) Anonimiza o histórico de audit da conta (quando o sink suporta). */
 export async function anonymizeAudit(cfg, accountId) {
-    if (cfg.audit && typeof cfg.audit.anonymizeAccount === "function") {
+    if (cfg.audit && typeof cfg.audit.anonymizeAccount === 'function') {
         const auditAnonymized = await cfg.audit.anonymizeAccount(accountId);
         return { auditAnonymized };
     }

package/build/src/host/account_deletion_service.d.ts

@@ -1,4 +1,4 @@
-import type { OidcService } from "../provider/oidc_service.js";
+import type { OidcService } from '../provider/oidc_service.js';
 /** Quem disparou a deleção (auditoria). 'self' = o próprio usuário; senão admin. */
 export interface DeletionActor {
     /** Id de quem agiu: o próprio user (self-service) ou o admin. null para admin-api. */
@@ -11,7 +11,7 @@ export interface DeletionActor {
      *   - 'admin'     → um admin pelo console HTML;
      *   - 'admin-api' → via Admin REST API / SDK.
      */
-    source: "self" | "admin" | "admin-api";
+    source: 'self' | 'admin' | 'admin-api';
 }
 /** Contagens do que foi removido no cascade (para auditoria/diagnóstico). */
 export interface DeletionResult {

package/build/src/host/account_deletion_service.js

@@ -1,5 +1,5 @@
-import { supportsAccountDeletion } from "../accounts/account_store.js";
-import { anonymizeAudit, auditDeleted, deleteAccountAvatar, deleteAccountRow, disableMfa, removeFromOrgs, removePasskeys, revokePats, revokeSessions, snapshotAccount, unlinkProviders, } from "./account_deletion_ops.js";
+import { supportsAccountDeletion } from '../accounts/account_store.js';
+import { anonymizeAudit, auditDeleted, deleteAccountAvatar, deleteAccountRow, disableMfa, removeFromOrgs, removePasskeys, revokePats, revokeSessions, snapshotAccount, unlinkProviders, } from './account_deletion_ops.js';
 /**
  * Orquestra a deleção COMPLETA de uma conta (LGPD/GDPR — "direito ao
  * esquecimento"), compartilhada entre o self-service (console de conta) e o admin

package/build/src/host/account_export_service.d.ts

@@ -1,4 +1,4 @@
-import type { OidcService } from "../provider/oidc_service.js";
+import type { OidcService } from '../provider/oidc_service.js';
 /** Payload de export de dados de uma conta (portabilidade — LGPD/GDPR). */
 export interface AccountExport {
     /** Versão do formato do export (para evolução futura). */

package/build/src/host/account_export_service.js

@@ -1,5 +1,5 @@
-import { supportsOrganizations, supportsPasskeys, supportsProviderIdentity, } from "../accounts/account_store.js";
-import { AdminSessionsService } from "./admin_sessions_service.js";
+import { supportsOrganizations, supportsPasskeys, supportsProviderIdentity, } from '../accounts/account_store.js';
+import { AdminSessionsService } from './admin_sessions_service.js';
 /** Limite de eventos de audit incluídos no export (evita payloads gigantes). */
 const AUDIT_EXPORT_LIMIT = 1000;
 /**
@@ -98,7 +98,7 @@ export class AccountExportService {
         }
         // Audit do próprio usuário (quando o sink suporta consulta).
         let auditLog = [];
-        if (cfg.audit && typeof cfg.audit.list === "function") {
+        if (cfg.audit && typeof cfg.audit.list === 'function') {
             try {
                 const page = await cfg.audit.list({
                     subject: accountId,
@@ -110,9 +110,7 @@ export class AccountExportService {
                     clientId: e.clientId ?? null,
                     ip: e.ip ?? null,
                     metadata: e.metadata ?? null,
-                    createdAt: typeof e.createdAt === "string"
-                        ? e.createdAt
-                        : (e.createdAt?.toISOString?.() ?? null),
+                    createdAt: typeof e.createdAt === 'string' ? e.createdAt : (e.createdAt?.toISOString?.() ?? null),
                 }));
             }
             catch {

package/build/src/host/account_home.d.ts

@@ -1,11 +1,3 @@
-/**
- * Destino default da área da conta (pós-login do console sem `return_to`,
- * confirmações de e-mail, fallback de redirects).
- *
- * Configurável via `accountHome` no defineConfig; default '/account/security'
- * (a "minha conta" natural — perfil, senha, sessões). Nunca '/account/tokens':
- * aterrissar usuário comum numa tela de Personal Access Tokens é hostil.
- */
 export declare function accountHome(cfg: {
     accountHome?: string;
 }): string;

package/build/src/host/account_home.js

@@ -2,10 +2,12 @@
  * Destino default da área da conta (pós-login do console sem `return_to`,
  * confirmações de e-mail, fallback de redirects).
  *
- * Configurável via `accountHome` no defineConfig; default '/account/security'
- * (a "minha conta" natural — perfil, senha, sessões). Nunca '/account/tokens':
- * aterrissar usuário comum numa tela de Personal Access Tokens é hostil.
+ * Configurável via `accountHome` no defineConfig; default `accountPath('security')`
+ * (a "minha conta" natural — perfil, senha, sessões; `/account/security`, ou
+ * `/conta/seguranca` com overrides). Nunca a tela de tokens: aterrissar usuário
+ * comum numa tela de Personal Access Tokens é hostil.
  */
+import { accountPath } from './account_paths.js';
 export function accountHome(cfg) {
-    return cfg.accountHome ?? '/account/security';
+    return cfg.accountHome ?? accountPath('security');
 }

package/build/src/host/account_login_url.d.ts

@@ -0,0 +1,44 @@
+/**
+ * URL de login do console de conta — singleton de processo.
+ *
+ * Definida em tempo de registro das rotas (`registerAuthHost`, via a opção
+ * `accountLoginUrl`) e lida em runtime por TODOS os pontos que redirecionam o
+ * visitante não-autenticado para "faça login": os guards (`accountGuard`/
+ * `adminGuard`), o middleware `AccountAuthMiddleware`, o helper público
+ * `consoleLoginUrl()`, os redirects de fallback dos controllers de conta e a
+ * view Edge `otp-unlock` (injetada como prop `loginUrl` pelo renderer).
+ *
+ * Existe porque a tela `account/login` é DESMONTÁVEL (`account: { login: false }`):
+ * um host OIDC passwordless não monta o login por senha da lib e aponta o
+ * redirect de não-autenticado para a própria rota de login dele (ex.: `/login`).
+ * Sem esta indireção, esses destinos ficariam presos no `/account/login` que
+ * deixou de existir.
+ *
+ * Default `/account/login` (back-compat total: hosts que não passam a opção
+ * seguem redirecionando para a tela montada de sempre).
+ *
+ * Por que módulo singleton e não binding do container? Mesma razão do
+ * `admin_prefix`: os guards são closures construídas em tempo de registro,
+ * ANTES da primeira request, quando o container ainda não existe. Um módulo ESM
+ * é inicializado uma vez por processo — ideal para configuração imutável de boot.
+ */
+/**
+ * Define a URL de login do console de conta para este processo.
+ * Chamado UMA VEZ por `registerAuthHost` no boot da aplicação.
+ *
+ * Não normaliza o path: aceita qualquer caminho interno que o host queira
+ * (ex.: `'/login'`, `'/auth/entrar'`). Valor vazio/whitespace volta a derivar
+ * de `accountPath('login')`.
+ *
+ * @param url  Caminho de destino do redirect de não-autenticado.
+ */
+export declare function setAccountLoginUrl(url: string): void;
+/**
+ * Retorna a URL de login do console de conta. Sem override explícito, deriva de
+ * `accountPath('login')` (default `'/account/login'`; `'/conta/login'` com
+ * `accountRoutes: { prefix: '/conta' }`). Usada por todo redirect/link de
+ * "faça login" da lib.
+ */
+export declare function getAccountLoginUrl(): string;
+/** Restaura o default — uso em testes (isola o singleton entre casos). */
+export declare function resetAccountLoginUrl(): void;

package/build/src/host/account_login_url.js

@@ -0,0 +1,58 @@
+/**
+ * URL de login do console de conta — singleton de processo.
+ *
+ * Definida em tempo de registro das rotas (`registerAuthHost`, via a opção
+ * `accountLoginUrl`) e lida em runtime por TODOS os pontos que redirecionam o
+ * visitante não-autenticado para "faça login": os guards (`accountGuard`/
+ * `adminGuard`), o middleware `AccountAuthMiddleware`, o helper público
+ * `consoleLoginUrl()`, os redirects de fallback dos controllers de conta e a
+ * view Edge `otp-unlock` (injetada como prop `loginUrl` pelo renderer).
+ *
+ * Existe porque a tela `account/login` é DESMONTÁVEL (`account: { login: false }`):
+ * um host OIDC passwordless não monta o login por senha da lib e aponta o
+ * redirect de não-autenticado para a própria rota de login dele (ex.: `/login`).
+ * Sem esta indireção, esses destinos ficariam presos no `/account/login` que
+ * deixou de existir.
+ *
+ * Default `/account/login` (back-compat total: hosts que não passam a opção
+ * seguem redirecionando para a tela montada de sempre).
+ *
+ * Por que módulo singleton e não binding do container? Mesma razão do
+ * `admin_prefix`: os guards são closures construídas em tempo de registro,
+ * ANTES da primeira request, quando o container ainda não existe. Um módulo ESM
+ * é inicializado uma vez por processo — ideal para configuração imutável de boot.
+ */
+import { accountPath } from './account_paths.js';
+/**
+ * `undefined` = não configurado explicitamente → deriva de `accountPath('login')`
+ * (que respeita o prefixo/segmento configurados via `accountRoutes`). Default
+ * efetivo `'/account/login'` — back-compat total.
+ */
+let _loginUrl;
+/**
+ * Define a URL de login do console de conta para este processo.
+ * Chamado UMA VEZ por `registerAuthHost` no boot da aplicação.
+ *
+ * Não normaliza o path: aceita qualquer caminho interno que o host queira
+ * (ex.: `'/login'`, `'/auth/entrar'`). Valor vazio/whitespace volta a derivar
+ * de `accountPath('login')`.
+ *
+ * @param url  Caminho de destino do redirect de não-autenticado.
+ */
+export function setAccountLoginUrl(url) {
+    const trimmed = (url ?? '').trim();
+    _loginUrl = trimmed || undefined;
+}
+/**
+ * Retorna a URL de login do console de conta. Sem override explícito, deriva de
+ * `accountPath('login')` (default `'/account/login'`; `'/conta/login'` com
+ * `accountRoutes: { prefix: '/conta' }`). Usada por todo redirect/link de
+ * "faça login" da lib.
+ */
+export function getAccountLoginUrl() {
+    return _loginUrl ?? accountPath('login');
+}
+/** Restaura o default — uso em testes (isola o singleton entre casos). */
+export function resetAccountLoginUrl() {
+    _loginUrl = undefined;
+}