@adonis-agora/authkit-server 0.47.0 → 0.48.0

package/build/src/host/controllers/interaction_controller.js

@@ -1,17 +1,17 @@
 import '../augmentations.js';
+import { supportsMagicLink, supportsPasskeys } from '../../accounts/account_store.js';
+import { AdminSessionsService } from '../admin_sessions_service.js';
+import { guardBotProtection, resolveEffectiveBotProtection } from '../bot_protection.js';
 import { brandFor, isFirstParty } from '../branding.js';
+import { sendMagicLinkEmail } from '../default_mailer.js';
+import { sendOtpUnlockEmail } from '../default_mailer.js';
 import { translate } from '../i18n.js';
 import { attemptPasswordLogin, isEmailUnverifiedBlock } from '../login_attempt.js';
 import { notifyLoginSuccess } from '../login_notify.js';
-import { guardBotProtection, resolveEffectiveBotProtection } from '../bot_protection.js';
+import { createOtpLockout, generateOtpUnlockToken, rawToDbOtpUnlockToken, resolveEffectiveOtpLockout, } from '../otp_lockout.js';
 import { RuntimeSettings, resolveRuntimeSettings } from '../runtime_settings.js';
-import { resolveEffectiveMaintenanceMode, resolveEffectiveRegistration, resolveEffectiveAuthMethods, resolveEffectiveSessionPolicy, } from '../runtime_toggles.js';
-import { supportsPasskeys, supportsMagicLink } from '../../accounts/account_store.js';
-import { sendMagicLinkEmail } from '../default_mailer.js';
+import { resolveEffectiveAuthMethods, resolveEffectiveMaintenanceMode, resolveEffectiveRegistration, resolveEffectiveSessionPolicy, } from '../runtime_toggles.js';
 import { TRUSTED_DEVICE_COOKIE, buildTrustedDevicePayload, isTrustedDeviceValid, } from '../trusted_device.js';
-import { AdminSessionsService } from '../admin_sessions_service.js';
-import { createOtpLockout, resolveEffectiveOtpLockout, generateOtpUnlockToken, rawToDbOtpUnlockToken, } from '../otp_lockout.js';
-import { sendOtpUnlockEmail } from '../default_mailer.js';
 /**
  * Best-effort: returns a RuntimeSettings backed by the container DB, or a no-op
  * fallback. Contrato NON-NULL preservado — é chamado 6× passando direto p/
@@ -21,7 +21,12 @@ import { sendOtpUnlockEmail } from '../default_mailer.js';
  */
 async function getRuntimeSettings(ctx) {
     const rs = await resolveRuntimeSettings(ctx);
-    return rs ?? new RuntimeSettings({ table: () => { throw new Error('no-op'); } });
+    return (rs ??
+        new RuntimeSettings({
+            table: () => {
+                throw new Error('no-op');
+            },
+        }));
 }
 const SESSION_KEY = 'authkit_login_email';
 /** accountId aguardando o 2º fator depois da senha verificada. */
@@ -78,7 +83,8 @@ export default class AuthInteractionController {
                 });
             }
         }
-        if (details.prompt.name === 'consent' && isFirstParty(cfg.branding, details.params.client_id)) {
+        if (details.prompt.name === 'consent' &&
+            isFirstParty(cfg.branding, details.params.client_id)) {
             // Clients first-party: auto-concede o consent (pula a tela de consent).
             // interactions.consent monta o Grant + interactionFinished e escreve o
             // redirect de volta para o client — opera via provider.interactionDetails,
@@ -185,9 +191,7 @@ export default class AuthInteractionController {
         // Bot protection (plugável): valida o token do widget ANTES de tocar nas
         // credenciais. Fail-safe: erro/timeout no verify do host PERMITE o fluxo.
         // We use a cfg-compatible object: pass effectiveBotLogin merged into cfg.
-        const cfgWithEffectiveBot = effectiveBotLogin !== cfg.botProtection
-            ? { ...cfg, botProtection: effectiveBotLogin }
-            : cfg;
+        const cfgWithEffectiveBot = effectiveBotLogin !== cfg.botProtection ? { ...cfg, botProtection: effectiveBotLogin } : cfg;
         if (!(await guardBotProtection(ctx, cfgWithEffectiveBot, 'login', { email, clientId }))) {
             const found = await cfg.accountStore.findByEmail(email);
             const account = found
@@ -209,7 +213,14 @@ export default class AuthInteractionController {
         // ligado precisamos exigir o 2º fator e NÃO podemos chamar interactionFinished
         // ainda. A sequência verificação + lockout + auditoria de falha é centralizada
         // em attemptPasswordLogin; a renderização (lookup p/ personalização) fica aqui.
-        const result = await attemptPasswordLogin(cfg, { email, password, ip, clientId, settings: runtimeSettings, logger: ctx.logger });
+        const result = await attemptPasswordLogin(cfg, {
+            email,
+            password,
+            ip,
+            clientId,
+            settings: runtimeSettings,
+            logger: ctx.logger,
+        });
         if (!result.ok) {
             // Senha expirada: redireciona para o step de troca obrigatória.
             if (result.passwordExpired && result.account) {
@@ -250,7 +261,9 @@ export default class AuthInteractionController {
                                 ? translate(cfg.messages, 'errors.account_expired')
                                 : translate(cfg.messages, 'errors.invalid_credentials'),
                 brand,
-                botProtection: effectiveBotLogin?.on.includes('login') ? effectiveBotLogin.widget : undefined,
+                botProtection: effectiveBotLogin?.on.includes('login')
+                    ? effectiveBotLogin.widget
+                    : undefined,
             });
         }
         const acc = result.account;
@@ -329,7 +342,10 @@ export default class AuthInteractionController {
         // remember-me: lê o checkbox do form. Checkbox HTML ausente/desmarcado = sem valor.
         // Quando rememberEnabled=false, ignora o checkbox (sessão sempre transiente).
         const rememberChecked = ctx.request.input('remember');
-        const rememberOn = rememberChecked === 'on' || rememberChecked === '1' || rememberChecked === 'true' || rememberChecked === true;
+        const rememberOn = rememberChecked === 'on' ||
+            rememberChecked === '1' ||
+            rememberChecked === 'true' ||
+            rememberChecked === true;
         const remember = sessionPolicy.rememberEnabled ? rememberOn : false;
         // single-session: lista sessões ANTES do login para saber quais existem.
         // Após o completeLogin, a sessão NOVA é criada; revogamos as ANTERIORES.
@@ -389,7 +405,7 @@ export default class AuthInteractionController {
         const otpLockoutCfg = await resolveEffectiveOtpLockout(runtimeForOtp);
         const otpLockout = createOtpLockout(otpLockoutCfg, ctx.logger);
         // Verifica se o fator OTP está travado ANTES de tentar verificar.
-        if (otpLockoutCfg.enabled && await otpLockout.isLocked(accountId)) {
+        if (otpLockoutCfg.enabled && (await otpLockout.isLocked(accountId))) {
             return render(ctx, 'mfa-challenge', {
                 uid: ctx.request.param('uid'),
                 csrfToken: ctx.request.csrfToken,
@@ -642,7 +658,12 @@ export default class AuthInteractionController {
         }
         const acc = await cfg.accountStore.consumeMagicLinkToken(token);
         if (!acc) {
-            await cfg.audit?.record({ type: 'login.failure', ip, clientId, metadata: { stage: 'magic_link' } });
+            await cfg.audit?.record({
+                type: 'login.failure',
+                ip,
+                clientId,
+                metadata: { stage: 'magic_link' },
+            });
             return ctx.response.redirect(`/auth/interaction/${uid}`);
         }
         // E-mail não verificado (LGPD/compliance): mesmo com o link válido, não
@@ -707,14 +728,20 @@ export default class AuthInteractionController {
             // Modo discoverable: sem accountId na sessão, gera options sem restrição
             // de credenciais (allowCredentials vazio = o browser apresenta todas).
             if (!supportsPasskeys(cfg.accountStore)) {
-                return ctx.response.badRequest({ message: translate(cfg.messages, 'errors.passkeys_unavailable'), discoverable: false });
+                return ctx.response.badRequest({
+                    message: translate(cfg.messages, 'errors.passkeys_unavailable'),
+                    discoverable: false,
+                });
             }
             // Passa '__discoverable__' como sentinel — o store (LucidStore) detecta e
             // retorna options com allowCredentials:[] se suportar; caso contrário null.
             const generated = await cfg.accountStore.generatePasskeyAuthenticationOptions?.('__discoverable__');
             if (!generated) {
                 // Store não suporta discoverable credentials — autofill não disponível.
-                return ctx.response.badRequest({ message: translate(cfg.messages, 'errors.passkeys_unavailable'), discoverable: false });
+                return ctx.response.badRequest({
+                    message: translate(cfg.messages, 'errors.passkeys_unavailable'),
+                    discoverable: false,
+                });
             }
             ctx.session.put(PASSKEY_AUTH_CHALLENGE_KEY, generated.challenge);
             return { ...generated.options, _discoverable: true };
@@ -782,7 +809,8 @@ export default class AuthInteractionController {
             parsed = null;
         }
         const ok = parsed
-            ? ((await cfg.accountStore.verifyPasskeyAuthentication?.(accountId, parsed, challenge)) ?? false)
+            ? ((await cfg.accountStore.verifyPasskeyAuthentication?.(accountId, parsed, challenge)) ??
+                false)
             : false;
         ctx.session.forget(PASSKEY_AUTH_CHALLENGE_KEY);
         if (!ok) {
@@ -975,14 +1003,23 @@ export default class AuthInteractionController {
                 }
             }
             if (!row) {
-                await cfg.audit?.record({ type: 'otp.unlock_failed', ip, metadata: { reason: 'token_not_found' } });
+                await cfg.audit?.record({
+                    type: 'otp.unlock_failed',
+                    ip,
+                    metadata: { reason: 'token_not_found' },
+                });
                 return render(ctx, 'otp-unlock', { ok: false });
             }
             // Verifica TTL.
             const { DateTime } = await import('luxon');
             const expiresAt = row.passwordResetExpiresAt;
             if (!expiresAt || expiresAt < DateTime.now()) {
-                await cfg.audit?.record({ type: 'otp.unlock_failed', accountId: row.id, ip, metadata: { reason: 'token_expired' } });
+                await cfg.audit?.record({
+                    type: 'otp.unlock_failed',
+                    accountId: row.id,
+                    ip,
+                    metadata: { reason: 'token_expired' },
+                });
                 return render(ctx, 'otp-unlock', { ok: false, expired: true });
             }
             // Token válido: zera o lock OTP + limpa o token do DB.

package/build/src/host/controllers/registration_controller.js

@@ -1,15 +1,15 @@
 import '../augmentations.js';
-import { brandFor } from '../branding.js';
 import { randomBytes } from 'node:crypto';
-import { signupValidator, passwordlessSignupValidator, forgotPasswordValidator, resetPasswordValidator, } from '../validators.js';
-import { sendPasswordResetEmail, sendEmailVerificationEmail, sendMagicLinkEmail, } from '../default_mailer.js';
-import { translate } from '../i18n.js';
 import { PasswordPolicyError } from '../../password/password_manager.js';
+import { AdminSessionsService } from '../admin_sessions_service.js';
 import { guardBotProtection, resolveEffectiveBotProtection } from '../bot_protection.js';
+import { brandFor } from '../branding.js';
+import { sendEmailVerificationEmail, sendMagicLinkEmail, sendPasswordResetEmail, } from '../default_mailer.js';
+import { translate } from '../i18n.js';
 import { RuntimeSettings, resolveRuntimeSettings } from '../runtime_settings.js';
-import { resolveEffectiveRegistration, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, } from '../runtime_toggles.js';
+import { resolveEffectiveAuthMethods, resolveEffectiveMaintenanceMode, resolveEffectiveRegistration, } from '../runtime_toggles.js';
 import { dispatchSecurityNotice } from '../security_notice_service.js';
-import { AdminSessionsService } from '../admin_sessions_service.js';
+import { forgotPasswordValidator, passwordlessSignupValidator, resetPasswordValidator, signupValidator, } from '../validators.js';
 /**
  * Best-effort: returns a RuntimeSettings backed by the container DB, or a no-op
  * fallback. Contrato NON-NULL preservado (callers passam direto p/ resolvers que
@@ -19,7 +19,12 @@ import { AdminSessionsService } from '../admin_sessions_service.js';
  */
 async function getRuntimeSettings(ctx) {
     const rs = await resolveRuntimeSettings(ctx);
-    return rs ?? new RuntimeSettings({ table: () => { throw new Error('no-op'); } });
+    return (rs ??
+        new RuntimeSettings({
+            table: () => {
+                throw new Error('no-op');
+            },
+        }));
 }
 export default class AuthRegistrationController {
     /** GET /auth/interaction/:uid/signup — tela de cadastro (dentro do fluxo OIDC). */
@@ -119,7 +124,9 @@ export default class AuthRegistrationController {
                 csrfToken: ctx.request.csrfToken,
                 error: translate(cfg.messages, 'errors.email_taken'),
                 brand,
-                botProtection: effectiveBotSignup?.on.includes('signup') ? effectiveBotSignup.widget : undefined,
+                botProtection: effectiveBotSignup?.on.includes('signup')
+                    ? effectiveBotSignup.widget
+                    : undefined,
             });
         }
         let created;
@@ -139,7 +146,9 @@ export default class AuthRegistrationController {
                     csrfToken: ctx.request.csrfToken,
                     error: translate(cfg.messages, error.key, error.params),
                     brand,
-                    botProtection: effectiveBotSignup?.on.includes('signup') ? effectiveBotSignup.widget : undefined,
+                    botProtection: effectiveBotSignup?.on.includes('signup')
+                        ? effectiveBotSignup.widget
+                        : undefined,
                 });
             }
             throw error;
@@ -163,7 +172,9 @@ export default class AuthRegistrationController {
                 csrfToken: ctx.request.csrfToken,
                 error: translate(cfg.messages, 'errors.signup_failed'),
                 brand,
-                botProtection: effectiveBotSignup?.on.includes('signup') ? effectiveBotSignup.widget : undefined,
+                botProtection: effectiveBotSignup?.on.includes('signup')
+                    ? effectiveBotSignup.widget
+                    : undefined,
             });
         }
         // Verificação de e-mail (best-effort — não bloqueia nem reverte o login).
@@ -257,7 +268,8 @@ export default class AuthRegistrationController {
         // auth_methods: se forgotPassword efetivo for false → 404 (endpoint desligado).
         const authMethods = await resolveEffectiveAuthMethods(runtimeSettings, {
             configuredSocialProviders: cfg.social?.providers ?? [],
-            magicLinkCapable: cfg.passwordless?.magicLink && typeof cfg.accountStore.issueMagicLinkToken === 'function',
+            magicLinkCapable: cfg.passwordless?.magicLink &&
+                typeof cfg.accountStore.issueMagicLinkToken === 'function',
             configOverrides: cfg.authMethods,
         });
         if (!authMethods.forgotPassword) {
@@ -286,7 +298,8 @@ export default class AuthRegistrationController {
         // auth_methods: se forgotPassword efetivo for false → 404 (endpoint desligado).
         const authMethods = await resolveEffectiveAuthMethods(runtimeSettings, {
             configuredSocialProviders: cfg.social?.providers ?? [],
-            magicLinkCapable: cfg.passwordless?.magicLink && typeof cfg.accountStore.issueMagicLinkToken === 'function',
+            magicLinkCapable: cfg.passwordless?.magicLink &&
+                typeof cfg.accountStore.issueMagicLinkToken === 'function',
             configOverrides: cfg.authMethods,
         });
         if (!authMethods.forgotPassword) {
@@ -377,7 +390,9 @@ export default class AuthRegistrationController {
             throw error;
         }
         if (!ok) {
-            return ctx.response.badRequest({ error: translate(cfg.messages, 'errors.invalid_or_expired_token') });
+            return ctx.response.badRequest({
+                error: translate(cfg.messages, 'errors.invalid_or_expired_token'),
+            });
         }
         await cfg.audit?.record({
             type: 'password_reset.consumed',

package/build/src/host/default_mailer.js

@@ -6,8 +6,9 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
+import { accountPath } from './account_paths.js';
 import { renderTransactionalEmail } from './email_templates.js';
-import { resolveMessages, translate, } from './i18n.js';
+import { resolveMessages, translate } from './i18n.js';
 let mailServicePromise;
 /**
  * Importa o service de mail do HOST de forma preguiçosa e fail-safe.
@@ -191,7 +192,7 @@ export async function sendNewLoginEmail(ctx, data) {
             heading: translate(t, 'mail.new_login.heading'),
             intro,
             ctaLabel: translate(t, 'account.security.title'),
-            ctaUrl: `${origin}/account/security`,
+            ctaUrl: `${origin}${accountPath('security')}`,
             footnote: translate(t, 'mail.new_login.fallback'),
         });
         const sent = await sendEmail(ctx, data.email, content);
@@ -212,7 +213,10 @@ export async function sendNewDeviceLoginEmail(ctx, data) {
         const brand = resolveBrand(ctx);
         const { messages: t, locale } = resolveMailMessages(ctx);
         const origin = `${ctx.request.protocol()}://${ctx.request.host()}`;
-        const lines = [translate(t, 'mail.new_login.intro'), translate(t, 'mail.new_login.when', { date: data.when })];
+        const lines = [
+            translate(t, 'mail.new_login.intro'),
+            translate(t, 'mail.new_login.when', { date: data.when }),
+        ];
         if (data.userAgent)
             lines.push(translate(t, 'mail.new_login.device', { device: data.userAgent }));
         if (data.ip)
@@ -225,7 +229,7 @@ export async function sendNewDeviceLoginEmail(ctx, data) {
             heading: translate(t, 'mail.new_login.heading'),
             intro: lines.join(' '),
             ctaLabel: translate(t, 'account.security.title'),
-            ctaUrl: `${origin}/account/security`,
+            ctaUrl: `${origin}${accountPath('security')}`,
             footnote: translate(t, 'mail.new_login.fallback'),
         });
         const sent = await sendEmail(ctx, data.email, content);
@@ -283,7 +287,7 @@ export async function sendEmailChangeNoticeEmail(ctx, data) {
             heading: translate(t, 'mail.email_change_notice.heading'),
             intro: translate(t, 'mail.email_change_notice.intro', { newEmail: data.newEmail }),
             ctaLabel: translate(t, 'mail.email_change_notice.cta'),
-            ctaUrl: `${origin}/account/security`,
+            ctaUrl: `${origin}${accountPath('security')}`,
             footnote: translate(t, 'mail.email_change_notice.fallback'),
         });
         const sent = await sendEmail(ctx, data.email, content);
@@ -316,7 +320,7 @@ export async function sendEmailChangedCompletedEmail(ctx, data) {
                 newEmail: data.newEmail,
             }),
             ctaLabel: translate(t, 'mail.email_changed_completed.cta'),
-            ctaUrl: `${origin}/account/security`,
+            ctaUrl: `${origin}${accountPath('security')}`,
             footnote: translate(t, 'mail.email_changed_completed.fallback'),
         });
         const sent = await sendEmail(ctx, data.oldEmail, content);
@@ -354,7 +358,7 @@ export async function sendSecurityNoticeEmail(ctx, data) {
             heading: translate(t, 'mail.security_notice.heading'),
             intro: intro.join(' '),
             ctaLabel: translate(t, 'account.security.title'),
-            ctaUrl: `${origin}/account/security`,
+            ctaUrl: `${origin}${accountPath('security')}`,
             footnote: translate(t, 'mail.security_notice.fallback'),
         });
         const sent = await sendEmail(ctx, data.email, content);

package/build/src/host/durable/account_deletion_workflow.d.ts

@@ -1,5 +1,5 @@
-import type { OidcService } from "../../provider/oidc_service.js";
-import type { DeletionActor } from "../account_deletion_service.js";
+import type { OidcService } from '../../provider/oidc_service.js';
+import type { DeletionActor } from '../account_deletion_service.js';
 /** Nome canônico do workflow durável de deleção de conta. */
 export declare const ACCOUNT_DELETE_WORKFLOW = "authkit.account.delete";
 /** Input do workflow `authkit.account.delete`. */

package/build/src/host/durable/account_deletion_workflow.js

@@ -1,6 +1,6 @@
-import { anonymizeAudit, auditDeleted, deleteAccountAvatar, deleteAccountRow, disableMfa, removeFromOrgs, removePasskeys, revokePats, revokeSessions, snapshotAccount, unlinkProviders, } from "../account_deletion_ops.js";
+import { anonymizeAudit, auditDeleted, deleteAccountAvatar, deleteAccountRow, disableMfa, removeFromOrgs, removePasskeys, revokePats, revokeSessions, snapshotAccount, unlinkProviders, } from '../account_deletion_ops.js';
 /** Nome canônico do workflow durável de deleção de conta. */
-export const ACCOUNT_DELETE_WORKFLOW = "authkit.account.delete";
+export const ACCOUNT_DELETE_WORKFLOW = 'authkit.account.delete';
 /** Estado inicial vazio do {@link DeletionResult} (acumulado etapa a etapa). */
 function emptyResult() {
     return {
@@ -42,7 +42,7 @@ export function defineAccountDeletionWorkflow(deps) {
         // Snapshot da conta ANTES de destruir (e-mail + avatar) — capturado num step
         // para ser determinístico no replay. Se a conta não existe (ou já foi
         // deletada num run anterior), encerra como no-op.
-        const snapshot = await ctx.step("snapshot", async () => {
+        const snapshot = await ctx.step('snapshot', async () => {
             const cfg = (await deps.oidc()).config;
             return snapshotAccount(cfg, accountId);
         });
@@ -50,37 +50,37 @@ export function defineAccountDeletionWorkflow(deps) {
             return emptyResult();
         const result = emptyResult();
         // 1) Audit `account.deleted` ANTES de qualquer destruição.
-        await ctx.step("audit.deleted", async () => {
+        await ctx.step('audit.deleted', async () => {
             const cfg = (await deps.oidc()).config;
             await auditDeleted(cfg, snapshot, actor);
         });
         // 2) Sessões + grants (cascateia os tokens do oidc-provider).
-        const revoke = await ctx.step("revoke.sessions", async () => revokeSessions(await deps.oidc(), accountId));
+        const revoke = await ctx.step('revoke.sessions', async () => revokeSessions(await deps.oidc(), accountId));
         result.sessions = revoke.sessions;
         result.grants = revoke.grants;
         result.accessTokens = revoke.accessTokens;
         result.refreshTokens = revoke.refreshTokens;
         // 3) Personal Access Tokens.
-        result.pats = (await ctx.step("revoke.pats", async () => revokePats((await deps.oidc()).config, accountId))).pats;
+        result.pats = (await ctx.step('revoke.pats', async () => revokePats((await deps.oidc()).config, accountId))).pats;
         // 4) Passkeys / credenciais WebAuthn.
-        result.passkeys = (await ctx.step("remove.passkeys", async () => removePasskeys((await deps.oidc()).config, accountId))).passkeys;
+        result.passkeys = (await ctx.step('remove.passkeys', async () => removePasskeys((await deps.oidc()).config, accountId))).passkeys;
         // 5) MFA / TOTP.
-        await ctx.step("disable.mfa", async () => {
+        await ctx.step('disable.mfa', async () => {
             await disableMfa((await deps.oidc()).config, accountId);
         });
         // 6) Identidades de provider linkadas.
-        result.providerIdentities = (await ctx.step("unlink.providers", async () => unlinkProviders((await deps.oidc()).config, accountId))).providerIdentities;
+        result.providerIdentities = (await ctx.step('unlink.providers', async () => unlinkProviders((await deps.oidc()).config, accountId))).providerIdentities;
         // 6b) Organizations.
-        const orgResult = await ctx.step("remove.orgs", async () => removeFromOrgs((await deps.oidc()).config, accountId));
+        const orgResult = await ctx.step('remove.orgs', async () => removeFromOrgs((await deps.oidc()).config, accountId));
         result.orgMemberships = orgResult.orgMemberships;
         result.orgInvitations = orgResult.orgInvitations;
         // 7) Avatar no drive.
-        result.avatarDeleted = (await ctx.step("delete.avatar", async () => deleteAccountAvatar((await deps.oidc()).config, accountId, snapshot.avatarUrl))).avatarDeleted;
+        result.avatarDeleted = (await ctx.step('delete.avatar', async () => deleteAccountAvatar((await deps.oidc()).config, accountId, snapshot.avatarUrl))).avatarDeleted;
         // 8) Anonimiza o histórico de audit.
-        result.auditAnonymized = (await ctx.step("anonymize.audit", async () => anonymizeAudit((await deps.oidc()).config, accountId))).auditAnonymized;
+        result.auditAnonymized = (await ctx.step('anonymize.audit', async () => anonymizeAudit((await deps.oidc()).config, accountId))).auditAnonymized;
         // 9) Deleta a linha da conta (ÚLTIMA etapa, forward-only).
-        result.ok = (await ctx.step("delete.account", async () => deleteAccountRow((await deps.oidc()).config, accountId))).ok;
+        result.ok = (await ctx.step('delete.account', async () => deleteAccountRow((await deps.oidc()).config, accountId))).ok;
         return result;
     };
-    return { name: ACCOUNT_DELETE_WORKFLOW, version: "1", body };
+    return { name: ACCOUNT_DELETE_WORKFLOW, version: '1', body };
 }

package/build/src/host/durable/account_export_workflow.d.ts

@@ -1,5 +1,5 @@
-import type { OidcService } from "../../provider/oidc_service.js";
-import type { DurableStepCtx } from "./account_deletion_workflow.js";
+import type { OidcService } from '../../provider/oidc_service.js';
+import type { DurableStepCtx } from './account_deletion_workflow.js';
 /** Nome canônico do workflow durável de export de dados de conta. */
 export declare const ACCOUNT_EXPORT_WORKFLOW = "authkit.account.export";
 /** Input do workflow `authkit.account.export`. */

package/build/src/host/durable/account_export_workflow.js

@@ -6,14 +6,14 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { AccountExportService, } from "../account_export_service.js";
+import { AccountExportService } from '../account_export_service.js';
 /** Nome canônico do workflow durável de export de dados de conta. */
-export const ACCOUNT_EXPORT_WORKFLOW = "authkit.account.export";
+export const ACCOUNT_EXPORT_WORKFLOW = 'authkit.account.export';
 /** Persistência default: grava o JSON no disk do drive do app (best-effort). */
-const defaultPersist = async ({ accountId, runId, json, oidc, }) => {
+const defaultPersist = async ({ accountId, runId, json, oidc }) => {
     // Indireção via variável: `@adonisjs/drive` é peer/opcional — pode não estar
     // instalado, então o specifier não é resolvido em build-time.
-    const specifier = "@adonisjs/drive/services/main";
+    const specifier = '@adonisjs/drive/services/main';
     let drive = null;
     try {
         const mod = await import(__rewriteRelativeImportExtension(specifier));
@@ -26,13 +26,13 @@ const defaultPersist = async ({ accountId, runId, json, oidc, }) => {
         return null;
     const cfg = oidc.config;
     const exportsCfg = cfg.uploads.exports;
-    const directory = (exportsCfg?.directory ?? "authkit/exports").replace(/\/+$/, "");
+    const directory = (exportsCfg?.directory ?? 'authkit/exports').replace(/\/+$/, '');
     const diskName = exportsCfg?.disk ?? cfg.uploads.avatars?.disk;
     const key = `${directory}/authkit-data-export-${accountId}-${runId}.json`;
     try {
         const disk = diskName ? drive.use(diskName) : drive.use();
         await disk.put(key, json, {
-            contentType: "application/json; charset=utf-8",
+            contentType: 'application/json; charset=utf-8',
         });
         return key;
     }
@@ -61,33 +61,33 @@ export function defineAccountExportWorkflow(deps) {
         const { accountId } = input;
         const runId = ctx.runId ?? accountId;
         // 1) Coleta o payload (reusa a coleta inline do AccountExportService).
-        const payload = await ctx.step("collect", async () => {
+        const payload = await ctx.step('collect', async () => {
             const oidc = await deps.oidc();
             return new AccountExportService(oidc).collect(accountId);
         });
         if (!payload)
             return { ok: false, artifactKey: null, bytes: 0 };
         // 2) Audita o export (account.exported).
-        await ctx.step("audit", async () => {
+        await ctx.step('audit', async () => {
             const cfg = (await deps.oidc()).config;
             await cfg.audit?.record({
-                type: "account.exported",
+                type: 'account.exported',
                 accountId,
                 ip: input.ip ?? null,
             });
         });
         // 3) Serializa + persiste o artefato.
         const json = JSON.stringify(payload, null, 2);
-        const artifactKey = await ctx.step("persist", async () => {
+        const artifactKey = await ctx.step('persist', async () => {
             const oidc = await deps.oidc();
             return persist({ accountId, runId, json, oidc });
         });
         // 4) Entrega ao titular (signal + e-mail, pluggable).
-        await ctx.step("deliver", async () => {
+        await ctx.step('deliver', async () => {
             const oidc = await deps.oidc();
             await deliver({ accountId, runId, artifactKey, oidc });
         });
         return { ok: true, artifactKey, bytes: json.length };
     };
-    return { name: ACCOUNT_EXPORT_WORKFLOW, version: "1", body };
+    return { name: ACCOUNT_EXPORT_WORKFLOW, version: '1', body };
 }

package/build/src/host/durable/index.d.ts

@@ -26,11 +26,11 @@
  * // ...e rode um worker (engine.runPending / runOne) p/ o grupo do authkit.
  * ```
  */
-import type { DeletionActor } from "../account_deletion_service.js";
-import { type AccountDeleteWorkflowInput } from "./account_deletion_workflow.js";
-import { type AccountExportWorkflowInput } from "./account_export_workflow.js";
-export { defineAccountDeletionWorkflow, ACCOUNT_DELETE_WORKFLOW, type AccountDeleteWorkflowInput, type AccountDeletionWorkflowDeps, type DurableStepCtx, type WorkflowBody, } from "./account_deletion_workflow.js";
-export { defineAccountExportWorkflow, ACCOUNT_EXPORT_WORKFLOW, type AccountExportWorkflowInput, type AccountExportWorkflowResult, type AccountExportWorkflowDeps, type PersistArtifact, type DeliverArtifact, } from "./account_export_workflow.js";
+import type { DeletionActor } from '../account_deletion_service.js';
+import { type AccountDeleteWorkflowInput } from './account_deletion_workflow.js';
+import { type AccountExportWorkflowInput } from './account_export_workflow.js';
+export { defineAccountDeletionWorkflow, ACCOUNT_DELETE_WORKFLOW, type AccountDeleteWorkflowInput, type AccountDeletionWorkflowDeps, type DurableStepCtx, type WorkflowBody, } from './account_deletion_workflow.js';
+export { defineAccountExportWorkflow, ACCOUNT_EXPORT_WORKFLOW, type AccountExportWorkflowInput, type AccountExportWorkflowResult, type AccountExportWorkflowDeps, type PersistArtifact, type DeliverArtifact, } from './account_export_workflow.js';
 /**
  * Superfície mínima do `WorkflowEngine` que o enqueue usa (`start` idempotente por
  * run-id). Tipada estruturalmente p/ NÃO acoplar o build ao peer opcional.

package/build/src/host/durable/index.js

@@ -26,10 +26,10 @@
  * // ...e rode um worker (engine.runPending / runOne) p/ o grupo do authkit.
  * ```
  */
-import { ACCOUNT_DELETE_WORKFLOW, } from "./account_deletion_workflow.js";
-import { ACCOUNT_EXPORT_WORKFLOW, } from "./account_export_workflow.js";
-export { defineAccountDeletionWorkflow, ACCOUNT_DELETE_WORKFLOW, } from "./account_deletion_workflow.js";
-export { defineAccountExportWorkflow, ACCOUNT_EXPORT_WORKFLOW, } from "./account_export_workflow.js";
+import { ACCOUNT_DELETE_WORKFLOW, } from './account_deletion_workflow.js';
+import { ACCOUNT_EXPORT_WORKFLOW, } from './account_export_workflow.js';
+export { defineAccountDeletionWorkflow, ACCOUNT_DELETE_WORKFLOW, } from './account_deletion_workflow.js';
+export { defineAccountExportWorkflow, ACCOUNT_EXPORT_WORKFLOW, } from './account_export_workflow.js';
 /**
  * Resolve o `WorkflowEngine` do container — SÓ no caminho durável. Importa
  * `@adonis-agora/durable` dinamicamente (peer opcional), então o barrel principal
@@ -38,11 +38,11 @@ export { defineAccountExportWorkflow, ACCOUNT_EXPORT_WORKFLOW, } from "./account
 export async function resolveWorkflowEngine(resolver) {
     let mod;
     try {
-        mod = (await import("@adonis-agora/durable"));
+        mod = (await import('@adonis-agora/durable'));
     }
     catch {
         throw new Error('[authkit] durable account-lifecycle is enabled but "@adonis-agora/durable" is not installed. ' +
-            "Add it as a dependency and register the workflows on your WorkflowEngine.");
+            'Add it as a dependency and register the workflows on your WorkflowEngine.');
     }
     return resolver.make(mod.WorkflowEngine);
 }