@adonis-agora/authkit-server 0.59.0 → 0.61.0

package/build/index.d.ts

@@ -23,8 +23,8 @@ export { lucidAccountStore, appKeyEncrypter } from './src/accounts/lucid_account
 export { lucidStores } from './src/accounts/lucid_stores.js';
 export type { LucidStoresModels, LucidStoresOptions, LucidStoresResult, } from './src/accounts/lucid_stores.js';
 export type { LucidAccountStoreOptions, AccountSecretEncrypter, } from './src/accounts/lucid_account_store.js';
-export type { AccountStore, CoreAccountStore, AdminCapability, MfaCapability, WebauthnCapability, ProviderIdentityCapability, ProviderIdentitySummary, AccountSecurityCapability, AccountStatusCapability, ProfileCapability, MagicLinkCapability, OtpLoginCapability, OtpLoginVerifyResult, EmailVerificationStatusCapability, AccountDeletionCapability, AccountImportCapability, ImportAccountInput, AuthAccount, CreateAccountInput, LinkProviderIdentityInput, ListAccountsParams, Paginated, PasskeySummary, } from './src/accounts/account_store.js';
-export { supportsMfa, supportsPasskeys, supportsProviderIdentity, supportsAccountSecurity, supportsAccountStatus, supportsProfile, supportsMagicLink, supportsOtpLogin, supportsEmailVerificationStatus, supportsAccountDeletion, supportsAccountImport, } from './src/accounts/account_store.js';
+export type { AccountStore, CoreAccountStore, AdminCapability, MfaCapability, WebauthnCapability, ProviderIdentityCapability, ProviderIdentitySummary, AccountSecurityCapability, AccountStatusCapability, ProfileCapability, MagicLinkCapability, OtpLoginCapability, OtpLoginVerifyResult, EmailVerificationStatusCapability, AccountDeletionCapability, AccountImportCapability, ImportAccountInput, AuthAccount, CreateAccountInput, LinkProviderIdentityInput, ListAccountsParams, Paginated, PasskeySummary, LoginMethodsPreferenceCapability, } from './src/accounts/account_store.js';
+export { supportsMfa, supportsPasskeys, supportsProviderIdentity, supportsAccountSecurity, supportsAccountStatus, supportsProfile, supportsMagicLink, supportsOtpLogin, supportsEmailVerificationStatus, supportsAccountDeletion, supportsAccountImport, supportsLoginMethodsPreference, } from './src/accounts/account_store.js';
 export { type OtpLoginConfigInput, type ResolvedOtpLoginConfig, type OtpVerifyOutcome, resolveOtpLoginConfig, generateOtpCode, evaluateLoginOtp, OTP_LOGIN_DEFAULTS, } from './src/host/otp_login.js';
 export { PasswordManager, PasswordPolicyError, } from './src/password/password_manager.js';
 export type { PasswordConfigInput, LegacyPasswordVerifier, PasswordVerifyResult, } from './src/password/password_manager.js';
@@ -125,6 +125,8 @@ export { resolveEffectiveBotProtection } from './src/host/bot_protection.js';
 export type { BotProtectionSetting } from './src/host/bot_protection.js';
 export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
 export type { SettingKey, RegistrationSetting, RequireVerifiedEmailSetting, MaintenanceModeSetting, ResolvedMaintenanceMode, AuthMethodsSetting, ResolvedAuthMethods, AuthMethodsCapabilities, AuthMethodsConfigOverride, } from './src/host/runtime_toggles.js';
+export { USER_LOGIN_METHOD_KEYS, normalizeUserLoginMethods, parseUserLoginMethodsPayload, resolveEffectiveUserLoginMethods, } from './src/host/user_login_methods.js';
+export type { UserLoginMethodKey, UserLoginMethods, ResolvedUserLoginMethods, } from './src/host/user_login_methods.js';
 export { resolveRegistration } from './src/define_config.js';
 export type { RegistrationConfigInput, ResolvedRegistrationConfig, } from './src/define_config.js';
 export { getAccountId, realAccountId, hasAccountSession, consoleLoginUrl, } from './src/host/console_session.js';

package/build/index.js

@@ -14,7 +14,7 @@ export { resolveTrustedDevices, isTrustedDeviceValid, buildTrustedDevicePayload,
 export { resolveBotProtection, botProtectionApplies, extractBotToken, verifyBotProtection, guardBotProtection, DEFAULT_BOT_TOKEN_FIELDS, } from './src/host/bot_protection.js';
 export { lucidAccountStore, appKeyEncrypter } from './src/accounts/lucid_account_store.js';
 export { lucidStores } from './src/accounts/lucid_stores.js';
-export { supportsMfa, supportsPasskeys, supportsProviderIdentity, supportsAccountSecurity, supportsAccountStatus, supportsProfile, supportsMagicLink, supportsOtpLogin, supportsEmailVerificationStatus, supportsAccountDeletion, supportsAccountImport, } from './src/accounts/account_store.js';
+export { supportsMfa, supportsPasskeys, supportsProviderIdentity, supportsAccountSecurity, supportsAccountStatus, supportsProfile, supportsMagicLink, supportsOtpLogin, supportsEmailVerificationStatus, supportsAccountDeletion, supportsAccountImport, supportsLoginMethodsPreference, } from './src/accounts/account_store.js';
 // Login por OTP (código digitável): config + helpers puros.
 export { resolveOtpLoginConfig, generateOtpCode, evaluateLoginOtp, OTP_LOGIN_DEFAULTS, } from './src/host/otp_login.js';
 // Gerência de senha: lazy rehash + legacy verifier, política e checagem de vazamento.
@@ -85,6 +85,8 @@ export { buildKeysStatus, rotateNow } from './src/host/key_rotation_actions.js';
 export { resolveEffectiveBotProtection } from './src/host/bot_protection.js';
 // Runtime toggles (registration, require_verified_email, maintenance_mode).
 export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
+// Tipos de login POR USUÁRIO (self-service no console de conta).
+export { USER_LOGIN_METHOD_KEYS, normalizeUserLoginMethods, parseUserLoginMethodsPayload, resolveEffectiveUserLoginMethods, } from './src/host/user_login_methods.js';
 export { resolveRegistration } from './src/define_config.js';
 export { getAccountId, realAccountId, hasAccountSession, consoleLoginUrl, } from './src/host/console_session.js';
 export { ACCOUNT_SESSION_KEY } from './src/host/account_session_key.js';

package/build/providers/authkit_server_provider.js

@@ -77,6 +77,13 @@ export default class AuthkitServerProvider {
                         // Defaults estruturais de `config.routes` (o argumento ainda vence).
                         routes: typeof config.routes === 'object' ? config.routes : undefined,
                         lockedRouteOptions: config.lockedRouteOptions,
+                        // API headless — repassa pro registerAuthHost montar as rotas.
+                        headless: config.headless
+                            ? {
+                                baseUrl: config.headless.baseUrl,
+                                resolveAccountId: config.headless.resolveAccountId,
+                            }
+                            : undefined,
                     });
                 }
             }

package/build/src/accounts/account_store.d.ts

@@ -1,4 +1,5 @@
 /** DTO público da conta — o que o provider e os controllers enxergam. Nunca um model Lucid. */
+import type { UserLoginMethods } from '../host/user_login_methods.js';
 export interface AuthAccount {
     id: string;
     email: string;
@@ -211,6 +212,22 @@ export interface ProviderIdentitySummary {
     providerUserId: string;
     email?: string | null;
 }
+/**
+ * Preferência POR USUÁRIO de tipos de login (self-service no console de conta).
+ * CAPACIDADE opcional, montada quando o model tem a coluna `login_methods`
+ * (JSONB) — hosts adotam por migração própria. `null` = sem preferência (herda
+ * os métodos globais efetivos). Ver `host/user_login_methods.ts` para o shape
+ * canônico (`UserLoginMethods`) e a semântica da interseção.
+ */
+export interface LoginMethodsPreferenceCapability {
+    /** Lê a preferência da conta; null quando não há preferência persistida. */
+    getLoginMethods(accountId: string): Promise<UserLoginMethods | null>;
+    /**
+     * Grava a preferência da conta. Objeto vazio ou null REMOVE a preferência
+     * (volta a herdar os globais). No-op se a conta não existe.
+     */
+    setLoginMethods(accountId: string, methods: UserLoginMethods | null): Promise<void>;
+}
 /**
  * MFA / TOTP. Stores sem suporte a MFA omitem a capacidade inteira; o interaction
  * flow trata a ausência como "MFA desligado".
@@ -599,7 +616,7 @@ export type AccountStore = CoreAccountStore & {
      * blocos `Partial<...>` de capacidades probáveis.
      */
     readonly connectionName?: string;
-} & Partial<MfaCapability & WebauthnCapability & ProviderIdentityCapability & AccountSecurityCapability & AccountStatusCapability & ProfileCapability & MagicLinkCapability & OtpLoginCapability & EmailVerificationStatusCapability & AccountDeletionCapability & AccountImportCapability & OrganizationsCapability & PasswordHistoryCapability & PasswordExpirationCapability>;
+} & Partial<MfaCapability & WebauthnCapability & ProviderIdentityCapability & AccountSecurityCapability & AccountStatusCapability & ProfileCapability & MagicLinkCapability & OtpLoginCapability & EmailVerificationStatusCapability & AccountDeletionCapability & AccountImportCapability & OrganizationsCapability & PasswordHistoryCapability & PasswordExpirationCapability & LoginMethodsPreferenceCapability>;
 /** Type guard: o store implementa a capacidade de MFA / TOTP. */
 export declare function supportsMfa(store: AccountStore): store is AccountStore & MfaCapability;
 /**
@@ -634,3 +651,5 @@ export declare function supportsAccountImport(store: AccountStore): store is Acc
 export declare function supportsPasswordHistory(store: AccountStore): store is AccountStore & PasswordHistoryCapability;
 /** Type guard: o store implementa expiração de senha (password_changed_at coluna). */
 export declare function supportsPasswordExpiration(store: AccountStore): store is AccountStore & PasswordExpirationCapability;
+/** Type guard: o store implementa a preferência por usuário de tipos de login. */
+export declare function supportsLoginMethodsPreference(store: AccountStore): store is AccountStore & LoginMethodsPreferenceCapability;

package/build/src/accounts/account_store.js

@@ -63,3 +63,7 @@ export function supportsPasswordHistory(store) {
 export function supportsPasswordExpiration(store) {
     return typeof store.getPasswordChangedAt === 'function';
 }
+/** Type guard: o store implementa a preferência por usuário de tipos de login. */
+export function supportsLoginMethodsPreference(store) {
+    return typeof store.getLoginMethods === 'function';
+}

package/build/src/accounts/lucid_account_store.js

@@ -1,6 +1,7 @@
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
 import { PasswordManager } from '../password/password_manager.js';
 import { buildCore } from './lucid_store/core.js';
+import { buildLoginMethods, supportsLoginMethodsColumn } from './lucid_store/login_methods.js';
 import { buildMfa } from './lucid_store/mfa.js';
 import { buildOrganizations } from './lucid_store/organizations.js';
 import { buildPasswordExpiration, buildPasswordHistory } from './lucid_store/password_hygiene.js';
@@ -212,6 +213,9 @@ export function lucidAccountStore(Model, options = {}) {
         ...buildDeletion(ctx),
         // Expiração de senha: só quando o model tem a coluna `password_changed_at`.
         ...(hasColumn(Model, 'passwordChangedAt') ? buildPasswordExpiration(ctx) : {}),
+        // Preferência por usuário de tipos de login: só quando o model tem a coluna
+        // `login_methods` (JSONB). Sem a coluna → capacidade ausente (feature no-op).
+        ...(supportsLoginMethodsColumn(Model) ? buildLoginMethods(ctx) : {}),
         // Organizations (multi-tenancy): só quando os três models foram fornecidos.
         ...(OrgModels
             ? buildOrganizations({

package/build/src/accounts/lucid_store/login_methods.d.ts

@@ -0,0 +1,11 @@
+import type { LoginMethodsPreferenceCapability } from '../account_store.js';
+import type { LucidStoreContext } from './shared.js';
+/**
+ * Preferência por usuário de tipos de login sobre a coluna `login_methods`
+ * (JSONB) do model. Só deve ser montada quando a coluna existe
+ * ({@link hasColumn}) — caso contrário a capacidade fica ausente e a feature
+ * degrada para no-op (hosts adotam por migração própria).
+ */
+export declare function buildLoginMethods(ctx: LucidStoreContext): LoginMethodsPreferenceCapability;
+/** Indica se o model suporta a preferência de tipos de login (coluna presente). */
+export declare function supportsLoginMethodsColumn(Model: any): boolean;

package/build/src/accounts/lucid_store/login_methods.js

@@ -0,0 +1,32 @@
+import { normalizeUserLoginMethods } from '../../host/user_login_methods.js';
+import { hasColumn } from './status_profile.js';
+/**
+ * Preferência por usuário de tipos de login sobre a coluna `login_methods`
+ * (JSONB) do model. Só deve ser montada quando a coluna existe
+ * ({@link hasColumn}) — caso contrário a capacidade fica ausente e a feature
+ * degrada para no-op (hosts adotam por migração própria).
+ */
+export function buildLoginMethods(ctx) {
+    const { Model } = ctx;
+    return {
+        async getLoginMethods(accountId) {
+            const row = await Model.find(accountId);
+            if (!row)
+                return null;
+            return normalizeUserLoginMethods(row.loginMethods);
+        },
+        async setLoginMethods(accountId, methods) {
+            const row = await Model.find(accountId);
+            if (!row)
+                return;
+            // Objeto vazio/null → grava null (sem preferência = herda globais).
+            const value = methods && Object.keys(methods).length > 0 ? normalizeUserLoginMethods(methods) : null;
+            row.loginMethods = value;
+            await row.save();
+        },
+    };
+}
+/** Indica se o model suporta a preferência de tipos de login (coluna presente). */
+export function supportsLoginMethodsColumn(Model) {
+    return hasColumn(Model, 'loginMethods');
+}

package/build/src/define_config.d.ts

@@ -822,6 +822,24 @@ export interface AuthServerConfigInput {
     i18n?: I18nConfig;
     /** Configuração de providers sociais. */
     social?: AuthSocialConfig;
+    /**
+     * API headless do AuthKit (Clerk-style). Quando declarada, o host-kit monta
+     * uma JSON API (`GET/PUT {baseUrl}/login-methods`) autenticada por um resolver
+     * de conta fornecido pelo HOST (`resolveAccountId`) — tipicamente a própria
+     * sessão do RP (`await ctx.auth.getUserOrFail()`). Assim um app usa AuthKit
+     * como frontend sem expor o console `/account/*`. Default: desligado (opt-in).
+     */
+    headless?: {
+        /** Base da JSON API headless. Default: `/api/authkit`. */
+        baseUrl?: string;
+        /**
+         * Resolve o id da conta (na identidade do IdP) a partir do contexto da
+         * request do HOST. Retorne null quando não autenticado → 401. Um `throw`
+         * do resolver também vira 401. O id deve ser o mesmo `sub`/`AuthAccount.id`
+         * usado pelo account store (no entre-textos, `auth.user.id === app.user.id`).
+         */
+        resolveAccountId: (ctx: import('@adonisjs/core/http').HttpContext) => string | null;
+    };
     /** Segredo para autenticar requests de introspecção de PAT. */
     patIntrospectionSecret?: string;
     /** Rate-limiting das rotas sensíveis (anti-brute-force). Default: ligado (no-op se o limiter não estiver configurado). */
@@ -1075,6 +1093,11 @@ export interface ResolvedServerConfig {
     firstPartyClients?: string[];
     social?: AuthSocialConfig;
     patIntrospectionSecret?: string;
+    /** API headless resolvida (Clerk-style). Presente só quando o host a declarou. */
+    headless?: {
+        baseUrl: string;
+        resolveAccountId: (ctx: import('@adonisjs/core/http').HttpContext) => string | null;
+    };
     rateLimit: ResolvedRateLimitConfig;
     /** Bloqueio progressivo de conta resolvido (sempre presente; default ligado). */
     lockout: ResolvedLockoutConfig;

package/build/src/define_config.js

@@ -395,6 +395,12 @@ export function defineConfig(config) {
             passwordless: resolvePasswordless(config.passwordless),
             authMethods: resolveAuthMethodsConfig(config.authMethods),
             login: resolveLogin(config.login),
+            headless: config.headless
+                ? {
+                    baseUrl: config.headless.baseUrl ?? '/api/authkit',
+                    resolveAccountId: config.headless.resolveAccountId,
+                }
+                : undefined,
             registration: resolveRegistration(config.registration),
             accessTokens: resolveAccessTokens(config.issuer, config.accessTokens),
             admin: resolveAdmin(config.admin),

package/build/src/host/account_api/account_api_controller.d.ts

@@ -30,6 +30,7 @@
 import '../augmentations.js';
 import type { HttpContext } from '@adonisjs/core/http';
 export default class AccountApiController {
+    #private;
     /** Perfil + flags do usuário logado. */
     me(ctx: HttpContext): Promise<void | {
         id: any;
@@ -171,6 +172,43 @@ export default class AccountApiController {
             available: any;
         };
     }>;
+    /**
+     * Preferência POR USUÁRIO de tipos de login + o catálogo do que está
+     * disponível/travado. A interseção com os métodos globais efetivos é feita
+     * AQUI (a UI mostra o estado final; o enforcement no login reusa o resolver).
+     */
+    getLoginMethods(ctx: HttpContext): Promise<{
+        supported: false;
+        methods: null;
+        available: null;
+        locked: null;
+    } | {
+        supported: true;
+        methods: any;
+        available: {
+            password: boolean;
+            magicLink: boolean;
+            passkey: boolean;
+            social: string[];
+            forgotPassword: boolean;
+        };
+        locked: {
+            password: boolean;
+            magicLink: boolean;
+            passkey: boolean;
+            social: boolean;
+        };
+    }>;
+    /** Grava a preferência de tipos de login do usuário logado. */
+    updateLoginMethods(ctx: HttpContext): Promise<void | {
+        ok: boolean;
+        methods: {
+            password?: boolean;
+            magicLink?: boolean;
+            passkey?: boolean;
+            social?: boolean;
+        };
+    }>;
     /** Lista passkeys do usuário logado. */
     listPasskeys(ctx: HttpContext): Promise<{
         supported: boolean;

package/build/src/host/account_api/account_api_controller.js

@@ -28,7 +28,7 @@
  *   GET  /account/api/orgs/invitations     → convites pendentes
  */
 import '../augmentations.js';
-import { supportsAccountSecurity, supportsOrganizations, supportsPasskeys, supportsProfile, } from '../../accounts/account_store.js';
+import { supportsAccountSecurity, supportsLoginMethodsPreference, supportsMagicLink, supportsOrganizations, supportsPasskeys, supportsProfile, } from '../../accounts/account_store.js';
 import { PasswordPolicyError } from '../../password/password_manager.js';
 import { accountPath } from '../account_paths.js';
 import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
@@ -39,11 +39,12 @@ import { AvatarUploadError, isAvatarUploadSupported, storeAvatar } from '../avat
 import { sendEmailChangeConfirmationEmail, sendEmailChangeNoticeEmail } from '../default_mailer.js';
 import { translate } from '../i18n.js';
 import { authkitOrigin } from '../origin.js';
-import { resolveRuntimeSettings } from '../runtime_settings.js';
-import { resolveEffectiveEmailChange, resolveEffectivePasswordHistory, } from '../runtime_toggles.js';
+import { resolveRuntimeSettings, resolveRuntimeSettingsOrNoop } from '../runtime_settings.js';
+import { configLockedAuthMethods, resolveEffectiveAuthMethods, resolveEffectiveEmailChange, resolveEffectivePasswordHistory, } from '../runtime_toggles.js';
 import { dispatchSecurityNotice } from '../security_notice_service.js';
 import { enrichSessionsWithContext } from '../session_context.js';
 import { SUDO_MODE_DEFAULTS, isSudoActive, requireSudo, resolveEffectiveSudoMode, } from '../sudo_mode.js';
+import { parseUserLoginMethodsPayload, resolveEffectiveUserLoginMethods, } from '../user_login_methods.js';
 import { changeEmailValidator, changePasswordValidator, updateProfileValidator, } from '../validators.js';
 // ---------------------------------------------------------------------------
 // Helpers (shared with existing controllers — kept local to avoid coupling)
@@ -641,6 +642,86 @@ export default class AccountApiController {
             recovery: { available: enabled },
         };
     }
+    // ─── GET /account/api/login-methods ─────────────────────────────────────
+    /**
+     * Preferência POR USUÁRIO de tipos de login + o catálogo do que está
+     * disponível/travado. A interseção com os métodos globais efetivos é feita
+     * AQUI (a UI mostra o estado final; o enforcement no login reusa o resolver).
+     */
+    async getLoginMethods(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        const supported = supportsLoginMethodsPreference(cfg.accountStore);
+        if (!supported) {
+            return { supported: false, methods: null, available: null, locked: null };
+        }
+        const pref = await cfg.accountStore.getLoginMethods(userId);
+        const { resolved: global, locked: cfgLocked } = await this.#resolveGlobalAuthMethods(ctx, cfg);
+        const effective = resolveEffectiveUserLoginMethods(global, pref);
+        return {
+            supported: true,
+            // Preferência crua do usuário (o que ELE escolheu; null = sem preferência).
+            methods: pref ?? {},
+            // Estado final por método (global ∩ preferência) — o que a tela de login mostra.
+            available: {
+                password: effective.password,
+                magicLink: effective.magicLink,
+                passkey: effective.passkey,
+                social: effective.social,
+                forgotPassword: effective.forgotPassword,
+            },
+            // Métodos que o usuário NÃO pode controlar (globalmente off ou pin de config).
+            // Pin de config: `cfgLocked` lista as chaves fixadas no arquivo de config.
+            locked: {
+                password: !global.password || cfgLocked.includes('password'),
+                magicLink: !global.magicLink || cfgLocked.includes('magicLink'),
+                passkey: !global.passkey || cfgLocked.includes('passkey'),
+                social: global.social.length === 0,
+            },
+        };
+    }
+    // ─── PUT /account/api/login-methods ─────────────────────────────────────
+    /** Grava a preferência de tipos de login do usuário logado. */
+    async updateLoginMethods(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        if (!supportsLoginMethodsPreference(cfg.accountStore)) {
+            return ctx.response.notFound(apiErr('not_supported', 'Login methods preference not supported.'));
+        }
+        const parsed = parseUserLoginMethodsPayload(ctx.request.body());
+        if (!parsed.ok) {
+            return ctx.response.badRequest(apiErr(parsed.error, 'Invalid login methods payload.'));
+        }
+        // All-off guard server-side: a preferência não pode zerar todos os métodos
+        // GLOBAIS disponíveis. Um `false` que deixaria zero métodos é recusado.
+        const { resolved: global } = await this.#resolveGlobalAuthMethods(ctx, cfg);
+        const value = { ...parsed.value };
+        const wouldBeAllOff = (value.password === false || !global.password) &&
+            (value.magicLink === false || !global.magicLink) &&
+            (value.passkey === false || !global.passkey) &&
+            (value.social === false || global.social.length === 0);
+        if (wouldBeAllOff) {
+            return ctx.response.badRequest(apiErr('all_methods_off', 'Cannot disable every login method.'));
+        }
+        await cfg.accountStore.setLoginMethods(userId, Object.keys(value).length > 0 ? value : null);
+        return { ok: true, methods: value };
+    }
+    /**
+     * Métodos globais efetivos + pins de config, compartilhados pelos handlers
+     * acima. Fail-safe: erro → defaults conservadores.
+     */
+    async #resolveGlobalAuthMethods(ctx, cfg) {
+        const settings = await resolveRuntimeSettingsOrNoop(ctx);
+        const resolved = await resolveEffectiveAuthMethods(settings, {
+            configuredSocialProviders: cfg.social?.providers ?? [],
+            magicLinkCapable: cfg.passwordless?.magicLink && supportsMagicLink(cfg.accountStore),
+            passkeyCapable: supportsPasskeys(cfg.accountStore),
+            configOverrides: cfg.authMethods,
+        });
+        return { resolved, locked: configLockedAuthMethods(cfg.authMethods) };
+    }
     // ─── GET /account/api/passkeys ──────────────────────────────────────────
     /** Lista passkeys do usuário logado. */
     async listPasskeys(ctx) {

package/build/src/host/auth_host_config.d.ts

@@ -1,3 +1,4 @@
+import type { HttpContext } from '@adonisjs/core/http';
 import type { AuthSocialConfig, ResolvedRateLimitConfig } from '../define_config.js';
 import type { PolicyRouteOption } from './config_locks.js';
 import type { AuthHostOptions } from './register_auth_host.js';
@@ -34,6 +35,14 @@ export interface AuthHostRuntimeConfig {
      * Ver `deriveLockedRouteOptions`.
      */
     lockedRouteOptions?: PolicyRouteOption[];
+    /**
+     * API headless (Clerk-style). Presente quando o host a declarou — o provider o
+     * stash no boot para `registerAuthHost` montar as rotas sem reler o config inteiro.
+     */
+    headless?: {
+        baseUrl: string;
+        resolveAccountId: (ctx: HttpContext) => string | null;
+    };
 }
 /** Stash dos bits de routing (chamado no boot do provider). */
 export declare function setAuthHostConfig(config: AuthHostRuntimeConfig): void;

package/build/src/host/controllers/headless_login_methods_controller.d.ts

@@ -0,0 +1,31 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * API headless do AuthKit (Clerk-style).
+ *
+ * Diferente da JSON API do console (`/account/api/*`, guardada pela sessão de
+ * CONTA), esta API é protegida por um resolver de conta fornecido pelo HOST
+ * (`headless.resolveAccountId`) — tipicamente a própria sessão do app
+ * (`await ctx.auth.getUserOrFail()`). Assim um RP integrado usa o app como
+ * frontend sem expor o console `/account/*`.
+ */
+export default class HeadlessLoginMethodsController {
+    #private;
+    /**
+     * GET {baseUrl}/login-methods
+     * Estado final de tipos de login para a conta resolvida pelo host.
+     */
+    index(ctx: HttpContext): Promise<void | import("../login_methods_state.js").LoginMethodsState>;
+    /**
+     * PUT {baseUrl}/login-methods
+     * Grava a preferência de tipos de login para a conta resolvida pelo host.
+     */
+    update(ctx: HttpContext): Promise<void | {
+        ok: boolean;
+        methods: {
+            password?: boolean;
+            magicLink?: boolean;
+            passkey?: boolean;
+            social?: boolean;
+        };
+    }>;
+}

package/build/src/host/controllers/headless_login_methods_controller.js

@@ -0,0 +1,79 @@
+import { supportsLoginMethodsPreference } from '../../accounts/account_store.js';
+import { loginMethodsStateForAccount, resolveGlobalAuthMethods } from '../login_methods_state.js';
+import { resolveRuntimeSettingsOrNoop } from '../runtime_settings.js';
+import { parseUserLoginMethodsPayload } from '../user_login_methods.js';
+/** Erro JSON padrão. */
+function apiErr(code, message) {
+    return { error: { code, message } };
+}
+/**
+ * API headless do AuthKit (Clerk-style).
+ *
+ * Diferente da JSON API do console (`/account/api/*`, guardada pela sessão de
+ * CONTA), esta API é protegida por um resolver de conta fornecido pelo HOST
+ * (`headless.resolveAccountId`) — tipicamente a própria sessão do app
+ * (`await ctx.auth.getUserOrFail()`). Assim um RP integrado usa o app como
+ * frontend sem expor o console `/account/*`.
+ */
+export default class HeadlessLoginMethodsController {
+    /**
+     * GET {baseUrl}/login-methods
+     * Estado final de tipos de login para a conta resolvida pelo host.
+     */
+    async index(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const accountId = await this.#resolveAccount(ctx, cfg);
+        if (!accountId) {
+            return ctx.response.unauthorized(apiErr('unauthorized', 'Not authenticated.'));
+        }
+        const settings = await resolveRuntimeSettingsOrNoop(ctx);
+        return loginMethodsStateForAccount(accountId, cfg.accountStore, settings, cfg);
+    }
+    /**
+     * PUT {baseUrl}/login-methods
+     * Grava a preferência de tipos de login para a conta resolvida pelo host.
+     */
+    async update(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const accountId = await this.#resolveAccount(ctx, cfg);
+        if (!accountId) {
+            return ctx.response.unauthorized(apiErr('unauthorized', 'Not authenticated.'));
+        }
+        if (!supportsLoginMethodsPreference(cfg.accountStore)) {
+            return ctx.response.notFound(apiErr('not_supported', 'Login methods preference not supported.'));
+        }
+        const parsed = parseUserLoginMethodsPayload(ctx.request.body());
+        if (!parsed.ok) {
+            return ctx.response.badRequest(apiErr(parsed.error, 'Invalid login methods payload.'));
+        }
+        // All-off guard: preferência não pode zerar todos os métodos globais.
+        const settings = await resolveRuntimeSettingsOrNoop(ctx);
+        const { resolved: global } = await resolveGlobalAuthMethods(settings, cfg);
+        const value = { ...parsed.value };
+        const wouldBeAllOff = (value.password === false || !global.password) &&
+            (value.magicLink === false || !global.magicLink) &&
+            (value.passkey === false || !global.passkey) &&
+            (value.social === false || global.social.length === 0);
+        if (wouldBeAllOff) {
+            return ctx.response.badRequest(apiErr('all_methods_off', 'Cannot disable every login method.'));
+        }
+        await cfg.accountStore.setLoginMethods(accountId, Object.keys(value).length > 0 ? value : null);
+        return { ok: true, methods: value };
+    }
+    /** Delega ao resolver do host; null (ou throw de auth) => 401. */
+    async #resolveAccount(ctx, cfg) {
+        const resolve = cfg.headless?.resolveAccountId;
+        if (!resolve)
+            return null;
+        try {
+            const id = await resolve(ctx);
+            return id ? String(id) : null;
+        }
+        catch {
+            // Resolver do host lançou (ex.: auth.getUserOrFail sem sessão) → não-autorizado.
+            return null;
+        }
+    }
+}