@adonis-agora/authkit-server 0.61.3 → 0.61.4

package/build/commands/settings_get.js

@@ -4,7 +4,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-import { BaseCommand, args, flags } from '@adonisjs/core/ace';
+import { args, BaseCommand, flags } from '@adonisjs/core/ace';
 import { settingsGet } from '../src/commands/settings_commands.js';
 /**
  * Obtém uma runtime setting por key.

package/build/commands/settings_set.js

@@ -4,7 +4,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-import { BaseCommand, args, flags } from '@adonisjs/core/ace';
+import { args, BaseCommand, flags } from '@adonisjs/core/ace';
 import { settingsSet } from '../src/commands/settings_commands.js';
 /**
  * Grava (upsert) uma runtime setting em `auth_settings`.

package/build/commands/settings_unset.js

@@ -4,7 +4,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-import { BaseCommand, args, flags } from '@adonisjs/core/ace';
+import { args, BaseCommand, flags } from '@adonisjs/core/ace';
 import { settingsUnset } from '../src/commands/settings_commands.js';
 /**
  * Remove uma runtime setting de `auth_settings` (reset to config/default).

package/build/index.d.ts

@@ -1,64 +1,25 @@
-export { ensureAuthkitSchema } from './src/schema/ensure.js';
-export { authkitCsrfExceptions } from './src/host/csrf.js';
-export type { AuthkitCsrfOptions } from './src/host/csrf.js';
-export { SettingLockedError, isSettingLocked, lockedSettingKeys, setLockedSettingKeys, resetLockedSettingKeys, deriveLockedSettingKeys, } from './src/host/config_locks.js';
-export type { EnsureSchemaOptions, EnsureSchemaReport } from './src/schema/ensure.js';
-export { defineConfig, adapters, toSeconds } from './src/define_config.js';
-export { generatePatToken, hashPatToken } from './src/pat/pat_tokens.js';
-export { withAuthUser } from './src/mixins/with_auth_user.js';
-export { withCredentials } from './src/mixins/with_credentials.js';
-export { withMfa } from './src/mixins/with_mfa.js';
-export { OidcService } from './src/provider/oidc_service.js';
-export { registerOidcRoutes } from './src/register_routes.js';
-export type { AuthServerConfigInput, ResolvedServerConfig, DynamicRegistrationConfigInput, ResolvedDynamicRegistrationConfig, AdminConfigInput, ResolvedAdminConfig, AdminApiConfigInput, ResolvedAdminApiConfig, } from './src/define_config.js';
-export { resolveAdmin, resolveAdminApi, resolveWebauthn, resolveDynamicRegistration, } from './src/define_config.js';
-export type { WebauthnConfigInput, ResolvedWebauthnConfig } from './src/define_config.js';
-export { resolvePasswordless, resolveLogin, resolveAuthMethodsConfig, } from './src/define_config.js';
-export type { PasswordlessConfigInput, ResolvedPasswordlessConfig, AuthMethodsConfigInput, ResolvedAuthMethodsConfig, LoginConfigInput, ResolvedLoginConfig, } from './src/define_config.js';
-export { resolveTrustedDevices, isTrustedDeviceValid, buildTrustedDevicePayload, TRUSTED_DEVICE_COOKIE, } from './src/host/trusted_device.js';
-export type { TrustedDevicesConfigInput, ResolvedTrustedDevicesConfig, TrustedDevicePayload, } from './src/host/trusted_device.js';
-export { resolveBotProtection, botProtectionApplies, extractBotToken, verifyBotProtection, guardBotProtection, DEFAULT_BOT_TOKEN_FIELDS, } from './src/host/bot_protection.js';
-export type { BotProtectionConfigInput, ResolvedBotProtectionConfig, BotProtectionVerifyInput, BotProtectionWidget, BotProtectionAction, } from './src/host/bot_protection.js';
-export { lucidAccountStore, appKeyEncrypter } from './src/accounts/lucid_account_store.js';
-export { lucidStores } from './src/accounts/lucid_stores.js';
+/**
+ * Configure hook + stubsRoot resolvidos pelo `node ace configure @adonis-agora/authkit-server`.
+ * O comando do AdonisJS importa o entrypoint principal e procura por estes exports.
+ */
+export { configure } from './commands/configure.js';
+export type { AccountDeletionCapability, AccountImportCapability, AccountSecurityCapability, AccountStatusCapability, AccountStore, ActiveOrgInfo, AdminCapability, AuthAccount, CoreAccountStore, CreateAccountInput, EmailVerificationStatusCapability, ImportAccountInput, LinkProviderIdentityInput, ListAccountsParams, LoginMethodsPreferenceCapability, MagicLinkCapability, MfaCapability, OrganizationsCapability, OrgInvitation, OrgMember, OrgSummary, OtpLoginCapability, OtpLoginVerifyResult, Paginated, PasskeySummary, ProfileCapability, ProviderIdentityCapability, ProviderIdentitySummary, WebauthnCapability, } from './src/accounts/account_store.js';
+export { supportsAccountDeletion, supportsAccountImport, supportsAccountSecurity, supportsAccountStatus, supportsEmailVerificationStatus, supportsLoginMethodsPreference, supportsMagicLink, supportsMfa, supportsOrganizations, supportsOtpLogin, supportsPasskeys, supportsProfile, supportsProviderIdentity, } from './src/accounts/account_store.js';
+export type { AccountSecretEncrypter, LucidAccountStoreOptions, } from './src/accounts/lucid_account_store.js';
+export { appKeyEncrypter, lucidAccountStore } from './src/accounts/lucid_account_store.js';
 export type { LucidStoresModels, LucidStoresOptions, LucidStoresResult, } from './src/accounts/lucid_stores.js';
-export type { LucidAccountStoreOptions, AccountSecretEncrypter, } from './src/accounts/lucid_account_store.js';
-export type { AccountStore, CoreAccountStore, AdminCapability, MfaCapability, WebauthnCapability, ProviderIdentityCapability, ProviderIdentitySummary, AccountSecurityCapability, AccountStatusCapability, ProfileCapability, MagicLinkCapability, OtpLoginCapability, OtpLoginVerifyResult, EmailVerificationStatusCapability, AccountDeletionCapability, AccountImportCapability, ImportAccountInput, AuthAccount, CreateAccountInput, LinkProviderIdentityInput, ListAccountsParams, Paginated, PasskeySummary, LoginMethodsPreferenceCapability, } from './src/accounts/account_store.js';
-export { supportsMfa, supportsPasskeys, supportsProviderIdentity, supportsAccountSecurity, supportsAccountStatus, supportsProfile, supportsMagicLink, supportsOtpLogin, supportsEmailVerificationStatus, supportsAccountDeletion, supportsAccountImport, supportsLoginMethodsPreference, } from './src/accounts/account_store.js';
-export { type OtpLoginConfigInput, type ResolvedOtpLoginConfig, type OtpVerifyOutcome, resolveOtpLoginConfig, generateOtpCode, evaluateLoginOtp, OTP_LOGIN_DEFAULTS, } from './src/host/otp_login.js';
-export { PasswordManager, PasswordPolicyError, } from './src/password/password_manager.js';
-export type { PasswordConfigInput, LegacyPasswordVerifier, PasswordVerifyResult, } from './src/password/password_manager.js';
-export { checkPasswordPolicy, policyViolationParams, DEFAULT_PWNED_TIMEOUT_MS, } from './src/password/policy.js';
-export type { ResolvedPasswordPolicy, ResolvedPasswordConfig, PasswordPolicyViolation, } from './src/password/policy.js';
-export { isPasswordPwned, __setFetchForTests as __setPwnedFetchForTests, } from './src/password/pwned.js';
-export type { PwnedLogger, FetchLike as PwnedFetchLike } from './src/password/pwned.js';
-export { withProviderIdentity } from './src/mixins/with_provider_identity.js';
-export type { ProviderIdentityRow, ProviderIdentityClass, } from './src/mixins/with_provider_identity.js';
-export { withWebauthnCredential } from './src/mixins/with_webauthn_credential.js';
-export type { WebauthnCredentialRow, WebauthnCredentialClass, } from './src/mixins/with_webauthn_credential.js';
-export { lucidPatStore } from './src/pat/lucid_pat_store.js';
-export type { PatStore, PatRecord, IssuePatInput } from './src/pat/pat_store.js';
-export { withPersonalAccessToken } from './src/mixins/with_personal_access_token.js';
+export { lucidStores } from './src/accounts/lucid_stores.js';
+export type { AuditEvent, AuditEventType, AuditPage, AuditSink, ListAuditParams, StoredAuditEvent, } from './src/audit/audit_sink.js';
 export { lucidAuditSink } from './src/audit/lucid_audit_sink.js';
-export type { AuditSink, AuditEvent, AuditEventType, StoredAuditEvent, ListAuditParams, AuditPage, } from './src/audit/audit_sink.js';
-export { withAuditLog } from './src/mixins/with_audit_log.js';
-export { composeAuditSink, resolveEvents, buildWebhookBody, signWebhookBody, } from './src/events/dispatcher.js';
+export type { AdminApiConfigInput, AdminConfigInput, AuthHostRenderer, AuthMethodsConfigInput, AuthServerConfigInput, AuthSocialConfig, DynamicRegistrationConfigInput, LoginConfigInput, OrganizationsConfigInput, PasswordlessConfigInput, RateLimitBucket, RateLimitConfigInput, RegistrationConfigInput, ResolvedAdminApiConfig, ResolvedAdminConfig, ResolvedAuthMethodsConfig, ResolvedDynamicRegistrationConfig, ResolvedLoginConfig, ResolvedNotificationsConfig, ResolvedOrganizationsConfig, ResolvedPasswordlessConfig, ResolvedRateLimitConfig, ResolvedRegistrationConfig, ResolvedServerConfig, ResolvedWebauthnConfig, WebauthnConfigInput, } from './src/define_config.js';
+export { adapters, defineConfig, resolveAdmin, resolveAdminApi, resolveAuthMethodsConfig, resolveDynamicRegistration, resolveLogin, resolveNotifications, resolveOrganizations, resolvePasswordless, resolveRateLimit, resolveRegistration, resolveWebauthn, toSeconds, } from './src/define_config.js';
 export type { EventsConfigInput, ResolvedEventsConfig } from './src/events/dispatcher.js';
-export { inertiaRenderer } from './src/host/renderers/inertia_renderer.js';
-export type { AuthkitScreen } from './src/host/renderers/inertia_renderer.js';
-export type { InertiaRendererOptions } from './src/host/renderers/inertia_renderer.js';
-export type { AccountLoginProps, AccountSecurityProps, AccountMfaProps, AccountConfirmProps, AccountConfirmMethod, AccountEmailConfirmedProps, } from './src/host/account_screen_props.js';
-export { edgeRenderer } from './src/host/renderers/edge_renderer.js';
-export { brandFor, isFirstParty, isFirstPartyClient } from './src/host/branding.js';
-export type { BrandingConfig, ClientBrand } from './src/host/branding.js';
-export { resolveMessages, translate, DEFAULT_MESSAGES, PT_BR_MESSAGES, BUILTIN_MESSAGES, DEFAULT_LOCALE, } from './src/host/i18n.js';
-export type { I18nConfig, AuthMessages } from './src/host/i18n.js';
-export type { AuthHostRenderer, AuthSocialConfig } from './src/define_config.js';
-export { registerAuthHost } from './src/host/register_auth_host.js';
-export type { AuthHostOptions, AuthHostRouteMap, AccountScreensOptions, } from './src/host/register_auth_host.js';
-export type { PolicyRouteOption } from './src/host/config_locks.js';
-export { POLICY_ROUTE_OPTIONS } from './src/host/config_locks.js';
-export { getAdminPrefix, setAdminPrefix, normalizeAdminPrefix, getAdminApiPrefix, setAdminApiPrefix, normalizeAdminApiPrefix, } from './src/host/admin_prefix.js';
+export { buildWebhookBody, composeAuditSink, resolveEvents, signWebhookBody, } from './src/events/dispatcher.js';
+export type { DeletionActor, DeletionResult, } from './src/host/account_deletion_service.js';
+export { AccountDeletionService } from './src/host/account_deletion_service.js';
+export type { AccountExport } from './src/host/account_export_service.js';
+export { AccountExportService } from './src/host/account_export_service.js';
+export type { AccountPathKey, AccountPathsOptions } from './src/host/account_paths.js';
 /**
  * Helpers de path do console de conta (`/account/*`). Um host que precisa casar
  * um middleware ou link com uma rota do console (ex.: `GET
@@ -71,74 +32,94 @@ export { getAdminPrefix, setAdminPrefix, normalizeAdminPrefix, getAdminApiPrefix
  * (`/account/*`). Componha URLs em runtime (dentro de handlers/factories de
  * middleware), não em tempo de import de módulo.
  */
-export { accountPath, joinAccountPath, accountPrefix, } from './src/host/account_paths.js';
-export type { AccountPathsOptions, AccountPathKey } from './src/host/account_paths.js';
-export { resolveRateLimit, resolveNotifications } from './src/define_config.js';
-export type { ResolvedNotificationsConfig } from './src/define_config.js';
-export type { RateLimitConfigInput, RateLimitBucket, ResolvedRateLimitConfig, } from './src/define_config.js';
-export { createAuthThrottles } from './src/host/rate_limit.js';
-export type { AuthThrottles, ThrottleMiddleware } from './src/host/rate_limit.js';
+export { accountPath, accountPrefix, joinAccountPath, } from './src/host/account_paths.js';
+export type { AccountConfirmMethod, AccountConfirmProps, AccountEmailConfirmedProps, AccountLoginProps, AccountMfaProps, AccountSecurityProps, } from './src/host/account_screen_props.js';
+export { ACCOUNT_SESSION_KEY } from './src/host/account_session_key.js';
+export { ACTIVE_ORG_COOKIE, ACTIVE_ORG_COOKIE_TTL, decodeActiveOrgCookie, encodeActiveOrgCookie, readActiveOrgFromKoaCtx, } from './src/host/active_org_cookie.js';
+export type { AddMemberInput as AdminAddMemberInput, CreateInvitationInput as AdminCreateInvitationInput, CreateOrgInput as AdminCreateOrgInput, OrgDetail, OrgWithMemberCount, UpdateOrgInput as AdminUpdateOrgInput, } from './src/host/admin_api/admin_orgs_service.js';
+export { AdminOrgsService } from './src/host/admin_api/admin_orgs_service.js';
+export type { AdminActor, CreateUserInput as AdminCreateUserInput, CreateUserResult as AdminCreateUserResult, DeleteUserResult as AdminDeleteUserResult, } from './src/host/admin_api/admin_users_service.js';
 /**
  * Admin services compartilhados pelo console (B6/HTML), pela Admin REST API (R6)
  * e pelo driver `embedded` do @adonis-agora/authkit-sdk (in-process).
  */
 export { AdminUsersService } from './src/host/admin_api/admin_users_service.js';
-export { AdminOrgsService } from './src/host/admin_api/admin_orgs_service.js';
-export type { OrgWithMemberCount, OrgDetail, CreateOrgInput as AdminCreateOrgInput, UpdateOrgInput as AdminUpdateOrgInput, AddMemberInput as AdminAddMemberInput, CreateInvitationInput as AdminCreateInvitationInput, } from './src/host/admin_api/admin_orgs_service.js';
-export type { AdminActor, CreateUserInput as AdminCreateUserInput, CreateUserResult as AdminCreateUserResult, DeleteUserResult as AdminDeleteUserResult, } from './src/host/admin_api/admin_users_service.js';
-export { AccountDeletionService } from './src/host/account_deletion_service.js';
-export type { DeletionActor, DeletionResult, } from './src/host/account_deletion_service.js';
-export { AccountExportService } from './src/host/account_export_service.js';
-export type { AccountExport } from './src/host/account_export_service.js';
-export { AdminClientsService } from './src/host/admin_clients_service.js';
+export type { VerifyResult } from './src/host/admin_api/token_verify_service.js';
+export { TokenVerifyService } from './src/host/admin_api/token_verify_service.js';
 export type { AdminClient, ClientInput as AdminClientInput, CreatedClient, TokenEndpointAuthMethod, } from './src/host/admin_clients_service.js';
+export { AdminClientsService } from './src/host/admin_clients_service.js';
+export { getAdminApiPrefix, getAdminPrefix, normalizeAdminApiPrefix, normalizeAdminPrefix, setAdminApiPrefix, setAdminPrefix, } from './src/host/admin_prefix.js';
+export type { AdminGrant, AdminSession, RevokeResult, } from './src/host/admin_sessions_service.js';
 export { AdminSessionsService } from './src/host/admin_sessions_service.js';
-export type { AdminSession, AdminGrant, RevokeResult, } from './src/host/admin_sessions_service.js';
-export { TokenVerifyService } from './src/host/admin_api/token_verify_service.js';
-export type { VerifyResult } from './src/host/admin_api/token_verify_service.js';
-export { enrichSessionsWithContext } from './src/host/session_context.js';
-export { parseUserAgent } from './src/host/user_agent.js';
-export type { ParsedUserAgent } from './src/host/user_agent.js';
-export { resolveGeoSafe, GEO_RESOLVE_TIMEOUT_MS } from './src/host/geo.js';
-export type { ResolveGeo } from './src/host/geo.js';
-export { computeAdminStats } from './src/host/admin_stats_service.js';
 export type { AdminStats, DailyPoint } from './src/host/admin_stats_service.js';
-export { barChartSvg } from './src/host/svg_chart.js';
+export { computeAdminStats } from './src/host/admin_stats_service.js';
+export { authkitUserProvider } from './src/host/adonis_auth_user_provider.js';
+export type { BotProtectionAction, BotProtectionConfigInput, BotProtectionSetting, BotProtectionVerifyInput, BotProtectionWidget, ResolvedBotProtectionConfig, } from './src/host/bot_protection.js';
+export { botProtectionApplies, DEFAULT_BOT_TOKEN_FIELDS, extractBotToken, guardBotProtection, resolveBotProtection, resolveEffectiveBotProtection, verifyBotProtection, } from './src/host/bot_protection.js';
+export type { BrandingConfig, ClientBrand } from './src/host/branding.js';
+export { brandFor, isFirstParty, isFirstPartyClient } from './src/host/branding.js';
+export type { PolicyRouteOption } from './src/host/config_locks.js';
+export { deriveLockedSettingKeys, isSettingLocked, lockedSettingKeys, POLICY_ROUTE_OPTIONS, resetLockedSettingKeys, SettingLockedError, setLockedSettingKeys, } from './src/host/config_locks.js';
+export { consoleLoginUrl, getAccountId, hasAccountSession, realAccountId, } from './src/host/console_session.js';
+export type { AuthkitCsrfOptions } from './src/host/csrf.js';
+export { authkitCsrfExceptions } from './src/host/csrf.js';
+export type { ResolveGeo } from './src/host/geo.js';
+export { GEO_RESOLVE_TIMEOUT_MS, resolveGeoSafe } from './src/host/geo.js';
+export type { AuthMessages, I18nConfig } from './src/host/i18n.js';
+export { BUILTIN_MESSAGES, DEFAULT_LOCALE, DEFAULT_MESSAGES, PT_BR_MESSAGES, resolveMessages, translate, } from './src/host/i18n.js';
+export type { ImpersonationClientLike, ImpersonationPanel } from './src/host/impersonation.js';
 export { buildImpersonationPanel } from './src/host/impersonation.js';
-export type { ImpersonationPanel, ImpersonationClientLike } from './src/host/impersonation.js';
-export { ACTIVE_ORG_COOKIE, ACTIVE_ORG_COOKIE_TTL, encodeActiveOrgCookie, decodeActiveOrgCookie, readActiveOrgFromKoaCtx, } from './src/host/active_org_cookie.js';
-export { resolveOrganizations } from './src/define_config.js';
-export type { OrganizationsConfigInput, ResolvedOrganizationsConfig, } from './src/define_config.js';
-export { supportsOrganizations } from './src/accounts/account_store.js';
-export type { OrganizationsCapability, OrgSummary, OrgMember, OrgInvitation, ActiveOrgInfo, } from './src/accounts/account_store.js';
-/**
- * Configure hook + stubsRoot resolvidos pelo `node ace configure @adonis-agora/authkit-server`.
- * O comando do AdonisJS importa o entrypoint principal e procura por estes exports.
- */
-export { configure } from './commands/configure.js';
-export { stubsRoot } from './stubs/main.js';
-export { RuntimeSettings, supportsSettings } from './src/host/runtime_settings.js';
-export type { SettingsCapability, SettingRow, RuntimeSettingsOptions, } from './src/host/runtime_settings.js';
-export { buildKeysStatus, rotateNow } from './src/host/key_rotation_actions.js';
+export type { ImpersonationState, StartImpersonationParams, } from './src/host/impersonation_session.js';
+export { impersonationState, refreshAccessToken, rememberAccessToken, rememberRefreshToken, startImpersonation, stopImpersonation, } from './src/host/impersonation_session.js';
 export type { KeysStatus as ServerKeysStatus } from './src/host/key_rotation_actions.js';
-export { resolveEffectiveBotProtection } from './src/host/bot_protection.js';
-export type { BotProtectionSetting } from './src/host/bot_protection.js';
-export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
-export type { SettingKey, RegistrationSetting, RequireVerifiedEmailSetting, MaintenanceModeSetting, ResolvedMaintenanceMode, AuthMethodsSetting, ResolvedAuthMethods, AuthMethodsCapabilities, AuthMethodsConfigOverride, } from './src/host/runtime_toggles.js';
-export { USER_LOGIN_METHOD_KEYS, normalizeUserLoginMethods, parseUserLoginMethodsPayload, resolveEffectiveUserLoginMethods, } from './src/host/user_login_methods.js';
-export type { UserLoginMethodKey, UserLoginMethods, ResolvedUserLoginMethods, } from './src/host/user_login_methods.js';
-export { resolveRegistration } from './src/define_config.js';
-export type { RegistrationConfigInput, ResolvedRegistrationConfig, } from './src/define_config.js';
-export { getAccountId, realAccountId, hasAccountSession, consoleLoginUrl, } from './src/host/console_session.js';
-export { ACCOUNT_SESSION_KEY } from './src/host/account_session_key.js';
-export { rememberAccessToken, rememberRefreshToken, refreshAccessToken, startImpersonation, impersonationState, stopImpersonation, } from './src/host/impersonation_session.js';
-export type { StartImpersonationParams, ImpersonationState, } from './src/host/impersonation_session.js';
-export { SUDO_SESSION_KEY, SUDO_ACCOUNT_SESSION_KEY, SUDO_MODE_DEFAULTS, requireSudo, isSudoActive, markSudo, resolveEffectiveSudoMode, } from './src/host/sudo_mode.js';
-export type { SudoModeSetting, ResolvedSudoModeSetting, } from './src/host/sudo_mode.js';
-export { sudoMethods } from './src/host/sudo/index.js';
-export { completeSudo, fail as failSudo, LAST_METHOD_SESSION_KEY, } from './src/host/sudo/runtime.js';
-export { sudoContextFrom } from './src/host/sudo/runtime.js';
-export type { SudoMethod, SudoContext, SudoMethodDescriptor, SudoRouteHelpers, } from './src/host/sudo/types.js';
-export { authkitUserProvider } from './src/host/adonis_auth_user_provider.js';
+export { buildKeysStatus, rotateNow } from './src/host/key_rotation_actions.js';
+export type { OidcRpGuardEvents, OidcRpGuardOptions } from './src/host/oidc_rp_guard.js';
 export { OidcRpGuard, oidcRpGuard } from './src/host/oidc_rp_guard.js';
-export type { OidcRpGuardOptions, OidcRpGuardEvents } from './src/host/oidc_rp_guard.js';
+export { evaluateLoginOtp, generateOtpCode, OTP_LOGIN_DEFAULTS, type OtpLoginConfigInput, type OtpVerifyOutcome, type ResolvedOtpLoginConfig, resolveOtpLoginConfig, } from './src/host/otp_login.js';
+export type { AuthThrottles, ThrottleMiddleware } from './src/host/rate_limit.js';
+export { createAuthThrottles } from './src/host/rate_limit.js';
+export type { AccountScreensOptions, AuthHostOptions, AuthHostRouteMap, } from './src/host/register_auth_host.js';
+export { registerAuthHost } from './src/host/register_auth_host.js';
+export { edgeRenderer } from './src/host/renderers/edge_renderer.js';
+export type { AuthkitScreen, InertiaRendererOptions, } from './src/host/renderers/inertia_renderer.js';
+export { inertiaRenderer } from './src/host/renderers/inertia_renderer.js';
+export type { RuntimeSettingsOptions, SettingRow, SettingsCapability, } from './src/host/runtime_settings.js';
+export { RuntimeSettings, supportsSettings } from './src/host/runtime_settings.js';
+export type { AuthMethodsCapabilities, AuthMethodsConfigOverride, AuthMethodsSetting, MaintenanceModeSetting, RegistrationSetting, RequireVerifiedEmailSetting, ResolvedAuthMethods, ResolvedMaintenanceMode, SettingKey, } from './src/host/runtime_toggles.js';
+export { configLockedAuthMethods, resolveEffectiveAuthMethods, resolveEffectiveMaintenanceMode, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, SETTING_KEYS, } from './src/host/runtime_toggles.js';
+export { enrichSessionsWithContext } from './src/host/session_context.js';
+export { sudoMethods } from './src/host/sudo/index.js';
+export { completeSudo, fail as failSudo, LAST_METHOD_SESSION_KEY, sudoContextFrom, } from './src/host/sudo/runtime.js';
+export type { SudoContext, SudoMethod, SudoMethodDescriptor, SudoRouteHelpers, } from './src/host/sudo/types.js';
+export type { ResolvedSudoModeSetting, SudoModeSetting, } from './src/host/sudo_mode.js';
+export { isSudoActive, markSudo, requireSudo, resolveEffectiveSudoMode, SUDO_ACCOUNT_SESSION_KEY, SUDO_MODE_DEFAULTS, SUDO_SESSION_KEY, } from './src/host/sudo_mode.js';
+export { barChartSvg } from './src/host/svg_chart.js';
+export type { ResolvedTrustedDevicesConfig, TrustedDevicePayload, TrustedDevicesConfigInput, } from './src/host/trusted_device.js';
+export { buildTrustedDevicePayload, isTrustedDeviceValid, resolveTrustedDevices, TRUSTED_DEVICE_COOKIE, } from './src/host/trusted_device.js';
+export type { ParsedUserAgent } from './src/host/user_agent.js';
+export { parseUserAgent } from './src/host/user_agent.js';
+export type { ResolvedUserLoginMethods, UserLoginMethodKey, UserLoginMethods, } from './src/host/user_login_methods.js';
+export { normalizeUserLoginMethods, parseUserLoginMethodsPayload, resolveEffectiveUserLoginMethods, USER_LOGIN_METHOD_KEYS, } from './src/host/user_login_methods.js';
+export { withAuditLog } from './src/mixins/with_audit_log.js';
+export { withAuthUser } from './src/mixins/with_auth_user.js';
+export { withCredentials } from './src/mixins/with_credentials.js';
+export { withMfa } from './src/mixins/with_mfa.js';
+export { withPersonalAccessToken } from './src/mixins/with_personal_access_token.js';
+export type { ProviderIdentityClass, ProviderIdentityRow, } from './src/mixins/with_provider_identity.js';
+export { withProviderIdentity } from './src/mixins/with_provider_identity.js';
+export type { WebauthnCredentialClass, WebauthnCredentialRow, } from './src/mixins/with_webauthn_credential.js';
+export { withWebauthnCredential } from './src/mixins/with_webauthn_credential.js';
+export type { LegacyPasswordVerifier, PasswordConfigInput, PasswordVerifyResult, } from './src/password/password_manager.js';
+export { PasswordManager, PasswordPolicyError, } from './src/password/password_manager.js';
+export type { PasswordPolicyViolation, ResolvedPasswordConfig, ResolvedPasswordPolicy, } from './src/password/policy.js';
+export { checkPasswordPolicy, DEFAULT_PWNED_TIMEOUT_MS, policyViolationParams, } from './src/password/policy.js';
+export type { FetchLike as PwnedFetchLike, PwnedLogger } from './src/password/pwned.js';
+export { __setFetchForTests as __setPwnedFetchForTests, isPasswordPwned, } from './src/password/pwned.js';
+export { lucidPatStore } from './src/pat/lucid_pat_store.js';
+export type { IssuePatInput, PatRecord, PatStore } from './src/pat/pat_store.js';
+export { generatePatToken, hashPatToken } from './src/pat/pat_tokens.js';
+export { OidcService } from './src/provider/oidc_service.js';
+export { registerOidcRoutes } from './src/register_routes.js';
+export type { EnsureSchemaOptions, EnsureSchemaReport } from './src/schema/ensure.js';
+export { ensureAuthkitSchema } from './src/schema/ensure.js';
+export { stubsRoot } from './stubs/main.js';

package/build/index.js

@@ -1,40 +1,16 @@
-export { ensureAuthkitSchema } from './src/schema/ensure.js';
-export { authkitCsrfExceptions } from './src/host/csrf.js';
-export { SettingLockedError, isSettingLocked, lockedSettingKeys, setLockedSettingKeys, resetLockedSettingKeys, deriveLockedSettingKeys, } from './src/host/config_locks.js';
-export { defineConfig, adapters, toSeconds } from './src/define_config.js';
-export { generatePatToken, hashPatToken } from './src/pat/pat_tokens.js';
-export { withAuthUser } from './src/mixins/with_auth_user.js';
-export { withCredentials } from './src/mixins/with_credentials.js';
-export { withMfa } from './src/mixins/with_mfa.js';
-export { OidcService } from './src/provider/oidc_service.js';
-export { registerOidcRoutes } from './src/register_routes.js';
-export { resolveAdmin, resolveAdminApi, resolveWebauthn, resolveDynamicRegistration, } from './src/define_config.js';
-export { resolvePasswordless, resolveLogin, resolveAuthMethodsConfig, } from './src/define_config.js';
-export { resolveTrustedDevices, isTrustedDeviceValid, buildTrustedDevicePayload, TRUSTED_DEVICE_COOKIE, } from './src/host/trusted_device.js';
-export { resolveBotProtection, botProtectionApplies, extractBotToken, verifyBotProtection, guardBotProtection, DEFAULT_BOT_TOKEN_FIELDS, } from './src/host/bot_protection.js';
-export { lucidAccountStore, appKeyEncrypter } from './src/accounts/lucid_account_store.js';
+/**
+ * Configure hook + stubsRoot resolvidos pelo `node ace configure @adonis-agora/authkit-server`.
+ * O comando do AdonisJS importa o entrypoint principal e procura por estes exports.
+ */
+export { configure } from './commands/configure.js';
+export { supportsAccountDeletion, supportsAccountImport, supportsAccountSecurity, supportsAccountStatus, supportsEmailVerificationStatus, supportsLoginMethodsPreference, supportsMagicLink, supportsMfa, supportsOrganizations, supportsOtpLogin, supportsPasskeys, supportsProfile, supportsProviderIdentity, } from './src/accounts/account_store.js';
+export { appKeyEncrypter, lucidAccountStore } from './src/accounts/lucid_account_store.js';
 export { lucidStores } from './src/accounts/lucid_stores.js';
-export { supportsMfa, supportsPasskeys, supportsProviderIdentity, supportsAccountSecurity, supportsAccountStatus, supportsProfile, supportsMagicLink, supportsOtpLogin, supportsEmailVerificationStatus, supportsAccountDeletion, supportsAccountImport, supportsLoginMethodsPreference, } from './src/accounts/account_store.js';
-// Login por OTP (código digitável): config + helpers puros.
-export { resolveOtpLoginConfig, generateOtpCode, evaluateLoginOtp, OTP_LOGIN_DEFAULTS, } from './src/host/otp_login.js';
-// Gerência de senha: lazy rehash + legacy verifier, política e checagem de vazamento.
-export { PasswordManager, PasswordPolicyError, } from './src/password/password_manager.js';
-export { checkPasswordPolicy, policyViolationParams, DEFAULT_PWNED_TIMEOUT_MS, } from './src/password/policy.js';
-export { isPasswordPwned, __setFetchForTests as __setPwnedFetchForTests, } from './src/password/pwned.js';
-export { withProviderIdentity } from './src/mixins/with_provider_identity.js';
-export { withWebauthnCredential } from './src/mixins/with_webauthn_credential.js';
-export { lucidPatStore } from './src/pat/lucid_pat_store.js';
-export { withPersonalAccessToken } from './src/mixins/with_personal_access_token.js';
 export { lucidAuditSink } from './src/audit/lucid_audit_sink.js';
-export { withAuditLog } from './src/mixins/with_audit_log.js';
-export { composeAuditSink, resolveEvents, buildWebhookBody, signWebhookBody, } from './src/events/dispatcher.js';
-export { inertiaRenderer } from './src/host/renderers/inertia_renderer.js';
-export { edgeRenderer } from './src/host/renderers/edge_renderer.js';
-export { brandFor, isFirstParty, isFirstPartyClient } from './src/host/branding.js';
-export { resolveMessages, translate, DEFAULT_MESSAGES, PT_BR_MESSAGES, BUILTIN_MESSAGES, DEFAULT_LOCALE, } from './src/host/i18n.js';
-export { registerAuthHost } from './src/host/register_auth_host.js';
-export { POLICY_ROUTE_OPTIONS } from './src/host/config_locks.js';
-export { getAdminPrefix, setAdminPrefix, normalizeAdminPrefix, getAdminApiPrefix, setAdminApiPrefix, normalizeAdminApiPrefix, } from './src/host/admin_prefix.js';
+export { adapters, defineConfig, resolveAdmin, resolveAdminApi, resolveAuthMethodsConfig, resolveDynamicRegistration, resolveLogin, resolveNotifications, resolveOrganizations, resolvePasswordless, resolveRateLimit, resolveRegistration, resolveWebauthn, toSeconds, } from './src/define_config.js';
+export { buildWebhookBody, composeAuditSink, resolveEvents, signWebhookBody, } from './src/events/dispatcher.js';
+export { AccountDeletionService } from './src/host/account_deletion_service.js';
+export { AccountExportService } from './src/host/account_export_service.js';
 /**
  * Helpers de path do console de conta (`/account/*`). Um host que precisa casar
  * um middleware ou link com uma rota do console (ex.: `GET
@@ -47,55 +23,57 @@ export { getAdminPrefix, setAdminPrefix, normalizeAdminPrefix, getAdminApiPrefix
  * (`/account/*`). Componha URLs em runtime (dentro de handlers/factories de
  * middleware), não em tempo de import de módulo.
  */
-export { accountPath, joinAccountPath, accountPrefix, } from './src/host/account_paths.js';
-export { resolveRateLimit, resolveNotifications } from './src/define_config.js';
-export { createAuthThrottles } from './src/host/rate_limit.js';
+export { accountPath, accountPrefix, joinAccountPath, } from './src/host/account_paths.js';
+export { ACCOUNT_SESSION_KEY } from './src/host/account_session_key.js';
+// Organizations (multi-tenancy)
+export { ACTIVE_ORG_COOKIE, ACTIVE_ORG_COOKIE_TTL, decodeActiveOrgCookie, encodeActiveOrgCookie, readActiveOrgFromKoaCtx, } from './src/host/active_org_cookie.js';
+export { AdminOrgsService } from './src/host/admin_api/admin_orgs_service.js';
 /**
  * Admin services compartilhados pelo console (B6/HTML), pela Admin REST API (R6)
  * e pelo driver `embedded` do @adonis-agora/authkit-sdk (in-process).
  */
 export { AdminUsersService } from './src/host/admin_api/admin_users_service.js';
-export { AdminOrgsService } from './src/host/admin_api/admin_orgs_service.js';
-export { AccountDeletionService } from './src/host/account_deletion_service.js';
-export { AccountExportService } from './src/host/account_export_service.js';
+export { TokenVerifyService } from './src/host/admin_api/token_verify_service.js';
 export { AdminClientsService } from './src/host/admin_clients_service.js';
+export { getAdminApiPrefix, getAdminPrefix, normalizeAdminApiPrefix, normalizeAdminPrefix, setAdminApiPrefix, setAdminPrefix, } from './src/host/admin_prefix.js';
 export { AdminSessionsService } from './src/host/admin_sessions_service.js';
-export { TokenVerifyService } from './src/host/admin_api/token_verify_service.js';
-// Contexto de sessão (user-agent/geo) + métricas do dashboard.
-export { enrichSessionsWithContext } from './src/host/session_context.js';
-export { parseUserAgent } from './src/host/user_agent.js';
-export { resolveGeoSafe, GEO_RESOLVE_TIMEOUT_MS } from './src/host/geo.js';
 export { computeAdminStats } from './src/host/admin_stats_service.js';
-export { barChartSvg } from './src/host/svg_chart.js';
+// @adonisjs/auth integration (opt-in) — user provider for config/auth.ts's
+// sessionGuard(), backed by authkit's own accountStore. Pair with
+// `adonisAuth: { guard: '...' }` in config/authkit.ts so the account console's
+// login/logout also sync ctx.auth. See src/host/adonis_auth_user_provider.ts.
+export { authkitUserProvider } from './src/host/adonis_auth_user_provider.js';
+export { botProtectionApplies, DEFAULT_BOT_TOKEN_FIELDS, extractBotToken, guardBotProtection, resolveBotProtection, resolveEffectiveBotProtection, verifyBotProtection, } from './src/host/bot_protection.js';
+export { brandFor, isFirstParty, isFirstPartyClient } from './src/host/branding.js';
+export { deriveLockedSettingKeys, isSettingLocked, lockedSettingKeys, POLICY_ROUTE_OPTIONS, resetLockedSettingKeys, SettingLockedError, setLockedSettingKeys, } from './src/host/config_locks.js';
+export { consoleLoginUrl, getAccountId, hasAccountSession, realAccountId, } from './src/host/console_session.js';
+export { authkitCsrfExceptions } from './src/host/csrf.js';
+export { GEO_RESOLVE_TIMEOUT_MS, resolveGeoSafe } from './src/host/geo.js';
+export { BUILTIN_MESSAGES, DEFAULT_LOCALE, DEFAULT_MESSAGES, PT_BR_MESSAGES, resolveMessages, translate, } from './src/host/i18n.js';
 export { buildImpersonationPanel } from './src/host/impersonation.js';
-// Organizations (multi-tenancy)
-export { ACTIVE_ORG_COOKIE, ACTIVE_ORG_COOKIE_TTL, encodeActiveOrgCookie, decodeActiveOrgCookie, readActiveOrgFromKoaCtx, } from './src/host/active_org_cookie.js';
-export { resolveOrganizations } from './src/define_config.js';
-export { supportsOrganizations } from './src/accounts/account_store.js';
-/**
- * Configure hook + stubsRoot resolvidos pelo `node ace configure @adonis-agora/authkit-server`.
- * O comando do AdonisJS importa o entrypoint principal e procura por estes exports.
- */
-export { configure } from './commands/configure.js';
-export { stubsRoot } from './stubs/main.js';
-// Runtime settings (capability-probed, optional table `auth_settings`).
-export { RuntimeSettings, supportsSettings } from './src/host/runtime_settings.js';
-// Key rotation actions — shared between the Admin REST API controller and the SDK embedded driver.
-export { buildKeysStatus, rotateNow } from './src/host/key_rotation_actions.js';
-export { resolveEffectiveBotProtection } from './src/host/bot_protection.js';
-// Runtime toggles (registration, require_verified_email, maintenance_mode).
-export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
-// Tipos de login POR USUÁRIO (self-service no console de conta).
-export { USER_LOGIN_METHOD_KEYS, normalizeUserLoginMethods, parseUserLoginMethodsPayload, resolveEffectiveUserLoginMethods, } from './src/host/user_login_methods.js';
-export { resolveRegistration } from './src/define_config.js';
-export { getAccountId, realAccountId, hasAccountSession, consoleLoginUrl, } from './src/host/console_session.js';
-export { ACCOUNT_SESSION_KEY } from './src/host/account_session_key.js';
 // Session impersonation — RP-side glue that routes through the IdP's RFC 8693
 // token-exchange (the IdP validates the admin role + audits). See
 // src/host/impersonation_session.ts.
-export { rememberAccessToken, rememberRefreshToken, refreshAccessToken, startImpersonation, impersonationState, stopImpersonation, } from './src/host/impersonation_session.js';
-// Sudo mode — helpers for host controllers that require step-up authentication.
-export { SUDO_SESSION_KEY, SUDO_ACCOUNT_SESSION_KEY, SUDO_MODE_DEFAULTS, requireSudo, isSudoActive, markSudo, resolveEffectiveSudoMode, } from './src/host/sudo_mode.js';
+export { impersonationState, refreshAccessToken, rememberAccessToken, rememberRefreshToken, startImpersonation, stopImpersonation, } from './src/host/impersonation_session.js';
+// Key rotation actions — shared between the Admin REST API controller and the SDK embedded driver.
+export { buildKeysStatus, rotateNow } from './src/host/key_rotation_actions.js';
+// @adonisjs/auth integration (opt-in) — guard pra Relying Parties OIDC.
+// O RP não autentica ninguém (sem senha); a identidade vem da sessão gravada
+// pelo callback OIDC. Plugado em config/auth.ts, faz ctx.auth.user funcionar
+// nativamente em qualquer app que consome o issuer via Authorization Code + PKCE.
+export { OidcRpGuard, oidcRpGuard } from './src/host/oidc_rp_guard.js';
+// Login por OTP (código digitável): config + helpers puros.
+export { evaluateLoginOtp, generateOtpCode, OTP_LOGIN_DEFAULTS, resolveOtpLoginConfig, } from './src/host/otp_login.js';
+export { createAuthThrottles } from './src/host/rate_limit.js';
+export { registerAuthHost } from './src/host/register_auth_host.js';
+export { edgeRenderer } from './src/host/renderers/edge_renderer.js';
+export { inertiaRenderer } from './src/host/renderers/inertia_renderer.js';
+// Runtime settings (capability-probed, optional table `auth_settings`).
+export { RuntimeSettings, supportsSettings } from './src/host/runtime_settings.js';
+// Runtime toggles (registration, require_verified_email, maintenance_mode).
+export { configLockedAuthMethods, resolveEffectiveAuthMethods, resolveEffectiveMaintenanceMode, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, SETTING_KEYS, } from './src/host/runtime_toggles.js';
+// Contexto de sessão (user-agent/geo) + métricas do dashboard.
+export { enrichSessionsWithContext } from './src/host/session_context.js';
 // SPI de métodos de confirmação de identidade (sudo mode).
 //
 // `completeSudo` é público porque o host PRECISA chamá-lo: o `oidcStepUp` não
@@ -104,19 +82,32 @@ export { SUDO_SESSION_KEY, SUDO_ACCOUNT_SESSION_KEY, SUDO_MODE_DEFAULTS, require
 // perderia o audit `sudo.confirmed`, a preferência de método e o redirect para
 // o `return_to`.
 export { sudoMethods } from './src/host/sudo/index.js';
-export { completeSudo, fail as failSudo, LAST_METHOD_SESSION_KEY, } from './src/host/sudo/runtime.js';
 // Montador do `SudoContext` que `completeSudo`/`failSudo` recebem. Exportado
 // junto porque sem ele o host teria de montar o contexto na mão (resolver o
 // service do container, carregar a conta, validar o `return_to`) — e um
 // `returnTo` montado na mão é um open redirect esperando acontecer.
-export { sudoContextFrom } from './src/host/sudo/runtime.js';
-// @adonisjs/auth integration (opt-in) — user provider for config/auth.ts's
-// sessionGuard(), backed by authkit's own accountStore. Pair with
-// `adonisAuth: { guard: '...' }` in config/authkit.ts so the account console's
-// login/logout also sync ctx.auth. See src/host/adonis_auth_user_provider.ts.
-export { authkitUserProvider } from './src/host/adonis_auth_user_provider.js';
-// @adonisjs/auth integration (opt-in) — guard pra Relying Parties OIDC.
-// O RP não autentica ninguém (sem senha); a identidade vem da sessão gravada
-// pelo callback OIDC. Plugado em config/auth.ts, faz ctx.auth.user funcionar
-// nativamente em qualquer app que consome o issuer via Authorization Code + PKCE.
-export { OidcRpGuard, oidcRpGuard } from './src/host/oidc_rp_guard.js';
+export { completeSudo, fail as failSudo, LAST_METHOD_SESSION_KEY, sudoContextFrom, } from './src/host/sudo/runtime.js';
+// Sudo mode — helpers for host controllers that require step-up authentication.
+export { isSudoActive, markSudo, requireSudo, resolveEffectiveSudoMode, SUDO_ACCOUNT_SESSION_KEY, SUDO_MODE_DEFAULTS, SUDO_SESSION_KEY, } from './src/host/sudo_mode.js';
+export { barChartSvg } from './src/host/svg_chart.js';
+export { buildTrustedDevicePayload, isTrustedDeviceValid, resolveTrustedDevices, TRUSTED_DEVICE_COOKIE, } from './src/host/trusted_device.js';
+export { parseUserAgent } from './src/host/user_agent.js';
+// Tipos de login POR USUÁRIO (self-service no console de conta).
+export { normalizeUserLoginMethods, parseUserLoginMethodsPayload, resolveEffectiveUserLoginMethods, USER_LOGIN_METHOD_KEYS, } from './src/host/user_login_methods.js';
+export { withAuditLog } from './src/mixins/with_audit_log.js';
+export { withAuthUser } from './src/mixins/with_auth_user.js';
+export { withCredentials } from './src/mixins/with_credentials.js';
+export { withMfa } from './src/mixins/with_mfa.js';
+export { withPersonalAccessToken } from './src/mixins/with_personal_access_token.js';
+export { withProviderIdentity } from './src/mixins/with_provider_identity.js';
+export { withWebauthnCredential } from './src/mixins/with_webauthn_credential.js';
+// Gerência de senha: lazy rehash + legacy verifier, política e checagem de vazamento.
+export { PasswordManager, PasswordPolicyError, } from './src/password/password_manager.js';
+export { checkPasswordPolicy, DEFAULT_PWNED_TIMEOUT_MS, policyViolationParams, } from './src/password/policy.js';
+export { __setFetchForTests as __setPwnedFetchForTests, isPasswordPwned, } from './src/password/pwned.js';
+export { lucidPatStore } from './src/pat/lucid_pat_store.js';
+export { generatePatToken, hashPatToken } from './src/pat/pat_tokens.js';
+export { OidcService } from './src/provider/oidc_service.js';
+export { registerOidcRoutes } from './src/register_routes.js';
+export { ensureAuthkitSchema } from './src/schema/ensure.js';
+export { stubsRoot } from './stubs/main.js';

package/build/src/accounts/lucid_store/core.js

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { Scrypt } from '@adonisjs/core/hash/drivers/scrypt';
 import { DateTime } from 'luxon';
-import { OTP_LOGIN_PREFIX, decodeOtpToken, encodeOtpToken, evaluateLoginOtp, generateOtpCode, hashLoginOtp, linkTokenFromOtpUrl, } from '../../host/otp_login.js';
+import { decodeOtpToken, encodeOtpToken, evaluateLoginOtp, generateOtpCode, hashLoginOtp, linkTokenFromOtpUrl, OTP_LOGIN_PREFIX, } from '../../host/otp_login.js';
 import { hasColumn } from './status_profile.js';
 import { generateExpiringHashedToken, generateHashedToken, parseExpiringTokenExp, rawToDbToken, rawToExpiringDbToken, sha256Hex, } from './token_hash.js';
 /**

package/build/src/accounts/lucid_store/mfa.d.ts

@@ -1,15 +1,3 @@
 import type { MfaCapability } from '../account_store.js';
 import { type LucidStoreContext } from './shared.js';
-/**
- * Capacidade de MFA / TOTP — LIB-OWNED.
- *
- * O estado de MFA (`totp_secret`, `mfa_enabled_at`, `recovery_codes`,
- * `last_totp_step`) vive numa tabela PRÓPRIA auto-gerida `auth_mfa` (criada pelo
- * {@link ensureAuthkitSchema}), keyed por `account_id`. O host NÃO precisa migrar
- * nada — `withMfa()` continua componível no model mas não declara mais colunas.
- *
- * Acesso ao banco via a CONEXÃO do próprio model (`Model.query().client`), a mesma
- * usada pelo restante do store. O `email` (para o keyuri/QR) continua vindo do
- * model principal — só o ESTADO de MFA migrou para `auth_mfa`.
- */
 export declare function buildMfa(ctx: LucidStoreContext): MfaCapability;

package/build/src/accounts/lucid_store/mfa.js

@@ -1,4 +1,4 @@
-import { authenticator } from 'otplib';
+import { generateSecret, generateURI, verify } from 'otplib';
 import { buildMfaStateRepo, generateRecoveryCode, hashesEqual, sha256, } from './shared.js';
 /**
  * Capacidade de MFA / TOTP — LIB-OWNED.
@@ -12,6 +12,11 @@ import { buildMfaStateRepo, generateRecoveryCode, hashesEqual, sha256, } from '.
  * usada pelo restante do store. O `email` (para o keyuri/QR) continua vindo do
  * model principal — só o ESTADO de MFA migrou para `auth_mfa`.
  */
+/**
+ * Período TOTP (segundos). otplib >= 13 não expõe mais `authenticator.allOptions()`;
+ * o default RFC 6238 / Google Authenticator é 30s e é o que sempre usamos.
+ */
+const TOTP_PERIOD = 30;
 export function buildMfa(ctx) {
     const { Model, mfaIssuer, recoveryCodeCount, sealSecret, openSecret } = ctx;
     const repo = buildMfaStateRepo(Model);
@@ -27,7 +32,7 @@ export function buildMfa(ctx) {
             const row = await Model.find(accountId);
             if (!row)
                 return null;
-            const secret = authenticator.generateSecret();
+            const secret = generateSecret();
             // Segredo PENDENTE: armazenado (encriptado em repouso) mas mfaEnabledAt continua null.
             // Re-enrollment: zera o anti-replay para o NOVO segredo (o histórico de steps
             // do segredo antigo não se aplica ao novo) e limpa recovery codes pendentes.
@@ -37,7 +42,7 @@ export function buildMfa(ctx) {
                 recoveryCodes: null,
                 lastTotpStep: null,
             });
-            const otpauthUri = authenticator.keyuri(row.email, mfaIssuer, secret);
+            const otpauthUri = generateURI({ issuer: mfaIssuer, label: row.email, secret });
             return { secret, otpauthUri };
         },
         async confirmTotpEnrollment(accountId, code) {
@@ -48,7 +53,7 @@ export function buildMfa(ctx) {
             if (!secret)
                 return { ok: false };
             // Só confirma a partir de um segredo pendente (não re-confirma um já ativo).
-            const valid = authenticator.verify({ token: String(code ?? ''), secret });
+            const { valid } = await verify({ token: String(code ?? ''), secret, period: TOTP_PERIOD });
             if (!valid)
                 return { ok: false };
             const codes = Array.from({ length: recoveryCodeCount }, () => generateRecoveryCode());
@@ -66,19 +71,14 @@ export function buildMfa(ctx) {
             if (!secret)
                 return false;
             const token = String(code ?? '');
-            // M3 (anti-replay): `checkDelta` retorna o offset (delta) da janela onde o
-            // token bate, ou null se inválido. Convertemos o delta no índice ABSOLUTO
-            // da janela (`step`) usando o epoch/period correntes do otplib:
-            //   stepAtual = floor(epochSegundos / period)
-            //   stepDoToken = stepAtual + delta
-            const delta = authenticator.checkDelta(token, secret);
-            if (delta === null)
+            // M3 (anti-replay): `verify` devolve, quando válido, o `epoch` (segundos) do
+            // INÍCIO da janela onde o token bateu. Convertemos no índice ABSOLUTO da
+            // janela (`step`): stepDoToken = floor(epochDaJanela / period).
+            const result = await verify({ token, secret, period: TOTP_PERIOD });
+            // `'epoch' in result` estreita para o resultado TOTP (o tipo é união com o HOTP).
+            if (!result.valid || !('epoch' in result))
                 return false;
-            const opts = authenticator.allOptions();
-            // `epoch` vem em ms; `step` (period) em segundos. Default do otplib: epoch=now, step=30.
-            const period = opts.step || 30;
-            const currentStep = Math.floor(opts.epoch / 1000 / period);
-            const tokenStep = currentStep + delta;
+            const tokenStep = Math.floor(result.epoch / TOTP_PERIOD);
             // Rejeita replay: se este step já foi aceito (ou um posterior), nega. Isso
             // impede reusar o MESMO código dentro da janela de validade (~30s) e também
             // qualquer código de um step já consumido.