@adonis-agora/authkit-server 0.61.3 → 0.61.4

package/build/src/audit/audit_sink.d.ts

@@ -8,7 +8,7 @@
  * varre os `audit.record({ type: ... })` do `src/` e falha quando um evento
  * emitido não está aqui.
  */
-export declare const AUDIT_EVENT_TYPES: readonly ["login.success", "login.failure", "signup", "password_reset.issued", "password_reset.consumed", "pat.issued", "pat.revoked", "pat.used", "impersonation", "impersonation.panel_viewed", "mfa.enabled", "mfa.disabled", "account.locked", "passkey.registered", "passkey.removed", "email_verification.issued", "email_verification.consumed", "client.created", "client.updated", "client.deleted", "session.revoked_all", "password.changed", "password.rehashed", "email.change_requested", "email.changed", "login.new_ip_notified", "login.new_device", "login.otp_sent", "login.otp_verified", "login.otp_failed", "login.otp_invalidated", "bot_protection.rejected", "grant.revoked_by_user", "user.created", "user.password_reset_sent", "user.disabled", "user.enabled", "user.deleted", "profile.updated", "account.deleted", "account.exported", "keys.rotated", "organization.created", "organization.updated", "organization.deleted", "organization.member_added", "organization.member_removed", "organization.member_role_changed", "organization.member_role_updated", "organization.switched", "organization.deactivated", "organization.invitation_sent", "organization.invitation_accepted", "organization.invitation_revoked", "email_change.requested", "email_change.confirmed", "email_change.cancelled", "security_notice.sent", "settings.updated", "maintenance.enabled", "maintenance.disabled", "trusted_device.revoked", "password.expired_change_forced", "otp.locked", "otp.unlocked", "otp.unlock_failed", "sudo.confirmed", "session.single_enforced", "account.expired_login_blocked", "account.expiration_warned", "login.magic_link_sent", "session.revoked", "account.signed_out_all", "client.secret_regenerated", "roles_catalog.updated"];
+export declare const AUDIT_EVENT_TYPES: readonly ['login.success', 'login.failure', 'signup', 'password_reset.issued', 'password_reset.consumed', 'pat.issued', 'pat.revoked', 'pat.used', 'impersonation', 'impersonation.panel_viewed', 'mfa.enabled', 'mfa.disabled', 'account.locked', 'passkey.registered', 'passkey.removed', 'email_verification.issued', 'email_verification.consumed', 'client.created', 'client.updated', 'client.deleted', 'session.revoked_all', 'password.changed', 'password.rehashed', 'email.change_requested', 'email.changed', 'login.new_ip_notified', 'login.new_device', 'login.otp_sent', 'login.otp_verified', 'login.otp_failed', 'login.otp_invalidated', 'bot_protection.rejected', 'grant.revoked_by_user', 'user.created', 'user.password_reset_sent', 'user.disabled', 'user.enabled', 'user.deleted', 'profile.updated', 'account.deleted', 'account.exported', 'keys.rotated', 'organization.created', 'organization.updated', 'organization.deleted', 'organization.member_added', 'organization.member_removed', 'organization.member_role_changed', 'organization.member_role_updated', 'organization.switched', 'organization.deactivated', 'organization.invitation_sent', 'organization.invitation_accepted', 'organization.invitation_revoked', 'email_change.requested', 'email_change.confirmed', 'email_change.cancelled', 'security_notice.sent', 'settings.updated', 'maintenance.enabled', 'maintenance.disabled', 'trusted_device.revoked', 'password.expired_change_forced', 'otp.locked', 'otp.unlocked', 'otp.unlock_failed', 'sudo.confirmed', 'session.single_enforced', 'account.expired_login_blocked', 'account.expiration_warned', 'login.magic_link_sent', 'session.revoked', 'account.signed_out_all', 'client.secret_regenerated', 'roles_catalog.updated'];
 /** Tipos de eventos de auditoria relevantes para segurança emitidos pelo IdP. */
 export type AuditEventType = (typeof AUDIT_EVENT_TYPES)[number];
 /**

package/build/src/commands/import_users.js

@@ -16,7 +16,9 @@ export function parseImportFile(content) {
                 parseErrors.push({ line: 1, reason: 'expected a JSON array or NDJSON' });
                 return { records, parseErrors };
             }
-            arr.forEach((record, i) => records.push({ line: i + 1, record }));
+            arr.forEach((record, i) => {
+                records.push({ line: i + 1, record });
+            });
         }
         catch (error) {
             parseErrors.push({ line: 1, reason: `invalid JSON array: ${error.message}` });

package/build/src/define_config.d.ts

@@ -1,7 +1,7 @@
 import type { AccessTokenFormat, AccessTokensConfig, ClientConfig, JwksConfig, KeystoreStoreConfig, ObservabilityConfig, TtlConfig } from '@adonis-agora/authkit-core';
 import type { HttpContext } from '@adonisjs/core/http';
 import type { AccountStore, AuthAccount } from './accounts/account_store.js';
-import { type AdapterFactory, type OidcAdapterClass, adapters } from './adapters/factory.js';
+import { type AdapterFactory, adapters, type OidcAdapterClass } from './adapters/factory.js';
 import type { AuditSink } from './audit/audit_sink.js';
 import { type EventsConfigInput } from './events/dispatcher.js';
 import { type BotProtectionConfigInput, type ResolvedBotProtectionConfig } from './host/bot_protection.js';
@@ -14,8 +14,8 @@ import type { AuthHostOptions } from './host/register_auth_host.js';
 import type { SudoMethod } from './host/sudo/types.js';
 import { type ResolvedTrustedDevicesConfig, type TrustedDevicesConfigInput } from './host/trusted_device.js';
 import type { PatStore } from './pat/pat_store.js';
-export { adapters };
 export type { AuthAccount };
+export { adapters };
 export type AuthHostRenderer = (ctx: HttpContext, view: string, props: Record<string, unknown>) => unknown;
 export interface AuthSocialConfig {
     providers: string[];

package/build/src/host/account_api/account_api_controller.js

@@ -43,7 +43,7 @@ import { resolveRuntimeSettings, resolveRuntimeSettingsOrNoop } from '../runtime
 import { configLockedAuthMethods, resolveEffectiveAuthMethods, resolveEffectiveEmailChange, resolveEffectivePasswordHistory, } from '../runtime_toggles.js';
 import { dispatchSecurityNotice } from '../security_notice_service.js';
 import { enrichSessionsWithContext } from '../session_context.js';
-import { SUDO_MODE_DEFAULTS, isSudoActive, requireSudo, resolveEffectiveSudoMode, } from '../sudo_mode.js';
+import { isSudoActive, requireSudo, resolveEffectiveSudoMode, SUDO_MODE_DEFAULTS, } from '../sudo_mode.js';
 import { parseUserLoginMethodsPayload, resolveEffectiveUserLoginMethods, } from '../user_login_methods.js';
 import { changeEmailValidator, changePasswordValidator, updateProfileValidator, } from '../validators.js';
 // ---------------------------------------------------------------------------

package/build/src/host/account_paths.d.ts

@@ -36,15 +36,15 @@
  * o segmento de URL, sobrescrevível por `setAccountPaths`.
  */
 declare const DEFAULT_ACCOUNT_SEGMENTS: {
-    readonly login: "login";
-    readonly logout: "logout";
-    readonly security: "security";
-    readonly mfa: "mfa";
-    readonly confirm: "confirm";
-    readonly tokens: "tokens";
-    readonly apps: "apps";
-    readonly orgs: "orgs";
-    readonly emailConfirm: "email/confirm";
+    readonly login: 'login';
+    readonly logout: 'logout';
+    readonly security: 'security';
+    readonly mfa: 'mfa';
+    readonly confirm: 'confirm';
+    readonly tokens: 'tokens';
+    readonly apps: 'apps';
+    readonly orgs: 'orgs';
+    readonly emailConfirm: 'email/confirm';
 };
 /** Chave de tela do console de conta (`login`, `security`, `confirm`, ...). */
 export type AccountPathKey = keyof typeof DEFAULT_ACCOUNT_SEGMENTS;

package/build/src/host/admin_api/api_orgs_controller.d.ts

@@ -8,27 +8,34 @@ export default class ApiOrgsController {
     /** GET /organizations — lista todas as orgs com contagem de membros. */
     index(ctx: HttpContext): Promise<void | {
         data: {
-            memberCount?: number | undefined;
             id: string;
             name: string;
             slug: string;
             logoUrl: string | null;
             metadata: Record<string, unknown> | null;
             createdAt: string;
+            memberCount?: number | undefined;
         }[];
     }>;
     /** POST /organizations — cria uma org. Body: { name, slug, ownerAccountId, logoUrl? } */
     store(ctx: HttpContext): Promise<void | {
-        memberCount?: number | undefined;
         id: string;
         name: string;
         slug: string;
         logoUrl: string | null;
         metadata: Record<string, unknown> | null;
         createdAt: string;
+        memberCount?: number | undefined;
     }>;
     /** GET /organizations/:id — obtém uma org com membros e convites. */
     show(ctx: HttpContext): Promise<void | {
+        id: string;
+        name: string;
+        slug: string;
+        logoUrl: string | null;
+        metadata: Record<string, unknown> | null;
+        createdAt: string;
+        memberCount?: number | undefined;
         members: {
             accountId: string;
             email: string | null;
@@ -45,23 +52,16 @@ export default class ApiOrgsController {
             acceptedAt: string | null;
             createdAt: string;
         }[];
-        memberCount?: number | undefined;
-        id: string;
-        name: string;
-        slug: string;
-        logoUrl: string | null;
-        metadata: Record<string, unknown> | null;
-        createdAt: string;
     }>;
     /** PATCH /organizations/:id — atualiza nome e/ou logo. */
     update(ctx: HttpContext): Promise<void | {
-        memberCount?: number | undefined;
         id: string;
         name: string;
         slug: string;
         logoUrl: string | null;
         metadata: Record<string, unknown> | null;
         createdAt: string;
+        memberCount?: number | undefined;
     }>;
     /** DELETE /organizations/:id */
     destroy(ctx: HttpContext): Promise<void | {

package/build/src/host/admin_api/api_settings_controller.d.ts

@@ -16,35 +16,35 @@ export default class ApiSettingsController {
     /** GET /settings — lista settings (global por padrão, ou da org via ?organizationId=). */
     index(ctx: HttpContext): Promise<void | {
         data: {
-            lockedBy?: "config" | undefined;
             key: string;
             organizationId: string | null;
             value: unknown;
             updatedAt: string | null;
             updatedBy: string | null;
             locked: boolean;
+            lockedBy?: "config" | undefined;
         }[];
         locked: string[];
     }>;
     /** GET /settings/:key — obtém uma setting por key (global ou org). */
     show(ctx: HttpContext): Promise<void | {
-        lockedBy?: "config" | undefined;
         key: string;
         organizationId: string | null;
         value: unknown;
         updatedAt: string | null;
         updatedBy: string | null;
         locked: boolean;
+        lockedBy?: "config" | undefined;
     }>;
     /** PUT /settings/:key — cria ou atualiza uma setting. Body: { value: any } */
     upsert(ctx: HttpContext): Promise<void | {
-        lockedBy?: "config" | undefined;
         key: string;
         organizationId: string | null;
         value: unknown;
         updatedAt: string | null;
         updatedBy: string | null;
         locked: boolean;
+        lockedBy?: "config" | undefined;
     }>;
     /** DELETE /settings/:key */
     destroy(ctx: HttpContext): Promise<void | {

package/build/src/host/admin_api/api_settings_controller.js

@@ -1,5 +1,5 @@
 import '../augmentations.js';
-import { SettingLockedError, isSettingLocked, lockedSettingKeys } from '../config_locks.js';
+import { isSettingLocked, lockedSettingKeys, SettingLockedError } from '../config_locks.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { apiError, settingDto } from './dto.js';
 /** 423 Locked: a setting foi travada via defineConfig (não editável em runtime). */

package/build/src/host/admin_api/api_users_controller.d.ts

@@ -24,13 +24,13 @@ export default class ApiUsersController {
     }>;
     /** POST /users — { email, name?, password? | invite?:true }. */
     store(ctx: HttpContext): Promise<void | {
-        invited: boolean;
         id: string;
         email: string;
         name: string | null;
         avatarUrl: string | null;
         globalRoles: string[];
         disabled: boolean;
+        invited: boolean;
     }>;
     /** PATCH /users/:id — { globalRoles?, name?, avatarUrl? }. */
     update(ctx: HttpContext): Promise<void | {
@@ -60,10 +60,10 @@ export default class ApiUsersController {
         avatarDeleted: boolean;
         orgMemberships: number;
         orgInvitations: number;
-        id: any;
-        deleted: boolean;
         enqueued?: undefined;
         runId?: undefined;
+        id: any;
+        deleted: boolean;
     }>;
     /** POST /users/:id/disable */
     disable(ctx: HttpContext): Promise<void | {

package/build/src/host/admin_api/dto.d.ts

@@ -1,5 +1,4 @@
-import type { AuthAccount } from '../../accounts/account_store.js';
-import type { OrgInvitation, OrgMember, OrgSummary } from '../../accounts/account_store.js';
+import type { AuthAccount, OrgInvitation, OrgMember, OrgSummary } from '../../accounts/account_store.js';
 import type { StoredAuditEvent } from '../../audit/audit_sink.js';
 import type { AdminClient, CreatedClient } from '../admin_clients_service.js';
 import type { AdminGrant, AdminSession } from '../admin_sessions_service.js';
@@ -49,7 +48,7 @@ export declare function grantDto(grant: AdminGrant): {
 };
 export declare function auditDto(event: StoredAuditEvent): {
     id: string;
-    type: "login.success" | "login.failure" | "signup" | "password_reset.issued" | "password_reset.consumed" | "pat.issued" | "pat.revoked" | "pat.used" | "impersonation" | "impersonation.panel_viewed" | "mfa.enabled" | "mfa.disabled" | "account.locked" | "passkey.registered" | "passkey.removed" | "email_verification.issued" | "email_verification.consumed" | "client.created" | "client.updated" | "client.deleted" | "session.revoked_all" | "password.changed" | "password.rehashed" | "email.change_requested" | "email.changed" | "login.new_ip_notified" | "login.new_device" | "login.otp_sent" | "login.otp_verified" | "login.otp_failed" | "login.otp_invalidated" | "bot_protection.rejected" | "grant.revoked_by_user" | "user.created" | "user.password_reset_sent" | "user.disabled" | "user.enabled" | "user.deleted" | "profile.updated" | "account.deleted" | "account.exported" | "keys.rotated" | "organization.created" | "organization.updated" | "organization.deleted" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.deactivated" | "organization.invitation_sent" | "organization.invitation_accepted" | "organization.invitation_revoked" | "email_change.requested" | "email_change.confirmed" | "email_change.cancelled" | "security_notice.sent" | "settings.updated" | "maintenance.enabled" | "maintenance.disabled" | "trusted_device.revoked" | "password.expired_change_forced" | "otp.locked" | "otp.unlocked" | "otp.unlock_failed" | "sudo.confirmed" | "session.single_enforced" | "account.expired_login_blocked" | "account.expiration_warned" | "login.magic_link_sent" | "session.revoked" | "account.signed_out_all" | "client.secret_regenerated" | "roles_catalog.updated";
+    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.locked" | "account.signed_out_all" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
     accountId: string | null;
     email: string | null;
     clientId: string | null;
@@ -61,13 +60,13 @@ export declare function auditDto(event: StoredAuditEvent): {
 export declare function orgDto(org: OrgSummary & {
     memberCount?: number;
 }): {
-    memberCount?: number | undefined;
     id: string;
     name: string;
     slug: string;
     logoUrl: string | null;
     metadata: Record<string, unknown> | null;
     createdAt: string;
+    memberCount?: number | undefined;
 };
 export declare function orgMemberDto(member: OrgMember): {
     accountId: string;
@@ -86,6 +85,13 @@ export declare function orgInvitationDto(inv: OrgInvitation): {
     createdAt: string;
 };
 export declare function orgDetailDto(detail: OrgDetail): {
+    id: string;
+    name: string;
+    slug: string;
+    logoUrl: string | null;
+    metadata: Record<string, unknown> | null;
+    createdAt: string;
+    memberCount?: number | undefined;
     members: {
         accountId: string;
         email: string | null;
@@ -102,25 +108,17 @@ export declare function orgDetailDto(detail: OrgDetail): {
         acceptedAt: string | null;
         createdAt: string;
     }[];
-    memberCount?: number | undefined;
-    id: string;
-    name: string;
-    slug: string;
-    logoUrl: string | null;
-    metadata: Record<string, unknown> | null;
-    createdAt: string;
 };
 /** Envelope de erro padrão da Admin REST API. */
 export declare function apiError(code: string, message: string, details?: Record<string, unknown>): {
     error: {
-        details?: Record<string, unknown> | undefined;
         code: string;
         message: string;
+        details?: Record<string, unknown> | undefined;
     };
 };
 import type { SettingRow } from '../runtime_settings.js';
 export declare function settingDto(row: SettingRow): {
-    lockedBy?: "config" | undefined;
     key: string;
     organizationId: string | null;
     value: unknown;
@@ -128,4 +126,5 @@ export declare function settingDto(row: SettingRow): {
     updatedBy: string | null;
     /** Travada via defineConfig → UI deve desabilitar a edição e mostrar aviso. */
     locked: boolean;
+    lockedBy?: "config" | undefined;
 };

package/build/src/host/admin_console/console_orgs_controller.d.ts

@@ -23,19 +23,26 @@ export default class ConsoleOrgsController {
     /** GET {prefix}/api/orgs */
     index(ctx: HttpContext): Promise<void | {
         data: {
-            memberCount?: number | undefined;
             id: string;
             name: string;
             slug: string;
             logoUrl: string | null;
             metadata: Record<string, unknown> | null;
             createdAt: string;
+            memberCount?: number | undefined;
         }[];
     }>;
     /** POST {prefix}/api/orgs */
     store(ctx: HttpContext): Promise<void>;
     /** GET {prefix}/api/orgs/:id */
     show(ctx: HttpContext): Promise<void | {
+        id: string;
+        name: string;
+        slug: string;
+        logoUrl: string | null;
+        metadata: Record<string, unknown> | null;
+        createdAt: string;
+        memberCount?: number | undefined;
         members: {
             accountId: string;
             email: string | null;
@@ -52,23 +59,16 @@ export default class ConsoleOrgsController {
             acceptedAt: string | null;
             createdAt: string;
         }[];
-        memberCount?: number | undefined;
-        id: string;
-        name: string;
-        slug: string;
-        logoUrl: string | null;
-        metadata: Record<string, unknown> | null;
-        createdAt: string;
     }>;
     /** PATCH {prefix}/api/orgs/:id */
     update(ctx: HttpContext): Promise<void | {
-        memberCount?: number | undefined;
         id: string;
         name: string;
         slug: string;
         logoUrl: string | null;
         metadata: Record<string, unknown> | null;
         createdAt: string;
+        memberCount?: number | undefined;
     }>;
     /** DELETE {prefix}/api/orgs/:id */
     destroy(ctx: HttpContext): Promise<void | {

package/build/src/host/admin_console/console_roles_controller.js

@@ -3,7 +3,7 @@ import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { apiError } from '../admin_api/dto.js';
 import { roleCreateValidator, roleUpdateValidator } from '../admin_validators.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
-import { SETTING_KEYS, resolveEffectiveRolesCatalog, } from '../runtime_toggles.js';
+import { resolveEffectiveRolesCatalog, SETTING_KEYS, } from '../runtime_toggles.js';
 /** Regex de validação: nome de role — letras maiúsculas, dígitos e underscore. */
 const ROLE_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
 /** ADMIN é protegido: não pode ser removido. */

package/build/src/host/admin_console/console_settings_controller.d.ts

@@ -18,25 +18,25 @@ export default class ConsoleSettingsController {
     /** GET {prefix}/api/settings */
     index(ctx: HttpContext): Promise<void | {
         data: {
-            lockedBy?: "config" | undefined;
             key: string;
             organizationId: string | null;
             value: unknown;
             updatedAt: string | null;
             updatedBy: string | null;
             locked: boolean;
+            lockedBy?: "config" | undefined;
         }[];
         locked: string[];
     }>;
     /** PUT {prefix}/api/settings/:key — body: { value: any } */
     upsert(ctx: HttpContext): Promise<void | {
-        lockedBy?: "config" | undefined;
         key: string;
         organizationId: string | null;
         value: unknown;
         updatedAt: string | null;
         updatedBy: string | null;
         locked: boolean;
+        lockedBy?: "config" | undefined;
     }>;
     /** DELETE {prefix}/api/settings/:key */
     destroy(ctx: HttpContext): Promise<void | {

package/build/src/host/admin_console/console_settings_controller.js

@@ -1,6 +1,6 @@
 import '../augmentations.js';
 import { apiError, settingDto } from '../admin_api/dto.js';
-import { SettingLockedError, isSettingLocked, lockedSettingKeys } from '../config_locks.js';
+import { isSettingLocked, lockedSettingKeys, SettingLockedError } from '../config_locks.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 /** 423 Locked: setting travada via defineConfig. */
 function lockedResponse(ctx, err) {

package/build/src/host/admin_console/console_users_controller.d.ts

@@ -27,6 +27,12 @@ export default class ConsoleUsersController {
     }>;
     /** GET {prefix}/api/users/:id */
     show(ctx: HttpContext): Promise<void | {
+        id: string;
+        email: string;
+        name: string | null;
+        avatarUrl: string | null;
+        globalRoles: string[];
+        disabled: boolean;
         sessionsSupported: boolean;
         sessions: {
             id: string;
@@ -53,22 +59,16 @@ export default class ConsoleUsersController {
             name: string;
             description?: string;
         }[];
-        id: string;
-        email: string;
-        name: string | null;
-        avatarUrl: string | null;
-        globalRoles: string[];
-        disabled: boolean;
     }>;
     /** POST {prefix}/api/users */
     store(ctx: HttpContext): Promise<void | {
-        invited: boolean;
         id: string;
         email: string;
         name: string | null;
         avatarUrl: string | null;
         globalRoles: string[];
         disabled: boolean;
+        invited: boolean;
     }>;
     /** PATCH {prefix}/api/users/:id/roles */
     updateRoles(ctx: HttpContext): Promise<void | {

package/build/src/host/admin_validators.d.ts

@@ -16,32 +16,32 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     backchannelLogoutUri: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
     backchannelLogoutSessionRequired: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineBoolean>;
 }, {
+    backchannelLogoutSessionRequired?: string | number | boolean | null | undefined;
+    backchannelLogoutUri?: string | null | undefined;
     clientId?: string | null | undefined;
-    grants?: ("refresh_token" | "authorization_code" | "urn:ietf:params:oauth:grant-type:token-exchange" | "client_credentials")[] | null | undefined;
-    redirectUris?: string[] | null | undefined;
+    grantTypes?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | null | undefined;
+    grants?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | null | undefined;
     postLogoutRedirectUris?: string[] | null | undefined;
-    grantTypes?: ("refresh_token" | "authorization_code" | "urn:ietf:params:oauth:grant-type:token-exchange" | "client_credentials")[] | null | undefined;
-    tokenEndpointAuthMethod?: "none" | "client_secret_basic" | "client_secret_post" | null | undefined;
-    backchannelLogoutUri?: string | null | undefined;
-    backchannelLogoutSessionRequired?: string | number | boolean | null | undefined;
+    redirectUris?: string[] | null | undefined;
+    tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | null | undefined;
 }, {
+    backchannelLogoutSessionRequired?: boolean | undefined;
+    backchannelLogoutUri?: string | undefined;
     clientId?: string | undefined;
-    grants?: ("refresh_token" | "authorization_code" | "urn:ietf:params:oauth:grant-type:token-exchange" | "client_credentials")[] | undefined;
-    redirectUris?: string[] | undefined;
+    grantTypes?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | undefined;
+    grants?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | undefined;
     postLogoutRedirectUris?: string[] | undefined;
-    grantTypes?: ("refresh_token" | "authorization_code" | "urn:ietf:params:oauth:grant-type:token-exchange" | "client_credentials")[] | undefined;
-    tokenEndpointAuthMethod?: "none" | "client_secret_basic" | "client_secret_post" | undefined;
-    backchannelLogoutUri?: string | undefined;
-    backchannelLogoutSessionRequired?: boolean | undefined;
+    redirectUris?: string[] | undefined;
+    tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | undefined;
 }, {
+    backchannelLogoutSessionRequired?: boolean | undefined;
+    backchannelLogoutUri?: string | undefined;
     clientId?: string | undefined;
-    grants?: ("refresh_token" | "authorization_code" | "urn:ietf:params:oauth:grant-type:token-exchange" | "client_credentials")[] | undefined;
-    redirectUris?: string[] | undefined;
+    grantTypes?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | undefined;
+    grants?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | undefined;
     postLogoutRedirectUris?: string[] | undefined;
-    grantTypes?: ("refresh_token" | "authorization_code" | "urn:ietf:params:oauth:grant-type:token-exchange" | "client_credentials")[] | undefined;
-    tokenEndpointAuthMethod?: "none" | "client_secret_basic" | "client_secret_post" | undefined;
-    backchannelLogoutUri?: string | undefined;
-    backchannelLogoutSessionRequired?: boolean | undefined;
+    redirectUris?: string[] | undefined;
+    tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | undefined;
 }>, Record<string, any> | undefined>;
 /** Forma validada de um client (saída do {@link clientInputValidator}). */
 export type ClientInputFields = {
@@ -74,20 +74,20 @@ export declare const adminUserCreateValidator: import("@vinejs/vine").VineValida
     password: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
     invite: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineBoolean>;
 }, {
+    email: string;
+    invite?: string | number | boolean | null | undefined;
     name?: string | null | undefined;
     password?: string | null | undefined;
-    invite?: string | number | boolean | null | undefined;
-    email: string;
 }, {
+    email: string;
+    invite?: boolean | undefined;
     name?: string | undefined;
     password?: string | undefined;
-    invite?: boolean | undefined;
-    email: string;
 }, {
+    email: string;
+    invite?: boolean | undefined;
     name?: string | undefined;
     password?: string | undefined;
-    invite?: boolean | undefined;
-    email: string;
 }>, Record<string, any> | undefined>;
 /** Atualização de usuário (PATCH): roles globais e/ou perfil. Tudo opcional. */
 export declare const adminUserUpdateValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
@@ -95,17 +95,17 @@ export declare const adminUserUpdateValidator: import("@vinejs/vine").VineValida
     name: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
     avatarUrl: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
 }, {
-    name?: string | null | undefined;
     avatarUrl?: string | null | undefined;
     globalRoles?: string[] | null | undefined;
-}, {
     name?: string | null | undefined;
+}, {
     avatarUrl?: string | null | undefined;
     globalRoles?: string[] | undefined;
-}, {
     name?: string | null | undefined;
+}, {
     avatarUrl?: string | null | undefined;
     globalRoles?: string[] | undefined;
+    name?: string | null | undefined;
 }>, Record<string, any> | undefined>;
 /** Substituição de roles globais no console (PATCH /users/:id/roles). */
 export declare const adminUserRolesValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
@@ -126,46 +126,46 @@ export declare const orgCreateValidator: import("@vinejs/vine").VineValidator<im
 }, {
     logoUrl?: string | null | undefined;
     name: string;
-    slug: string;
     ownerAccountId: string;
+    slug: string;
 }, {
     logoUrl?: string | null | undefined;
     name: string;
-    slug: string;
     ownerAccountId: string;
+    slug: string;
 }, {
     logoUrl?: string | null | undefined;
     name: string;
-    slug: string;
     ownerAccountId: string;
+    slug: string;
 }>, Record<string, any> | undefined>;
 /** Atualização de org (PATCH): nome e/ou logo, ambos opcionais. */
 export declare const orgUpdateValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
     name: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
     logoUrl: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
 }, {
-    name?: string | null | undefined;
     logoUrl?: string | null | undefined;
+    name?: string | null | undefined;
 }, {
-    name?: string | undefined;
     logoUrl?: string | null | undefined;
-}, {
     name?: string | undefined;
+}, {
     logoUrl?: string | null | undefined;
+    name?: string | undefined;
 }>, Record<string, any> | undefined>;
 /** Adição de membro: accountId obrigatório; role opcional (default `member`). */
 export declare const orgAddMemberValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
     accountId: import("@vinejs/vine").VineString;
     role: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
 }, {
-    role?: string | null | undefined;
     accountId: string;
+    role?: string | null | undefined;
 }, {
-    role?: string | undefined;
     accountId: string;
-}, {
     role?: string | undefined;
+}, {
     accountId: string;
+    role?: string | undefined;
 }>, Record<string, any> | undefined>;
 /** Troca de papel de membro: role obrigatório. */
 export declare const orgMemberRoleValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
@@ -182,14 +182,14 @@ export declare const orgInvitationValidator: import("@vinejs/vine").VineValidato
     email: import("@vinejs/vine").VineString;
     role: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
 }, {
-    role?: string | null | undefined;
     email: string;
+    role?: string | null | undefined;
 }, {
-    role?: string | undefined;
     email: string;
-}, {
     role?: string | undefined;
+}, {
     email: string;
+    role?: string | undefined;
 }>, Record<string, any> | undefined>;
 /**
  * Criação de role no catálogo: `name` obrigatório (o formato — uppercase +

package/build/src/host/bot_protection.d.ts

@@ -98,7 +98,7 @@ export interface BotProtectionWidget {
  *   - `g-recaptcha-response`  (Google reCAPTCHA)
  *   - `authkit-bot-token`     (genérico, p/ widgets custom)
  */
-export declare const DEFAULT_BOT_TOKEN_FIELDS: readonly ["cf-turnstile-response", "h-captcha-response", "g-recaptcha-response", "authkit-bot-token"];
+export declare const DEFAULT_BOT_TOKEN_FIELDS: readonly ['cf-turnstile-response', 'h-captcha-response', 'g-recaptcha-response', 'authkit-bot-token'];
 /** Config de entrada do bot protection (em `config/authkit.ts`). */
 export interface BotProtectionConfigInput {
     /**