@adonis-agora/authkit-server 0.74.0 → 0.76.0

package/build/src/agents/signer.js

@@ -0,0 +1,70 @@
+import { CompactSign, createLocalJWKSet, importJWK, SignJWT, } from 'jose';
+/** O PACT só admite estes algoritmos nos tokens de delegação e recibos (§5.4). */
+const DELEGATION_ALGS = ['ES256', 'RS256'];
+function algOf(jwk) {
+    if (DELEGATION_ALGS.includes(jwk.alg))
+        return jwk.alg;
+    if (jwk.alg)
+        return null;
+    // JWKS inline sem `alg`: infere pelo tipo da chave.
+    if (jwk.kty === 'EC' && jwk.crv === 'P-256')
+        return 'ES256';
+    if (jwk.kty === 'RSA')
+        return 'RS256';
+    return null;
+}
+/** Lança quando o JWKS não tem nenhuma chave que possa assinar tokens de delegação. */
+export function assertDelegationSigningKey(jwks) {
+    if (!jwks.keys.some((k) => algOf(k) !== null)) {
+        throw new Error('authkit: personalAgents.delegation exige uma chave ES256 ou RS256 no keystore (PACT §5.4). Configure `jwks.algorithm` como RS256 ou ES256.');
+    }
+}
+/**
+ * Signer sobre o keystore do IdP: a primeira chave ES256/RS256 do JWKS assina
+ * (a primeira é a corrente após uma rotação); o JWKS público inteiro verifica,
+ * então tokens assinados antes de uma rotação continuam válidos no período de
+ * graça. Lê a fonte a cada chamada — rotação ao vivo não exige restart.
+ */
+export function keystoreSigner(source) {
+    const imported = new Map();
+    let localSet = null;
+    const current = async () => {
+        const jwk = source.signingJwks.keys.find((k) => algOf(k) !== null);
+        if (!jwk) {
+            throw new Error('authkit: personal agents exigem uma chave ES256 ou RS256 no keystore (PACT §5.4). Configure `jwks.algorithm` como RS256 ou ES256.');
+        }
+        const alg = algOf(jwk);
+        const cacheKey = `${jwk.kid ?? ''}:${alg}`;
+        let key = imported.get(cacheKey);
+        if (!key) {
+            key = importJWK(jwk, alg);
+            imported.set(cacheKey, key);
+        }
+        return { key: await key, alg, kid: jwk.kid };
+    };
+    return {
+        algorithms: [...DELEGATION_ALGS],
+        async signJwt(payload, { issuedAt, expiresIn }) {
+            const { key, alg, kid } = await current();
+            const iat = Math.floor(issuedAt.getTime() / 1000);
+            return new SignJWT(payload)
+                .setProtectedHeader({ alg, typ: 'JWT', ...(kid ? { kid } : {}) })
+                .setIssuedAt(iat)
+                .setExpirationTime(iat + expiresIn)
+                .sign(key);
+        },
+        async signJson(value) {
+            const { key, alg, kid } = await current();
+            return new CompactSign(new TextEncoder().encode(JSON.stringify(value)))
+                .setProtectedHeader({ alg, ...(kid ? { kid } : {}) })
+                .sign(key);
+        },
+        keySet() {
+            const jwks = source.publicJwks;
+            if (!localSet || localSet.jwks !== jwks) {
+                localSet = { jwks, set: createLocalJWKSet(jwks) };
+            }
+            return localSet.set;
+        },
+    };
+}

package/build/src/audit/audit_sink.d.ts

@@ -8,7 +8,7 @@
  * varre os `audit.record({ type: ... })` do `src/` e falha quando um evento
  * emitido não está aqui.
  */
-export declare const AUDIT_EVENT_TYPES: readonly ['login.success', 'login.failure', 'signup', 'password_reset.issued', 'password_reset.consumed', 'pat.issued', 'pat.revoked', 'pat.used', 'impersonation', 'impersonation.panel_viewed', 'impersonation.stopped', 'mfa.enabled', 'mfa.disabled', 'mfa.recovery_codes_regenerated', 'account.locked', 'passkey.registered', 'passkey.removed', 'email_verification.issued', 'email_verification.consumed', 'client.created', 'client.updated', 'client.deleted', 'session.revoked_all', 'password.changed', 'password.rehashed', 'email.change_requested', 'email.changed', 'login.new_ip_notified', 'login.new_device', 'login.otp_sent', 'login.otp_verified', 'login.otp_failed', 'login.otp_invalidated', 'bot_protection.rejected', 'grant.revoked_by_user', 'user.created', 'user.password_reset_sent', 'user.disabled', 'user.enabled', 'user.deleted', 'profile.updated', 'account.deleted', 'account.exported', 'keys.rotated', 'organization.created', 'organization.updated', 'organization.deleted', 'organization.member_added', 'organization.member_removed', 'organization.member_role_changed', 'organization.member_role_updated', 'organization.switched', 'organization.deactivated', 'organization.invitation_sent', 'organization.invitation_accepted', 'organization.invitation_revoked', 'email_change.requested', 'email_change.confirmed', 'email_change.cancelled', 'security_notice.sent', 'settings.updated', 'maintenance.enabled', 'maintenance.disabled', 'trusted_device.revoked', 'password.expired_change_forced', 'otp.locked', 'otp.unlocked', 'otp.unlock_failed', 'sudo.confirmed', 'session.single_enforced', 'account.expired_login_blocked', 'account.expiration_warned', 'login.magic_link_sent', 'session.revoked', 'account.signed_out_all', 'client.secret_regenerated', 'roles_catalog.updated'];
+export declare const AUDIT_EVENT_TYPES: readonly ['login.success', 'login.failure', 'signup', 'password_reset.issued', 'password_reset.consumed', 'pat.issued', 'pat.revoked', 'pat.used', 'impersonation', 'impersonation.panel_viewed', 'impersonation.stopped', 'mfa.enabled', 'mfa.disabled', 'mfa.recovery_codes_regenerated', 'account.locked', 'passkey.registered', 'passkey.removed', 'email_verification.issued', 'email_verification.consumed', 'client.created', 'client.updated', 'client.deleted', 'session.revoked_all', 'password.changed', 'password.rehashed', 'email.change_requested', 'email.changed', 'login.new_ip_notified', 'login.new_device', 'login.otp_sent', 'login.otp_verified', 'login.otp_failed', 'login.otp_invalidated', 'bot_protection.rejected', 'grant.revoked_by_user', 'user.created', 'user.password_reset_sent', 'user.disabled', 'user.enabled', 'user.deleted', 'profile.updated', 'account.deleted', 'account.exported', 'keys.rotated', 'organization.created', 'organization.updated', 'organization.deleted', 'organization.member_added', 'organization.member_removed', 'organization.member_role_changed', 'organization.member_role_updated', 'organization.switched', 'organization.deactivated', 'organization.invitation_sent', 'organization.invitation_accepted', 'organization.invitation_revoked', 'email_change.requested', 'email_change.confirmed', 'email_change.cancelled', 'security_notice.sent', 'settings.updated', 'maintenance.enabled', 'maintenance.disabled', 'trusted_device.revoked', 'password.expired_change_forced', 'otp.locked', 'otp.unlocked', 'otp.unlock_failed', 'sudo.confirmed', 'session.single_enforced', 'account.expired_login_blocked', 'account.expiration_warned', 'login.magic_link_sent', 'session.revoked', 'account.signed_out_all', 'client.secret_regenerated', 'roles_catalog.updated', 'agent.delegation_approved', 'agent.delegation_denied', 'agent.grant_revoked'];
 /** Tipos de eventos de auditoria relevantes para segurança emitidos pelo IdP. */
 export type AuditEventType = (typeof AUDIT_EVENT_TYPES)[number];
 /**

package/build/src/audit/audit_sink.js

@@ -108,4 +108,9 @@ export const AUDIT_EVENT_TYPES = [
     'account.signed_out_all',
     'client.secret_regenerated',
     'roles_catalog.updated',
+    // Personal agents (PACT §5): o usuário aprovou/negou a delegação pedida por um
+    // agente, ou revogou um grant no console. `clientId` = issuer do agente.
+    'agent.delegation_approved',
+    'agent.delegation_denied',
+    'agent.grant_revoked',
 ];

package/build/src/controllers/authorization_server_metadata_controller.d.ts

@@ -0,0 +1,10 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * Metadata do servidor de autorização no caminho da RFC 8414 §3.1: com o issuer em
+ * `https://app/oidc`, o documento fica em `https://app/.well-known/oauth-authorization-server/oidc`
+ * — onde os clientes MCP o procuram primeiro. O provider só o serve sob o próprio mount
+ * (`/oidc/.well-known/...`); aqui a requisição é reescrita para lá.
+ */
+export default class AuthorizationServerMetadataController {
+    handle(ctx: HttpContext): Promise<void>;
+}

package/build/src/controllers/authorization_server_metadata_controller.js

@@ -0,0 +1,20 @@
+/**
+ * Metadata do servidor de autorização no caminho da RFC 8414 §3.1: com o issuer em
+ * `https://app/oidc`, o documento fica em `https://app/.well-known/oauth-authorization-server/oidc`
+ * — onde os clientes MCP o procuram primeiro. O provider só o serve sob o próprio mount
+ * (`/oidc/.well-known/...`); aqui a requisição é reescrita para lá.
+ */
+export default class AuthorizationServerMetadataController {
+    async handle(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const req = ctx.request.request;
+        const res = ctx.response.response;
+        const issuerPath = new URL(service.config.issuer).pathname.replace(/\/+$/, '');
+        req.url = `${issuerPath}/.well-known/oauth-authorization-server`;
+        return new Promise((resolve) => {
+            res.on('finish', resolve);
+            res.on('close', resolve);
+            service.callback(req, res);
+        });
+    }
+}

package/build/src/define_config.d.ts

@@ -2,6 +2,7 @@ import type { AccessTokenFormat, AccessTokensConfig, ClientConfig, JwksConfig, K
 import type { HttpContext } from '@adonisjs/core/http';
 import type { AccountStore, AuthAccount } from './accounts/account_store.js';
 import { type AdapterFactory, adapters, type OidcAdapterClass } from './adapters/factory.js';
+import { type PersonalAgentsConfigInput, type ResolvedPersonalAgentsConfig } from './agents/config.js';
 import type { AuditSink } from './audit/audit_sink.js';
 import { type EventsConfigInput } from './events/dispatcher.js';
 import { type BotProtectionConfigInput, type ResolvedBotProtectionConfig } from './host/bot_protection.js';
@@ -13,6 +14,7 @@ import { type OtpLoginConfigInput, type ResolvedOtpLoginConfig } from './host/ot
 import type { AuthHostOptions } from './host/register_auth_host.js';
 import type { SudoMethod } from './host/sudo/types.js';
 import { type ResolvedTrustedDevicesConfig, type TrustedDevicesConfigInput } from './host/trusted_device.js';
+import { type McpOAuthConfigInput, type ResolvedMcpOAuthConfig } from './mcp/mcp_oauth.js';
 import type { PatStore } from './pat/pat_store.js';
 import { type RedirectUriPolicy, type ResolvedRedirectUriPolicy, type ValidateRegistrationHook } from './provider/registration_policy.js';
 export type { AuthAccount };
@@ -622,11 +624,19 @@ export interface AdminConfigInput {
      * não altera mais o valor.
      */
     impersonation?: boolean;
+    /**
+     * Permite impersonar uma conta que também tem um dos `roles` de admin. Com
+     * `false`, o token-exchange recusa alvo admin (`invalid_grant`): um admin não
+     * assume a identidade de outro. Default: **`true`** (back-compat; virar o
+     * default é decisão de major, mesma regra de `impersonation`).
+     */
+    impersonateAdmins?: boolean;
 }
 export interface ResolvedAdminConfig {
     enabled: boolean;
     roles: string[];
     impersonation: boolean;
+    impersonateAdmins: boolean;
 }
 export declare function resolveAdmin(input?: AdminConfigInput): ResolvedAdminConfig;
 /**
@@ -967,6 +977,14 @@ export interface AuthServerConfigInput {
     dynamicRegistration?: DynamicRegistrationConfigInput;
     /** Device Authorization Grant (RFC 8628). Default: desligado. */
     deviceFlow?: DeviceFlowConfigInput;
+    /**
+     * Personal agents (PACT — https://openpactprotocol.org): plataformas de agente
+     * que falam com este app em nome de um usuário. Identidade por JWT assinado
+     * pelo agente (JWKS) e, com `delegation`, consentimento do usuário via device
+     * flow para o agente agir na conta dele dentro de scopes do app. Default:
+     * desligado.
+     */
+    personalAgents?: PersonalAgentsConfigInput;
     /** Uploads (avatar) via o `@adonisjs/drive` do app. Default: drive default, 5MB. */
     uploads?: UploadsConfigInput;
     /** DPoP — sender-constrained tokens (RFC 9449). Default: desligado. */
@@ -1016,6 +1034,14 @@ export interface AuthServerConfigInput {
      * `resources` mapeia resource indicators (RFC 8707) para audiences/scopes/formato/TTL por API.
      */
     accessTokens?: AccessTokensConfig;
+    /**
+     * Login OAuth de clientes MCP (Claude Code, Claude, ChatGPT, VS Code, Cursor): `true` liga o
+     * registro dinâmico restrito aos redirects deles, o refresh token desses clientes e os
+     * `resource` dos servidores MCP — os de `resources` e os que se registram em runtime (o MCP do
+     * `@adonis-agora/agent`). Um `dynamicRegistration` declarado continua mandando no registro.
+     * Ver `src/mcp/mcp_oauth.ts`. Default: desligado.
+     */
+    mcp?: boolean | McpOAuthConfigInput;
     /**
      * Console admin do IdP (B6). Default: desligado.
      *
@@ -1048,11 +1074,13 @@ export interface AuthServerConfigInput {
      */
     resolveGeo?: ResolveGeo;
     /**
-     * Gestão automática do schema das OITO tabelas do authkit:
+     * Gestão automática do schema das ONZE tabelas do authkit:
      * `authkit_oidc_payloads`, `auth_settings`, `auth_password_history`,
-     * `auth_mfa`, `auth_session_revocations` e as três de organizations
+     * `auth_mfa`, `auth_session_revocations`, as três de organizations
      * (`auth_organizations`, `auth_organization_members`,
-     * `auth_organization_invitations`). Ver `TABLES` em `schema/ensure.ts` — a
+     * `auth_organization_invitations`) e as três de personal agents
+     * (`auth_agent_device_codes`, `auth_agent_grants`,
+     * `auth_agent_refresh_tokens`). Ver `TABLES` em `schema/ensure.ts` — a
      * lista aqui existe para o leitor, mas quem manda é aquele array.
      *
      * FORA desta gestão: `authkit_keystore`, criada sob demanda pelo
@@ -1206,6 +1234,8 @@ export interface ResolvedServerConfig {
     dynamicRegistration: ResolvedDynamicRegistrationConfig;
     /** Device Authorization Grant resolvido (default desligado). */
     deviceFlow: ResolvedDeviceFlowConfig;
+    /** Personal agents resolvido (undefined = desligado). */
+    personalAgents?: ResolvedPersonalAgentsConfig;
     /** Uploads resolvido (avatar via drive do app; sempre presente). */
     uploads: ResolvedUploadsConfig;
     /** DPoP resolvido (default desligado). */
@@ -1228,6 +1258,7 @@ export interface ResolvedServerConfig {
     registration: ResolvedRegistrationConfig;
     /** Access Tokens resolvido (RFC 9068; default opaque). */
     accessTokens: ResolvedAccessTokensConfig;
+    mcp: ResolvedMcpOAuthConfig;
     /** Console admin resolvido (sempre presente; default desligado). */
     admin: ResolvedAdminConfig;
     /** Admin REST API resolvida (sempre presente; default desligada). */

package/build/src/define_config.js

@@ -1,5 +1,7 @@
 import { configProvider } from '@adonisjs/core';
 import { adapters } from './adapters/factory.js';
+import { resolvePersonalAgentsConfig, } from './agents/config.js';
+import { assertDelegationSigningKey } from './agents/signer.js';
 import { composeAuditSink, resolveEvents } from './events/dispatcher.js';
 import { resolveBotProtection, } from './host/bot_protection.js';
 import { resolveBranding } from './host/branding.js';
@@ -13,6 +15,7 @@ import { generateJwks } from './keys/jwks_manager.js';
 import { KeystoreCodec } from './keys/keystore_codec.js';
 import { loadEncryptionService } from './keys/keystore_crypto.js';
 import { KeystoreManager, resolveKeystoreVault } from './keys/keystore_manager.js';
+import { mcpClientRegistration, resolveMcpOAuth, } from './mcp/mcp_oauth.js';
 import { OPEN_REGISTRATION_REDIRECT_POLICY, resolveRedirectUriPolicy, } from './provider/registration_policy.js';
 export { adapters };
 const RATE_LIMIT_DEFAULTS = {
@@ -81,6 +84,20 @@ export function resolveDynamicRegistration(input) {
         validateRegistration: input?.validateRegistration,
     };
 }
+/**
+ * O registro dinâmico que `mcp` liga quando o app não declarou o seu: aberto, só para os
+ * redirects dos clientes MCP, pedindo `offline_access` para quem quer refresh token.
+ */
+function mcpDynamicRegistration(mcp) {
+    const resolved = resolveMcpOAuth(mcp);
+    if (!resolved.enabled)
+        return undefined;
+    return {
+        enabled: true,
+        redirectUriPolicy: resolved.redirectUriPolicy,
+        validateRegistration: (metadata) => mcpClientRegistration(metadata),
+    };
+}
 export function resolveDeviceFlow(input) {
     return { enabled: input?.enabled ?? false };
 }
@@ -174,6 +191,7 @@ export function resolveAdmin(input) {
         // Default `true`: preserva o comportamento histórico (grant sempre
         // registrado). Ver o docblock de `AdminConfigInput.impersonation`.
         impersonation: input?.impersonation !== false,
+        impersonateAdmins: input?.impersonateAdmins !== false,
     };
 }
 /** Lê API keys de `AUTHKIT_ADMIN_API_KEY` (uma ou várias, separadas por vírgula). */
@@ -316,6 +334,20 @@ export function defineConfig(config) {
         else {
             jwks = { keys: jwksConfig.keys ?? [] };
         }
+        // Personal agents com delegação assinam tokens e recibos com este keystore,
+        // e o PACT só admite ES256/RS256 — falha no boot, não na primeira troca de token.
+        const personalAgents = resolvePersonalAgentsConfig(config.personalAgents);
+        if (personalAgents?.delegation)
+            assertDelegationSigningKey(jwks);
+        // Debaixo do mountPath, a rota curinga do oidc-provider (`${mount}/*`)
+        // engoliria as rotas dos agentes — e o `authkitCsrfExceptions` (que isenta
+        // tudo que contém o mountPath) tiraria o CSRF da tela de consentimento.
+        const oidcMount = (config.mountPath ?? '/oidc').replace(/\/+$/, '');
+        if (personalAgents &&
+            oidcMount &&
+            (personalAgents.prefix === oidcMount || personalAgents.prefix.startsWith(`${oidcMount}/`))) {
+            throw new Error(`authkit: personalAgents.prefix "${personalAgents.prefix}" não pode ficar debaixo do mountPath do OIDC ("${oidcMount}").`);
+        }
         // BACKSTOP DE SUDO. Um host cujo `sudo.methods` não tem um único método
         // satisfazível por conta sem senha fica bricado para TODA operação sob
         // `requireSudo` — e hoje isso só se descobre quando um usuário não consegue
@@ -404,8 +436,9 @@ export function defineConfig(config) {
             // top-level não os fornece — consumidor declara UMA vez. Top-level ainda vence.
             mfaIssuer: effectiveMfaIssuer,
             webauthn: resolveWebauthn(config.issuer, effectiveMfaIssuer, config.webauthn ?? config.accountStore?.__webauthn),
-            dynamicRegistration: resolveDynamicRegistration(config.dynamicRegistration),
+            dynamicRegistration: resolveDynamicRegistration(config.dynamicRegistration ?? mcpDynamicRegistration(config.mcp)),
             deviceFlow: resolveDeviceFlow(config.deviceFlow),
+            personalAgents,
             uploads: resolveUploads(config.uploads),
             dpop: resolveDpop(config.dpop),
             par: resolvePar(config.par),
@@ -423,6 +456,7 @@ export function defineConfig(config) {
                 : undefined,
             registration: resolveRegistration(config.registration),
             accessTokens: resolveAccessTokens(config.issuer, config.accessTokens),
+            mcp: resolveMcpOAuth(config.mcp),
             admin: resolveAdmin(config.admin),
             adminApi: resolveAdminApi(config.adminApi),
             organizations: resolveOrganizations(config.organizations),

package/build/src/host/access_token_verifier.d.ts

@@ -18,6 +18,13 @@ export interface VerifiedAccessToken {
     exp: number | null;
     /** Id do token (`jti`), quando conhecido. */
     jti: string | null;
+    /**
+     * Quem está AGINDO quando o token é de impersonation (RFC 8693 `act.sub`, o
+     * admin que trocou o próprio token pelo do `sub`). `null` num token comum.
+     * É o que deixa o resource server tratar a request como impersonation
+     * (`impersonationState`/`realAccountId`) em vez de confundi-la com o alvo.
+     */
+    actor: string | null;
 }
 /**
  * Estratégia de verificação de access token plugável no `oidcBearerGuard`.

package/build/src/host/access_token_verifier.js

@@ -10,6 +10,11 @@ function rejectedJwt(error) {
         !(error instanceof joseErrors.JWKSTimeout) &&
         !(error instanceof joseErrors.JWKSInvalid));
 }
+/** `act.sub` (RFC 8693 §4.1) de um payload/`extra`/introspecção, ou `null`. */
+function actorOf(source) {
+    const act = source?.act;
+    return typeof act?.sub === 'string' && act.sub ? act.sub : null;
+}
 /** `header.payload.signature` em base64url — o formato compacto de um JWS. */
 const JWS_COMPACT = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
 function looksLikeJwt(token) {
@@ -44,6 +49,7 @@ function fromJwtPayload(payload) {
         audience: toAudience(payload.aud),
         exp: typeof payload.exp === 'number' ? payload.exp : null,
         jti: typeof payload.jti === 'string' ? payload.jti : null,
+        actor: actorOf(payload),
     };
 }
 /**
@@ -121,6 +127,7 @@ export function inProcessAccessTokenVerifier(resolveIssuer) {
                 audience: toAudience(at.aud),
                 exp: typeof at.exp === 'number' ? at.exp : null,
                 jti: typeof at.jti === 'string' ? at.jti : null,
+                actor: actorOf(at.extra),
             };
         },
         async issue(accountId, options = {}) {
@@ -212,6 +219,7 @@ export function remoteAccessTokenVerifier(options) {
             audience: toAudience(body.aud),
             exp: typeof body.exp === 'number' ? body.exp : null,
             jti: typeof body.jti === 'string' ? body.jti : null,
+            actor: actorOf(body),
         };
     };
     return {

package/build/src/host/account_api/account_api_controller.d.ts

@@ -119,6 +119,7 @@ export default class AccountApiController {
         grants: number;
         accessTokens: number;
         refreshTokens: number;
+        agentGrants?: number;
         ok: boolean;
     }>;
     /**
@@ -133,6 +134,7 @@ export default class AccountApiController {
         grants: number;
         accessTokens: number;
         refreshTokens: number;
+        agentGrants?: number;
         ok: boolean;
         signedOut: boolean;
     }>;
@@ -141,6 +143,7 @@ export default class AccountApiController {
         supported: boolean;
         apps: {
             clientId: string;
+            name: string;
             accessTokens: number;
             refreshTokens: number;
         }[];
@@ -151,6 +154,15 @@ export default class AccountApiController {
         grants: number;
         accessTokens: number;
         refreshTokens: number;
+        agentGrants?: number;
+        ok: boolean;
+    }>;
+    /** Personal agents com delegação ativa na conta (scopes aprovados). */
+    listAgents(ctx: HttpContext): Promise<void | {
+        agents: import("../../agents/delegation_service.ts").DelegationGrantSummary[];
+    }>;
+    /** Revoga a delegação de um personal agent (efeito imediato nos tokens). */
+    revokeAgent(ctx: HttpContext): Promise<void | {
         ok: boolean;
     }>;
     /** Status completo do MFA: TOTP + passkeys + recovery. */

package/build/src/host/account_api/account_api_controller.js

@@ -27,8 +27,10 @@
  *   GET  /account/api/orgs/:id             → detalhe de org (requer membership)
  *   GET  /account/api/orgs/invitations     → convites pendentes
  */
+import { clientDisplayNames } from '../client_names.js';
 import '../augmentations.js';
 import { supportsAccountSecurity, supportsLoginMethodsPreference, supportsMagicLink, supportsOrganizations, supportsPasskeys, supportsProfile, supportsRecoveryCodeCount, supportsRecoveryCodeRegeneration, } from '../../accounts/account_store.js';
+import { personalAgentsFor } from '../../agents/runtime.js';
 import { PasswordPolicyError } from '../../password/password_manager.js';
 import { accountPath } from '../account_paths.js';
 import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
@@ -575,12 +577,14 @@ export default class AccountApiController {
             return { supported: false, apps: [] };
         }
         const grants = await adminSessions.listGrants(userId);
+        const names = await clientDisplayNames(service, grants.map((g) => g.clientId).filter((id) => !!id));
         return {
             supported: true,
             apps: grants
                 .filter((g) => !!g.clientId)
                 .map((g) => ({
                 clientId: g.clientId,
+                name: names.get(g.clientId) ?? g.clientId,
                 accessTokens: g.accessTokens,
                 refreshTokens: g.refreshTokens,
             })),
@@ -609,6 +613,42 @@ export default class AccountApiController {
         });
         return { ok: true, ...result };
     }
+    // ─── GET /account/api/agents ─────────────────────────────────────────────
+    /** Personal agents com delegação ativa na conta (scopes aprovados). */
+    async listAgents(ctx) {
+        const runtime = await personalAgentsFor(ctx);
+        if (!runtime?.delegation) {
+            return ctx.response
+                .status(404)
+                .send(apiErr('capability_unsupported', 'Personal agent delegation is not enabled.'));
+        }
+        const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        const grants = await runtime.delegation.listGrants(userId);
+        return { agents: grants };
+    }
+    // ─── DELETE /account/api/agents/:id ──────────────────────────────────────
+    /** Revoga a delegação de um personal agent (efeito imediato nos tokens). */
+    async revokeAgent(ctx) {
+        const runtime = await personalAgentsFor(ctx);
+        if (!runtime?.delegation) {
+            return ctx.response
+                .status(404)
+                .send(apiErr('capability_unsupported', 'Personal agent delegation is not enabled.'));
+        }
+        const service = await ctx.containerResolver.make('authkit.server');
+        const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        const grantId = ctx.request.param('id');
+        if (!(await runtime.delegation.revokeGrant(userId, grantId))) {
+            return ctx.response.status(404).send(apiErr('not_found', 'Grant not found.'));
+        }
+        await service.config.audit?.record({
+            type: 'agent.grant_revoked',
+            accountId: userId,
+            ip: ctx.request.ip?.() ?? null,
+            metadata: { grantId },
+        });
+        return { ok: true };
+    }
     // ─── GET /account/api/mfa ────────────────────────────────────────────────
     /** Status completo do MFA: TOTP + passkeys + recovery. */
     async mfaStatus(ctx) {

package/build/src/host/admin_api/dto.d.ts

@@ -49,7 +49,7 @@ export declare function grantDto(grant: AdminGrant): {
 };
 export declare function auditDto(event: StoredAuditEvent): {
     id: string;
-    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.locked" | "account.signed_out_all" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "impersonation.stopped" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "mfa.recovery_codes_regenerated" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
+    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.locked" | "account.signed_out_all" | "agent.delegation_approved" | "agent.delegation_denied" | "agent.grant_revoked" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "impersonation.stopped" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "mfa.recovery_codes_regenerated" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
     accountId: string | null;
     email: string | null;
     clientId: string | null;

package/build/src/host/admin_sessions_service.d.ts

@@ -45,6 +45,8 @@ export interface RevokeResult {
     grants: number;
     accessTokens: number;
     refreshTokens: number;
+    /** Delegações de personal agents revogadas junto (ausente quando nenhuma). */
+    agentGrants?: number;
 }
 export declare class AdminSessionsService {
     #private;

package/build/src/host/admin_sessions_service.js

@@ -1,5 +1,6 @@
 import { getBootedApp } from '../../services/booted_app.js';
 import { pickModelAdapterClass } from '../adapters/factory.js';
+import { buildPersonalAgentsRuntime } from '../agents/runtime.js';
 import { normalizeActiveOrg } from './active_org_cookie.js';
 /**
  * Serviço de inspeção/revogação das SESSÕES e GRANTS ativos de uma conta.
@@ -23,7 +24,9 @@ export class AdminSessionsService {
     #accountStore;
     /** Conexão Lucid das tabelas authkit (schema `auth`) — onde vive auth_session_revocations. */
     #schemaConnection;
+    #oidc;
     constructor(oidc) {
+        this.#oidc = oidc;
         this.#AdapterClass = oidc.config.AdapterClass;
         // `Session`/`Grant`/tokens vivem no adapter da sessão quando `session:`
         // está configurado (default: o mesmo do `AdapterClass`). `??` cobre
@@ -81,6 +84,17 @@ export class AdminSessionsService {
             await this.#logRevocationFailure(accountId, error);
         }
     }
+    /**
+     * Revogação total também corta os personal agents: "sair de todas as sessões",
+     * reset de senha, a ação do admin e a exclusão de conta não podem deixar um
+     * agente agindo na conta. Sem `personalAgents.delegation` é no-op — e aí nem
+     * resolve o banco. Diferente do `recordSubRevocation`, uma falha AQUI propaga:
+     * não há outra camada que corte esses tokens.
+     */
+    async #revokeAgentGrants(accountId) {
+        const runtime = await buildPersonalAgentsRuntime(this.#oidc, () => getBootedApp().container.make('lucid.db'));
+        return runtime?.delegation ? runtime.delegation.revokeAllGrants(accountId) : 0;
+    }
     /**
      * Loga (best-effort, sem nunca lançar) a falha de {@link recordSubRevocation}. Prefere o
      * `logger` do container; se ele não puder ser resolvido (ex.: o próprio `getBootedApp()` foi o
@@ -240,11 +254,13 @@ export class AdminSessionsService {
         // no default (`now`) — não há sessão nova a proteger nesse caminho.
         const cutoff = typeof preserved?.loginTs === 'number' ? new Date((preserved.loginTs - 1) * 1000) : undefined;
         await this.recordSubRevocation(accountId, cutoff);
+        const agentGrants = await this.#revokeAgentGrants(accountId);
         return {
             sessions: sessionsToRevoke.length,
             grants: grants.length,
             accessTokens,
             refreshTokens,
+            ...(agentGrants > 0 ? { agentGrants } : {}),
         };
     }
     /**
@@ -277,11 +293,13 @@ export class AdminSessionsService {
         }
         // Revogação total → propaga p/ clients cookie-based via tabela compartilhada (instantâneo).
         await this.recordSubRevocation(accountId);
+        const agentGrants = await this.#revokeAgentGrants(accountId);
         return {
             sessions: sessions.length,
             grants: grants.length,
             accessTokens,
             refreshTokens,
+            ...(agentGrants > 0 ? { agentGrants } : {}),
         };
     }
     /**

package/build/src/host/auth_host_config.d.ts

@@ -35,6 +35,10 @@ export interface AuthHostRuntimeConfig {
      * Ver `deriveLockedRouteOptions`.
      */
     lockedRouteOptions?: PolicyRouteOption[];
+    /** Personal agents ligados → prefixo das rotas deles (`/agents`). */
+    personalAgents?: {
+        prefix: string;
+    };
     /**
      * API headless (Clerk-style). Presente quando o host a declarou — o provider o
      * stash no boot para `registerAuthHost` montar as rotas sem reler o config inteiro.

package/build/src/host/bearer_account.d.ts

@@ -7,3 +7,20 @@ export declare function clearBearerAccountId(ctx: object): void;
  * `oidcBearerGuard` autenticou (ainda) a request.
  */
 export declare function bearerAccountId(ctx: object): string | null;
+/**
+ * Impersonation carregada pelo access token bearer desta request: o ator
+ * (`act.sub`, o admin) e a expiração do token. Gravada pelo `oidcBearerGuard`
+ * só quando o token é de impersonation; lida por `impersonationState` e
+ * `realAccountId` quando não há sessão.
+ */
+export interface BearerImpersonation {
+    actorId: string;
+    /** Epoch em segundos do `exp` do token, quando conhecido. */
+    exp: number | null;
+    /** `jti` do token trocado, quando conhecido (correlaciona com a auditoria). */
+    jti: string | null;
+}
+/** Registra que o token bearer desta request é de impersonation. */
+export declare function setBearerImpersonation(ctx: object, value: BearerImpersonation): void;
+/** Impersonation do token bearer desta request, ou `null`. */
+export declare function bearerImpersonation(ctx: object): BearerImpersonation | null;

package/build/src/host/bearer_account.js

@@ -11,6 +11,7 @@
  * barrel) depende dele.
  */
 const bearerAccounts = new WeakMap();
+const bearerImpersonations = new WeakMap();
 /** Registra a conta autenticada via bearer nesta request. */
 export function setBearerAccountId(ctx, accountId) {
     bearerAccounts.set(ctx, accountId);
@@ -18,6 +19,7 @@ export function setBearerAccountId(ctx, accountId) {
 /** Esquece a conta bearer desta request (falha de autenticação). */
 export function clearBearerAccountId(ctx) {
     bearerAccounts.delete(ctx);
+    bearerImpersonations.delete(ctx);
 }
 /**
  * Id da conta autenticada via bearer nesta request, ou `null` quando nenhum
@@ -26,3 +28,11 @@ export function clearBearerAccountId(ctx) {
 export function bearerAccountId(ctx) {
     return bearerAccounts.get(ctx) ?? null;
 }
+/** Registra que o token bearer desta request é de impersonation. */
+export function setBearerImpersonation(ctx, value) {
+    bearerImpersonations.set(ctx, value);
+}
+/** Impersonation do token bearer desta request, ou `null`. */
+export function bearerImpersonation(ctx) {
+    return bearerImpersonations.get(ctx) ?? null;
+}

package/build/src/host/client_names.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Nome de exibição de cada client: o `client_name` que ele registrou (um cliente MCP registra o
+ * seu, ex.: "Claude Code"), senão o próprio `client_id`. Client que sumiu do adapter → o id.
+ */
+export declare function clientDisplayNames(service: {
+    provider: {
+        Client: {
+            find(id: string): Promise<any>;
+        };
+    };
+}, clientIds: string[]): Promise<Map<string, string>>;