@adonis-agora/authkit-server 0.76.0 → 0.78.0

package/build/src/host/register_auth_host.js

@@ -8,6 +8,7 @@ import { adminApiGuard } from './admin_api/admin_api_guard.js';
 import { normalizeAdminApiPrefix, normalizeAdminPrefix, setAdminApiPrefix, setAdminPrefix, } from './admin_prefix.js';
 import { getAuthHostConfig, markAuthHostAutoMounted, wasAuthHostAutoMounted, } from './auth_host_config.js';
 import { ensureConsoleSession } from './idp_session_bridge.js';
+import { POPPY_WEB_SESSION_KEY } from './poppy_session_key.js';
 import { createAuthThrottles } from './rate_limit.js';
 import { redirectExact } from './redirect_exact.js';
 import { requestPathWithQuery } from './request_url.js';
@@ -113,7 +114,16 @@ function buildLoginRedirect(ctx, extra) {
  * classe NÃO era aplicada em runtime num grupo, deixando /account/tokens e
  * /account/mfa acessíveis sem sessão.
  */
+/** A sessão é do navegador de um personal agent Poppy (§5)? */
+function isPoppyBrowser(ctx) {
+    const marker = ctx.session?.get?.(POPPY_WEB_SESSION_KEY);
+    return typeof marker === 'object' && marker !== null && typeof marker.sessionId === 'string';
+}
 const accountGuard = async (ctx, next) => {
+    // O navegador de um personal agent Poppy (§5) não entra no console de conta nem
+    // nas telas de consentimento: a sessão é do agente, não do usuário.
+    if (isPoppyBrowser(ctx))
+        return ctx.response.status(403).send('');
     // Sessão do console — ou, com `accountSession.acceptIdpSession`, a do IdP (SSO).
     if (!(await ensureConsoleSession(ctx))) {
         return redirectExact(ctx.response, buildLoginRedirect(ctx));
@@ -145,6 +155,8 @@ export const adminGuard = async (ctx, next) => {
     if (!cfg.admin.enabled) {
         return ctx.response.notFound();
     }
+    if (isPoppyBrowser(ctx))
+        return ctx.response.status(403).send('');
     // Com `accountSession.acceptIdpSession`, a sessão do IdP também abre o console.
     await ensureConsoleSession(ctx);
     const accountId = ctx.session?.get(ACCOUNT_SESSION_KEY);
@@ -187,6 +199,8 @@ const C = {
     accountConfirm: () => import('./controllers/account_confirm_controller.js'),
     agentOAuth: () => import('./controllers/agent_oauth_controller.js'),
     agentConsent: () => import('./controllers/agent_consent_controller.js'),
+    poppy: () => import('./controllers/poppy_controller.js'),
+    poppyConsent: () => import('./controllers/poppy_consent_controller.js'),
     webauthnAsset: () => import('./controllers/webauthn_asset_controller.js'),
     logoutAsset: () => import('./controllers/logout_asset_controller.js'),
     passkeyAutofillAsset: () => import('./controllers/passkey_autofill_asset_controller.js'),
@@ -441,6 +455,18 @@ export function registerAuthHost(router, opts = {}) {
     router.post('/auth/interaction/:uid/identifier', [C.interaction, 'identifier']);
     withLogin(router.post('/auth/interaction/:uid/login', [C.interaction, 'login']));
     withLogin(router.post('/auth/interaction/:uid/mfa', [C.interaction, 'mfaVerify']));
+    const customMfaBeginRoute = router.post('/auth/interaction/:uid/mfa/custom/:method/begin', [
+        C.interaction,
+        'customMfaBegin',
+    ]);
+    withLogin(customMfaBeginRoute);
+    customMfaBeginRoute.as('authkit.mfa.custom.begin');
+    const customMfaVerifyRoute = router.post('/auth/interaction/:uid/mfa/custom/:method/verify', [
+        C.interaction,
+        'customMfaVerify',
+    ]);
+    withLogin(customMfaVerifyRoute);
+    customMfaVerifyRoute.as('authkit.mfa.custom.verify');
     // Troca de senha obrigatória quando a senha expirou (password expiration gate).
     withLogin(router.post('/auth/interaction/:uid/password-expired', [
         C.interaction,
@@ -496,6 +522,52 @@ export function registerAuthHost(router, opts = {}) {
         })
             .use([accountGuard]);
     }
+    // Personal Agent Protocol (Poppy): descoberta, authorization server (token,
+    // revogação, device authorization), Mediated Sign-In e sessão de navegador —
+    // server-to-server ou POST cross-site do navegador do agente (sem CSRF, ver
+    // `authkitCsrfExceptions`). As telas do usuário (authorize/device) exigem a
+    // sessão de conta e mantêm o CSRF.
+    const poppyPrefix = hostCfg?.personalAgents?.poppyPrefix;
+    if (poppyPrefix) {
+        // Nomes explícitos: o Router nomeia pela dupla controller.método, e as duas URLs da metadata
+        // (RFC 8414 na raiz e debaixo do issuer) usam o mesmo — "poppy.metadata already exists" no boot.
+        router.get('/.well-known/poppy.json', [C.poppy, 'discovery']).as('authkit.poppy.discovery');
+        router
+            .get(`/.well-known/oauth-authorization-server${poppyPrefix}`, [C.poppy, 'metadata'])
+            .as('authkit.poppy.metadata');
+        router
+            .get(`${poppyPrefix}/.well-known/oauth-authorization-server`, [C.poppy, 'metadata'])
+            .as('authkit.poppy.metadata_under_issuer');
+        router.post(`${poppyPrefix}/oauth/token`, [C.poppy, 'token']).as('authkit.poppy.token');
+        router.post(`${poppyPrefix}/oauth/revoke`, [C.poppy, 'revoke']).as('authkit.poppy.revoke');
+        router
+            .post(`${poppyPrefix}/oauth/device`, [C.poppy, 'deviceAuthorization'])
+            .as('authkit.poppy.device_authorization');
+        // Credenciais e códigos de uso único: throttle por IP (§4.7 exige rate limit).
+        withLogin(router.post(`${poppyPrefix}/sign-in`, [C.poppy, 'mediatedStart']).as('authkit.poppy.sign_in'));
+        withOtpLogin(router
+            .post(`${poppyPrefix}/sign-in/:id`, [C.poppy, 'mediatedCode'])
+            .as('authkit.poppy.sign_in_code'));
+        router
+            .post(`${poppyPrefix}/browser-session`, [C.poppy, 'browserSession'])
+            .as('authkit.poppy.browser_session');
+        router
+            .group(() => {
+            router
+                .get(`${poppyPrefix}/oauth/authorize`, [C.poppyConsent, 'authorize'])
+                .as('authkit.poppy.authorize');
+            router
+                .post(`${poppyPrefix}/oauth/authorize`, [C.poppyConsent, 'decideAuthorization'])
+                .as('authkit.poppy.authorize_decide');
+            withOtpLogin(router
+                .get(`${poppyPrefix}/device`, [C.poppyConsent, 'device'])
+                .as('authkit.poppy.device'));
+            withOtpLogin(router
+                .post(`${poppyPrefix}/device`, [C.poppyConsent, 'decideDevice'])
+                .as('authkit.poppy.device_decide'));
+        })
+            .use([accountGuard]);
+    }
     // Paths do console de conta (configuráveis/localizáveis via `accountRoutes`).
     // As TELAS vêm de `accountPath(key)` (prefixo + segmento configurável); os
     // action-subpaths concatenados (`/password`, `/enroll`, ...) são FIXOS —

package/build/src/host/whatsapp_code_sender.d.ts

@@ -0,0 +1,20 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/** Provider-neutral delivery input. Only the host generates and verifies the OTP. */
+export interface WhatsappCodeInput {
+    phone: string;
+    code: string;
+    locale: string;
+    expiresInSeconds: number;
+    /** Optional host-localized copy for transports that send free-form messages. */
+    text?: string;
+}
+/** Implement this interface to support any WhatsApp provider. Reject on failed delivery. */
+export interface WhatsappCodeSender {
+    sendCode(input: WhatsappCodeInput): Promise<void>;
+}
+/** A configured instance, or an injectable class resolved by the request container. */
+export type WhatsappCodeSenderConstructor = new (...args: never[]) => WhatsappCodeSender;
+export type WhatsappCodeSenderBinding = WhatsappCodeSender | WhatsappCodeSenderConstructor;
+export declare function resolveWhatsappCodeSender(resolver: Pick<HttpContext['containerResolver'], 'make'>, binding: WhatsappCodeSenderBinding): Promise<WhatsappCodeSender>;
+export { MetaWhatsappCodeSender, type MetaWhatsappCodeSenderOptions, } from './whatsapp_senders/meta_whatsapp_code_sender.js';
+export { WhatsmiauCodeSender, type WhatsmiauCodeSenderOptions, } from './whatsapp_senders/whatsmiau_code_sender.js';

package/build/src/host/whatsapp_code_sender.js

@@ -0,0 +1,9 @@
+export async function resolveWhatsappCodeSender(resolver, binding) {
+    const sender = typeof binding === 'function' ? await resolver.make(binding) : binding;
+    if (!sender || typeof sender.sendCode !== 'function') {
+        throw new Error('Invalid WhatsApp code sender: expected sendCode(input)');
+    }
+    return sender;
+}
+export { MetaWhatsappCodeSender, } from './whatsapp_senders/meta_whatsapp_code_sender.js';
+export { WhatsmiauCodeSender, } from './whatsapp_senders/whatsmiau_code_sender.js';

package/build/src/host/whatsapp_senders/http.d.ts

@@ -0,0 +1,5 @@
+/** Never include configuration values in validation errors. */
+export declare function requireString(value: string, field: string): void;
+export declare function recipientPhone(phone: string): string;
+/** Response bodies and fetch causes can contain credentials and OTPs: discard both. */
+export declare function postJson(provider: string, url: URL, headers: Record<string, string>, body: unknown): Promise<void>;

package/build/src/host/whatsapp_senders/http.js

@@ -0,0 +1,33 @@
+/** Never include configuration values in validation errors. */
+export function requireString(value, field) {
+    if (typeof value !== 'string' || !value.trim() || /[\r\n]/.test(value)) {
+        throw new Error(`Invalid WhatsApp sender ${field}`);
+    }
+}
+export function recipientPhone(phone) {
+    if (typeof phone !== 'string' || !/^\+?[1-9]\d{6,14}$/.test(phone)) {
+        throw new Error('Invalid WhatsApp recipient phone');
+    }
+    return phone.replace(/^\+/, '');
+}
+/** Response bodies and fetch causes can contain credentials and OTPs: discard both. */
+export async function postJson(provider, url, headers, body) {
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', ...headers },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(15_000),
+            redirect: 'error',
+        });
+    }
+    catch {
+        throw new Error(`WhatsApp code delivery failed (${provider})`);
+    }
+    // Do not parse or log the body, even when a provider echoes the submitted code.
+    void response.body?.cancel().catch(() => { });
+    if (!response.ok) {
+        throw new Error(`WhatsApp code delivery failed (${provider}, HTTP ${response.status})`);
+    }
+}

package/build/src/host/whatsapp_senders/meta_whatsapp_code_sender.d.ts

@@ -0,0 +1,20 @@
+import type { WhatsappCodeInput, WhatsappCodeSender } from '../whatsapp_code_sender.js';
+export interface MetaWhatsappCodeSenderOptions {
+    accessToken: string;
+    phoneNumberId: string;
+    /** Explicit supported Graph API version, for example v23.0. */
+    apiVersion: string;
+    /** An approved authentication template with an OTP URL button. */
+    templateName: string;
+    /** Overrides the host locale when the template uses a different language. */
+    languageCode?: string;
+}
+/** Meta Cloud API authentication template transport (copy-code / OTP URL button). */
+export declare class MetaWhatsappCodeSender implements WhatsappCodeSender {
+    private readonly accessToken;
+    private readonly endpoint;
+    private readonly templateName;
+    private readonly languageCode?;
+    constructor(options: MetaWhatsappCodeSenderOptions);
+    sendCode(input: WhatsappCodeInput): Promise<void>;
+}

package/build/src/host/whatsapp_senders/meta_whatsapp_code_sender.js

@@ -0,0 +1,51 @@
+import { postJson, recipientPhone, requireString } from './http.js';
+const LANGUAGE_CODES = { 'pt-BR': 'pt_BR', en: 'en_US', es: 'es' };
+/** Meta Cloud API authentication template transport (copy-code / OTP URL button). */
+export class MetaWhatsappCodeSender {
+    accessToken;
+    endpoint;
+    templateName;
+    languageCode;
+    constructor(options) {
+        requireString(options.accessToken, 'accessToken');
+        if (typeof options.apiVersion !== 'string' || !/^v\d+\.\d+$/.test(options.apiVersion)) {
+            throw new Error('Invalid WhatsApp sender apiVersion');
+        }
+        if (typeof options.phoneNumberId !== 'string' || !/^\d+$/.test(options.phoneNumberId)) {
+            throw new Error('Invalid WhatsApp sender phoneNumberId');
+        }
+        if (typeof options.templateName !== 'string' || !/^[a-z0-9_]+$/.test(options.templateName)) {
+            throw new Error('Invalid WhatsApp sender templateName');
+        }
+        if (options.languageCode !== undefined) {
+            requireString(options.languageCode, 'languageCode');
+        }
+        this.endpoint = new URL(`https://graph.facebook.com/${options.apiVersion}/${options.phoneNumberId}/messages`);
+        this.accessToken = options.accessToken;
+        this.templateName = options.templateName;
+        this.languageCode = options.languageCode;
+    }
+    async sendCode(input) {
+        await postJson('Meta', this.endpoint, { Authorization: `Bearer ${this.accessToken}` }, {
+            messaging_product: 'whatsapp',
+            recipient_type: 'individual',
+            to: recipientPhone(input.phone),
+            type: 'template',
+            template: {
+                name: this.templateName,
+                language: {
+                    code: this.languageCode ?? LANGUAGE_CODES[input.locale] ?? input.locale.replace(/-/g, '_'),
+                },
+                components: [
+                    { type: 'body', parameters: [{ type: 'text', text: input.code }] },
+                    {
+                        type: 'button',
+                        sub_type: 'url',
+                        index: '0',
+                        parameters: [{ type: 'text', text: input.code }],
+                    },
+                ],
+            },
+        });
+    }
+}

package/build/src/host/whatsapp_senders/whatsmiau_code_sender.d.ts

@@ -0,0 +1,14 @@
+import type { WhatsappCodeInput, WhatsappCodeSender } from '../whatsapp_code_sender.js';
+export interface WhatsmiauCodeSenderOptions {
+    apiKey: string;
+    instanceName: string;
+    /** Includes the API version path. Defaults to Whatsmiau Cloud's /v2 endpoint. */
+    baseUrl?: string;
+}
+/** Whatsmiau Cloud v2 / Evolution-compatible free-form text transport. */
+export declare class WhatsmiauCodeSender implements WhatsappCodeSender {
+    private readonly apiKey;
+    private readonly endpoint;
+    constructor(options: WhatsmiauCodeSenderOptions);
+    sendCode(input: WhatsappCodeInput): Promise<void>;
+}

package/build/src/host/whatsapp_senders/whatsmiau_code_sender.js

@@ -0,0 +1,36 @@
+import { postJson, recipientPhone, requireString } from './http.js';
+/** Whatsmiau Cloud v2 / Evolution-compatible free-form text transport. */
+export class WhatsmiauCodeSender {
+    apiKey;
+    endpoint;
+    constructor(options) {
+        requireString(options.apiKey, 'apiKey');
+        if (typeof options.instanceName !== 'string' ||
+            !/^[A-Za-z0-9_-]+$/.test(options.instanceName)) {
+            throw new Error('Invalid WhatsApp sender instanceName');
+        }
+        let baseUrl;
+        try {
+            baseUrl = new URL(options.baseUrl ?? 'https://api.whatsmiau.dev/v2');
+        }
+        catch {
+            throw new Error('Invalid WhatsApp sender baseUrl');
+        }
+        if (!['http:', 'https:'].includes(baseUrl.protocol) ||
+            baseUrl.username ||
+            baseUrl.password ||
+            baseUrl.search ||
+            baseUrl.hash) {
+            throw new Error('Invalid WhatsApp sender baseUrl');
+        }
+        baseUrl.pathname = `${baseUrl.pathname.replace(/\/+$/, '')}/message/sendText/${options.instanceName}`;
+        this.endpoint = baseUrl;
+        this.apiKey = options.apiKey;
+    }
+    async sendCode(input) {
+        await postJson('Whatsmiau', this.endpoint, { apikey: this.apiKey }, {
+            number: recipientPhone(input.phone),
+            text: input.text ?? input.code,
+        });
+    }
+}

package/build/src/provider/oidc_service.d.ts

@@ -25,6 +25,11 @@ export declare class OidcService {
     get signingJwks(): {
         keys: Record<string, any>[];
     };
+    /**
+     * @internal Segredo derivado da app key para um uso (`label`) — HMAC dos nonces
+     * DPoP do Poppy, por exemplo. Igual em todas as instâncias, sem expor a chave.
+     */
+    deriveSecret(label: string): Buffer;
     /** Pathname do issuer sem barra final (ex.: `/oidc`). Vazio quando montado na raiz. */
     readonly mountPath: string;
     readonly recorder: MetricsRecorder;

package/build/src/provider/oidc_service.js

@@ -1,4 +1,4 @@
-import { timingSafeEqual } from 'node:crypto';
+import { createHmac, timingSafeEqual } from 'node:crypto';
 import { NoopRecorder } from '@adonis-agora/authkit-core';
 import Koa from 'koa';
 import mount from 'koa-mount';
@@ -41,6 +41,13 @@ export class OidcService {
     get signingJwks() {
         return this.#signingJwks;
     }
+    /**
+     * @internal Segredo derivado da app key para um uso (`label`) — HMAC dos nonces
+     * DPoP do Poppy, por exemplo. Igual em todas as instâncias, sem expor a chave.
+     */
+    deriveSecret(label) {
+        return createHmac('sha256', this.#appKey).update(`authkit:${label}`).digest();
+    }
     /** Pathname do issuer sem barra final (ex.: `/oidc`). Vazio quando montado na raiz. */
     mountPath;
     recorder;
@@ -137,8 +144,12 @@ export class OidcService {
                     claims: async (_use, _scope) => {
                         const base = {
                             sub: user.id,
-                            email: user.email,
-                            email_verified: true,
+                            ...(user.email
+                                ? {
+                                    email: user.email,
+                                    email_verified: (await config.accountStore.isEmailVerified?.(user.id)) ?? false,
+                                }
+                                : {}),
                             name: user.name,
                             picture: user.avatarUrl,
                         };
@@ -321,7 +332,7 @@ export class OidcService {
     /** Verifica client_id + client_secret contra os clients da config (p/ endpoints custom como introspecção de PAT). */
     verifyClientCredentials(clientId, clientSecret) {
         const client = this.#clients.find((c) => c.clientId === clientId);
-        if (!client || !client.clientSecret)
+        if (!client?.clientSecret)
             return false;
         const a = Buffer.from(client.clientSecret);
         const b = Buffer.from(clientSecret);

package/build/src/schema/ensure.js

@@ -295,6 +295,130 @@ const TABLES = [
             created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
         },
     },
+    /*
+     * Personal Agent Protocol (Poppy). Os Account Tokens são grants de
+     * `auth_agent_grants` (prefixo `pgrant_`) com o hash em
+     * `auth_agent_refresh_tokens`; aqui ficam Sessions, Session Tokens, pedidos de
+     * sign-in e os `jti` vistos. Mesmas regras de data das tabelas acima.
+     */
+    {
+        name: 'auth_poppy_sessions',
+        /**
+         * Uma Session: um usuário do agente (`user_id`, opaco) num agente
+         * (`client_id`). `account_id` é a conta a que ficou PRESA ao logar (não troca);
+         * `grant_id` o Account Token com que está logada agora (`null` = deslogada).
+         */
+        create: (t) => {
+            t.string('id').primary();
+            t.string('client_id', 2048).notNullable();
+            t.string('user_id').notNullable();
+            t.string('account_id').nullable().index();
+            t.string('grant_id').nullable().index();
+            t.text('scope').notNullable();
+            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable();
+            t.dateTime('ended_at', { useTz: true, precision: 3 }).nullable();
+            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
+            t.dateTime('updated_at', { useTz: true, precision: 3 }).notNullable();
+        },
+        columns: {
+            client_id: (t) => t.string('client_id', 2048),
+            user_id: (t) => t.string('user_id'),
+            account_id: (t) => t.string('account_id').nullable().index(),
+            grant_id: (t) => t.string('grant_id').nullable().index(),
+            scope: (t) => t.text('scope'),
+            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
+            ended_at: (t) => t.dateTime('ended_at', { useTz: true, precision: 3 }).nullable(),
+            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
+            updated_at: (t) => t.dateTime('updated_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
+    {
+        name: 'auth_poppy_tokens',
+        /** Session Tokens — só o hash. `jkt` = chave DPoP; `null` = Bearer (MCP). */
+        create: (t) => {
+            t.string('token_hash', 64).primary();
+            t.string('session_id').notNullable().index();
+            t.string('client_id', 2048).notNullable();
+            t.string('user_id').notNullable();
+            t.string('account_id').nullable();
+            t.string('grant_id').nullable().index();
+            t.text('scope').notNullable();
+            t.string('resource', 2048).nullable();
+            t.string('jkt', 64).nullable();
+            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable().index();
+            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
+        },
+        columns: {
+            session_id: (t) => t.string('session_id').index(),
+            client_id: (t) => t.string('client_id', 2048),
+            user_id: (t) => t.string('user_id'),
+            account_id: (t) => t.string('account_id').nullable(),
+            grant_id: (t) => t.string('grant_id').nullable().index(),
+            scope: (t) => t.text('scope'),
+            resource: (t) => t.string('resource', 2048).nullable(),
+            jkt: (t) => t.string('jkt', 64).nullable(),
+            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
+            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
+    {
+        name: 'auth_poppy_requests',
+        /**
+         * Pedidos de sign-in: `authorize` (Direct — vira código após o consentimento),
+         * `device` (RFC 8628) e `mediated` (§4.7, aguardando o código de uso único).
+         * Códigos só como hash. Linhas expiradas são apagadas no próximo pedido.
+         */
+        create: (t) => {
+            t.string('id').primary();
+            t.string('kind', 16).notNullable();
+            t.string('code_hash', 64).nullable().unique();
+            t.string('user_code', 16).nullable().unique();
+            t.string('client_id', 2048).notNullable();
+            t.string('session_id').nullable();
+            t.string('account_id').nullable();
+            t.text('requested_scope').notNullable();
+            t.text('granted_scope').nullable();
+            t.string('redirect_uri', 2048).nullable();
+            t.string('code_challenge', 128).nullable();
+            t.string('status', 16).notNullable();
+            t.integer('attempts').notNullable().defaultTo(0);
+            t.integer('interval_seconds').nullable();
+            t.dateTime('last_polled_at', { useTz: true, precision: 3 }).nullable();
+            t.text('data').nullable();
+            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable().index();
+            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
+        },
+        columns: {
+            kind: (t) => t.string('kind', 16),
+            code_hash: (t) => t.string('code_hash', 64).nullable(),
+            user_code: (t) => t.string('user_code', 16).nullable(),
+            client_id: (t) => t.string('client_id', 2048),
+            session_id: (t) => t.string('session_id').nullable(),
+            account_id: (t) => t.string('account_id').nullable(),
+            requested_scope: (t) => t.text('requested_scope'),
+            granted_scope: (t) => t.text('granted_scope').nullable(),
+            redirect_uri: (t) => t.string('redirect_uri', 2048).nullable(),
+            code_challenge: (t) => t.string('code_challenge', 128).nullable(),
+            status: (t) => t.string('status', 16),
+            attempts: (t) => t.integer('attempts').defaultTo(0),
+            interval_seconds: (t) => t.integer('interval_seconds').nullable(),
+            last_polled_at: (t) => t.dateTime('last_polled_at', { useTz: true, precision: 3 }).nullable(),
+            data: (t) => t.text('data').nullable(),
+            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
+            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
+    {
+        name: 'auth_poppy_jtis',
+        /** `jti` já aceitos (asserções, provas DPoP), até expirarem — anti-replay entre instâncias. */
+        create: (t) => {
+            t.string('key', 100).primary();
+            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable().index();
+        },
+        columns: {
+            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
 ];
 /**
  * Probe searchPath-aware: `schema.hasTable` no Postgres ignora o