@adonis-agora/authkit-server 0.78.0 → 0.79.0

package/build/src/agents/config.d.ts

@@ -103,6 +103,8 @@ export interface ResolvedPersonalAgentsConfig {
     /** `''` quando o PACT está desligado. */
     audience: string;
     resolveAgent: PersonalAgentResolver;
+    /** A lista `agents` do config quando é um array (o console mostra); `null` = resolver do host. */
+    staticAgents: PersonalAgentRegistration[] | null;
     open: boolean;
     delegation?: ResolvedPersonalAgentDelegationConfig;
     prefix: string;

package/build/src/agents/config.js

@@ -51,10 +51,12 @@ export function resolvePersonalAgentsConfig(input) {
         throw new Error('authkit: o Poppy não é um `protocol` do PACT — configure-o em `personalAgents.poppy` (os dois convivem).');
     }
     let resolveAgent;
+    let staticAgents = null;
     if (typeof input.agents === 'function') {
         resolveAgent = input.agents;
     }
     else {
+        staticAgents = [...(input.agents ?? [])];
         const byIssuer = new Map();
         for (const agent of input.agents ?? []) {
             assertUrl(agent.issuer, `agents[].issuer`);
@@ -101,6 +103,7 @@ export function resolvePersonalAgentsConfig(input) {
         protocol,
         audience: pact ? input.audience : '',
         resolveAgent,
+        staticAgents,
         open: input.open === true,
         delegation,
         prefix,

package/build/src/agents/delegation_store.d.ts

@@ -37,7 +37,13 @@ export interface GrantRow {
     createdAt: Date;
     updatedAt: Date;
 }
+export interface LiveGrantFilter {
+    protocol?: 'pact' | 'poppy';
+    clientId?: string;
+    accountId?: string;
+}
 export declare class DelegationStore {
+    #private;
     private conn;
     /** `conn` = uma conexão Lucid (`db.connection(name?)`) — ou uma transação. */
     constructor(conn: () => any);
@@ -75,6 +81,16 @@ export declare class DelegationStore {
     /** Revoga um grant DA CONTA. `false` = não existe, é de outra conta ou já revogado. */
     revokeGrant(accountId: string, id: string, at: Date): Promise<boolean>;
     revokeAllGrants(accountId: string, at: Date): Promise<number>;
+    listLiveGrants(input: LiveGrantFilter & {
+        now: Date;
+        offset: number;
+        limit: number;
+    }): Promise<GrantRow[]>;
+    countLiveGrants(now: Date, filter?: LiveGrantFilter): Promise<number>;
+    /** Conexões vivas de um protocolo por agente: `client_id` → número de grants. */
+    countLiveGrantsByClient(now: Date, protocol: 'pact' | 'poppy'): Promise<Map<string, number>>;
+    /** Ids dos grants não revogados de um agente (vivos ou não) — para revogar todos. */
+    unrevokedGrantIdsOfClient(clientId: string): Promise<string[]>;
     /** Revoga um grant sem checar a conta — reação a reuso de refresh token. */
     revokeGrantById(id: string, at: Date): Promise<void>;
     insertRefreshToken(row: {

package/build/src/agents/delegation_store.js

@@ -183,6 +183,50 @@ export class DelegationStore {
             .update({ revoked_at: at, updated_at: at });
         return affected(result);
     }
+    // ─── console admin (todas as contas) ──────────────────────────────────────
+    /**
+     * Grants vivos (não revogados nem expirados em `now`), de todas as contas. O
+     * protocolo sai do prefixo do id: `agrant_` (PACT) ou `pgrant_` (Poppy).
+     */
+    #live(now, filter = {}) {
+        let q = this.conn().from(GRANT_TABLE).whereNull('revoked_at').where('expires_at', '>', now);
+        if (filter.protocol)
+            q = q.where('id', 'like', filter.protocol === 'poppy' ? 'pgrant_%' : 'agrant_%');
+        if (filter.clientId)
+            q = q.where('client_id', filter.clientId);
+        if (filter.accountId)
+            q = q.where('account_id', filter.accountId);
+        return q;
+    }
+    async listLiveGrants(input) {
+        const rows = await this.#live(input.now, input)
+            .orderBy('created_at', 'desc')
+            .orderBy('id', 'asc')
+            .offset(input.offset)
+            .limit(input.limit);
+        return rows.map(toGrant);
+    }
+    async countLiveGrants(now, filter = {}) {
+        const row = await this.#live(now, filter).count('* as total').first();
+        return Number(row?.total ?? 0);
+    }
+    /** Conexões vivas de um protocolo por agente: `client_id` → número de grants. */
+    async countLiveGrantsByClient(now, protocol) {
+        const rows = await this.#live(now, { protocol })
+            .select('client_id')
+            .count('* as total')
+            .groupBy('client_id');
+        return new Map(rows.map((r) => [r.client_id, Number(r.total)]));
+    }
+    /** Ids dos grants não revogados de um agente (vivos ou não) — para revogar todos. */
+    async unrevokedGrantIdsOfClient(clientId) {
+        const rows = await this.conn()
+            .from(GRANT_TABLE)
+            .where('client_id', clientId)
+            .whereNull('revoked_at')
+            .select('id');
+        return rows.map((r) => r.id);
+    }
     /** Revoga um grant sem checar a conta — reação a reuso de refresh token. */
     async revokeGrantById(id, at) {
         await this.conn()

package/build/src/agents/poppy/config.d.ts

@@ -332,6 +332,9 @@ export interface ResolvedPoppyConfig {
         requireRegistration: boolean;
         isRegistered: (clientId: string) => Promise<boolean>;
         isBlocked: (clientId: string) => Promise<boolean>;
+        /** As listas do config quando são arrays (o console mostra); `null` = função do host. */
+        registeredList: string[] | null;
+        blockedList: string[] | null;
     };
     /** Dev/teste: `client_id` http e busca sem guarda de SSRF (ver o input). */
     allowInsecureClientIds: boolean;

package/build/src/agents/poppy/config.js

@@ -47,6 +47,11 @@ function membership(value) {
     const set = new Set(value ?? []);
     return async (id) => set.has(id);
 }
+function listOf(value) {
+    if (typeof value === 'function')
+        return null;
+    return [...new Set(value ?? [])];
+}
 function typeScopes(input, all, what) {
     if (input === false)
         return null;
@@ -180,6 +185,8 @@ export function resolvePoppyConfig(input, fallbackScopes) {
             requireRegistration: input.clients?.requireRegistration === true,
             isRegistered: membership(input.clients?.registered),
             isBlocked: membership(input.clients?.blocked),
+            registeredList: listOf(input.clients?.registered),
+            blockedList: listOf(input.clients?.blocked),
         },
         allowInsecureClientIds,
         sessionTokenTtl: positive(input.sessionTokenTtl, 3600, 'sessionTokenTtl'),

package/build/src/agents/poppy/service.d.ts

@@ -276,5 +276,11 @@ export declare class PoppyService {
     revokeAccountGrant(accountId: string, grantId: string): Promise<boolean>;
     /** Revoga todos os Account Tokens da conta (sair de tudo, conta suspensa…). */
     revokeAllAccountGrants(accountId: string): Promise<number>;
+    /**
+     * Bloqueio pelo console admin: revoga todos os Account Tokens do agente (todas as
+     * contas) e encerra as Sessions dele — os Session Tokens param na próxima request.
+     * Devolve quantos Account Tokens estavam vivos.
+     */
+    disconnectClient(clientId: string): Promise<number>;
 }
 export type { RequestRow };

package/build/src/agents/poppy/service.js

@@ -1277,6 +1277,18 @@ export class PoppyService {
             await this.revokeGrant(g.id);
         return live.length;
     }
+    /**
+     * Bloqueio pelo console admin: revoga todos os Account Tokens do agente (todas as
+     * contas) e encerra as Sessions dele — os Session Tokens param na próxima request.
+     * Devolve quantos Account Tokens estavam vivos.
+     */
+    async disconnectClient(clientId) {
+        const ids = (await this.#grants.unrevokedGrantIdsOfClient(clientId)).filter((id) => id.startsWith('pgrant_'));
+        for (const id of ids)
+            await this.revokeGrant(id);
+        await this.#store.endSessionsOfClient(clientId, this.#now());
+        return ids.length;
+    }
     // ─── internos ─────────────────────────────────────────────────────────────
     /** Scopes de um pedido de sign-in: obrigatórios, conhecidos e do tipo (§4.4). */
     #signInScopes(raw, type) {

package/build/src/agents/poppy/store.d.ts

@@ -82,6 +82,8 @@ export declare class PoppyStore {
     }): Promise<boolean>;
     /** Sign-out (§4.9): as Sessions logadas com o grant continuam, deslogadas. */
     signOutSessionsOfGrant(grantId: string, at: Date): Promise<number>;
+    /** Encerra todas as Sessions de um agente (bloqueio no console): os tokens param na hora. */
+    endSessionsOfClient(clientId: string, at: Date): Promise<number>;
     insertToken(row: TokenRow): Promise<void>;
     findToken(hash: string): Promise<TokenRow | null>;
     deleteToken(hash: string): Promise<boolean>;

package/build/src/agents/poppy/store.js

@@ -152,6 +152,15 @@ export class PoppyStore {
             .update({ grant_id: null, scope: '', updated_at: at });
         return affected(result);
     }
+    /** Encerra todas as Sessions de um agente (bloqueio no console): os tokens param na hora. */
+    async endSessionsOfClient(clientId, at) {
+        const result = await this.conn()
+            .from(SESSION_TABLE)
+            .where('client_id', clientId)
+            .whereNull('ended_at')
+            .update({ ended_at: at, grant_id: null, scope: '', updated_at: at });
+        return affected(result);
+    }
     // ─── session tokens ───────────────────────────────────────────────────────
     async insertToken(row) {
         await this.conn().table(TOKEN_TABLE).insert({

package/build/src/agents/registry_store.d.ts

@@ -0,0 +1,41 @@
+export declare const REGISTRY_TABLE = "auth_agent_registry";
+export type AgentProtocolId = 'pact' | 'poppy';
+export type AgentRegistryStatus = 'allowed' | 'blocked';
+export interface AgentRegistryRow {
+    id: string;
+    protocol: AgentProtocolId;
+    /** PACT: o `iss` do agente. Poppy: o `client_id` (URL do documento de metadata). */
+    identifier: string;
+    status: AgentRegistryStatus;
+    name: string | null;
+    /** JWKS do agente PACT (obrigatório num `allowed` PACT). */
+    jwksUri: string | null;
+    /** Conta do admin que fez a mudança. */
+    updatedBy: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** Quanto tempo o snapshot vale antes de reler a tabela. */
+export declare const SNAPSHOT_TTL_MS: number;
+export declare class AgentRegistryStore {
+    #private;
+    constructor(conn: () => any, options?: {
+        now?: () => number;
+    });
+    /** Todas as linhas, mais recentes primeiro. Lê do banco (console). */
+    list(): Promise<AgentRegistryRow[]>;
+    /** A linha do agente, pelo snapshot. `null` = o console não diz nada sobre ele. */
+    find(protocol: AgentProtocolId, identifier: string): Promise<AgentRegistryRow | null>;
+    findById(id: string): Promise<AgentRegistryRow | null>;
+    /** Cria ou troca a linha de (protocolo, identificador). */
+    upsert(input: {
+        protocol: AgentProtocolId;
+        identifier: string;
+        status: AgentRegistryStatus;
+        name?: string | null;
+        jwksUri?: string | null;
+        updatedBy?: string | null;
+    }): Promise<AgentRegistryRow>;
+    delete(id: string): Promise<boolean>;
+    invalidate(): void;
+}

package/build/src/agents/registry_store.js

@@ -0,0 +1,138 @@
+/**
+ * Registro de personal agents feito pelo console admin — tabela LIB-OWNED
+ * `auth_agent_registry` (ver `schema/ensure.ts`). SOMA ao `defineConfig`:
+ *
+ * - `allowed`: o agente entra mesmo fora da lista do config (PACT: issuer + JWKS;
+ *   Poppy: `client_id` registrado quando `clients.requireRegistration`).
+ * - `blocked`: o agente é recusado mesmo que o config o liste — bloquear é a
+ *   ação de emergência, e precisa valer sem deploy.
+ *
+ * O que o config bloqueia continua bloqueado: o console não desfaz o config.
+ *
+ * A tabela é pequena e lida em TODA verificação de agente PACT, então as linhas
+ * ficam num snapshot em memória por {@link SNAPSHOT_TTL_MS}. Escritas por este
+ * processo invalidam na hora; em outras instâncias o efeito chega no próximo
+ * refresh — o bloqueio corta os tokens já emitidos pelo banco (grants revogados,
+ * Sessions encerradas), então o atraso só vale para um agente começando do zero.
+ */
+import { randomBytes } from 'node:crypto';
+export const REGISTRY_TABLE = 'auth_agent_registry';
+/** Quanto tempo o snapshot vale antes de reler a tabela. */
+export const SNAPSHOT_TTL_MS = 15 * 1000;
+function toDate(value) {
+    if (value instanceof Date)
+        return value;
+    if (typeof value === 'number')
+        return new Date(value);
+    if (typeof value === 'string' && /^\d+$/.test(value))
+        return new Date(Number(value));
+    return new Date(String(value));
+}
+function toRow(row) {
+    return {
+        id: row.id,
+        protocol: row.protocol,
+        identifier: row.identifier,
+        status: row.status,
+        name: row.name ?? null,
+        jwksUri: row.jwks_uri ?? null,
+        updatedBy: row.updated_by ?? null,
+        createdAt: toDate(row.created_at),
+        updatedAt: toDate(row.updated_at),
+    };
+}
+const key = (protocol, identifier) => `${protocol} ${identifier}`;
+export class AgentRegistryStore {
+    #conn;
+    #now;
+    #snapshot = null;
+    #loading = null;
+    constructor(conn, options = {}) {
+        this.#conn = conn;
+        this.#now = options.now ?? Date.now;
+    }
+    /** Todas as linhas, mais recentes primeiro. Lê do banco (console). */
+    async list() {
+        const rows = await this.#conn().from(REGISTRY_TABLE).orderBy('updated_at', 'desc');
+        return rows.map(toRow);
+    }
+    /** A linha do agente, pelo snapshot. `null` = o console não diz nada sobre ele. */
+    async find(protocol, identifier) {
+        return (await this.#rows()).get(key(protocol, identifier)) ?? null;
+    }
+    async findById(id) {
+        const row = await this.#conn().from(REGISTRY_TABLE).where('id', id).first();
+        return row ? toRow(row) : null;
+    }
+    /** Cria ou troca a linha de (protocolo, identificador). */
+    async upsert(input) {
+        const now = new Date(this.#now());
+        const existing = await this.#conn()
+            .from(REGISTRY_TABLE)
+            .where('protocol', input.protocol)
+            .where('identifier', input.identifier)
+            .first();
+        const values = {
+            status: input.status,
+            name: input.name ?? null,
+            jwks_uri: input.jwksUri ?? null,
+            updated_by: input.updatedBy ?? null,
+            updated_at: now,
+        };
+        if (existing) {
+            await this.#conn().from(REGISTRY_TABLE).where('id', existing.id).update(values);
+        }
+        else {
+            await this.#conn()
+                .table(REGISTRY_TABLE)
+                .insert({
+                id: `areg_${randomBytes(12).toString('base64url')}`,
+                protocol: input.protocol,
+                identifier: input.identifier,
+                created_at: now,
+                ...values,
+            });
+        }
+        this.invalidate();
+        const row = await this.#conn()
+            .from(REGISTRY_TABLE)
+            .where('protocol', input.protocol)
+            .where('identifier', input.identifier)
+            .first();
+        return toRow(row);
+    }
+    async delete(id) {
+        const result = await this.#conn().from(REGISTRY_TABLE).where('id', id).delete();
+        this.invalidate();
+        return (typeof result === 'number' ? result : Array.isArray(result) ? result.length : 0) > 0;
+    }
+    invalidate() {
+        this.#snapshot = null;
+    }
+    async #rows() {
+        const now = this.#now();
+        if (this.#snapshot && this.#snapshot.expiresAt > now)
+            return this.#snapshot.rows;
+        if (!this.#loading) {
+            this.#loading = (async () => {
+                try {
+                    const rows = (await this.#conn().from(REGISTRY_TABLE)).map(toRow);
+                    const map = new Map(rows.map((r) => [key(r.protocol, r.identifier), r]));
+                    this.#snapshot = { rows: map, expiresAt: this.#now() + SNAPSHOT_TTL_MS };
+                    return map;
+                }
+                catch {
+                    // Banco fora (ou tabela ainda não criada): fica com o último snapshot, ou
+                    // nenhum — o config continua valendo sozinho. Tenta de novo logo.
+                    const rows = this.#snapshot?.rows ?? new Map();
+                    this.#snapshot = { rows, expiresAt: this.#now() + 1000 };
+                    return rows;
+                }
+                finally {
+                    this.#loading = null;
+                }
+            })();
+        }
+        return this.#loading;
+    }
+}

package/build/src/agents/runtime.d.ts

@@ -3,8 +3,10 @@ import type { OidcService } from '../provider/oidc_service.js';
 import { PersonalAgentVerifier } from './agent_identity.js';
 import type { ResolvedPersonalAgentsConfig } from './config.js';
 import { PersonalAgentDelegation } from './delegation_service.js';
+import { DelegationStore, type GrantRow } from './delegation_store.js';
 import type { JsonFetcher } from './poppy/safe_fetch.js';
 import { PoppyService } from './poppy/service.js';
+import { type AgentProtocolId, AgentRegistryStore } from './registry_store.js';
 /** URLs públicas do authorization server de delegação. */
 export interface PersonalAgentUrls {
     /** `issuer` (RFC 8414) — também o `iss` dos tokens de delegação. */
@@ -35,6 +37,17 @@ export interface PersonalAgentsRuntime {
     revokeAgentGrant(accountId: string, grantId: string): Promise<boolean>;
     /** Revoga todos os grants de personal agents da conta. Devolve quantos estavam vivos. */
     revokeAllAgentGrants(accountId: string): Promise<number>;
+    /**
+     * Registro do console admin (agentes liberados/bloqueados além do config).
+     * `null` sem banco (PACT só de identidade sem `lucid.db`).
+     */
+    registry: AgentRegistryStore | null;
+    /** Grants de todas as contas (console admin). `null` sem banco. */
+    grants: DelegationStore | null;
+    /** Revoga um grant de QUALQUER conta (console admin). Devolve o grant, ou `null` se já não valia. */
+    revokeGrantById(grantId: string): Promise<GrantRow | null>;
+    /** Desconecta um agente de todas as contas (bloqueio). Devolve quantos grants estavam vivos. */
+    disconnectAgent(protocol: AgentProtocolId, identifier: string): Promise<number>;
 }
 export interface BuildPersonalAgentsOptions {
     /** Resolve serviços do container (redis do replay store). */

package/build/src/agents/runtime.js

@@ -8,6 +8,7 @@ import { hmacNonceSource } from './poppy/dpop.js';
 import { databaseReplayStore, memoryLimiter, memoryReplayStore, redisReplayStore, } from './poppy/replay.js';
 import { PoppyService, poppyUrls } from './poppy/service.js';
 import { PoppyStore } from './poppy/store.js';
+import { AgentRegistryStore } from './registry_store.js';
 import { keystoreSigner } from './signer.js';
 /**
  * Deriva as URLs da ORIGEM do issuer configurado — nunca do Host da request
@@ -92,6 +93,41 @@ async function resolveReplay(replay, conn, make) {
     const redis = await make('redis');
     return redisReplayStore(redis.connection(name));
 }
+/**
+ * Config com o registro do console por cima: um agente BLOQUEADO no console é
+ * recusado mesmo que o config o liste; um LIBERADO entra mesmo fora da lista.
+ * O que o config bloqueia continua bloqueado.
+ */
+function withRegistry(config, registry) {
+    const resolveAgent = async (issuer) => {
+        const row = await registry.find('pact', issuer);
+        if (row?.status === 'blocked') {
+            return { issuer, jwksUri: row.jwksUri ?? '', name: row.name ?? undefined, enabled: false };
+        }
+        const configured = await config.resolveAgent(issuer);
+        if (configured)
+            return configured;
+        if (row?.status === 'allowed' && row.jwksUri) {
+            return { issuer, jwksUri: row.jwksUri, name: row.name ?? undefined };
+        }
+        return null;
+    };
+    const poppy = config.poppy;
+    return {
+        ...config,
+        resolveAgent,
+        poppy: poppy && {
+            ...poppy,
+            clients: {
+                ...poppy.clients,
+                isBlocked: async (id) => (await poppy.clients.isBlocked(id)) ||
+                    (await registry.find('poppy', id))?.status === 'blocked',
+                isRegistered: async (id) => (await poppy.clients.isRegistered(id)) ||
+                    (await registry.find('poppy', id))?.status === 'allowed',
+            },
+        },
+    };
+}
 /**
  * Monta (uma vez por `OidcService`) o runtime de personal agents. `null` quando
  * `personalAgents` não está no config — as rotas respondem 404.
@@ -112,12 +148,25 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
                 return !(supportsAccountStatus(store) && (await store.isDisabled(accountId)));
             };
             let conn = null;
+            const connection = service.config.schema.connection;
             if (config.delegation || config.poppy) {
                 const db = await makeDb();
-                const connection = service.config.schema.connection;
                 conn = () => (connection ? db.connection(connection) : db.connection());
             }
+            else {
+                // PACT só de identidade não precisa de banco; com ele, o console pode bloquear.
+                try {
+                    const db = await makeDb();
+                    if (db)
+                        conn = () => (connection ? db.connection(connection) : db.connection());
+                }
+                catch {
+                    conn = null;
+                }
+            }
             const store = conn ? new DelegationStore(conn) : null;
+            const registry = conn ? new AgentRegistryStore(conn) : null;
+            const effective = registry ? withRegistry(config, registry) : config;
             let delegation = null;
             if (config.delegation && store) {
                 delegation = new PersonalAgentDelegation({
@@ -129,8 +178,8 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
                 });
             }
             let poppy = null;
-            if (config.poppy && store && conn) {
-                const cfg = config.poppy;
+            if (effective.poppy && store && conn) {
+                const cfg = effective.poppy;
                 const limiter = cfg.rateLimit === false
                     ? null
                     : typeof cfg.rateLimit === 'function'
@@ -165,14 +214,47 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
                     count += await delegation.revokeAllGrants(accountId);
                 return count;
             };
+            const revokeGrantById = async (grantId) => {
+                if (!store)
+                    return null;
+                const grant = await store.findGrant(grantId);
+                const now = options.now?.() ?? new Date();
+                // Expirado já não vale: revogar não muda nada (e não vira evento de auditoria).
+                if (!grant || grant.revokedAt || grant.expiresAt <= now)
+                    return null;
+                if (grantId.startsWith('pgrant_')) {
+                    if (!poppy)
+                        return null;
+                    await poppy.revokeGrant(grantId);
+                }
+                else {
+                    await store.revokeGrantById(grantId, now);
+                }
+                return grant;
+            };
+            const disconnectAgent = async (protocol, identifier) => {
+                if (!store)
+                    return 0;
+                if (protocol === 'poppy')
+                    return poppy ? poppy.disconnectClient(identifier) : 0;
+                const ids = (await store.unrevokedGrantIdsOfClient(identifier)).filter((id) => !id.startsWith('pgrant_'));
+                const at = options.now?.() ?? new Date();
+                for (const id of ids)
+                    await store.revokeGrantById(id, at);
+                return ids.length;
+            };
             return {
-                config,
+                config: effective,
                 urls,
-                verifier: new PersonalAgentVerifier(config),
+                verifier: new PersonalAgentVerifier(effective),
                 delegation,
                 poppy,
                 revokeAgentGrant,
                 revokeAllAgentGrants,
+                registry,
+                grants: store,
+                revokeGrantById,
+                disconnectAgent,
             };
         })();
         // Falha (DB indisponível) não fica em cache — a próxima request tenta de novo.

package/build/src/audit/audit_sink.d.ts

@@ -8,7 +8,7 @@
  * varre os `audit.record({ type: ... })` do `src/` e falha quando um evento
  * emitido não está aqui.
  */
-export declare const AUDIT_EVENT_TYPES: readonly ['login.success', 'login.failure', 'signup', 'password_reset.issued', 'password_reset.consumed', 'pat.issued', 'pat.revoked', 'pat.used', 'impersonation', 'impersonation.panel_viewed', 'impersonation.stopped', 'mfa.enabled', 'mfa.disabled', 'mfa.recovery_codes_regenerated', 'account.locked', 'passkey.registered', 'passkey.removed', 'email_verification.issued', 'email_verification.consumed', 'client.created', 'client.updated', 'client.deleted', 'session.revoked_all', 'password.changed', 'password.rehashed', 'email.change_requested', 'email.changed', 'login.new_ip_notified', 'login.new_device', 'login.otp_sent', 'login.otp_verified', 'login.otp_failed', 'login.otp_invalidated', 'bot_protection.rejected', 'grant.revoked_by_user', 'user.created', 'user.password_reset_sent', 'user.disabled', 'user.enabled', 'user.deleted', 'profile.updated', 'account.deleted', 'account.exported', 'keys.rotated', 'organization.created', 'organization.updated', 'organization.deleted', 'organization.member_added', 'organization.member_removed', 'organization.member_role_changed', 'organization.member_role_updated', 'organization.switched', 'organization.deactivated', 'organization.invitation_sent', 'organization.invitation_accepted', 'organization.invitation_revoked', 'email_change.requested', 'email_change.confirmed', 'email_change.cancelled', 'security_notice.sent', 'settings.updated', 'maintenance.enabled', 'maintenance.disabled', 'trusted_device.revoked', 'password.expired_change_forced', 'otp.locked', 'otp.unlocked', 'otp.unlock_failed', 'sudo.confirmed', 'session.single_enforced', 'account.expired_login_blocked', 'account.expiration_warned', 'login.magic_link_sent', 'session.revoked', 'account.signed_out_all', 'client.secret_regenerated', 'roles_catalog.updated', 'agent.delegation_approved', 'agent.delegation_denied', 'agent.grant_revoked'];
+export declare const AUDIT_EVENT_TYPES: readonly ['login.success', 'login.failure', 'signup', 'password_reset.issued', 'password_reset.consumed', 'pat.issued', 'pat.revoked', 'pat.used', 'impersonation', 'impersonation.panel_viewed', 'impersonation.stopped', 'mfa.enabled', 'mfa.disabled', 'mfa.recovery_codes_regenerated', 'account.locked', 'passkey.registered', 'passkey.removed', 'email_verification.issued', 'email_verification.consumed', 'client.created', 'client.updated', 'client.deleted', 'session.revoked_all', 'password.changed', 'password.rehashed', 'email.change_requested', 'email.changed', 'login.new_ip_notified', 'login.new_device', 'login.otp_sent', 'login.otp_verified', 'login.otp_failed', 'login.otp_invalidated', 'bot_protection.rejected', 'grant.revoked_by_user', 'user.created', 'user.password_reset_sent', 'user.disabled', 'user.enabled', 'user.deleted', 'profile.updated', 'account.deleted', 'account.exported', 'keys.rotated', 'organization.created', 'organization.updated', 'organization.deleted', 'organization.member_added', 'organization.member_removed', 'organization.member_role_changed', 'organization.member_role_updated', 'organization.switched', 'organization.deactivated', 'organization.invitation_sent', 'organization.invitation_accepted', 'organization.invitation_revoked', 'email_change.requested', 'email_change.confirmed', 'email_change.cancelled', 'security_notice.sent', 'settings.updated', 'maintenance.enabled', 'maintenance.disabled', 'trusted_device.revoked', 'password.expired_change_forced', 'otp.locked', 'otp.unlocked', 'otp.unlock_failed', 'sudo.confirmed', 'session.single_enforced', 'account.expired_login_blocked', 'account.expiration_warned', 'login.magic_link_sent', 'session.revoked', 'account.signed_out_all', 'client.secret_regenerated', 'roles_catalog.updated', 'agent.delegation_approved', 'agent.delegation_denied', 'agent.grant_revoked', 'agent.grant_revoked_by_admin', 'agent.allowed', 'agent.blocked', 'agent.registry_removed'];
 /** Tipos de eventos de auditoria relevantes para segurança emitidos pelo IdP. */
 export type AuditEventType = (typeof AUDIT_EVENT_TYPES)[number];
 /**

package/build/src/audit/audit_sink.js

@@ -113,4 +113,10 @@ export const AUDIT_EVENT_TYPES = [
     'agent.delegation_approved',
     'agent.delegation_denied',
     'agent.grant_revoked',
+    // Console admin: um admin revogou a conexão de um usuário, ou liberou/bloqueou um
+    // agente (PACT pelo `iss`, Poppy pelo `client_id`).
+    'agent.grant_revoked_by_admin',
+    'agent.allowed',
+    'agent.blocked',
+    'agent.registry_removed',
 ];

package/build/src/host/admin_api/dto.d.ts

@@ -49,7 +49,7 @@ export declare function grantDto(grant: AdminGrant): {
 };
 export declare function auditDto(event: StoredAuditEvent): {
     id: string;
-    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.locked" | "account.signed_out_all" | "agent.delegation_approved" | "agent.delegation_denied" | "agent.grant_revoked" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "impersonation.stopped" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "mfa.recovery_codes_regenerated" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
+    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.locked" | "account.signed_out_all" | "agent.allowed" | "agent.blocked" | "agent.delegation_approved" | "agent.delegation_denied" | "agent.grant_revoked" | "agent.grant_revoked_by_admin" | "agent.registry_removed" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "impersonation.stopped" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "mfa.recovery_codes_regenerated" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
     accountId: string | null;
     email: string | null;
     clientId: string | null;

package/build/src/host/admin_console/admin_shell_controller.js

@@ -1,5 +1,6 @@
 import { readFile } from 'node:fs/promises';
 import { extname } from 'node:path';
+import { accountPath } from '../account_paths.js';
 import { resolveAccountRoles } from '../account_roles.js';
 import { getAdminPrefix } from '../admin_prefix.js';
 // ─── Shell HTML cache ─────────────────────────────────────────────────────────
@@ -134,6 +135,12 @@ export default class AdminShellController {
             currentUser,
             endpoints: {
                 api: `${adminBase}/api`,
+                // Confirmação de identidade (sudo) das ações destrutivas.
+                confirm: accountPath('confirm'),
+            },
+            features: {
+                // A página de personal agents só aparece com `personalAgents` no config.
+                personalAgents: !!cfg.personalAgents,
             },
         };
         const { html: rawHtml } = await loadShell();