@adonis-agora/authkit-server 0.90.2 → 1.0.0-rc.0

package/build/src/host/account_api/account_api_controller.js

@@ -27,7 +27,7 @@
  *   GET  /account/api/orgs/:id             → detalhe de org (requer membership)
  *   GET  /account/api/orgs/invitations     → convites pendentes
  */
-import { clientDisplayNames } from '../client_names.js';
+import { clientDisplayInfo } from '../client_names.js';
 import '../augmentations.js';
 import { supportsAccountSecurity, supportsLoginMethodsPreference, supportsMagicLink, supportsOrganizations, supportsPasskeys, supportsProfile, supportsRecoveryCodeCount, supportsRecoveryCodeRegeneration, } from '../../accounts/account_store.js';
 import { personalAgentsFor } from '../../agents/runtime.js';
@@ -403,13 +403,6 @@ export default class AccountApiController {
                 oldEmail: account?.email ?? '',
             });
         }
-        else if (cfg.mail?.onEmailVerification) {
-            await cfg.mail.onEmailVerification({
-                email: newEmail,
-                verifyUrl: confirmUrl,
-                token: issued.token,
-            });
-        }
         else {
             await sendEmailChangeConfirmationEmail(ctx, { email: newEmail, confirmUrl });
         }
@@ -577,14 +570,15 @@ export default class AccountApiController {
             return { supported: false, apps: [] };
         }
         const grants = await adminSessions.listGrants(userId);
-        const names = await clientDisplayNames(service, grants.map((g) => g.clientId).filter((id) => !!id));
+        const info = await clientDisplayInfo(service, grants.map((g) => g.clientId).filter((id) => !!id));
         return {
             supported: true,
             apps: grants
                 .filter((g) => !!g.clientId)
                 .map((g) => ({
                 clientId: g.clientId,
-                name: names.get(g.clientId) ?? g.clientId,
+                name: info.get(g.clientId)?.name ?? g.clientId,
+                logoUrl: info.get(g.clientId)?.logoUrl ?? null,
                 accessTokens: g.accessTokens,
                 refreshTokens: g.refreshTokens,
             })),
@@ -934,7 +928,7 @@ export default class AccountApiController {
         return { ok: true, revoked: patId };
     }
     // ─── GET /account/api/orgs ───────────────────────────────────────────────
-    /** Lista orgs do usuário logado. Alias consolidado dos /account/orgs/json existentes. */
+    /** Lista orgs do usuário logado. */
     async listOrgs(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;

package/build/src/host/admin_api/api_clients_controller.d.ts

@@ -10,26 +10,30 @@ export default class ApiClientsController {
         data: {
             clientId: string;
             confidential: boolean;
-            grants: string[];
+            grantTypes: string[];
             redirectUris: string[];
             postLogoutRedirectUris: string[];
             tokenEndpointAuthMethod: string;
             applicationType: import("../client_metadata.js").ApplicationType;
             backchannelLogoutUri: string | null;
             backchannelLogoutSessionRequired: boolean;
+            clientName: string | null;
+            logoUri: string | null;
         }[];
         canList: boolean;
     }>;
     show(ctx: HttpContext): Promise<void | {
         clientId: string;
         confidential: boolean;
-        grants: string[];
+        grantTypes: string[];
         redirectUris: string[];
         postLogoutRedirectUris: string[];
         tokenEndpointAuthMethod: string;
         applicationType: import("../client_metadata.js").ApplicationType;
         backchannelLogoutUri: string | null;
         backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
     }>;
     store(ctx: HttpContext): Promise<void | {
         clientId: string;
@@ -38,13 +42,15 @@ export default class ApiClientsController {
     update(ctx: HttpContext): Promise<void | {
         clientId: string;
         confidential: boolean;
-        grants: string[];
+        grantTypes: string[];
         redirectUris: string[];
         postLogoutRedirectUris: string[];
         tokenEndpointAuthMethod: string;
         applicationType: import("../client_metadata.js").ApplicationType;
         backchannelLogoutUri: string | null;
         backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
     }>;
     regenerateSecret(ctx: HttpContext): Promise<void | {
         clientId: any;

package/build/src/host/admin_api/dto.d.ts

@@ -31,13 +31,15 @@ export declare function userDtoWithRoles(cfg: Parameters<typeof resolveAccountRo
 export declare function clientDto(client: AdminClient): {
     clientId: string;
     confidential: boolean;
-    grants: string[];
+    grantTypes: string[];
     redirectUris: string[];
     postLogoutRedirectUris: string[];
     tokenEndpointAuthMethod: string;
     applicationType: import("../client_metadata.ts").ApplicationType;
     backchannelLogoutUri: string | null;
     backchannelLogoutSessionRequired: boolean;
+    clientName: string | null;
+    logoUri: string | null;
 };
 /** Inclui o secret (mostrado UMA vez) em create/regenerate. */
 export declare function createdClientDto(created: CreatedClient): {

package/build/src/host/admin_api/dto.js

@@ -23,13 +23,15 @@ export function clientDto(client) {
     return {
         clientId: client.clientId,
         confidential: client.confidential,
-        grants: client.grants,
+        grantTypes: client.grantTypes,
         redirectUris: client.redirectUris,
         postLogoutRedirectUris: client.postLogoutRedirectUris,
         tokenEndpointAuthMethod: client.tokenEndpointAuthMethod,
         applicationType: client.applicationType,
         backchannelLogoutUri: client.backchannelLogoutUri ?? null,
         backchannelLogoutSessionRequired: client.backchannelLogoutSessionRequired ?? false,
+        clientName: client.clientName,
+        logoUri: client.logoUri,
     };
 }
 /** Inclui o secret (mostrado UMA vez) em create/regenerate. */

package/build/src/host/admin_clients_service.d.ts

@@ -18,8 +18,13 @@ export interface ClientInput {
     /**
      * Endpoint de OIDC Back-Channel Logout do RP. Quando definido, o IdP envia um
      * `logout_token` para esta URI ao encerrar a sessão/grant do usuário (RFC 7644).
+     * Num update, `null` remove a URI; ausente (`undefined`) preserva a atual.
      */
-    backchannelLogoutUri?: string;
+    backchannelLogoutUri?: string | null;
+    /** `client_name`: the name people see on consent and authorized-app screens. `null` removes it. */
+    clientName?: string | null;
+    /** `logo_uri`: the client's logo URL. `null` removes it. */
+    logoUri?: string | null;
     /**
      * Quando `true`, exige que o `logout_token` inclua a claim `sid`. Ignorado quando
      * `backchannelLogoutUri` não está definido.
@@ -30,7 +35,7 @@ export interface ClientInput {
 export interface AdminClient {
     clientId: string;
     confidential: boolean;
-    grants: string[];
+    grantTypes: string[];
     redirectUris: string[];
     postLogoutRedirectUris: string[];
     tokenEndpointAuthMethod: string;
@@ -40,6 +45,10 @@ export interface AdminClient {
     backchannelLogoutUri?: string;
     /** Exige sid no logout_token (opcional). */
     backchannelLogoutSessionRequired?: boolean;
+    /** `client_name` registrado, ou `null`. */
+    clientName: string | null;
+    /** `logo_uri` registrado, ou `null`. */
+    logoUri: string | null;
 }
 /** Resultado de uma criação: o client + o secret em claro (mostrado UMA vez). */
 export interface CreatedClient {
@@ -73,9 +82,8 @@ export declare class AdminClientsService {
      */
     create(input: ClientInput): Promise<CreatedClient>;
     /**
-     * Cria um client PRESERVANDO um `clientSecret` fornecido externamente (em vez de
-     * gerar um aleatório). Útil para migração de clients estáticos do config, onde o
-     * secret original deve ser preservado para não quebrar apps já configurados.
+     * Cria um client com um `clientSecret` fornecido externamente (em vez de gerar
+     * um aleatório) — ex.: para manter o secret que os RPs já usam.
      *
      * Para clients públicos (auth method `none`), `providedSecret` é ignorado.
      * Lança se o `clientId` já existir no adapter — chame `find` antes.

package/build/src/host/admin_clients_service.js

@@ -60,9 +60,8 @@ export class AdminClientsService {
         return { clientId, clientSecret };
     }
     /**
-     * Cria um client PRESERVANDO um `clientSecret` fornecido externamente (em vez de
-     * gerar um aleatório). Útil para migração de clients estáticos do config, onde o
-     * secret original deve ser preservado para não quebrar apps já configurados.
+     * Cria um client com um `clientSecret` fornecido externamente (em vez de gerar
+     * um aleatório) — ex.: para manter o secret que os RPs já usam.
      *
      * Para clients públicos (auth method `none`), `providedSecret` é ignorado.
      * Lança se o `clientId` já existir no adapter — chame `find` antes.
@@ -98,9 +97,17 @@ export class AdminClientsService {
                 existing.token_endpoint_auth_method ??
                 'client_secret_basic',
             applicationType: input.applicationType ?? existing.application_type ?? 'web',
-            backchannelLogoutUri: input.backchannelLogoutUri ?? existing.backchannel_logout_uri,
+            backchannelLogoutUri: input.backchannelLogoutUri === null
+                ? undefined
+                : (input.backchannelLogoutUri ?? existing.backchannel_logout_uri),
             backchannelLogoutSessionRequired: input.backchannelLogoutSessionRequired ??
                 existing.backchannel_logout_session_required,
+            clientName: input.clientName === null
+                ? undefined
+                : (input.clientName ?? existing.client_name),
+            logoUri: input.logoUri === null
+                ? undefined
+                : (input.logoUri ?? existing.logo_uri),
         };
         const confidential = !PUBLIC_AUTH_METHODS.has(merged.tokenEndpointAuthMethod);
         // Mantém o secret atual se continua confidencial; se virou public, remove-o.
@@ -173,6 +180,10 @@ export class AdminClientsService {
         // sempre (sem `application_type` o oidc-provider assume `web`).
         if (input.applicationType === 'native')
             payload.application_type = 'native';
+        if (input.clientName)
+            payload.client_name = input.clientName;
+        if (input.logoUri)
+            payload.logo_uri = input.logoUri;
         if (input.backchannelLogoutUri) {
             payload.backchannel_logout_uri = input.backchannelLogoutUri;
             if (input.backchannelLogoutSessionRequired !== undefined) {
@@ -188,11 +199,13 @@ export class AdminClientsService {
         const result = {
             clientId: row.clientId,
             confidential: !!p.client_secret,
-            grants: p.grant_types ?? ['authorization_code', 'refresh_token'],
+            grantTypes: p.grant_types ?? ['authorization_code', 'refresh_token'],
             redirectUris: p.redirect_uris ?? [],
             postLogoutRedirectUris: p.post_logout_redirect_uris ?? [],
             tokenEndpointAuthMethod: authMethod,
             applicationType: p.application_type === 'native' ? 'native' : 'web',
+            clientName: typeof p.client_name === 'string' && p.client_name ? p.client_name : null,
+            logoUri: typeof p.logo_uri === 'string' && p.logo_uri ? p.logo_uri : null,
         };
         if (p.backchannel_logout_uri) {
             result.backchannelLogoutUri = p.backchannel_logout_uri;

package/build/src/host/admin_console/admin_shell_controller.d.ts

@@ -1,4 +1,19 @@
 import type { HttpContext } from '@adonisjs/core/http';
+/** Id of the JSON data block the SPA reads its config from. */
+export declare const ADMIN_CONFIG_ELEMENT_ID = "authkit-admin-config";
+/**
+ * Serializes the config for an HTML data block: `<`, `>`, `&` and the JS line
+ * separators are escaped so no value can close the `<script>` element.
+ */
+export declare function serializeConfigBlock(config: Record<string, unknown>): string;
+/**
+ * Embeds the config as a `<script type="application/json">` data block right
+ * after `<body>`. A data block is never executed, so a strict CSP
+ * (`script-src 'self' 'nonce-…'`) leaves it alone; the SPA parses it.
+ * Also rewrites `/__AUTHKIT_BASE__/` → actual adminBase so all asset URLs
+ * produced by Vite (base: '/__AUTHKIT_BASE__/') resolve correctly at runtime.
+ */
+export declare function prepareShell(html: string, config: Record<string, unknown>): string;
 /**
  * Controla o serving do console admin React (Missão B).
  *
@@ -6,7 +21,7 @@ import type { HttpContext } from '@adonisjs/core/http';
  * `serveAsset`  — serve arquivos estáticos do build (JS/CSS/fonts/images) com cache.
  *
  * O shell HTML é o index.html produzido pelo Vite build em `build/host/ui-dist/`.
- * O servidor injeta `window.__AUTHKIT__` e reescreve o placeholder de base dinâmica
+ * O servidor embute a config num data block JSON (`#authkit-admin-config`) e reescreve o placeholder de base dinâmica
  * `/__AUTHKIT_BASE__/` → `${adminBase}/assets/` para que todos os imports de assets
  * Vite resolvam corretamente independente do prefixo admin configurado.
  *

package/build/src/host/admin_console/admin_shell_controller.js

@@ -50,19 +50,33 @@ then restart the server.</p>
     }
 }
 // ─── Config injection ─────────────────────────────────────────────────────────
+/** Id of the JSON data block the SPA reads its config from. */
+export const ADMIN_CONFIG_ELEMENT_ID = 'authkit-admin-config';
 /**
- * Injects `window.__AUTHKIT__` into the HTML shell right after `<body>`.
+ * Serializes the config for an HTML data block: `<`, `>`, `&` and the JS line
+ * separators are escaped so no value can close the `<script>` element.
+ */
+export function serializeConfigBlock(config) {
+    return JSON.stringify(config)
+        .replace(/</g, '\\u003c')
+        .replace(/>/g, '\\u003e')
+        .replace(/&/g, '\\u0026')
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
+}
+/**
+ * Embeds the config as a `<script type="application/json">` data block right
+ * after `<body>`. A data block is never executed, so a strict CSP
+ * (`script-src 'self' 'nonce-…'`) leaves it alone; the SPA parses it.
  * Also rewrites `/__AUTHKIT_BASE__/` → actual adminBase so all asset URLs
  * produced by Vite (base: '/__AUTHKIT_BASE__/') resolve correctly at runtime.
  */
-function prepareShell(html, config) {
+export function prepareShell(html, config) {
     const adminBase = config.adminBase;
     // 1. Rewrite the Vite placeholder base in ALL occurrences (src/href attributes).
-    //    Vite puts `/__AUTHKIT_BASE__/assets/foo.js` so we rewrite `/__AUTHKIT_BASE__/`
-    //    to `${adminBase}/` so asset URLs become `${adminBase}/assets/foo.js`.
     const rewritten = html.replaceAll('/__AUTHKIT_BASE__/', `${adminBase}/`);
-    // 2. Inject config script right after <body>.
-    const script = `<script>window.__AUTHKIT__=${JSON.stringify(config)};</script>`;
+    // 2. Inject the config data block right after <body>.
+    const script = `<script type="application/json" id="${ADMIN_CONFIG_ELEMENT_ID}">${serializeConfigBlock(config)}</script>`;
     const bodyIdx = rewritten.indexOf('<body');
     if (bodyIdx === -1)
         return script + rewritten;
@@ -97,7 +111,7 @@ const MIME = {
  * `serveAsset`  — serve arquivos estáticos do build (JS/CSS/fonts/images) com cache.
  *
  * O shell HTML é o index.html produzido pelo Vite build em `build/host/ui-dist/`.
- * O servidor injeta `window.__AUTHKIT__` e reescreve o placeholder de base dinâmica
+ * O servidor embute a config num data block JSON (`#authkit-admin-config`) e reescreve o placeholder de base dinâmica
  * `/__AUTHKIT_BASE__/` → `${adminBase}/assets/` para que todos os imports de assets
  * Vite resolvam corretamente independente do prefixo admin configurado.
  *

package/build/src/host/admin_console/console_clients_controller.d.ts

@@ -5,6 +5,7 @@ import type { HttpContext } from '@adonisjs/core/http';
  *
  * GET    {prefix}/api/clients                 → lista clients dinâmicos
  * POST   {prefix}/api/clients                 → criar client (secret retornado UMA vez)
+ * GET    {prefix}/api/clients/:id             → um client (404 se não existir)
  * PATCH  {prefix}/api/clients/:id             → atualizar metadata
  * DELETE {prefix}/api/clients/:id             → remover client
  * POST   {prefix}/api/clients/:id/regenerate-secret → gerar novo secret
@@ -15,16 +16,32 @@ export default class ConsoleClientsController {
         data: {
             clientId: string;
             confidential: boolean;
-            grants: string[];
+            grantTypes: string[];
             redirectUris: string[];
             postLogoutRedirectUris: string[];
             tokenEndpointAuthMethod: string;
             applicationType: import("../client_metadata.js").ApplicationType;
             backchannelLogoutUri: string | null;
             backchannelLogoutSessionRequired: boolean;
+            clientName: string | null;
+            logoUri: string | null;
         }[];
         canList: boolean;
     }>;
+    /** GET {prefix}/api/clients/:id */
+    show(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+    }>;
     /** POST {prefix}/api/clients */
     store(ctx: HttpContext): Promise<void | {
         clientId: string;
@@ -34,13 +51,15 @@ export default class ConsoleClientsController {
     update(ctx: HttpContext): Promise<void | {
         clientId: string;
         confidential: boolean;
-        grants: string[];
+        grantTypes: string[];
         redirectUris: string[];
         postLogoutRedirectUris: string[];
         tokenEndpointAuthMethod: string;
         applicationType: import("../client_metadata.js").ApplicationType;
         backchannelLogoutUri: string | null;
         backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
     }>;
     /** DELETE {prefix}/api/clients/:id */
     destroy(ctx: HttpContext): Promise<void | {

package/build/src/host/admin_console/console_clients_controller.js

@@ -15,6 +15,7 @@ function invalidMetadata(ctx, err) {
  *
  * GET    {prefix}/api/clients                 → lista clients dinâmicos
  * POST   {prefix}/api/clients                 → criar client (secret retornado UMA vez)
+ * GET    {prefix}/api/clients/:id             → um client (404 se não existir)
  * PATCH  {prefix}/api/clients/:id             → atualizar metadata
  * DELETE {prefix}/api/clients/:id             → remover client
  * POST   {prefix}/api/clients/:id/regenerate-secret → gerar novo secret
@@ -30,6 +31,14 @@ export default class ConsoleClientsController {
         const clients = await svc.list();
         return { data: clients.map(clientDto), canList: true };
     }
+    /** GET {prefix}/api/clients/:id */
+    async show(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const client = await new AdminClientsService(service).find(ctx.request.param('id'));
+        if (!client)
+            return ctx.response.notFound(apiError('not_found', 'Client não encontrado.'));
+        return clientDto(client);
+    }
     /** POST {prefix}/api/clients */
     async store(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');

package/build/src/host/admin_console/console_impersonation_controller.js

@@ -49,11 +49,7 @@ export default class ConsoleImpersonationController {
         if (!account) {
             return ctx.response.notFound(apiError('not_found', 'Usuário não encontrado.'));
         }
-        // Clients de RUNTIME. `cfg.clients` é sempre `[]` num host real — clients
-        // vivem no adapter, criados pelo console/Admin API/`authkit:clients:create`.
-        // Ler só o config fazia o painel devolver 404 SEMPRE, que é por que o botão
-        // do console nunca funcionou. O fallback para o config cobre hosts legados
-        // com clients estáticos e adapters que não enumeram.
+        // Clients vivem no adapter, criados pelo console/Admin API/`authkit:clients:create`.
         const panel = buildImpersonationPanel(cfg, targetId, await listRuntimeClients(service));
         if (!panel) {
             return ctx.response.notFound(apiError('no_token_exchange_client', 'Nenhum client habilitado ao grant token-exchange encontrado.'));
@@ -83,8 +79,7 @@ export default class ConsoleImpersonationController {
 }
 /**
  * Clients persistidos que podem hospedar o token-exchange. Best-effort: um
- * adapter sem `list` (ou que falhe) devolve lista vazia e o
- * `buildImpersonationPanel` cai no `cfg.clients`.
+ * adapter sem `list` (ou que falhe) devolve lista vazia e o painel responde 404.
  */
 async function listRuntimeClients(service) {
     try {
@@ -93,7 +88,7 @@ async function listRuntimeClients(service) {
             return [];
         return (await clients.list()).map((c) => ({
             clientId: c.clientId,
-            grants: c.grants,
+            grantTypes: c.grantTypes,
             confidential: c.confidential,
         }));
     }

package/build/src/host/admin_console/console_overview_controller.d.ts

@@ -5,7 +5,7 @@ import type { HttpContext } from '@adonisjs/core/http';
  *
  * Métricas-resumo do IdP para o dashboard do console React. Reutiliza
  * `computeAdminStats` (mesma fonte do console Edge) e adiciona:
- * - `clientsCount`   — número de clients na config
+ * - `clientsCount`   — número de clients no adapter (0 quando o adapter não enumera)
  * - `auditTotal`     — total de eventos de auditoria (0 quando sink não suporta)
  * - `recentEvents`   — últimos 5 eventos de auditoria ([] quando não suporta)
  */
@@ -20,7 +20,7 @@ export default class ConsoleOverviewController {
         signUpsPerDay: import("../admin_stats_service.js").DailyPoint[];
         windowDays: number;
         auditSupported: boolean;
-        clientsCount: any;
+        clientsCount: number;
         auditTotal: any;
         recentEvents: any;
     }>;

package/build/src/host/admin_console/console_overview_controller.js

@@ -1,5 +1,6 @@
 import '../augmentations.js';
 import { LIST_FIRST_PAGE } from '../../pagination.js';
+import { AdminClientsService } from '../admin_clients_service.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
 import { computeAdminStats } from '../admin_stats_service.js';
 /**
@@ -7,7 +8,7 @@ import { computeAdminStats } from '../admin_stats_service.js';
  *
  * Métricas-resumo do IdP para o dashboard do console React. Reutiliza
  * `computeAdminStats` (mesma fonte do console Edge) e adiciona:
- * - `clientsCount`   — número de clients na config
+ * - `clientsCount`   — número de clients no adapter (0 quando o adapter não enumera)
  * - `auditTotal`     — total de eventos de auditoria (0 quando sink não suporta)
  * - `recentEvents`   — últimos 5 eventos de auditoria ([] quando não suporta)
  */
@@ -17,7 +18,8 @@ export default class ConsoleOverviewController {
         const cfg = service.config;
         const sessions = new AdminSessionsService(service);
         const stats = await computeAdminStats(cfg, sessions);
-        const clientsCount = cfg.clients.length;
+        const clients = new AdminClientsService(service);
+        const clientsCount = clients.canList ? (await clients.list()).length : 0;
         const recentResult = typeof cfg.audit?.list === 'function'
             ? await cfg.audit.list({ page: LIST_FIRST_PAGE, size: 5 })
             : null;

package/build/src/host/admin_validators.d.ts

@@ -4,8 +4,7 @@ import { type ApplicationType } from './client_metadata.js';
  * Input de client OIDC — serve create E update (PATCH). Tudo opcional: no create
  * o controller aplica defaults (ver {@link clientCreateInput}); no update os campos
  * ausentes (undefined) são preservados pelo `AdminClientsService.update` (merge,
- * ver {@link clientPartialInput}). `grants` é aceito como alias de `grantTypes`
- * (o DTO de saída usa `grants`).
+ * ver {@link clientPartialInput}).
  */
 export declare const clientInputValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
     clientId: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
@@ -13,37 +12,41 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     redirectUris: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").VineArray<import("@vinejs/vine").VineString>>;
     postLogoutRedirectUris: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").VineArray<import("@vinejs/vine").VineString>>;
     grantTypes: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").VineArray<import("@vinejs/vine").VineEnum<readonly ["authorization_code", "refresh_token", "client_credentials", "urn:ietf:params:oauth:grant-type:token-exchange"]>>>;
-    grants: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").VineArray<import("@vinejs/vine").VineEnum<readonly ["authorization_code", "refresh_token", "client_credentials", "urn:ietf:params:oauth:grant-type:token-exchange"]>>>;
     tokenEndpointAuthMethod: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineEnum<readonly ["client_secret_basic", "client_secret_post", "none"]>>;
-    backchannelLogoutUri: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
+    backchannelLogoutUri: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
     backchannelLogoutSessionRequired: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineBoolean>;
+    clientName: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
+    logoUri: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
 }, {
     applicationType?: "native" | "web" | null | undefined;
     backchannelLogoutSessionRequired?: string | number | boolean | null | undefined;
     backchannelLogoutUri?: string | null | undefined;
     clientId?: string | null | undefined;
+    clientName?: string | null | undefined;
     grantTypes?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | null | undefined;
-    grants?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | null | undefined;
+    logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | null | undefined;
     redirectUris?: string[] | null | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | null | undefined;
 }, {
     applicationType?: "native" | "web" | undefined;
     backchannelLogoutSessionRequired?: boolean | undefined;
-    backchannelLogoutUri?: string | undefined;
+    backchannelLogoutUri?: string | null | undefined;
     clientId?: string | undefined;
+    clientName?: string | null | undefined;
     grantTypes?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | undefined;
-    grants?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | undefined;
+    logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | undefined;
     redirectUris?: string[] | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | undefined;
 }, {
     applicationType?: "native" | "web" | undefined;
     backchannelLogoutSessionRequired?: boolean | undefined;
-    backchannelLogoutUri?: string | undefined;
+    backchannelLogoutUri?: string | null | undefined;
     clientId?: string | undefined;
+    clientName?: string | null | undefined;
     grantTypes?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | undefined;
-    grants?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | undefined;
+    logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | undefined;
     redirectUris?: string[] | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | undefined;
@@ -55,10 +58,11 @@ export type ClientInputFields = {
     redirectUris?: string[];
     postLogoutRedirectUris?: string[];
     grantTypes?: string[];
-    grants?: string[];
     tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
-    backchannelLogoutUri?: string;
+    backchannelLogoutUri?: string | null;
     backchannelLogoutSessionRequired?: boolean;
+    clientName?: string | null;
+    logoUri?: string | null;
 };
 /**
  * Mapeia o input validado para um {@link ClientInput} COMPLETO (create), com defaults.

package/build/src/host/admin_validators.js

@@ -83,8 +83,7 @@ const grantTypeArray = vine.array(vine.enum(ALLOWED_GRANT_TYPES));
  * Input de client OIDC — serve create E update (PATCH). Tudo opcional: no create
  * o controller aplica defaults (ver {@link clientCreateInput}); no update os campos
  * ausentes (undefined) são preservados pelo `AdminClientsService.update` (merge,
- * ver {@link clientPartialInput}). `grants` é aceito como alias de `grantTypes`
- * (o DTO de saída usa `grants`).
+ * ver {@link clientPartialInput}).
  */
 export const clientInputValidator = vine.compile(vine.object({
     clientId: vine.string().trim().optional(),
@@ -96,11 +95,14 @@ export const clientInputValidator = vine.compile(vine.object({
     postLogoutRedirectUris: redirectUriArray.optional(),
     // grant_types restrito à allowlist; `implicit` e desconhecidos viram 422 (M10).
     grantTypes: grantTypeArray.optional(),
-    grants: grantTypeArray.optional(),
     tokenEndpointAuthMethod: authMethod.optional(),
     // backchannel_logout_uri também precisa ser URI absoluta (L10).
-    backchannelLogoutUri: vine.string().trim().url(URL_OPTS).optional(),
+    // `null` (update) remove a URI.
+    backchannelLogoutUri: vine.string().trim().url(URL_OPTS).nullable().optional(),
     backchannelLogoutSessionRequired: vine.boolean().optional(),
+    // `null` (update) removes them.
+    clientName: vine.string().trim().maxLength(200).nullable().optional(),
+    logoUri: vine.string().trim().url(URL_OPTS).nullable().optional(),
 }));
 /**
  * Mapeia o input validado para um {@link ClientInput} COMPLETO (create), com defaults.
@@ -114,10 +116,12 @@ export function clientCreateInput(v) {
         applicationType,
         redirectUris: v.redirectUris ?? [],
         postLogoutRedirectUris: v.postLogoutRedirectUris ?? [],
-        grantTypes: v.grantTypes ?? v.grants ?? [],
+        grantTypes: v.grantTypes ?? [],
         tokenEndpointAuthMethod: v.tokenEndpointAuthMethod ?? (applicationType === 'native' ? 'none' : 'client_secret_basic'),
         backchannelLogoutUri: v.backchannelLogoutUri || undefined,
         backchannelLogoutSessionRequired: v.backchannelLogoutSessionRequired,
+        clientName: v.clientName || undefined,
+        logoUri: v.logoUri || undefined,
     };
 }
 /**
@@ -132,15 +136,18 @@ export function clientPartialInput(v) {
         out.redirectUris = v.redirectUris;
     if (v.postLogoutRedirectUris !== undefined)
         out.postLogoutRedirectUris = v.postLogoutRedirectUris;
-    const grants = v.grantTypes ?? v.grants;
-    if (grants !== undefined)
-        out.grantTypes = grants;
+    if (v.grantTypes !== undefined)
+        out.grantTypes = v.grantTypes;
     if (v.tokenEndpointAuthMethod !== undefined)
         out.tokenEndpointAuthMethod = v.tokenEndpointAuthMethod;
     if (v.backchannelLogoutUri !== undefined)
-        out.backchannelLogoutUri = v.backchannelLogoutUri.trim() || undefined;
+        out.backchannelLogoutUri = v.backchannelLogoutUri?.trim() || null;
     if (v.backchannelLogoutSessionRequired !== undefined)
         out.backchannelLogoutSessionRequired = v.backchannelLogoutSessionRequired;
+    if (v.clientName !== undefined)
+        out.clientName = v.clientName?.trim() || null;
+    if (v.logoUri !== undefined)
+        out.logoUri = v.logoUri?.trim() || null;
     return out;
 }
 // ─── Usuários ───────────────────────────────────────────────────────────────

package/build/src/host/client_names.d.ts

@@ -2,10 +2,17 @@
  * Nome de exibição de cada client: o `client_name` que ele registrou (um cliente MCP registra o
  * seu, ex.: "Claude Code"), senão o próprio `client_id`. Client que sumiu do adapter → o id.
  */
-export declare function clientDisplayNames(service: {
+export declare function clientDisplayNames(service: ClientLookup, clientIds: string[]): Promise<Map<string, string>>;
+type ClientLookup = {
     provider: {
         Client: {
             find(id: string): Promise<any>;
         };
     };
-}, clientIds: string[]): Promise<Map<string, string>>;
+};
+/** Nome de exibição e logo (`logo_uri` registrado, ou `null`) de cada client. */
+export declare function clientDisplayInfo(service: ClientLookup, clientIds: string[]): Promise<Map<string, {
+    name: string;
+    logoUrl: string | null;
+}>>;
+export {};