@adonis-agora/authkit-server 0.90.2 → 1.0.0-rc.0

package/build/src/host/client_names.js

@@ -3,10 +3,18 @@
  * seu, ex.: "Claude Code"), senão o próprio `client_id`. Client que sumiu do adapter → o id.
  */
 export async function clientDisplayNames(service, clientIds) {
-    const names = new Map();
+    const info = await clientDisplayInfo(service, clientIds);
+    return new Map([...info].map(([id, v]) => [id, v.name]));
+}
+/** Nome de exibição e logo (`logo_uri` registrado, ou `null`) de cada client. */
+export async function clientDisplayInfo(service, clientIds) {
+    const info = new Map();
     await Promise.all([...new Set(clientIds)].map(async (clientId) => {
         const client = await service.provider.Client.find(clientId).catch(() => null);
-        names.set(clientId, client?.clientName || clientId);
+        info.set(clientId, {
+            name: client?.clientName || clientId,
+            logoUrl: typeof client?.logoUri === 'string' && client.logoUri ? client.logoUri : null,
+        });
     }));
-    return names;
+    return info;
 }

package/build/src/host/consent_params.d.ts

@@ -0,0 +1,7 @@
+import type { ConsentRequestParams } from './screen_props.js';
+/**
+ * The interaction's request parameters for the consent screen: `client_id` and the
+ * standard string parameters are guaranteed strings (or absent); everything else is
+ * passed through untouched.
+ */
+export declare function consentRequestParams(raw: Record<string, unknown> | undefined): ConsentRequestParams;

package/build/src/host/consent_params.js

@@ -0,0 +1,27 @@
+/** Optional standard parameters of an authorization request, typed as strings. */
+const CONSENT_STRING_PARAMS = [
+    'redirect_uri',
+    'response_type',
+    'scope',
+    'state',
+    'prompt',
+    'nonce',
+    'code_challenge',
+    'code_challenge_method',
+];
+/**
+ * The interaction's request parameters for the consent screen: `client_id` and the
+ * standard string parameters are guaranteed strings (or absent); everything else is
+ * passed through untouched.
+ */
+export function consentRequestParams(raw) {
+    const params = { ...raw, client_id: String(raw?.client_id ?? '') };
+    for (const key of CONSENT_STRING_PARAMS) {
+        const value = raw?.[key];
+        if (typeof value === 'string')
+            params[key] = value;
+        else
+            delete params[key];
+    }
+    return params;
+}

package/build/src/host/controllers/account_apps_controller.js

@@ -4,7 +4,7 @@ import { personalAgentsFor } from '../../agents/runtime.js';
 import { accountPath } from '../account_paths.js';
 import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
-import { clientDisplayNames } from '../client_names.js';
+import { clientDisplayInfo } from '../client_names.js';
 /**
  * Self-service de consentimento ("apps com acesso") no console de conta. Lista os
  * Grants da própria conta agrupados por client (resolvendo o nome do client da
@@ -23,8 +23,8 @@ export default class AccountAppsController {
         const supported = sessions.canList;
         const grantList = supported ? await sessions.listGrants(accountId) : [];
         // O nome que o client registrou; sem ele, o clientId.
-        const names = await clientDisplayNames(service, grantList.map((g) => g.clientId).filter((id) => !!id));
-        const nameOf = (clientId) => clientId ? (names.get(clientId) ?? clientId) : '';
+        const info = await clientDisplayInfo(service, grantList.map((g) => g.clientId).filter((id) => !!id));
+        const nameOf = (clientId) => clientId ? (info.get(clientId)?.name ?? clientId) : '';
         const revoked = ctx.session.flashMessages.get('appRevoked');
         // Personal agents com delegação ativa (só quando a feature está ligada).
         const agentsRuntime = await personalAgentsFor(ctx);
@@ -58,6 +58,7 @@ export default class AccountAppsController {
                 .map((g) => ({
                 clientId: g.clientId,
                 name: nameOf(g.clientId),
+                logoUrl: info.get(g.clientId)?.logoUrl ?? null,
                 accessTokens: g.accessTokens,
                 refreshTokens: g.refreshTokens,
             })),

package/build/src/host/controllers/account_confirm_controller.d.ts

@@ -9,13 +9,6 @@
  */
 import '../augmentations.js';
 import type { HttpContext } from '@adonisjs/core/http';
-import { sudoContextFrom } from '../sudo/runtime.js';
-/**
- * Reexport de compatibilidade. O construtor canônico do `SudoContext` vive em
- * `sudo/runtime.ts` (é runtime do SPI, não detalhe da tela); este caminho
- * antigo segue valendo para quem já o importava.
- */
-export { sudoContextFrom };
 export default class AccountConfirmController {
     show(ctx: HttpContext): Promise<unknown>;
 }

package/build/src/host/controllers/account_confirm_controller.js

@@ -9,12 +9,6 @@
  */
 import '../augmentations.js';
 import { configuredSudoMethods, isSudoMethodMounted, LAST_METHOD_SESSION_KEY, resolveAvailableMethods, sudoContextFrom, } from '../sudo/runtime.js';
-/**
- * Reexport de compatibilidade. O construtor canônico do `SudoContext` vive em
- * `sudo/runtime.ts` (é runtime do SPI, não detalhe da tela); este caminho
- * antigo segue valendo para quem já o importava.
- */
-export { sudoContextFrom };
 export default class AccountConfirmController {
     async show(ctx) {
         const c = await sudoContextFrom(ctx);

package/build/src/host/controllers/account_orgs_controller.d.ts

@@ -27,54 +27,4 @@ export default class AccountOrgsController {
     removeMember(ctx: HttpContext): Promise<void>;
     /** POST /account/orgs/:id/invitations/:invId/revoke */
     revokeInvitation(ctx: HttpContext): Promise<void>;
-    /**
-     * GET /account/orgs/json — lista as orgs do usuário logado com papel + se ativa.
-     * Usado pelo hook `useOrganizations()`.
-     */
-    listJson(ctx: HttpContext): Promise<void | {
-        supported: boolean;
-        activeOrgId: any;
-        orgs: {
-            id: string;
-            name: string;
-            slug: string;
-            logoUrl: string | null;
-            role: string;
-            isActive: boolean;
-        }[];
-    }>;
-    /**
-     * GET /account/orgs/:id/json — detalhes da org ativa (para uso pelo hook `useOrganization()`).
-     * Só retorna se o usuário é membro.
-     */
-    showJson(ctx: HttpContext): Promise<void | {
-        id: string;
-        name: string;
-        slug: string;
-        logoUrl: string | null;
-        role: string;
-        canManage: boolean;
-        members: {
-            accountId: string;
-            email: string | null;
-            role: string;
-            joinedAt: string;
-        }[];
-    }>;
-    /**
-     * GET /account/orgs/invitations/json — lista convites pendentes pro e-mail do usuário logado.
-     * Usado pelo hook `useOrgInvitations()`.
-     */
-    listInvitationsJson(ctx: HttpContext): Promise<void | {
-        invitations: {
-            id: string;
-            organizationId: string;
-            orgName: string;
-            orgSlug: string;
-            email: string;
-            role: string;
-            expiresAt: string;
-            createdAt: string;
-        }[];
-    }>;
 }

package/build/src/host/controllers/account_orgs_controller.js

@@ -27,12 +27,10 @@ export default class AccountOrgsController {
         const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
-        const messages = cfg.messages;
         if (!supportsOrganizations(store)) {
             return cfg.render
                 ? cfg.render(ctx, 'account/orgs', {
                     supported: false,
-                    messages,
                     csrfToken: ctx.request.csrfToken,
                 })
                 : response.notFound();
@@ -64,10 +62,11 @@ export default class AccountOrgsController {
             pendingInvitations: invitationsWithOrg,
             allowSelfCreate: policy.allowSelfCreate,
             availableRoles: policy.roles,
-            messages,
             csrfToken: ctx.request.csrfToken,
         };
-        return cfg.render ? cfg.render(ctx, 'account/orgs', props) : response.notFound();
+        return cfg.render
+            ? cfg.render(ctx, 'account/orgs', props)
+            : response.notFound();
     }
     /** POST /account/orgs — criar nova org (requer allowSelfCreate). */
     async store(ctx) {
@@ -265,11 +264,13 @@ export default class AccountOrgsController {
         const props = {
             invitation,
             token: params.token,
-            messages: cfg.messages,
             csrfToken: ctx.request.csrfToken,
         };
         return cfg.render
-            ? cfg.render(ctx, 'account/orgs', { ...props, subview: 'accept-invitation' })
+            ? cfg.render(ctx, 'account/orgs', {
+                ...props,
+                subview: 'accept-invitation',
+            })
             : response.notFound();
     }
     /** POST /account/orgs/invitations/:token/accept — processa aceite. */
@@ -351,111 +352,4 @@ export default class AccountOrgsController {
         });
         return response.redirect(accountPath('orgs'));
     }
-    // ──────────────────────────────────────────────────────────────────────────
-    // JSON endpoints — consumed by @adonis-agora/authkit-react hooks.
-    // ──────────────────────────────────────────────────────────────────────────
-    /**
-     * GET /account/orgs/json — lista as orgs do usuário logado com papel + se ativa.
-     * Usado pelo hook `useOrganizations()`.
-     */
-    async listJson(ctx) {
-        const { session, response, request } = ctx;
-        const service = await ctx.containerResolver.make('authkit.server');
-        const cfg = service.config;
-        const store = cfg.accountStore;
-        if (!supportsOrganizations(store))
-            return { supported: false, orgs: [], activeOrgId: null };
-        const accountId = session.get(ACCOUNT_SESSION_KEY);
-        if (!accountId)
-            return response.unauthorized({ message: 'Not authenticated.' });
-        const orgs = await store.listOrgsForAccount(accountId);
-        const activeOrgRaw = request.cookie(ACTIVE_ORG_COOKIE);
-        const activeOrgId = activeOrgRaw ? activeOrgRaw.split('\t')[0] : null;
-        return {
-            supported: true,
-            activeOrgId,
-            orgs: orgs.map((org) => ({
-                id: org.id,
-                name: org.name,
-                slug: org.slug,
-                logoUrl: org.logoUrl ?? null,
-                role: org.role,
-                isActive: org.id === activeOrgId,
-            })),
-        };
-    }
-    /**
-     * GET /account/orgs/:id/json — detalhes da org ativa (para uso pelo hook `useOrganization()`).
-     * Só retorna se o usuário é membro.
-     */
-    async showJson(ctx) {
-        const { session, response, params } = ctx;
-        const service = await ctx.containerResolver.make('authkit.server');
-        const cfg = service.config;
-        const store = cfg.accountStore;
-        if (!supportsOrganizations(store))
-            return response.notFound({ message: 'Not supported.' });
-        const accountId = session.get(ACCOUNT_SESSION_KEY);
-        if (!accountId)
-            return response.unauthorized({ message: 'Not authenticated.' });
-        const membership = await store.getOrgMembership(params.id, accountId);
-        if (!membership)
-            return response.notFound({ message: 'Organization not found or not a member.' });
-        const org = await store.findOrgById(params.id);
-        if (!org)
-            return response.notFound({ message: 'Organization not found.' });
-        const canManage = membership.role === 'owner' || membership.role === 'admin';
-        const members = canManage ? await store.listOrgMembers(params.id) : [];
-        const enrichedMembers = await Promise.all(members.map(async (m) => {
-            const account = await store.findById(m.accountId);
-            return {
-                accountId: m.accountId,
-                email: account?.email ?? null,
-                role: m.role,
-                joinedAt: m.joinedAt,
-            };
-        }));
-        return {
-            id: org.id,
-            name: org.name,
-            slug: org.slug,
-            logoUrl: org.logoUrl ?? null,
-            role: membership.role,
-            canManage,
-            members: enrichedMembers,
-        };
-    }
-    /**
-     * GET /account/orgs/invitations/json — lista convites pendentes pro e-mail do usuário logado.
-     * Usado pelo hook `useOrgInvitations()`.
-     */
-    async listInvitationsJson(ctx) {
-        const { session, response } = ctx;
-        const service = await ctx.containerResolver.make('authkit.server');
-        const cfg = service.config;
-        const store = cfg.accountStore;
-        if (!supportsOrganizations(store))
-            return { invitations: [] };
-        const accountId = session.get(ACCOUNT_SESSION_KEY);
-        if (!accountId)
-            return response.unauthorized({ message: 'Not authenticated.' });
-        const account = await store.findById(accountId);
-        if (!account)
-            return response.unauthorized({ message: 'Not authenticated.' });
-        const invitations = await store.listPendingInvitationsForEmail(account.email);
-        const enriched = await Promise.all(invitations.map(async (inv) => {
-            const org = await store.findOrgById(inv.organizationId);
-            return {
-                id: inv.id,
-                organizationId: inv.organizationId,
-                orgName: org?.name ?? inv.organizationId,
-                orgSlug: org?.slug ?? inv.organizationId,
-                email: inv.email,
-                role: inv.role,
-                expiresAt: inv.expiresAt,
-                createdAt: inv.createdAt,
-            };
-        }));
-        return { invitations: enriched };
-    }
 }

package/build/src/host/controllers/account_security_controller.js

@@ -426,7 +426,7 @@ export default class AccountSecurityController {
         });
         const origin = authkitOrigin(cfg);
         const confirmUrl = `${origin}${accountPath('emailConfirm')}?token=${encodeURIComponent(issued.token)}`;
-        // 1. Link de confirmação → NOVO e-mail (hook onEmailChangeConfirm > onEmailVerification > default).
+        // 1. Link de confirmação → NOVO e-mail (hook onEmailChangeConfirm > default).
         if (cfg.mail?.onEmailChangeConfirm) {
             await cfg.mail.onEmailChangeConfirm({
                 email: newEmail,
@@ -435,14 +435,6 @@ export default class AccountSecurityController {
                 oldEmail: account?.email ?? '',
             });
         }
-        else if (cfg.mail?.onEmailVerification) {
-            // Retrocompat: hook legado onEmailVerification (ainda funciona como override).
-            await cfg.mail.onEmailVerification({
-                email: newEmail,
-                verifyUrl: confirmUrl,
-                token: issued.token,
-            });
-        }
         else {
             await sendEmailChangeConfirmationEmail(ctx, {
                 email: newEmail,
@@ -513,7 +505,9 @@ export default class AccountSecurityController {
         const store = cfg.accountStore;
         const render = cfg.render;
         if (!supportsAccountSecurity(store)) {
-            return render(ctx, 'account/email-confirmed', { ok: false });
+            return render(ctx, 'account/email-confirmed', {
+                ok: false,
+            });
         }
         const token = ctx.request.qs().token ?? '';
         const result = await store.confirmEmailChange(token);
@@ -551,6 +545,8 @@ export default class AccountSecurityController {
                 metadata: { oldEmail: result.oldEmail, newEmail: result.newEmail },
             }, cfg.mail, cfg.audit, cfg);
         }
-        return render(ctx, 'account/email-confirmed', { ok: result.ok });
+        return render(ctx, 'account/email-confirmed', {
+            ok: result.ok,
+        });
     }
 }

package/build/src/host/controllers/agent_consent_controller.js

@@ -51,14 +51,20 @@ export default class AgentConsentController {
             error: null,
         };
         if (impersonationState(ctx).active) {
-            return render(ctx, 'agents/consent', { ...base, error: 'agents.consent.impersonating' });
+            return render(ctx, 'agents/consent', {
+                ...base,
+                error: 'agents.consent.impersonating',
+            });
         }
         const input = ctx.request.input('user_code');
         if (!input)
             return render(ctx, 'agents/consent', base);
         const pending = await runtime.delegation.pendingRequest(input);
         if (!pending) {
-            return render(ctx, 'agents/consent', { ...base, error: 'agents.consent.invalid_code' });
+            return render(ctx, 'agents/consent', {
+                ...base,
+                error: 'agents.consent.invalid_code',
+            });
         }
         const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
         const account = await service.config.accountStore.findById(accountId);
@@ -96,7 +102,11 @@ export default class AgentConsentController {
         const userCode = typeof rawCode === 'string' ? rawCode : '';
         const pending = await runtime.delegation.pendingRequest(userCode);
         if (!pending) {
-            return render(ctx, 'agents/done', { status: 'expired', agentName: null, scopes: [] });
+            return render(ctx, 'agents/done', {
+                status: 'expired',
+                agentName: null,
+                scopes: [],
+            });
         }
         const name = await agentName(runtime, pending.clientId);
         const raw = ctx.request.input('scope');
@@ -108,7 +118,11 @@ export default class AgentConsentController {
             // Negou ou desmarcou tudo. Se nem negar deu, o pedido mudou de estado no
             // meio do caminho (aprovado em outra aba, expirou).
             if (!(await runtime.delegation.deny({ userCode, accountId }))) {
-                return render(ctx, 'agents/done', { status: 'expired', agentName: name, scopes: [] });
+                return render(ctx, 'agents/done', {
+                    status: 'expired',
+                    agentName: name,
+                    scopes: [],
+                });
             }
             await cfg.audit?.record({
                 type: 'agent.delegation_denied',
@@ -117,7 +131,11 @@ export default class AgentConsentController {
                 ip: ctx.request.ip?.() ?? null,
                 metadata: { requested: pending.scopes.map((s) => s.id) },
             });
-            return render(ctx, 'agents/done', { status: 'denied', agentName: name, scopes: [] });
+            return render(ctx, 'agents/done', {
+                status: 'denied',
+                agentName: name,
+                scopes: [],
+            });
         }
         await cfg.audit?.record({
             type: 'agent.delegation_approved',

package/build/src/host/controllers/interaction_controller.js

@@ -4,6 +4,7 @@ import { resolveAccountRoles } from '../account_roles.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
 import { guardBotProtection, resolveEffectiveBotProtection } from '../bot_protection.js';
 import { brandFor, isFirstParty } from '../branding.js';
+import { consentRequestParams } from '../consent_params.js';
 import { isCustomLoginMethodId } from '../custom_login.js';
 import { completeCustomLoginSession } from '../custom_login_completion.js';
 import { beginCustomMfa, clearMfaFlow, customMfaViewProps, getMfaFlow, initializeMfaFlow, recordVerifiedMfaFactor, resolveCustomMfaMethods, verifyCustomMfa, } from '../custom_mfa.js';
@@ -264,7 +265,7 @@ export default class AuthInteractionController {
             // Consent or other prompts — unchanged
             return render(ctx, 'consent', {
                 uid: details.uid,
-                params: details.params,
+                params: consentRequestParams(details.params),
                 csrfToken: ctx.request.csrfToken,
                 brand,
                 ...(await consentSubject(service, details, cfg.messages)),
@@ -1950,7 +1951,10 @@ export default class AuthInteractionController {
                     ip,
                     metadata: { reason: 'token_expired' },
                 });
-                return render(ctx, 'otp-unlock', { ok: false, expired: true });
+                return render(ctx, 'otp-unlock', {
+                    ok: false,
+                    expired: true,
+                });
             }
             // Token válido: zera o lock OTP + limpa o token do DB.
             const runtimeForOtp = await resolveRuntimeSettingsOrNoop(ctx);

package/build/src/host/controllers/poppy_consent_controller.js

@@ -44,7 +44,11 @@ export default class PoppyConsentController {
             return redirectExact(ctx.response, outcome.url);
         if (outcome.kind === 'error') {
             ctx.response.status(400);
-            return render(ctx, 'agents/done', { status: 'invalid', agentName: null, scopes: [] });
+            return render(ctx, 'agents/done', {
+                status: 'invalid',
+                agentName: null,
+                scopes: [],
+            });
         }
         const account = await service.config.accountStore.findById(accountId);
         return render(ctx, 'agents/consent', {
@@ -72,7 +76,11 @@ export default class PoppyConsentController {
         const cfg = service.config;
         const render = cfg.render;
         if (impersonationState(ctx).active) {
-            return render(ctx, 'agents/done', { status: 'expired', agentName: null, scopes: [] });
+            return render(ctx, 'agents/done', {
+                status: 'expired',
+                agentName: null,
+                scopes: [],
+            });
         }
         const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
         const decided = await poppy.decideAuthorization({
@@ -82,7 +90,11 @@ export default class PoppyConsentController {
             scopes: chosenScopes(ctx),
         });
         if (!decided) {
-            return render(ctx, 'agents/done', { status: 'expired', agentName: null, scopes: [] });
+            return render(ctx, 'agents/done', {
+                status: 'expired',
+                agentName: null,
+                scopes: [],
+            });
         }
         await cfg.audit?.record({
             type: decided.approved ? 'agent.delegation_approved' : 'agent.delegation_denied',
@@ -110,14 +122,20 @@ export default class PoppyConsentController {
             error: null,
         };
         if (impersonationState(ctx).active) {
-            return render(ctx, 'agents/consent', { ...base, error: 'agents.consent.impersonating' });
+            return render(ctx, 'agents/consent', {
+                ...base,
+                error: 'agents.consent.impersonating',
+            });
         }
         const input = ctx.request.input('user_code');
         if (!input)
             return render(ctx, 'agents/consent', base);
         const pending = await poppy.pendingDevice(input);
         if (!pending) {
-            return render(ctx, 'agents/consent', { ...base, error: 'agents.consent.invalid_code' });
+            return render(ctx, 'agents/consent', {
+                ...base,
+                error: 'agents.consent.invalid_code',
+            });
         }
         const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
         const account = await service.config.accountStore.findById(accountId);
@@ -143,7 +161,11 @@ export default class PoppyConsentController {
         const cfg = service.config;
         const render = cfg.render;
         if (impersonationState(ctx).active) {
-            return render(ctx, 'agents/done', { status: 'expired', agentName: null, scopes: [] });
+            return render(ctx, 'agents/done', {
+                status: 'expired',
+                agentName: null,
+                scopes: [],
+            });
         }
         const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
         const userCode = String(ctx.request.input('user_code') ?? '');
@@ -155,7 +177,11 @@ export default class PoppyConsentController {
             scopes: chosenScopes(ctx),
         });
         if (!decided || !pending) {
-            return render(ctx, 'agents/done', { status: 'expired', agentName: null, scopes: [] });
+            return render(ctx, 'agents/done', {
+                status: 'expired',
+                agentName: null,
+                scopes: [],
+            });
         }
         await cfg.audit?.record({
             type: decided.approved ? 'agent.delegation_approved' : 'agent.delegation_denied',

package/build/src/host/controllers/registration_controller.js

@@ -450,7 +450,10 @@ export default class AuthRegistrationController {
         const cfg = service.config;
         const render = cfg.render;
         const token = ctx.request.qs().token ?? '';
-        return render(ctx, 'reset', { token, csrfToken: ctx.request.csrfToken });
+        return render(ctx, 'reset', {
+            token,
+            csrfToken: ctx.request.csrfToken,
+        });
     }
     /** POST /auth/reset-password — redefine a senha. */
     async reset(ctx) {
@@ -552,6 +555,8 @@ export default class AuthRegistrationController {
                 ip: ctx.request.ip?.() ?? null,
             });
         }
-        return render(ctx, 'verify-email', { verified: ok });
+        return render(ctx, 'verify-email', {
+            verified: ok,
+        });
     }
 }

package/build/src/host/i18n.d.ts

@@ -346,7 +346,6 @@ export declare const DEFAULT_MESSAGES: {
     'admin.clients.grants': string;
     'admin.clients.redirect_uris': string;
     'admin.clients.dynamic_notice': string;
-    'admin.clients.static_section': string;
     'admin.clients.dynamic_section': string;
     'admin.clients.dynamic_empty': string;
     'admin.clients.dynamic_not_supported': string;
@@ -377,7 +376,6 @@ export declare const DEFAULT_MESSAGES: {
     'admin.clients.field_backchannel_uri_help': string;
     'admin.clients.field_backchannel_session_required': string;
     'admin.clients.field_backchannel_session_required_help': string;
-    'admin.clients.static_deprecated_notice': string;
     'admin.orgs.page_title': string;
     'admin.orgs.title': string;
     'admin.orgs.detail_title': string;
@@ -1141,7 +1139,6 @@ export declare const PT_BR_MESSAGES: {
     'admin.clients.grants': string;
     'admin.clients.redirect_uris': string;
     'admin.clients.dynamic_notice': string;
-    'admin.clients.static_section': string;
     'admin.clients.dynamic_section': string;
     'admin.clients.dynamic_empty': string;
     'admin.clients.dynamic_not_supported': string;
@@ -1172,7 +1169,6 @@ export declare const PT_BR_MESSAGES: {
     'admin.clients.field_backchannel_uri_help': string;
     'admin.clients.field_backchannel_session_required': string;
     'admin.clients.field_backchannel_session_required_help': string;
-    'admin.clients.static_deprecated_notice': string;
     'admin.audit.page_title': string;
     'admin.audit.title': string;
     'admin.audit.type_placeholder': string;

package/build/src/host/i18n.js

@@ -367,7 +367,6 @@ export const DEFAULT_MESSAGES = {
     'admin.clients.grants': 'Grants: {grants}',
     'admin.clients.redirect_uris': 'Redirects: {uris}',
     'admin.clients.dynamic_notice': 'Dynamic client registration (RFC 7591) is on — clients registered via /reg are persisted in the adapter and appear in the dynamic section below.',
-    'admin.clients.static_section': 'Static clients (config)',
     'admin.clients.dynamic_section': 'Dynamic clients (adapter)',
     'admin.clients.dynamic_empty': 'No dynamic clients persisted.',
     'admin.clients.dynamic_not_supported': 'The configured OIDC adapter does not support client enumeration — dynamic management is unavailable.',
@@ -398,8 +397,6 @@ export const DEFAULT_MESSAGES = {
     'admin.clients.field_backchannel_uri_help': 'OIDC Back-Channel Logout endpoint of the RP. Leave blank if not needed.',
     'admin.clients.field_backchannel_session_required': 'Require sid in logout_token',
     'admin.clients.field_backchannel_session_required_help': 'When checked, the IdP includes the session ID (sid) in every logout_token sent to this client.',
-    'admin.clients.static_deprecated_notice': 'These clients are defined statically in config and are deprecated. ' +
-        'Migrate them to the adapter/DB with:',
     // Console admin — organizations.
     'admin.orgs.page_title': 'Organizations',
     'admin.orgs.title': 'Organizations',
@@ -1250,7 +1247,6 @@ export const PT_BR_MESSAGES = {
     'admin.clients.grants': 'Grants: {grants}',
     'admin.clients.redirect_uris': 'Redirects: {uris}',
     'admin.clients.dynamic_notice': 'O registro dinâmico de clients (RFC 7591) está ligado — clients registrados via /reg são persistidos no adapter e aparecem na seção dinâmica abaixo.',
-    'admin.clients.static_section': 'Clients estáticos (config)',
     'admin.clients.dynamic_section': 'Clients dinâmicos (adapter)',
     'admin.clients.dynamic_empty': 'Nenhum client dinâmico persistido.',
     'admin.clients.dynamic_not_supported': 'O adapter OIDC configurado não suporta enumeração de clients — a gestão dinâmica fica indisponível.',
@@ -1281,8 +1277,6 @@ export const PT_BR_MESSAGES = {
     'admin.clients.field_backchannel_uri_help': 'Endpoint de OIDC Back-Channel Logout do RP. Deixe em branco se não usar.',
     'admin.clients.field_backchannel_session_required': 'Exigir sid no logout_token',
     'admin.clients.field_backchannel_session_required_help': 'Quando marcado, o IdP inclui o session ID (sid) em cada logout_token enviado a este client.',
-    'admin.clients.static_deprecated_notice': 'Estes clients estão definidos estaticamente no config e estão depreciados. ' +
-        'Migre-os para o adapter/DB com:',
     // Console admin — auditoria.
     'admin.audit.page_title': 'Auditoria',
     'admin.audit.title': 'Log de auditoria',