@adonis-agora/authkit-server 0.90.2 → 1.0.0-rc.0

package/build/src/host/impersonation.d.ts

@@ -18,16 +18,13 @@ export interface ImpersonationPanel {
     curl: string;
 }
 /**
- * Um client candidato a hospedar o token-exchange. Modelado estruturalmente para
- * aceitar tanto os clients ESTÁTICOS do config (`ResolvedServerConfig['clients']`,
- * que trazem o secret) quanto os clients de RUNTIME lidos do adapter pelo
- * `AdminClientsService` (que NÃO trazem o secret — ele não é recuperável).
+ * Um client candidato a hospedar o token-exchange, na forma que o
+ * `AdminClientsService` lê do adapter (sem o secret — ele não é recuperável).
  */
 export interface ImpersonationClientLike {
     clientId: string;
-    clientSecret?: string;
-    grants?: string[];
-    /** Runtime clients reportam confidencialidade sem expor o secret. */
+    grantTypes?: string[];
+    /** Client confidencial: o curl sai com o placeholder do secret. */
     confidential?: boolean;
 }
 /**
@@ -35,12 +32,7 @@ export interface ImpersonationClientLike {
  * client candidato tem o grant token-exchange habilitado (sem ele o fluxo não
  * funciona) — a UI então mostra a instrução de habilitar o grant.
  *
- * ⚠️ `clients` é OBRIGATÓRIO na prática. `cfg.clients` é sempre `[]` num host
- * real: clients são 100% de runtime (console admin / Admin API / `authkit:clients:create`),
- * e o config resolvido nunca os carrega — é o que o `checkClients` do doctor
- * afirma. Passar só o config faria o painel devolver `null` SEMPRE, que foi
- * exatamente o bug: o botão do console nunca teve um client para oferecer.
- * O fallback para `cfg.clients` existe só para hosts que ainda declaram clients
- * estáticos e para os testes que os declaram.
+ * `clients` são os clients do adapter (console admin / Admin API /
+ * `authkit:clients:create`), por exemplo `new AdminClientsService(service).list()`.
  */
-export declare function buildImpersonationPanel(cfg: Pick<ResolvedServerConfig, 'issuer' | 'clients'>, targetId: string, clients?: readonly ImpersonationClientLike[]): ImpersonationPanel | null;
+export declare function buildImpersonationPanel(cfg: Pick<ResolvedServerConfig, 'issuer'>, targetId: string, clients: readonly ImpersonationClientLike[]): ImpersonationPanel | null;

package/build/src/host/impersonation.js

@@ -7,27 +7,18 @@ const SECRET_PLACEHOLDER = '<CLIENT_SECRET>';
  * client candidato tem o grant token-exchange habilitado (sem ele o fluxo não
  * funciona) — a UI então mostra a instrução de habilitar o grant.
  *
- * ⚠️ `clients` é OBRIGATÓRIO na prática. `cfg.clients` é sempre `[]` num host
- * real: clients são 100% de runtime (console admin / Admin API / `authkit:clients:create`),
- * e o config resolvido nunca os carrega — é o que o `checkClients` do doctor
- * afirma. Passar só o config faria o painel devolver `null` SEMPRE, que foi
- * exatamente o bug: o botão do console nunca teve um client para oferecer.
- * O fallback para `cfg.clients` existe só para hosts que ainda declaram clients
- * estáticos e para os testes que os declaram.
+ * `clients` são os clients do adapter (console admin / Admin API /
+ * `authkit:clients:create`), por exemplo `new AdminClientsService(service).list()`.
  */
 export function buildImpersonationPanel(cfg, targetId, clients) {
-    const candidates = clients && clients.length > 0 ? clients : (cfg.clients ?? []);
-    const client = candidates.find((c) => (c.grants ?? []).includes(TOKEN_EXCHANGE));
+    const client = clients.find((c) => (c.grantTypes ?? []).includes(TOKEN_EXCHANGE));
     if (!client)
         return null;
     const tokenEndpoint = `${cfg.issuer.replace(/\/+$/, '')}/token`;
-    // Confidencial = tem secret conhecido, ou o adapter marcou como confidencial.
-    // No segundo caso o secret NÃO é recuperável (o adapter guarda o hash/valor
-    // opaco e a lib mostra o secret uma única vez na criação), então o curl sai
-    // com um placeholder em vez de mentir com uma string vazia.
-    const confidential = client.confidential ?? client.clientSecret !== undefined;
-    const auth = confidential
-        ? `  -u '${client.clientId}:${client.clientSecret ?? SECRET_PLACEHOLDER}' \\\n`
+    // O secret NÃO é recuperável (a lib mostra o secret uma única vez na criação),
+    // então o curl de um client confidencial sai com um placeholder.
+    const auth = client.confidential
+        ? `  -u '${client.clientId}:${SECRET_PLACEHOLDER}' \\\n`
         : `  -d 'client_id=${client.clientId}' \\\n`;
     const curl = `curl -X POST '${tokenEndpoint}' \\\n${auth}  -d 'grant_type=${TOKEN_EXCHANGE}' \\\n  -d 'subject_token=<ADMIN_ACCESS_TOKEN>' \\\n  -d 'subject_token_type=${ACCESS_TOKEN_TYPE}' \\\n  -d 'requested_subject=${targetId}' \\\n  -d 'scope=openid profile email'`;
     return {

package/build/src/host/interaction_recovery.js

@@ -87,7 +87,10 @@ export async function recoverLostInteraction(ctx) {
         return ctx.response.redirect(loginUrl);
     }
     ctx.response.status(400);
-    const body = await render(ctx, 'session-expired', { loginUrl, brand });
+    const body = await render(ctx, 'session-expired', {
+        loginUrl,
+        brand,
+    });
     // ESCREVE o body na resposta. Diferente do dispatch normal de rota — onde o
     // `useReturnValue`/`canWriteResponseBody` do http-server envia o valor
     // retornado — o caminho de exception handler DESCARTA o retorno de

package/build/src/host/login_attempt.js

@@ -231,7 +231,11 @@ export async function attemptPasswordLogin(cfg, input) {
     if (lock.locked) {
         return { ok: false, locked: true, retryAfterSec: lock.retryAfterSec };
     }
-    const account = await cfg.accountStore.verifyCredentials(email, password);
+    // A form posted without a password (e-mail only, typical when password login is
+    // off) is a failed attempt like a wrong password, never a crash in the hasher.
+    const account = typeof password === 'string' && password !== ''
+        ? await cfg.accountStore.verifyCredentials(email, password)
+        : null;
     if (!account) {
         // `clientId` só entra no evento quando o fluxo o fornece (interaction).
         await cfg.audit?.record(input.clientId !== undefined

package/build/src/host/middleware/account_auth.js

@@ -7,6 +7,12 @@ export default class AccountAuthMiddleware {
     async handle(ctx, next) {
         // Sessão do console — ou, com `accountSession.acceptIdpSession`, a do IdP (SSO).
         if (!(await ensureConsoleSession(ctx))) {
+            // JSON callers get a status, not an HTML login page.
+            if (ctx.request?.accepts?.(['html', 'json']) === 'json') {
+                return ctx.response
+                    .status(401)
+                    .send({ error: { code: 'unauthenticated', message: 'Sign in to continue.' } });
+            }
             // Destino configurável (`accountLoginUrl`): default `/account/login`.
             return ctx.response.redirect(getAccountLoginUrl());
         }

package/build/src/host/rate_limit.js

@@ -159,7 +159,11 @@ export function withFriendly429(throttle) {
             ctx.response.status(429);
             if (retryAfter)
                 ctx.response.header('Retry-After', String(retryAfter));
-            const body = await render(ctx, 'throttled', { brand, retryAfter, retryUrl });
+            const body = await render(ctx, 'throttled', {
+                brand,
+                retryAfter,
+                retryUrl,
+            });
             const res = ctx.response;
             if (body !== undefined && !res.hasLazyBody && body !== ctx.response) {
                 res.send(body);

package/build/src/host/register_auth_host.d.ts

@@ -5,6 +5,12 @@ import type { PolicyRouteOption } from './config_locks.js';
 import type { SudoMethod } from './sudo/types.js';
 /** Chave da sessão Adonis que registra o timestamp da última atividade (idle timeout). */
 export declare const ACCOUNT_LAST_SEEN_KEY = "authkit_last_seen";
+/**
+ * `true` when the caller wants JSON (an `Accept` that prefers `application/json`,
+ * as `fetch` from the React client sends): a JSON API answers it with a status,
+ * not with a redirect to an HTML login page.
+ */
+export declare function wantsJson(ctx: any): boolean;
 /**
  * Guard do console admin (B6). Como o `accountGuard`, é uma closure inline (forma
  * confiável do `.use()` num grupo). Exige:

package/build/src/host/register_auth_host.js

@@ -119,6 +119,28 @@ function isPoppyBrowser(ctx) {
     const marker = ctx.session?.get?.(POPPY_WEB_SESSION_KEY);
     return typeof marker === 'object' && marker !== null && typeof marker.sessionId === 'string';
 }
+/**
+ * `true` when the caller wants JSON (an `Accept` that prefers `application/json`,
+ * as `fetch` from the React client sends): a JSON API answers it with a status,
+ * not with a redirect to an HTML login page.
+ */
+export function wantsJson(ctx) {
+    try {
+        return ctx.request?.accepts?.(['html', 'json']) === 'json';
+    }
+    catch {
+        return false;
+    }
+}
+/** 401 for a JSON caller, otherwise the redirect to the login. */
+function unauthenticated(ctx, redirectTo) {
+    if (wantsJson(ctx)) {
+        return ctx.response
+            .status(401)
+            .send({ error: { code: 'unauthenticated', message: 'Sign in to continue.' } });
+    }
+    return redirectExact(ctx.response, redirectTo);
+}
 const accountGuard = async (ctx, next) => {
     // O navegador de um personal agent Poppy (§5) não entra no console de conta nem
     // nas telas de consentimento: a sessão é do agente, não do usuário.
@@ -126,12 +148,12 @@ const accountGuard = async (ctx, next) => {
         return ctx.response.status(403).send('');
     // Sessão do console — ou, com `accountSession.acceptIdpSession`, a do IdP (SSO).
     if (!(await ensureConsoleSession(ctx))) {
-        return redirectExact(ctx.response, buildLoginRedirect(ctx));
+        return unauthenticated(ctx, buildLoginRedirect(ctx));
     }
     // Idle timeout: encerra e redireciona com query param de motivo.
     const idleExpired = await checkAndRefreshIdle(ctx);
     if (idleExpired) {
-        return redirectExact(ctx.response, buildLoginRedirect(ctx, 'reason=idle'));
+        return unauthenticated(ctx, buildLoginRedirect(ctx, 'reason=idle'));
     }
     return next();
 };
@@ -162,12 +184,12 @@ export const adminGuard = async (ctx, next) => {
     const accountId = ctx.session?.get(ACCOUNT_SESSION_KEY);
     if (!accountId) {
         // `/account/login` é sempre o login da conta — NÃO muda com o prefixo admin.
-        return redirectExact(ctx.response, buildLoginRedirect(ctx));
+        return unauthenticated(ctx, buildLoginRedirect(ctx));
     }
     // Idle timeout: também protege o console admin.
     const idleExpired = await checkAndRefreshIdle(ctx);
     if (idleExpired) {
-        return redirectExact(ctx.response, buildLoginRedirect(ctx, 'reason=idle'));
+        return unauthenticated(ctx, buildLoginRedirect(ctx, 'reason=idle'));
     }
     const allowed = cfg.admin.roles;
     const account = await cfg.accountStore.findById(accountId);
@@ -179,6 +201,11 @@ export const adminGuard = async (ctx, next) => {
     if (!isAdmin) {
         // Evita vazar a existência do console admin: redireciona para o accountHome
         // (sem mostrar a URL do admin).
+        if (wantsJson(ctx)) {
+            return ctx.response
+                .status(403)
+                .send({ error: { code: 'forbidden', message: 'Admin role required.' } });
+        }
         return ctx.response.redirect(accountHome(cfg));
     }
     return next();
@@ -770,10 +797,6 @@ export function registerAuthHost(router, opts = {}) {
                 C.accountOrgs,
                 'revokeInvitation',
             ]);
-            // JSON endpoints for React hooks (authkit-react).
-            router.get(`${orgsPath}/json`, [C.accountOrgs, 'listJson']);
-            router.get(`${orgsPath}/invitations/json`, [C.accountOrgs, 'listInvitationsJson']);
-            router.get(`${orgsPath}/:id/json`, [C.accountOrgs, 'showJson']);
         }
         // ─── Account self-service JSON API (authkit-react TanStack hooks) ─────
         // ⚠️ ORDER MATTERS: fixed-segment routes before parameterised ones.
@@ -925,6 +948,7 @@ export function registerAuthHost(router, opts = {}) {
             // Clients OIDC.
             router.get(`${ap}/api/clients`, [C.consoleClients, 'index']);
             router.post(`${ap}/api/clients`, [C.consoleClients, 'store']);
+            router.get(`${ap}/api/clients/:id`, [C.consoleClients, 'show']);
             router.patch(`${ap}/api/clients/:id`, [C.consoleClients, 'update']);
             router.delete(`${ap}/api/clients/:id`, [C.consoleClients, 'destroy']);
             router.post(`${ap}/api/clients/:id/regenerate-secret`, [

package/build/src/host/renderers/inertia_renderer.d.ts

@@ -1,4 +1,5 @@
 import type { HttpContext } from '@adonisjs/core/http';
+import type { AuthkitScreen } from '../screen_props.js';
 /**
  * Opções do renderer Inertia/React.
  */
@@ -11,18 +12,10 @@ export interface InertiaRendererOptions {
     /**
      * Lista de nomes de view que o host criou como páginas React (allowlist).
      *
-     * Quando fornecida, **somente** as views listadas passam pelo Inertia; qualquer
-     * outra view (não listada, ou prefixada com `admin/`) recai silenciosamente no
-     * renderer Edge built-in da lib — sem erro 500.
-     *
-     * ### ⚠️ Atenção: sem `views`, qualquer tela nova da lib quebra hosts SSR
-     *
-     * Se `views` for omitido, o comportamento legado é preservado (todas as views
-     * são enviadas ao Inertia) para compatibilidade retroativa. Nesse modo, qualquer
-     * tela nova adicionada pela lib gerará um erro SSR no host ("Cannot read
-     * properties of undefined (reading 'default')") porque o host não terá criado a
-     * página React correspondente. **Recomenda-se sempre fornecer `views`** com
-     * exatamente as páginas que o scaffold (`node ace configure`) gerou.
+     * **Somente** as views listadas passam pelo Inertia; qualquer outra view (não
+     * listada, ou prefixada com `admin/`) é renderizada pelo renderer Edge built-in
+     * da lib. Liste exatamente as páginas que o scaffold (`node ace configure`)
+     * gerou, mais as que você criar.
      *
      * A ordem do array é irrelevante — `views` é tratado como um *conjunto*
      * (allowlist). Os nomes têm autocomplete via {@link AuthkitScreen}.
@@ -38,14 +31,9 @@ export interface InertiaRendererOptions {
      *   ],
      * })
      */
-    views?: AuthkitScreen[];
+    views: readonly AuthkitScreen[];
 }
-/**
- * Nomes das telas conhecidas da lib — dá autocomplete no array `views`.
- * O `(string & {})` mantém o tipo aberto: telas custom (ou de versões mais
- * novas da lib) continuam aceitas sem erro de compilação.
- */
-export type AuthkitScreen = 'login' | 'signup' | 'consent' | 'forgot' | 'reset' | 'verify-email' | 'mfa-challenge' | 'otp-unlock' | 'maintenance' | 'session-expired' | 'account/login' | 'account/tokens' | 'account/mfa' | 'account/security' | 'account/apps' | 'account/orgs' | 'account/confirm' | 'account/email-confirmed' | (string & {});
+export type { AuthkitScreen } from '../screen_props.js';
 /**
  * Renderer do seam para hosts Inertia/React.
  *
@@ -53,8 +41,8 @@ export type AuthkitScreen = 'login' | 'signup' | 'consent' | 'forgot' | 'reset'
  * (O console admin não passa por aqui: é a SPA self-contained da lib,
  * servida pelo shell controller.)
  *
- * Quando `views` é fornecido (allowlist), apenas as views listadas vão ao Inertia;
- * qualquer outra view recai no Edge renderer built-in sem erro.
+ * Apenas as views listadas em `views` (allowlist) vão ao Inertia; qualquer outra
+ * view é renderizada pelo Edge renderer built-in.
  *
  * ---
  *

package/build/src/host/renderers/inertia_renderer.js

@@ -24,8 +24,8 @@ async function resolveMessagesFromCtx(ctx) {
  * (O console admin não passa por aqui: é a SPA self-contained da lib,
  * servida pelo shell controller.)
  *
- * Quando `views` é fornecido (allowlist), apenas as views listadas vão ao Inertia;
- * qualquer outra view recai no Edge renderer built-in sem erro.
+ * Apenas as views listadas em `views` (allowlist) vão ao Inertia; qualquer outra
+ * view é renderizada pelo Edge renderer built-in.
  *
  * ---
  *
@@ -59,11 +59,10 @@ async function resolveMessagesFromCtx(ctx) {
  * ```
  */
 export function inertiaRenderer(opts) {
-    const allowed = opts.views ? new Set(opts.views) : null;
+    const allowed = new Set(opts.views);
     return async (ctx, view, props) => {
-        // Allowlist: se `views` foi fornecido e a view não está na lista,
-        // usa o fallback Edge silenciosamente (evita SSR crash por página inexistente no host).
-        if (allowed !== null && !allowed.has(view)) {
+        // Allowlist: view fora da lista vai ao Edge (o host não tem a página React).
+        if (!allowed.has(view)) {
             return renderEdgeView(ctx, view, props);
         }
         // Happy path: view vai ao Inertia.

package/build/src/host/screen_props.d.ts

@@ -0,0 +1,309 @@
+/**
+ * Props of every screen authkit-server renders through `cfg.render` — what an
+ * `inertiaRenderer` page (or a custom renderer) receives for each view.
+ *
+ * `AuthkitScreenProps['<view>']` is the shape a page gets, `messages` included
+ * (the renderer adds it). The controllers call `cfg.render` with
+ * {@link ScreenRenderProps} (the same shape without `messages`), and `render` is
+ * typed per view, so a controller that drifts from these types fails the
+ * package's `tsc`.
+ */
+import type { OrgInvitation, OrgMember, OrgSummary } from '../accounts/account_store.js';
+import type { PatRecord } from '../pat/pat_store.js';
+import type { AccountConfirmProps, AccountEmailConfirmedProps, AccountLoginProps, AccountMfaProps, AccountSecurityProps } from './account_screen_props.js';
+import type { BotProtectionWidget } from './bot_protection.js';
+import type { ClientBrand } from './branding.js';
+import type { CustomMfaDescriptor } from './custom_mfa.js';
+import type { AuthMessages } from './i18n.js';
+import type { LastLoginMethod } from './last_login_method.js';
+import type { MagicChannelProp } from './login_channel.js';
+import type { ResolvedAuthMethods, ResolvedOrganizationsPolicySetting } from './runtime_toggles.js';
+/** What every screen receives from the renderer. */
+interface WithMessages {
+    /** The i18n catalog for the request's locale (added by the renderer). */
+    messages: AuthMessages;
+}
+/** The account a login step is about (step 2+), or `null`. */
+export interface LoginAccount {
+    fullName: string | null;
+    globalRoles: string[];
+}
+/**
+ * `login` — the OIDC interaction's login screen. `step` drives the sub-view:
+ * `identifier` (ask for the e-mail), `password`, or `password_expired`.
+ */
+export interface LoginProps extends WithMessages {
+    uid: string;
+    csrfToken: string;
+    brand?: ClientBrand;
+    step?: 'identifier' | 'password' | 'password_expired';
+    email?: string;
+    account?: LoginAccount | null;
+    error?: string | null;
+    /** `true` shows the link to sign up. */
+    registrationEnabled?: boolean;
+    /** Login methods allowed now (global settings × the account's preference). */
+    authMethods?: ResolvedAuthMethods;
+    magicLinkAvailable?: boolean;
+    otpEnabled?: boolean;
+    /** The method this device signed in with last time, for the "last used" badge. */
+    lastUsedLoginMethod?: LastLoginMethod;
+    passkeyFirstAvailable?: boolean;
+    botProtection?: BotProtectionWidget;
+    rememberEnabled?: boolean;
+    rememberDays?: number;
+    /** `true` after a magic link / code was sent. */
+    magicLinkSent?: boolean;
+    /** Which part of the "sent" state to show; `none` hides both. */
+    magicChannel?: MagicChannelProp | 'none';
+    /** Error of the one-time code field. */
+    otpError?: string;
+}
+/** `signup` — the interaction's registration screen. */
+export interface SignupProps extends WithMessages {
+    uid: string;
+    csrfToken: string;
+    brand?: ClientBrand;
+    error?: string;
+    registrationDisabled?: boolean;
+    registrationDisabledMessage?: string;
+    /** `true` when signup sends a magic link instead of asking for a password. */
+    passwordlessSignup?: boolean;
+    botProtection?: BotProtectionWidget;
+    /** `true` after the passwordless signup link was sent. */
+    magicLinkSent?: boolean;
+    otpEnabled?: boolean;
+}
+/** `forgot` — request a password reset e-mail. */
+export interface ForgotProps extends WithMessages {
+    csrfToken: string;
+    error?: string;
+    botProtection?: BotProtectionWidget;
+    /** `true` after the e-mail was sent. */
+    sent?: boolean;
+}
+/** `reset` — choose a new password from the e-mailed link. */
+export interface ResetProps extends WithMessages {
+    token: string;
+    csrfToken: string;
+    error?: string;
+    /** `true` once the password was changed. */
+    done?: boolean;
+}
+/** `verify-email` — result of the e-mail verification link. */
+export interface VerifyEmailProps extends WithMessages {
+    verified: boolean;
+}
+/** A host-registered second factor, as the `mfa-challenge` screen lists it. */
+export type MfaChallengeCustomMethod = CustomMfaDescriptor & {
+    beginUrl: string;
+    verifyUrl: string;
+    started: boolean;
+};
+/** `mfa-challenge` — the second factor of a login. */
+export interface MfaChallengeProps extends WithMessages {
+    uid: string;
+    csrfToken: string;
+    brand?: ClientBrand;
+    error?: string;
+    totpAvailable?: boolean;
+    passkeyAvailable?: boolean;
+    /** MFA is required but the account has no factor enrolled. */
+    noEnrollment?: boolean;
+    trustedDevicesEnabled?: boolean;
+    trustedDeviceDays?: number;
+    /** Too many wrong codes: the code field is locked for now. */
+    otpLocked?: boolean;
+    customMfaMethods?: MfaChallengeCustomMethod[];
+    completedMfaMethods?: string[];
+    requiredMfaFactors?: number;
+}
+/** A scope on the consent screen. */
+export interface ConsentScope {
+    id: string;
+    label: string;
+}
+/**
+ * The authorization request behind a consent, as the provider parsed it. Only
+ * `client_id` is always there: device-flow and CIBA requests carry no
+ * `redirect_uri` / `response_type`, and plain OAuth requests may omit `scope`.
+ * Every other request parameter (`audience`, `resource`, `claims`, …) keeps its
+ * raw value under its own name.
+ */
+export type ConsentRequestParams = {
+    client_id: string;
+    redirect_uri?: string;
+    response_type?: string;
+    scope?: string;
+    state?: string;
+    prompt?: string;
+    nonce?: string;
+    code_challenge?: string;
+    code_challenge_method?: string;
+} & Record<string, unknown>;
+/** `consent` — the user grants the client the requested scopes. */
+export interface ConsentProps extends WithMessages {
+    uid: string;
+    csrfToken: string;
+    brand?: ClientBrand;
+    /** The authorization request parameters. */
+    params: ConsentRequestParams;
+    /** The client's registered `client_name`, or its `client_id`. */
+    clientName: string;
+    /** `clientName`, HTML-escaped (Edge raw output). */
+    clientNameHtml: string;
+    scopes: ConsentScope[];
+}
+/** `maintenance` — maintenance mode is on. */
+export interface MaintenanceProps extends WithMessages {
+    uid?: string;
+    csrfToken: string;
+    brand?: ClientBrand;
+    message: string;
+    /** Admins may still sign in. */
+    adminLoginAllowed?: boolean;
+    adminLoginNote?: string;
+}
+/** `otp-unlock` — result of the "unlock my code login" link. */
+export interface OtpUnlockProps extends WithMessages {
+    ok: boolean;
+    expired?: boolean;
+}
+/** `session-expired` — the interaction expired or was lost. */
+export interface SessionExpiredProps extends WithMessages {
+    /** Where the "sign in again" button goes (`interactionRecovery.redirectTo`). */
+    loginUrl: string;
+    brand?: ClientBrand;
+}
+/** `throttled` — the request hit a rate limit. */
+export interface ThrottledProps extends WithMessages {
+    brand?: ClientBrand;
+    /** Seconds until a retry is allowed, or `null` when unknown. */
+    retryAfter: number | null;
+    retryUrl: string;
+}
+/** The agent asking for access, on `agents/consent`. */
+export interface AgentConsentRequest {
+    /** Device-flow user code, when the agent uses it. */
+    userCode?: string;
+    agentName: string | null;
+    agentOrigin: string | null;
+    logoUri?: string | null;
+    scopes: Array<{
+        id: string;
+        description: string;
+    }>;
+    /** Extra hidden form fields to send back. */
+    hidden?: Array<{
+        name: string;
+        value: string;
+    }>;
+}
+/** `agents/consent` — the user approves a personal agent's request. */
+export interface AgentsConsentProps extends WithMessages {
+    csrfToken: string;
+    /** The form's POST target. */
+    action: string;
+    /** `null` while the user still has to enter a user code. */
+    request: AgentConsentRequest | null;
+    account: {
+        email: string | null;
+    } | null;
+    /** i18n key of the error to show, or `null`. */
+    error: string | null;
+}
+/** `agents/done` — outcome of a personal agent consent. */
+export interface AgentsDoneProps extends WithMessages {
+    status: 'approved' | 'denied' | 'expired' | 'invalid';
+    agentName: string | null;
+    scopes: Array<{
+        id: string;
+        description: string;
+    }>;
+}
+/** `account/apps` — apps and personal agents with access to the account. */
+export interface AccountAppsProps extends WithMessages {
+    csrfToken: string;
+    supported: boolean;
+    /** Personal agents with a delegation, or `null` when the feature is off. */
+    agents: Array<{
+        id: string;
+        name: string;
+        scopes: Array<{
+            id: string;
+            description: string;
+        }>;
+    }> | null;
+    /** Flash with the revoked app, or `null`. */
+    revoked: string | null;
+    apps: Array<{
+        clientId: string;
+        name: string;
+        /** The client's registered `logo_uri`, or `null`. */
+        logoUrl: string | null;
+        accessTokens: number;
+        refreshTokens: number;
+    }>;
+}
+/** `account/tokens` — personal access tokens. */
+export interface AccountTokensProps extends WithMessages {
+    csrfToken: string;
+    /** The token just created, shown once, or `null`. */
+    createdToken: string | null;
+    tokens: Array<Pick<PatRecord, 'id' | 'name' | 'scopes' | 'audience' | 'lastUsedAt' | 'createdAt'>>;
+}
+/** An organization on `account/orgs`. */
+export type AccountOrg = OrgSummary & {
+    role: string;
+    members: OrgMember[];
+    canManage: boolean;
+    isActive: boolean;
+};
+/**
+ * `account/orgs` — the user's organizations. With `subview: 'accept-invitation'`
+ * it is the invitation acceptance screen (`invitation`, `token`).
+ */
+export interface AccountOrgsProps extends WithMessages {
+    csrfToken: string;
+    supported?: boolean;
+    orgs?: AccountOrg[];
+    pendingInvitations?: Array<OrgInvitation & {
+        orgName: string;
+    }>;
+    allowSelfCreate?: ResolvedOrganizationsPolicySetting['allowSelfCreate'];
+    availableRoles?: ResolvedOrganizationsPolicySetting['roles'];
+    subview?: 'accept-invitation';
+    invitation?: OrgInvitation | null;
+    token?: string;
+}
+/** Props of every screen, by view name. */
+export interface AuthkitScreenProps {
+    login: LoginProps;
+    signup: SignupProps;
+    consent: ConsentProps;
+    forgot: ForgotProps;
+    reset: ResetProps;
+    'verify-email': VerifyEmailProps;
+    'mfa-challenge': MfaChallengeProps;
+    'otp-unlock': OtpUnlockProps;
+    maintenance: MaintenanceProps;
+    'session-expired': SessionExpiredProps;
+    throttled: ThrottledProps;
+    'agents/consent': AgentsConsentProps;
+    'agents/done': AgentsDoneProps;
+    'account/login': AccountLoginProps;
+    'account/tokens': AccountTokensProps;
+    'account/mfa': AccountMfaProps;
+    'account/security': AccountSecurityProps;
+    'account/apps': AccountAppsProps;
+    'account/orgs': AccountOrgsProps;
+    'account/confirm': AccountConfirmProps;
+    'account/email-confirmed': AccountEmailConfirmedProps;
+}
+/** Every screen authkit-server renders. */
+export type AuthkitScreen = keyof AuthkitScreenProps;
+/** What a controller hands `cfg.render` for a view: the page props without `messages`. */
+export type ScreenRenderProps<View extends AuthkitScreen> = Omit<AuthkitScreenProps[View], 'messages'>;
+/** `cfg.render`, typed per view. */
+export type AuthkitScreenRenderer = <View extends AuthkitScreen>(ctx: import('@adonisjs/core/http').HttpContext, view: View, props: ScreenRenderProps<View>) => unknown;
+export {};

package/build/src/host/screen_props.js

@@ -0,0 +1,11 @@
+/**
+ * Props of every screen authkit-server renders through `cfg.render` — what an
+ * `inertiaRenderer` page (or a custom renderer) receives for each view.
+ *
+ * `AuthkitScreenProps['<view>']` is the shape a page gets, `messages` included
+ * (the renderer adds it). The controllers call `cfg.render` with
+ * {@link ScreenRenderProps} (the same shape without `messages`), and `render` is
+ * typed per view, so a controller that drifts from these types fails the
+ * package's `tsc`.
+ */
+export {};