@adonis-agora/authkit-server 1.0.0-rc.0 → 1.0.0-rc.10

package/build/src/doctor/checks.d.ts

@@ -87,7 +87,7 @@ export declare function checkOtpLockout(input: DoctorInput): Finding | null;
 export declare function checkSudoMode(_input: DoctorInput): Finding | null;
 /** rateLimit ligado mas @adonisjs/limiter ausente → warn. */
 export declare function checkRateLimit(input: DoctorInput): Finding;
-/** admin.enabled mas sem roles → warn. Reporta o modo de UI ativo. */
+/** admin.enabled mas sem roles, ou sem `admin.authorize` → warn. Reporta o modo de UI ativo. */
 export declare function checkAdmin(input: DoctorInput): Finding | null;
 /** requireVerifiedEmail ligado mas o store não sabe checar verificação → warn. */
 export declare function checkRequireVerifiedEmail(input: DoctorInput): Finding | null;
@@ -214,6 +214,12 @@ export declare function checkPasskeyAutofill(input: DoctorInput): Finding | null
  * de TERCEIROS precisa saber que existe uma lista para fechar.
  */
 export declare function checkFirstPartyClients(input: DoctorInput): Finding | null;
+/**
+ * Como se entra no console de conta e no console admin. O default é o login do
+ * IdP (SSO, `accountSession.acceptIdpSession`); desligado, o console só tem o
+ * login próprio por senha.
+ */
+export declare function checkConsoleSignIn(input: DoctorInput): Finding | null;
 /**
  * Finding da idade da chave de assinatura managed. `ageDays === null` (sem
  * keystore em arquivo/cofre) → no-op `ok`. Acima de `maxAgeDays` → `warn`.

package/build/src/doctor/checks.js

@@ -311,7 +311,7 @@ export function checkRateLimit(input) {
     }
     return { level: 'ok', message: 'rate-limiting on and @adonisjs/limiter available.' };
 }
-/** admin.enabled mas sem roles → warn. Reporta o modo de UI ativo. */
+/** admin.enabled mas sem roles, ou sem `admin.authorize` → warn. Reporta o modo de UI ativo. */
 export function checkAdmin(input) {
     const admin = input.authkitConfig?.admin;
     if (!admin || admin.enabled !== true)
@@ -323,6 +323,12 @@ export function checkAdmin(input) {
             message: 'admin console on, but no `admin.roles` — nobody will have access (the default ["ADMIN"] was not resolved here).',
         };
     }
+    if (!admin.authorize) {
+        return {
+            level: 'warn',
+            message: `admin console on for roles: ${roles.join(', ')}, but no \`admin.authorize\` — it is open outside production and denies every request in production. Set \`admin.authorize\` in config/authkit.ts.`,
+        };
+    }
     return {
         level: 'ok',
         message: `admin console on for roles: ${roles.join(', ')} (React SPA self-contained — JSON API under {prefix}/api/*).`,
@@ -908,6 +914,43 @@ export function checkFirstPartyClients(input) {
         message: `firstPartyClients: ${allowlist.length} client(s) receive the roles/organization claims (${allowlist.join(', ')}).`,
     };
 }
+/**
+ * Como se entra no console de conta e no console admin. O default é o login do
+ * IdP (SSO, `accountSession.acceptIdpSession`); desligado, o console só tem o
+ * login próprio por senha.
+ */
+export function checkConsoleSignIn(input) {
+    const cfg = input.authkitConfig;
+    if (!cfg)
+        return null;
+    const sso = cfg.accountSession?.acceptIdpSession !== false;
+    const passwordOff = cfg.authMethods?.password === false;
+    const routes = typeof cfg.routes === 'object' && cfg.routes ? cfg.routes : undefined;
+    if (!sso && passwordOff && !routes?.accountLoginUrl) {
+        return {
+            level: 'warn',
+            message: 'The account and admin consoles have no way to sign in unless `registerAuthHost` gets an ' +
+                '`accountLoginUrl`: `accountSession.acceptIdpSession` is false and password login is off ' +
+                '(`authMethods: { password: false }`), and route registration refuses to start without ' +
+                'one. Remove `acceptIdpSession: false` so the consoles sign in through the IdP, or point ' +
+                '`accountLoginUrl` at a login route of your app.',
+        };
+    }
+    if (!sso) {
+        return {
+            level: 'warn',
+            message: 'The consoles use their own password login (`accountSession.acceptIdpSession: false`): ' +
+                'users sign in twice, and passwordless accounts cannot open them. The default (SSO through ' +
+                'the IdP login) is recommended; sensitive operations still ask for sudo.',
+        };
+    }
+    return {
+        level: 'ok',
+        message: 'The consoles sign in through the IdP login (SSO). Sensitive operations ask for sudo. ' +
+            'Make sure admin accounts have MFA enrolled (or require it for everyone with ' +
+            '`mfa.requiredFactors`).',
+    };
+}
 /**
  * Finding da idade da chave de assinatura managed. `ageDays === null` (sem
  * keystore em arquivo/cofre) → no-op `ok`. Acima de `maxAgeDays` → `warn`.
@@ -1007,6 +1050,9 @@ export function runAllChecks(input) {
     const firstPartyClients = checkFirstPartyClients(input);
     if (firstPartyClients)
         findings.push(firstPartyClients);
+    const consoleSignIn = checkConsoleSignIn(input);
+    if (consoleSignIn)
+        findings.push(consoleSignIn);
     return findings;
 }
 /** Há algum finding de nível 'error'? (define o exit code). */

package/build/src/doctor/doctor_input.d.ts

@@ -0,0 +1,27 @@
+import type { ApplicationService } from '@adonisjs/core/types';
+import { type DoctorInput, type Finding } from './checks.js';
+/** Logger mínimo para reportar peers instalados-mas-quebrados. */
+export interface CanImportLogger {
+    warning(msg: string): void;
+}
+/**
+ * Tenta importar um peer; `true` se importável.
+ *
+ * Distingue "não instalado" de "instalado mas quebrado": só um erro de
+ * módulo-não-encontrado (`ERR_MODULE_NOT_FOUND`/`MODULE_NOT_FOUND`) é tratado como
+ * peer ausente (silencioso — é o caso esperado). Qualquer outro erro significa que
+ * o peer ESTÁ presente mas falhou ao carregar (import circular, erro de sintaxe,
+ * config inválida) — isso o doctor precisa gritar, senão um peer quebrado aparece
+ * como "ausente" e o diagnóstico mente.
+ */
+export declare function canImport(specifier: string, logger?: CanImportLogger): Promise<boolean>;
+/**
+ * Monta o `DoctorInput` a partir do app (config `authkit` resolvida, `session`, peers). Usado por
+ * `authkit:doctor` e pelos checks do `agora:doctor`. Lança se `config/authkit.ts` não resolver.
+ */
+export declare function buildDoctorInput(app: ApplicationService, logger?: CanImportLogger): Promise<DoctorInput>;
+/**
+ * O finding de idade da chave de assinatura managed (best-effort): `null` quando o jwks não é
+ * `managed` com store, ou quando o keystore não pôde ser lido.
+ */
+export declare function managedSigningKeyAgeFinding(app: ApplicationService, authkitConfig: Record<string, any> | null): Promise<Finding | null>;

package/build/src/doctor/doctor_input.js

@@ -0,0 +1,86 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { DatabaseAdapter } from '../adapters/database_adapter.js';
+import { resolveAuthkitConfig } from '../commands/resolve_config.js';
+import { defaultEncryptForStore } from '../define_config.js';
+import { signingKeyAgeDays } from '../keys/keystore.js';
+import { KeystoreCodec } from '../keys/keystore_codec.js';
+import { loadEncryptionService } from '../keys/keystore_crypto.js';
+import { KeystoreManager, resolveKeystoreVault } from '../keys/keystore_manager.js';
+import { signingKeyAgeFinding } from './checks.js';
+/**
+ * Tenta importar um peer; `true` se importável.
+ *
+ * Distingue "não instalado" de "instalado mas quebrado": só um erro de
+ * módulo-não-encontrado (`ERR_MODULE_NOT_FOUND`/`MODULE_NOT_FOUND`) é tratado como
+ * peer ausente (silencioso — é o caso esperado). Qualquer outro erro significa que
+ * o peer ESTÁ presente mas falhou ao carregar (import circular, erro de sintaxe,
+ * config inválida) — isso o doctor precisa gritar, senão um peer quebrado aparece
+ * como "ausente" e o diagnóstico mente.
+ */
+export async function canImport(specifier, logger) {
+    try {
+        await import(__rewriteRelativeImportExtension(specifier));
+        return true;
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code !== 'ERR_MODULE_NOT_FOUND' && code !== 'MODULE_NOT_FOUND') {
+            logger?.warning(`⚠️  ${specifier} está instalado mas falhou ao carregar: ${err.message}`);
+        }
+        return false;
+    }
+}
+/**
+ * Monta o `DoctorInput` a partir do app (config `authkit` resolvida, `session`, peers). Usado por
+ * `authkit:doctor` e pelos checks do `agora:doctor`. Lança se `config/authkit.ts` não resolver.
+ */
+export async function buildDoctorInput(app, logger) {
+    const config = await app.container.make('config');
+    // `defineConfig` exporta um config provider — resolve antes de inspecionar,
+    // senão todo campo aparece como "ausente" (provider cru não tem issuer etc.).
+    const authkitConfig = await resolveAuthkitConfig(app, config.get('authkit', null));
+    const sessionConfig = config.get('session', null) ?? null;
+    return {
+        authkitConfig,
+        sessionConfig,
+        peers: {
+            session: await canImport('@adonisjs/session', logger),
+            shield: await canImport('@adonisjs/shield', logger),
+            ally: await canImport('@adonisjs/ally', logger),
+            limiter: await canImport('@adonisjs/limiter', logger),
+        },
+        __adapterClasses: { DatabaseAdapter },
+    };
+}
+/**
+ * O finding de idade da chave de assinatura managed (best-effort): `null` quando o jwks não é
+ * `managed` com store, ou quando o keystore não pôde ser lido.
+ */
+export async function managedSigningKeyAgeFinding(app, authkitConfig) {
+    const jwksInput = (authkitConfig?.jwksConfig ?? authkitConfig?.jwks);
+    if (jwksInput?.source !== 'managed' || !jwksInput?.store)
+        return null;
+    try {
+        const vault = resolveKeystoreVault(jwksInput.store, {
+            makePath: (p) => app.makePath(p),
+            container: app.container,
+        });
+        const encrypt = jwksInput.encrypt ?? defaultEncryptForStore(jwksInput.store);
+        const enc = encrypt ? await loadEncryptionService().catch(() => undefined) : undefined;
+        const mgr = new KeystoreManager(vault, new KeystoreCodec({ encrypt, enc }), jwksInput.algorithm ?? 'RS256');
+        const store = await mgr.read().catch(() => null);
+        const maxAge = jwksInput.rotationDays ?? 90;
+        return signingKeyAgeFinding(signingKeyAgeDays(store), maxAge);
+    }
+    catch {
+        /* idade é best-effort no doctor */
+        return null;
+    }
+}

package/build/src/doctor/index.d.ts

@@ -0,0 +1,5 @@
+import type { AgoraDoctorCheck } from './agora_doctor.js';
+export type { AgoraDoctorCheck, AgoraDoctorRegistry, AgoraDoctorReport, AgoraDoctorResult, AgoraDoctorStatus, } from './agora_doctor.js';
+export { AGORA_DOCTOR_BINDING, registerDoctorChecks } from './agora_doctor.js';
+/** authkit's checks, for `node ace agora:doctor --no-boot` (which imports this entry instead of booting). */
+export declare const agoraDoctorChecks: AgoraDoctorCheck[];

package/build/src/doctor/index.js

@@ -0,0 +1,4 @@
+import { authkitDoctorChecks } from './agora_checks.js';
+export { AGORA_DOCTOR_BINDING, registerDoctorChecks } from './agora_doctor.js';
+/** authkit's checks, for `node ace agora:doctor --no-boot` (which imports this entry instead of booting). */
+export const agoraDoctorChecks = authkitDoctorChecks();

package/build/src/host/access_token_verifier.js

@@ -41,6 +41,10 @@ function fromJwtPayload(payload) {
     if (typeof payload.sub !== 'string' || !payload.sub)
         return null;
     const clientId = payload.client_id;
+    // No user behind it: a `client_credentials` token (a service tenant's, for one) has
+    // `sub` = the client id (RFC 9068 §2.2) and never authenticates an account.
+    if (payload.sub === clientId)
+        return null;
     return {
         format: 'jwt',
         sub: payload.sub,
@@ -209,6 +213,9 @@ export function remoteAccessTokenVerifier(options) {
             return null;
         if (typeof body.sub !== 'string' || !body.sub)
             return null;
+        // `client_credentials` token: no account behind it.
+        if (body.sub === body.client_id)
+            return null;
         if (typeof body.exp === 'number' && body.exp <= Math.floor(Date.now() / 1000))
             return null;
         return {

package/build/src/host/account_api/account_api_controller.js

@@ -611,7 +611,7 @@ export default class AccountApiController {
     /** Personal agents com delegação ativa na conta (scopes aprovados). */
     async listAgents(ctx) {
         const runtime = await personalAgentsFor(ctx);
-        if (!runtime?.delegation && !runtime?.poppy) {
+        if (!runtime || (!runtime.delegation && runtime.extensions.size === 0)) {
             return ctx.response
                 .status(404)
                 .send(apiErr('capability_unsupported', 'Personal agent delegation is not enabled.'));
@@ -620,16 +620,18 @@ export default class AccountApiController {
         const pact = runtime.delegation
             ? (await runtime.delegation.listGrants(userId)).map((g) => ({ ...g, protocol: 'pact' }))
             : [];
-        const poppy = runtime.poppy
-            ? (await runtime.poppy.listGrants(userId)).map((g) => ({ ...g, protocol: 'poppy' }))
-            : [];
-        return { agents: [...pact, ...poppy] };
+        const others = [];
+        for (const [protocol, { runtime: extension }] of runtime.extensions) {
+            for (const g of await extension.listAccountGrants(userId))
+                others.push({ ...g, protocol });
+        }
+        return { agents: [...pact, ...others] };
     }
     // ─── DELETE /account/api/agents/:id ──────────────────────────────────────
     /** Revoga a delegação de um personal agent (efeito imediato nos tokens). */
     async revokeAgent(ctx) {
         const runtime = await personalAgentsFor(ctx);
-        if (!runtime?.delegation && !runtime?.poppy) {
+        if (!runtime || (!runtime.delegation && runtime.extensions.size === 0)) {
             return ctx.response
                 .status(404)
                 .send(apiErr('capability_unsupported', 'Personal agent delegation is not enabled.'));

package/build/src/host/account_session_sign_in.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Abrir e fechar a sessão de CONTA do authkit (o cookie do console, `ACCOUNT_SESSION_KEY`) a partir
+ * de código de fora do host-kit — o navegador de um personal agent que entrou na conta, por
+ * exemplo. Sincroniza `ctx.auth` (`adonisAuth.guard`) como o login do próprio console.
+ *
+ * Estável no 1.x (usado pelas `personalAgents.extensions`).
+ */
+import type { HttpContext } from '@adonisjs/core/http';
+/** Liga a sessão de conta a `accountId` e sincroniza `ctx.auth`. Não regenera a sessão. */
+export declare function signInAccountSession(ctx: HttpContext, accountId: string): Promise<void>;
+/** Desliga a sessão de conta e sincroniza `ctx.auth`. Não regenera a sessão. */
+export declare function signOutAccountSession(ctx: HttpContext): Promise<void>;

package/build/src/host/account_session_sign_in.js

@@ -0,0 +1,19 @@
+import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
+import { syncAdonisAuthLogin, syncAdonisAuthLogout } from './adonis_auth_sync.js';
+/** Liga a sessão de conta a `accountId` e sincroniza `ctx.auth`. Não regenera a sessão. */
+export async function signInAccountSession(ctx, accountId) {
+    // Sem augmentation no barrel (ver `augmentation_isolation.spec.ts`): a sessão é lida sem tipo.
+    const session = ctx.session;
+    const service = await ctx.containerResolver.make('authkit.server');
+    session.put(ACCOUNT_SESSION_KEY, accountId);
+    const account = await service.config.accountStore.findById(accountId);
+    if (account)
+        await syncAdonisAuthLogin(ctx, service.config, account);
+}
+/** Desliga a sessão de conta e sincroniza `ctx.auth`. Não regenera a sessão. */
+export async function signOutAccountSession(ctx) {
+    const session = ctx.session;
+    const service = await ctx.containerResolver.make('authkit.server');
+    session.forget(ACCOUNT_SESSION_KEY);
+    await syncAdonisAuthLogout(ctx, service.config);
+}

package/build/src/host/admin_api/admin_users_service.d.ts

@@ -8,8 +8,11 @@ import type { SettingsCapability } from '../runtime_settings.js';
 export interface AdminActor {
     actorId: string | null;
     ip: string | null;
-    /** Marca metadata da auditoria — 'admin-api' nas escritas via REST, 'admin' no console HTML. */
-    source?: 'admin-api' | 'admin';
+    /**
+     * Marca metadata da auditoria — 'admin-api' nas escritas via REST, 'admin' no console HTML,
+     * 'mcp' nas ações dos dev tools (endpoint MCP do Agora).
+     */
+    source?: 'admin-api' | 'admin' | 'mcp';
 }
 /** Resultado da deleção via admin: false quando o store não suporta hard delete. */
 export type DeleteUserResult = {

package/build/src/host/admin_api/api_clients_controller.d.ts

@@ -6,6 +6,7 @@ import type { HttpContext } from '@adonisjs/core/http';
  * em create/regenerate. Audita create/update/delete.
  */
 export default class ApiClientsController {
+    #private;
     index(ctx: HttpContext): Promise<{
         data: {
             clientId: string;
@@ -19,6 +20,8 @@ export default class ApiClientsController {
             backchannelLogoutSessionRequired: boolean;
             clientName: string | null;
             logoUri: string | null;
+            disabled: boolean;
+            serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
         }[];
         canList: boolean;
     }>;
@@ -34,6 +37,8 @@ export default class ApiClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     store(ctx: HttpContext): Promise<void | {
         clientId: string;
@@ -51,11 +56,43 @@ export default class ApiClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     regenerateSecret(ctx: HttpContext): Promise<void | {
         clientId: any;
         clientSecret: string;
     }>;
+    disable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
+    enable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
     destroy(ctx: HttpContext): Promise<{
         clientId: any;
         deleted: boolean;

package/build/src/host/admin_api/api_clients_controller.js

@@ -85,11 +85,16 @@ export default class ApiClientsController {
         const id = ctx.request.param('id');
         try {
             const secret = await svc.regenerateSecret(id);
+            const tenant = (await svc.find(id))?.serviceTenant;
             await service.config.audit?.record({
                 type: 'client.updated',
                 clientId: id,
                 ip: ctx.request.ip?.() ?? null,
-                metadata: { actor: 'admin-api', action: 'regenerate_secret' },
+                metadata: {
+                    actor: 'admin-api',
+                    action: 'regenerate_secret',
+                    ...(tenant ? { partition: tenant.partition } : {}),
+                },
             });
             return { clientId: id, clientSecret: secret };
         }
@@ -97,6 +102,31 @@ export default class ApiClientsController {
             return ctx.response.conflict(apiError('cannot_regenerate', e.message));
         }
     }
+    async disable(ctx) {
+        return this.#setDisabled(ctx, true);
+    }
+    async enable(ctx) {
+        return this.#setDisabled(ctx, false);
+    }
+    /** Disabled clients get `invalid_client` from the next request on. */
+    async #setDisabled(ctx, disabled) {
+        const { service, svc } = await clientsService(ctx);
+        const id = ctx.request.param('id');
+        if (!(await svc.setDisabled(id, disabled))) {
+            return ctx.response.notFound(apiError('not_found', 'Client não encontrado.'));
+        }
+        const client = await svc.find(id);
+        await service.config.audit?.record({
+            type: disabled ? 'client.disabled' : 'client.enabled',
+            clientId: id,
+            ip: ctx.request.ip?.() ?? null,
+            metadata: {
+                actor: 'admin-api',
+                ...(client?.serviceTenant ? { partition: client.serviceTenant.partition } : {}),
+            },
+        });
+        return clientDto(client);
+    }
     async destroy(ctx) {
         const { service, svc } = await clientsService(ctx);
         const id = ctx.request.param('id');

package/build/src/host/admin_api/dto.d.ts

@@ -40,6 +40,8 @@ export declare function clientDto(client: AdminClient): {
     backchannelLogoutSessionRequired: boolean;
     clientName: string | null;
     logoUri: string | null;
+    disabled: boolean;
+    serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
 };
 /** Inclui o secret (mostrado UMA vez) em create/regenerate. */
 export declare function createdClientDto(created: CreatedClient): {
@@ -67,7 +69,7 @@ export declare function grantDto(grant: AdminGrant): {
 };
 export declare function auditDto(event: StoredAuditEvent): {
     id: string;
-    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.locked" | "account.signed_out_all" | "agent.allowed" | "agent.blocked" | "agent.delegation_approved" | "agent.delegation_denied" | "agent.grant_revoked" | "agent.grant_revoked_by_admin" | "agent.registry_removed" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "impersonation.stopped" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "mfa.recovery_codes_regenerated" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
+    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.extension.action" | "account.extension.redirect" | "account.locked" | "account.signed_out_all" | "agent.allowed" | "agent.blocked" | "agent.delegation_approved" | "agent.delegation_denied" | "agent.grant_revoked" | "agent.grant_revoked_by_admin" | "agent.registry_removed" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.disabled" | "client.enabled" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "impersonation.stopped" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "mfa.recovery_codes_regenerated" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "service_tenant.token_issued" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
     accountId: string | null;
     email: string | null;
     clientId: string | null;

package/build/src/host/admin_api/dto.js

@@ -32,6 +32,8 @@ export function clientDto(client) {
         backchannelLogoutSessionRequired: client.backchannelLogoutSessionRequired ?? false,
         clientName: client.clientName,
         logoUri: client.logoUri,
+        disabled: client.disabled,
+        serviceTenant: client.serviceTenant,
     };
 }
 /** Inclui o secret (mostrado UMA vez) em create/regenerate. */

package/build/src/host/admin_authorize.d.ts

@@ -0,0 +1,8 @@
+import { type ConsoleAuthorize, type ConsoleAuthorizeDecision } from '../console_authorize.js';
+/**
+ * Whether the app runs in production. Unknown (the provider did not register the
+ * app) counts as production, so an omitted `admin.authorize` fails closed.
+ */
+export declare function appInProduction(): boolean;
+/** The resolved `admin.authorize` checker (memoized per configured value). Never throws. */
+export declare function adminAuthorizeChecker(authorize: ConsoleAuthorize): (ctx: any) => Promise<ConsoleAuthorizeDecision>;

package/build/src/host/admin_authorize.js

@@ -0,0 +1,25 @@
+import { getBootedApp } from '../../services/booted_app.js';
+import { resolveConsoleAuthorize, } from '../console_authorize.js';
+/**
+ * Whether the app runs in production. Unknown (the provider did not register the
+ * app) counts as production, so an omitted `admin.authorize` fails closed.
+ */
+export function appInProduction() {
+    try {
+        return getBootedApp().inProduction !== false;
+    }
+    catch {
+        return true;
+    }
+}
+/** One checker per configured `admin.authorize`, so a lazy import runs once. */
+const adminAuthorizeCheckers = new WeakMap();
+/** The resolved `admin.authorize` checker (memoized per configured value). Never throws. */
+export function adminAuthorizeChecker(authorize) {
+    let checker = adminAuthorizeCheckers.get(authorize);
+    if (!checker) {
+        checker = resolveConsoleAuthorize(authorize);
+        adminAuthorizeCheckers.set(authorize, checker);
+    }
+    return checker;
+}

package/build/src/host/admin_clients_service.d.ts

@@ -1,4 +1,5 @@
 import type { OidcService } from '../provider/oidc_service.js';
+import { type ServiceTenantInfo } from '../service_tenants/client_metadata.js';
 import { type ApplicationType } from './client_metadata.js';
 /** Métodos de autenticação no token endpoint suportados pelo formulário admin. */
 export type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';
@@ -30,6 +31,15 @@ export interface ClientInput {
      * `backchannelLogoutUri` não está definido.
      */
     backchannelLogoutSessionRequired?: boolean;
+    /**
+     * Makes the client a service tenant: confidential, `client_credentials` only, no
+     * redirect URIs; its tokens carry `partition` and `capabilities`. On update, `null`
+     * turns it back into a regular client; absent keeps the current value.
+     */
+    serviceTenant?: {
+        partition: string;
+        capabilities?: string[];
+    } | null;
 }
 /** Client persistido, apresentado ao console admin. */
 export interface AdminClient {
@@ -49,6 +59,10 @@ export interface AdminClient {
     clientName: string | null;
     /** `logo_uri` registrado, ou `null`. */
     logoUri: string | null;
+    /** Disabled clients get no tokens (`invalid_client`) until enabled again. */
+    disabled: boolean;
+    /** Service-tenant settings, or `null` for a regular client. */
+    serviceTenant: ServiceTenantInfo | null;
 }
 /** Resultado de uma criação: o client + o secret em claro (mostrado UMA vez). */
 export interface CreatedClient {
@@ -94,6 +108,12 @@ export declare class AdminClientsService {
      * PRESERVANDO o client_secret existente. Lança se o client não existe.
      */
     update(clientId: string, input: Partial<ClientInput>): Promise<void>;
+    /**
+     * Disables or re-enables a client. A disabled client gets `invalid_client` on every
+     * endpoint from the next request on (tokens already issued stay valid until they
+     * expire). Returns `false` when the client does not exist.
+     */
+    setDisabled(clientId: string, disabled: boolean): Promise<boolean>;
     /**
      * Regenera o client_secret de um client confidencial, preservando o resto da
      * metadata. Retorna o novo secret em claro (mostrado UMA vez). Lança se o