@adonis-agora/authkit-server 1.0.0-rc.0 → 1.0.0-rc.2

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # @adonis-agora/authkit-server
 
+## 1.0.0-rc.2
+
+### Major Changes
+
+- [#456](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/456) [`9c12ef9`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/9c12ef9c1c49db9d54a7da6d241264499ad76e18) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Poppy (the Personal Agent Protocol) moves out of `@adonis-agora/authkit-server` into the new `@adonis-agora/authkit-poppy` package, and authkit-server gains a stable extension surface for personal-agent protocols. See [Install `@adonis-agora/authkit-poppy` for Poppy](https://github.com/DavideCarvalho/adonis-agora-authkit/blob/main/apps/docs/content/docs/migrating-to-1-0.mdx#install-adonis-agoraauthkit-poppy-for-poppy).
+  
+  Breaking changes (`@adonis-agora/authkit-server`):
+  
+  - `personalAgents.poppy` is removed: install `@adonis-agora/authkit-poppy` and use `personalAgents: { extensions: [poppy({ ... })] }` with the same options. A config that still has `personalAgents.poppy` fails at boot. Routes, tables, tokens and sessions are unchanged, so no data migration is needed.
+  - Every Poppy export (`PoppyConfigInput` and the other `Poppy*` types, `poppyEmailCodeSignIn`, `verifyPoppyRequest`, `poppyAuth`, `poppyOf`, `poppyWebSession`, `poppyWebSessionOf`, `installPoppySlots`, `POPPY_AUTHENTICATE_SLOT`, `POPPY_WEB_SESSION_KEY`, `PoppyError`, `verifyDpopProof`, `accessTokenHash`, `hmacNonceSource`, `databaseReplayStore`, `memoryReplayStore`, `redisReplayStore`, `safeFetchJson`, `isBlockedAddress`, `SafeFetchError`, `maskEmail`) now comes from `@adonis-agora/authkit-poppy`.
+  - `mail.onPoppySignInCode` is removed: pass `sendCode` to `poppyEmailCodeSignIn()`.
+  - `authkitCsrfExceptions` no longer takes `poppyPrefix`; extensions' endpoints are exempted from the config (`personalAgentExtensions: false` turns that off).
+  - `ensureAuthkitSchema()` no longer creates the `auth_poppy_*` tables (the extension's tables are ensured at boot; `ensurePoppySchema()` for migrations).
+  - Admin console API: an extension's `protocols` entry is `{ label, requireRegistration, hostResolver, allowHttpIdentifiers, identifierLabel, identifierPlaceholder }`.
+  
+  New, stable for 1.x: `personalAgents.extensions` and the types `PersonalAgentExtension`, `PersonalAgentExtensionDefinition`, `PersonalAgentExtensionContext`, `PersonalAgentRouteKit`, `PersonalAgentHost`, `PersonalAgentGrantLedger`, `PersonalAgentGrant`, `PersonalAgentRefreshToken`, `PersonalAgentAccessTokens`, `PersonalAgentProtocolRuntime`, `PersonalAgentGrantSummary`, `PersonalAgentConsoleSummary`, `ResolvedPersonalAgentExtension`, `AuthkitTable`; the functions `personalAgentExtensionRuntime`, `ensureAuthkitTables`, `sendAuthkitCodeEmail`, `signInAccountSession` and `signOutAccountSession`; and the `tables` option of `ensureAuthkitSchema`.
+  
+  Breaking changes (`@adonis-agora/authkit-react`):
+  
+  - `PersonalAgentProtocol` is `'pact'` or any extension id, and `PersonalAgentsOverview.protocols` has one entry per extension (`PersonalAgentExtensionOverview`) instead of a fixed `poppy` key. `AccountAgentGrant.protocol` uses `PersonalAgentProtocol`.
+
+## 1.0.0-rc.1
+
+### Major Changes
+
+- [#451](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/451) [`1162aee`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/1162aeeee00d4706b8515d89e37f93d172cec44a) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - The account and admin consoles now sign in through the IdP login by default.
+  
+  - `accountSession.acceptIdpSession` defaults to `true`. Without a console session, `/account/*` and the admin console send the visitor to the IdP login (`/auth/console/sso`) and come back with the console open; a user already signed in to an app opens them directly.
+  - `/account/login` redirects to the IdP login. The password form stays at `/account/login?method=password` while password login is on.
+  - The console's idle timeout now also ends the IdP session the console was opened from, like "Sign out" already did.
+  - `accountSession: { acceptIdpSession: false }` with `authMethods: { password: false }` and no `accountLoginUrl` (passed to `registerAuthHost` or set in `routes`) now fails at boot when the routes are registered, since the consoles would have no way in. `authkit:doctor` warns about it, and when SSO is off.
+  - The client id `authkit-console` is reserved for the consoles' internal client (`response_type=none`, never listed in the console) and cannot be registered.
+  - New `admin.authorize`, the access check every `@adonis-agora` console takes: an inline function, an authorizer class (built through the container, so `@inject()` works) or a lazy import (`() => import('#policies/console_access')`). It runs after `admin.roles` (both must pass) on the shell and on every `{prefix}/api/*` route. An account without one of the roles still goes to `accountHome`.
+  - **Breaking:** without `admin.authorize`, the admin console is open outside production and answers 403 to every request in production. The app logs `[@adonis-agora/authkit-server] console has no \`authorize\` configured: …` once at boot, and `authkit:doctor` warns. To keep letting every admin in, set `admin: { enabled: true, roles: ['ADMIN'], authorize: () => true }`.
+  - An `authorize` denial answers 403 (an access-denied page, or `{ error: 'forbidden' }` for JSON); `reason: 'unauthenticated'` answers 401 (`{ error: 'unauthenticated' }`); `{ redirectTo }` redirects page navigations and answers 401 `{ error: 'unauthenticated', redirectTo }` to JSON calls; a thrown error is a 403.
+  - New `authorizeByToken({ token })`: a `ConsoleAuthorize` that allows `Authorization: Bearer <token>` (timing-safe compare) and answers 401 otherwise. An empty token throws when the config loads.
+  - The types `ConsoleAuthorize`, `ConsoleAuthorizer`, `ConsoleAuthorizerClass` and `ConsoleAuthorizeResult` are exported, next to `authorizeByToken`.
+
 ## 1.0.0-rc.0
 
 ### Major Changes

package/README.md

@@ -15,11 +15,10 @@ wrapper around [`oidc-provider`](https://github.com/panva/node-oidc-provider).
   auth via `acr_values`, Dynamic Client Registration (RFC 7591/7592).
 - **Personal agents** — AI assistants acting for your users: agent identity by signed JWT
   (JWKS, no shared secrets) and user-approved, revocable delegation with scopes you define,
-  over a pluggable protocol adapter ([PACT](https://openpactprotocol.org) built in).
-  Plus the [Personal Agent Protocol ("Poppy")](https://personalagentprotocol.org/docs/spec):
-  discovery, signed `Poppy-Session` agent sessions, Direct/Device/Mediated sign-in, MCP and browser sessions.
-  ⚠️ **Experimental** — tracks the spec's Draft 0.3 and will change (possibly breaking, outside
-  semver majors) while the spec is a draft.
+  over a pluggable protocol adapter ([PACT](https://openpactprotocol.org) built in), plus
+  `personalAgents.extensions` for protocols shipped as their own packages — the
+  [Personal Agent Protocol ("Poppy")](https://personalagentprotocol.org/docs/spec) is
+  [`@adonis-agora/authkit-poppy`](https://www.npmjs.com/package/@adonis-agora/authkit-poppy).
 - **Native apps** — RFC 8252 native clients (`authkit:clients:create --native`: private-use
   scheme / claimed https / loopback redirects, always public + PKCE) and the `@adonisjs/auth`
   guards `oidcRpGuard` (session) and `oidcBearerGuard` (`Authorization: Bearer` access tokens,

package/build/index.d.ts

@@ -15,21 +15,16 @@ export type { PersonalAgentIdentity } from './src/agents/agent_identity.js';
 export { PersonalAgentVerifier } from './src/agents/agent_identity.js';
 export type { PersonalAgentDelegationConfigInput, PersonalAgentRegistration, PersonalAgentResolver, PersonalAgentsConfigInput, ResolvedPersonalAgentsConfig, } from './src/agents/config.js';
 export type { DelegationContext, DelegationGrantSummary, DelegationReceipt, } from './src/agents/delegation_service.js';
+export type { AuthkitTable, PersonalAgentAccessTokens, PersonalAgentConsoleSummary, PersonalAgentExtension, PersonalAgentExtensionContext, PersonalAgentExtensionDefinition, PersonalAgentGrant, PersonalAgentGrantLedger, PersonalAgentGrantSummary, PersonalAgentHost, PersonalAgentProtocolRuntime, PersonalAgentRefreshToken, PersonalAgentRouteKit, ResolvedPersonalAgentExtension, } from './src/agents/extension.js';
 export type { PersonalAgentAuthOptions, PersonalAgentRequestContext, } from './src/agents/middleware.js';
 export { personalAgentAuth, personalAgentOf, personalAgentReceipt, personalAgentSecurity, personalAgentStepUp, } from './src/agents/middleware.js';
-export type { PoppyAgentProtocolEntry, PoppyApiEntry, PoppyBrowserLogin, PoppyClientsConfigInput, PoppyConfigInput, PoppyLimiter, PoppyMediatedConfigInput, PoppyMediatedField, PoppyMediatedResult, PoppyMediatedVerifyInput, PoppyPrincipalBase, PoppyReplayStore, PoppyScopeHint, ResolvedPoppyConfig, } from './src/agents/poppy/config.js';
-export { accessTokenHash, type DpopNonceSource, type DpopResult, hmacNonceSource, type VerifyDpopInput, verifyDpopProof, } from './src/agents/poppy/dpop.js';
-export { maskEmail, type PoppyEmailCodeSignInOptions, poppyEmailCodeSignIn, } from './src/agents/poppy/email_code_sign_in.js';
-export { PoppyError, type PoppyErrorCode } from './src/agents/poppy/errors.js';
-export { databaseReplayStore, memoryReplayStore, redisReplayStore, } from './src/agents/poppy/replay.js';
-export { installPoppySlots, POPPY_AUTHENTICATE_SLOT, type PoppyAuthenticate, type PoppyAuthResult, type PoppyPrincipal, type PoppySlotRequest, poppyAuth, poppyOf, verifyPoppyRequest, writePoppyAuthError, } from './src/agents/poppy/resource.js';
-export { isBlockedAddress, SafeFetchError, safeFetchJson, } from './src/agents/poppy/safe_fetch.js';
-export type { PoppyAuthError, PoppyGrantSummary, PoppySessionState, PoppyTokenResponse, PoppyVerifyOptions, } from './src/agents/poppy/service.js';
-export { type PoppyWebSessionMarker, poppyWebSession, poppyWebSessionOf, } from './src/agents/poppy/web_session.js';
 export type { BuiltinProtocolId, PactOptions, PersonalAgentProtocol, } from './src/agents/protocol.js';
 export { pact, pactProtocol } from './src/agents/protocol.js';
+export { type PersonalAgentRuntimeSource, personalAgentExtensionRuntime, } from './src/agents/runtime.js';
 export type { AuditEvent, AuditEventType, AuditPage, AuditSink, ListAuditParams, StoredAuditEvent, } from './src/audit/audit_sink.js';
 export { lucidAuditSink } from './src/audit/lucid_audit_sink.js';
+export type { ConsoleAuthorize, ConsoleAuthorizeResult, ConsoleAuthorizer, ConsoleAuthorizerClass, } from './src/console_authorize.js';
+export { authorizeByToken } from './src/console_authorize.js';
 export type { AdminApiConfigInput, AdminConfigInput, AuthHostRenderer, AuthMethodsConfigInput, AuthServerConfigInput, AuthSocialConfig, DynamicRegistrationConfigInput, LoginConfigInput, OrganizationsConfigInput, PasswordlessConfigInput, RateLimitBucket, RateLimitConfigInput, RegistrationConfigInput, ResolvedAdminApiConfig, ResolvedAdminConfig, ResolvedAuthMethodsConfig, ResolvedDynamicRegistrationConfig, ResolvedLoginConfig, ResolvedNotificationsConfig, ResolvedOrganizationsConfig, ResolvedPasswordlessConfig, ResolvedRateLimitConfig, ResolvedRegistrationConfig, ResolvedServerConfig, ResolvedWebauthnConfig, WebauthnConfigInput, } from './src/define_config.js';
 export { adapters, defineConfig, resolveAdmin, resolveAdminApi, resolveAuthMethodsConfig, resolveDynamicRegistration, resolveLogin, resolveNotifications, resolveOrganizations, resolvePasswordless, resolveRateLimit, resolveRegistration, resolveWebauthn, toSeconds, } from './src/define_config.js';
 export type { EventsConfigInput, ResolvedEventsConfig } from './src/events/dispatcher.js';
@@ -56,6 +51,7 @@ export type { AccountPathKey, AccountPathsOptions } from './src/host/account_pat
 export { accountPath, accountPrefix, joinAccountPath, } from './src/host/account_paths.js';
 export type { AccountConfirmMethod, AccountConfirmProps, AccountEmailConfirmedProps, AccountLoginProps, AccountMfaProps, AccountSecurityProps, } from './src/host/account_screen_props.js';
 export { ACCOUNT_SESSION_KEY } from './src/host/account_session_key.js';
+export { signInAccountSession, signOutAccountSession, } from './src/host/account_session_sign_in.js';
 export { ACTIVE_ORG_COOKIE, ACTIVE_ORG_COOKIE_TTL, decodeActiveOrgCookie, encodeActiveOrgCookie, readActiveOrgFromKoaCtx, } from './src/host/active_org_cookie.js';
 export type { AddMemberInput as AdminAddMemberInput, CreateInvitationInput as AdminCreateInvitationInput, CreateOrgInput as AdminCreateOrgInput, OrgDetail, OrgWithMemberCount, UpdateOrgInput as AdminUpdateOrgInput, } from './src/host/admin_api/admin_orgs_service.js';
 export { AdminOrgsService } from './src/host/admin_api/admin_orgs_service.js';
@@ -90,6 +86,7 @@ export type { CustomLoginIdentity, CustomLoginMethod, CustomLoginMethodBinding,
 export { authenticateCustomLogin, beginCustomLogin, completeCustomLogin, } from './src/host/custom_login.js';
 export type { CustomMfaContext, CustomMfaDescription, CustomMfaDescriptor, CustomMfaField, CustomMfaMethod, CustomMfaMethodBinding, CustomMfaMethodConstructor, CustomMfaMethods, } from './src/host/custom_mfa.js';
 export { beginCustomMfa, customMfaViewProps, verifyCustomMfa } from './src/host/custom_mfa.js';
+export { sendAuthkitCodeEmail } from './src/host/default_mailer.js';
 export { normalizeEmailIdentifier } from './src/host/email_identifier.js';
 export type { ResolveGeo } from './src/host/geo.js';
 export { GEO_RESOLVE_TIMEOUT_MS, resolveGeoSafe } from './src/host/geo.js';
@@ -109,7 +106,6 @@ export { OidcRpGuard, oidcRpGuard } from './src/host/oidc_rp_guard.js';
 export { evaluateLoginOtp, generateOtpCode, OTP_LOGIN_DEFAULTS, type OtpLoginConfigInput, type OtpVerifyOutcome, type ResolvedOtpLoginConfig, resolveOtpLoginConfig, } from './src/host/otp_login.js';
 export type { PersistentRpOptions } from './src/host/persistent_rp_session.js';
 export { endRpSession } from './src/host/persistent_rp_session.js';
-export { POPPY_WEB_SESSION_KEY } from './src/host/poppy_session_key.js';
 export type { AuthThrottles, ThrottleMiddleware } from './src/host/rate_limit.js';
 export { createAuthThrottles } from './src/host/rate_limit.js';
 export type { AccountScreensOptions, AuthHostOptions, AuthHostRouteMap, } from './src/host/register_auth_host.js';
@@ -161,5 +157,5 @@ export { OidcService } from './src/provider/oidc_service.js';
 export { checkClientRegistration, classifyRedirect, type RedirectUriPolicy, type RegistrationOperation, RegistrationPolicyError, type ResolvedRedirectUriPolicy, type ValidateRegistrationHook, } from './src/provider/registration_policy.js';
 export { registerOidcRoutes } from './src/register_routes.js';
 export type { EnsureSchemaOptions, EnsureSchemaReport } from './src/schema/ensure.js';
-export { ensureAuthkitSchema } from './src/schema/ensure.js';
+export { ensureAuthkitSchema, ensureAuthkitTables } from './src/schema/ensure.js';
 export { stubsRoot } from './stubs/main.js';

package/build/index.js

@@ -10,15 +10,10 @@ export { lucidStores } from './src/accounts/lucid_stores.js';
 export { ProviderIdentities, ProviderIdentitiesUnsupportedError, } from './src/accounts/provider_identities.js';
 export { PersonalAgentVerifier } from './src/agents/agent_identity.js';
 export { personalAgentAuth, personalAgentOf, personalAgentReceipt, personalAgentSecurity, personalAgentStepUp, } from './src/agents/middleware.js';
-export { accessTokenHash, hmacNonceSource, verifyDpopProof, } from './src/agents/poppy/dpop.js';
-export { maskEmail, poppyEmailCodeSignIn, } from './src/agents/poppy/email_code_sign_in.js';
-export { PoppyError } from './src/agents/poppy/errors.js';
-export { databaseReplayStore, memoryReplayStore, redisReplayStore, } from './src/agents/poppy/replay.js';
-export { installPoppySlots, POPPY_AUTHENTICATE_SLOT, poppyAuth, poppyOf, verifyPoppyRequest, writePoppyAuthError, } from './src/agents/poppy/resource.js';
-export { isBlockedAddress, SafeFetchError, safeFetchJson, } from './src/agents/poppy/safe_fetch.js';
-export { poppyWebSession, poppyWebSessionOf, } from './src/agents/poppy/web_session.js';
 export { pact, pactProtocol } from './src/agents/protocol.js';
+export { personalAgentExtensionRuntime, } from './src/agents/runtime.js';
 export { lucidAuditSink } from './src/audit/lucid_audit_sink.js';
+export { authorizeByToken } from './src/console_authorize.js';
 export { adapters, defineConfig, resolveAdmin, resolveAdminApi, resolveAuthMethodsConfig, resolveDynamicRegistration, resolveLogin, resolveNotifications, resolveOrganizations, resolvePasswordless, resolveRateLimit, resolveRegistration, resolveWebauthn, toSeconds, } from './src/define_config.js';
 export { buildWebhookBody, composeAuditSink, resolveEvents, signWebhookBody, } from './src/events/dispatcher.js';
 export { inProcessAccessTokenVerifier, remoteAccessTokenVerifier, } from './src/host/access_token_verifier.js';
@@ -38,6 +33,7 @@ export { AccountExportService } from './src/host/account_export_service.js';
  */
 export { accountPath, accountPrefix, joinAccountPath, } from './src/host/account_paths.js';
 export { ACCOUNT_SESSION_KEY } from './src/host/account_session_key.js';
+export { signInAccountSession, signOutAccountSession, } from './src/host/account_session_sign_in.js';
 // Organizations (multi-tenancy)
 export { ACTIVE_ORG_COOKIE, ACTIVE_ORG_COOKIE_TTL, decodeActiveOrgCookie, encodeActiveOrgCookie, readActiveOrgFromKoaCtx, } from './src/host/active_org_cookie.js';
 export { AdminOrgsService } from './src/host/admin_api/admin_orgs_service.js';
@@ -64,6 +60,7 @@ export { consoleLoginUrl, getAccountId, hasAccountSession, realAccountId, } from
 export { authkitCsrfExceptions } from './src/host/csrf.js';
 export { authenticateCustomLogin, beginCustomLogin, completeCustomLogin, } from './src/host/custom_login.js';
 export { beginCustomMfa, customMfaViewProps, verifyCustomMfa } from './src/host/custom_mfa.js';
+export { sendAuthkitCodeEmail } from './src/host/default_mailer.js';
 export { normalizeEmailIdentifier } from './src/host/email_identifier.js';
 export { GEO_RESOLVE_TIMEOUT_MS, resolveGeoSafe } from './src/host/geo.js';
 export { BUILTIN_MESSAGES, DEFAULT_LOCALE, DEFAULT_MESSAGES, PT_BR_MESSAGES, resolveMessages, translate, } from './src/host/i18n.js';
@@ -88,7 +85,6 @@ export { OidcRpGuard, oidcRpGuard } from './src/host/oidc_rp_guard.js';
 // Login por OTP (código digitável): config + helpers puros.
 export { evaluateLoginOtp, generateOtpCode, OTP_LOGIN_DEFAULTS, resolveOtpLoginConfig, } from './src/host/otp_login.js';
 export { endRpSession } from './src/host/persistent_rp_session.js';
-export { POPPY_WEB_SESSION_KEY } from './src/host/poppy_session_key.js';
 export { createAuthThrottles } from './src/host/rate_limit.js';
 export { registerAuthHost } from './src/host/register_auth_host.js';
 export { edgeRenderer } from './src/host/renderers/edge_renderer.js';
@@ -139,5 +135,5 @@ export { generatePatToken, hashPatToken } from './src/pat/pat_tokens.js';
 export { OidcService } from './src/provider/oidc_service.js';
 export { checkClientRegistration, classifyRedirect, RegistrationPolicyError, } from './src/provider/registration_policy.js';
 export { registerOidcRoutes } from './src/register_routes.js';
-export { ensureAuthkitSchema } from './src/schema/ensure.js';
+export { ensureAuthkitSchema, ensureAuthkitTables } from './src/schema/ensure.js';
 export { stubsRoot } from './stubs/main.js';

package/build/providers/authkit_server_provider.js

@@ -130,11 +130,12 @@ export default class AuthkitServerProvider {
             // Defaults estruturais de `config.routes` (o argumento ainda vence).
             routes: typeof config.routes === 'object' ? config.routes : undefined,
             lockedRouteOptions: config.lockedRouteOptions,
+            consoleNeedsLoginUrl: config.accountSession?.acceptIdpSession === false && config.authMethods?.password === false,
             personalAgents: config.personalAgents
                 ? {
                     prefix: config.personalAgents.prefix,
-                    ...(config.personalAgents.poppy
-                        ? { poppyPrefix: config.personalAgents.poppy.prefix }
+                    ...(config.personalAgents.extensions?.length
+                        ? { extensions: config.personalAgents.extensions }
                         : {}),
                 }
                 : undefined,
@@ -146,12 +147,16 @@ export default class AuthkitServerProvider {
                 }
                 : undefined,
         });
-        // Poppy: o slot global que o `@adonis-agora/agent` usa para autenticar o endpoint de
-        // conversas (e o MCP) sem importar este pacote — o contrato é o símbolo.
-        if (config.personalAgents?.poppy) {
-            const { installPoppySlots } = await import('../src/agents/poppy/resource.js');
-            const { poppyUrls } = await import('../src/agents/poppy/service.js');
-            installPoppySlots(poppyUrls(config.issuer, config.personalAgents.poppy.prefix).issuer);
+        // Admin console without `admin.authorize`: open outside production, 403 in production.
+        // Said once, at boot.
+        if (config.admin.enabled && !config.admin.authorize) {
+            const { warnAdminConsoleUnauthorized } = await import('../src/host/admin_console_warning.js');
+            const logger = await this.app.container.make('logger').catch(() => null);
+            warnAdminConsoleUnauthorized(logger);
+        }
+        // `personalAgents.extensions`: o boot de cada uma (slots globais, etc.).
+        for (const extension of config.personalAgents?.extensions ?? []) {
+            await extension.boot?.();
         }
         // Auto-montagem das rotas (`config.routes`). Chama a MESMA função exportada que o
         // `start/routes.ts` chamaria; não há segunda implementação. "As rotas não subiram" não pode
@@ -260,6 +265,7 @@ export default class AuthkitServerProvider {
             const report = await ensureAuthkitSchema(db, {
                 connection: config.schema.connection,
                 accountTable: config.accountStore?.accountTable,
+                tables: config.personalAgents?.extensions?.flatMap((e) => e.tables ?? []),
             });
             const logger = await this.app.container.make('logger').catch(() => null);
             if (report.created.length > 0) {

package/build/src/agents/config.d.ts

@@ -12,7 +12,7 @@
  * recibos) não depende de protocolo; o formato do fio vem do adapter em
  * `protocol` (default: PACT — https://openpactprotocol.org). Ver `protocol.ts`.
  */
-import { type PoppyConfigInput, type ResolvedPoppyConfig } from './poppy/config.js';
+import { type PersonalAgentExtension, type ResolvedPersonalAgentExtension } from './extension.js';
 import { type BuiltinProtocolId, type PersonalAgentProtocol } from './protocol.js';
 /** Registro de um personal agent conhecido (PACT §3.1). */
 export interface PersonalAgentRegistration {
@@ -58,8 +58,8 @@ export interface PersonalAgentsConfigInput {
     /**
      * Valor que os personal agents põem no `aud` do JWT deles (PACT). Opaco e
      * atribuído por ESTE app no registro do agente — um valor por app, não
-     * derivado de URL. Liga o PACT; obrigatório, a não ser num app só-Poppy
-     * (`poppy` sem `audience`).
+     * derivado de URL. Liga o PACT; obrigatório, a não ser num app que só usa
+     * `extensions` (sem `audience`).
      */
     audience?: string;
     /**
@@ -79,14 +79,10 @@ export interface PersonalAgentsConfigInput {
     /** Prefixo das rotas (`{prefix}/oauth/*`, `{prefix}/consent`). Default: `/agents`. */
     prefix?: string;
     /**
-     * Personal Agent Protocol ("Poppy", https://personalagentprotocol.org) — o
-     * segundo protocolo, ao lado do PACT. Um app pode servir os dois. Ver
-     * `poppy/config.ts`.
-     *
-     * @experimental Poppy (Personal Agent Protocol) Draft 0.3 — acompanha a spec em desenvolvimento e PODE MUDAR
-     *   de forma incompatível fora de majors enquanto ela for draft.
+     * Outros protocolos de personal agents, de pacotes à parte, ao lado do PACT
+     * (ex.: `poppy()` de `@adonis-agora/authkit-poppy`). Ver {@link PersonalAgentExtension}.
      */
-    poppy?: PoppyConfigInput;
+    extensions?: PersonalAgentExtension[];
 }
 export interface ResolvedPersonalAgentDelegationConfig {
     interfaceUrl: string;
@@ -108,11 +104,11 @@ export interface ResolvedPersonalAgentsConfig {
     open: boolean;
     delegation?: ResolvedPersonalAgentDelegationConfig;
     prefix: string;
-    /** Poppy resolvido (undefined = desligado). */
-    poppy?: ResolvedPoppyConfig;
+    /** `extensions` resolvidas, na ordem do config. */
+    extensions: ResolvedPersonalAgentExtension[];
 }
 export declare function normalizePersonalAgentsPrefix(prefix: string | undefined): string;
-export declare function resolvePersonalAgentsConfig(input: PersonalAgentsConfigInput | undefined): ResolvedPersonalAgentsConfig | undefined;
+export declare function resolvePersonalAgentsConfig(input: PersonalAgentsConfigInput | undefined, issuer?: string): ResolvedPersonalAgentsConfig | undefined;
 /** `"a b  c"` → `['a','b','c']` sem duplicatas, na ordem. */
 export declare function parseScope(value: string | null | undefined): string[];
 export declare function formatScope(scopes: Iterable<string>): string;

package/build/src/agents/config.js

@@ -12,7 +12,7 @@
  * recibos) não depende de protocolo; o formato do fio vem do adapter em
  * `protocol` (default: PACT — https://openpactprotocol.org). Ver `protocol.ts`.
  */
-import { resolvePoppyConfig, } from './poppy/config.js';
+import { resolvePersonalAgentExtensions, } from './extension.js';
 import { BUILTIN_PROTOCOLS, } from './protocol.js';
 const SCOPE_ID = /^[\x21\x23-\x5B\x5D-\x7E]+$/; // RFC 6749 §3.3 scope-token
 function assertUrl(value, what) {
@@ -37,19 +37,20 @@ export function normalizePersonalAgentsPrefix(prefix) {
         return '/agents';
     return trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
 }
-export function resolvePersonalAgentsConfig(input) {
+export function resolvePersonalAgentsConfig(input, issuer = '') {
     if (!input)
         return undefined;
+    // 0.x → 1.0: o Poppy virou o pacote `@adonis-agora/authkit-poppy`.
+    if ('poppy' in input) {
+        throw new Error('authkit: `personalAgents.poppy` saiu do authkit-server — instale `@adonis-agora/authkit-poppy` e use `personalAgents.extensions: [poppy({ ... })]`.');
+    }
     const pact = !!input.audience?.trim();
-    if (!pact && !input.poppy) {
-        throw new Error('authkit: personalAgents.audience é obrigatório (o `aud` dos JWTs dos agentes PACT) — ou configure só `personalAgents.poppy`.');
+    if (!pact && !input.extensions?.length) {
+        throw new Error('authkit: personalAgents.audience é obrigatório (o `aud` dos JWTs dos agentes PACT) — ou configure só `personalAgents.extensions`.');
     }
     if (!pact && input.delegation) {
         throw new Error('authkit: personalAgents.delegation é do PACT e exige `personalAgents.audience`.');
     }
-    if (input.protocol === 'poppy') {
-        throw new Error('authkit: o Poppy não é um `protocol` do PACT — configure-o em `personalAgents.poppy` (os dois convivem).');
-    }
     let resolveAgent;
     let staticAgents = null;
     if (typeof input.agents === 'function') {
@@ -94,9 +95,14 @@ export function resolvePersonalAgentsConfig(input) {
         throw new Error(`authkit: personalAgents.protocol "${String(input.protocol)}" desconhecido (embutidos: ${Object.keys(BUILTIN_PROTOCOLS).join(', ')}).`);
     }
     const prefix = normalizePersonalAgentsPrefix(input.prefix);
-    const poppy = resolvePoppyConfig(input.poppy, input.delegation?.scopes);
-    if (poppy && pact && (poppy.prefix === prefix || poppy.prefix.startsWith(`${prefix}/`))) {
-        throw new Error(`authkit: personalAgents.poppy.prefix "${poppy.prefix}" não pode ficar debaixo de personalAgents.prefix ("${prefix}").`);
+    const extensions = resolvePersonalAgentExtensions(input.extensions, {
+        issuer,
+        delegationScopes: input.delegation?.scopes ? { ...input.delegation.scopes } : null,
+    });
+    for (const extension of extensions) {
+        if (pact && (extension.prefix === prefix || extension.prefix.startsWith(`${prefix}/`))) {
+            throw new Error(`authkit: o prefixo "${extension.prefix}" de personalAgents.extensions "${extension.id}" não pode ficar debaixo de personalAgents.prefix ("${prefix}").`);
+        }
     }
     return {
         pact,
@@ -107,7 +113,7 @@ export function resolvePersonalAgentsConfig(input) {
         open: input.open === true,
         delegation,
         prefix,
-        poppy,
+        extensions,
     };
 }
 /** `"a b  c"` → `['a','b','c']` sem duplicatas, na ordem. */

package/build/src/agents/delegation_service.js

@@ -31,11 +31,11 @@ function newUserCode() {
     return `${code.slice(0, 4)}-${code.slice(4)}`;
 }
 /**
- * A tabela de grants é compartilhada com o Poppy (refresh tokens, `pgrant_`):
- * o PACT só enxerga os dele.
+ * A tabela de grants é compartilhada com as `personalAgents.extensions` (cada uma com o seu
+ * prefixo de id): o PACT só enxerga os dele, `agrant_`.
  */
 function isPactGrant(id) {
-    return !id.startsWith('pgrant_');
+    return id.startsWith('agrant_');
 }
 /** Aceita o código como o usuário digitar: minúsculas, sem hífen, com espaços. */
 export function normalizeUserCode(input) {

package/build/src/agents/delegation_store.d.ts

@@ -38,7 +38,8 @@ export interface GrantRow {
     updatedAt: Date;
 }
 export interface LiveGrantFilter {
-    protocol?: 'pact' | 'poppy';
+    /** Só os grants com este prefixo de id (`agrant_` = PACT; o `grantIdPrefix` de uma extension). */
+    idPrefix?: string;
     clientId?: string;
     accountId?: string;
 }
@@ -88,7 +89,7 @@ export declare class DelegationStore {
     }): Promise<GrantRow[]>;
     countLiveGrants(now: Date, filter?: LiveGrantFilter): Promise<number>;
     /** Conexões vivas de um protocolo por agente: `client_id` → número de grants. */
-    countLiveGrantsByClient(now: Date, protocol: 'pact' | 'poppy'): Promise<Map<string, number>>;
+    countLiveGrantsByClient(now: Date, idPrefix: string): Promise<Map<string, number>>;
     /** Ids dos grants não revogados de um agente (vivos ou não) — para revogar todos. */
     unrevokedGrantIdsOfClient(clientId: string): Promise<string[]>;
     /** Revoga um grant sem checar a conta — reação a reuso de refresh token. */

package/build/src/agents/delegation_store.js

@@ -186,12 +186,13 @@ export class DelegationStore {
     // ─── console admin (todas as contas) ──────────────────────────────────────
     /**
      * Grants vivos (não revogados nem expirados em `now`), de todas as contas. O
-     * protocolo sai do prefixo do id: `agrant_` (PACT) ou `pgrant_` (Poppy).
+     * protocolo sai do prefixo do id: `agrant_` (PACT) ou o `grantIdPrefix` de uma extension.
      */
     #live(now, filter = {}) {
         let q = this.conn().from(GRANT_TABLE).whereNull('revoked_at').where('expires_at', '>', now);
-        if (filter.protocol)
-            q = q.where('id', 'like', filter.protocol === 'poppy' ? 'pgrant_%' : 'agrant_%');
+        // O prefixo é `[a-z0-9]+_`: o `_` do LIKE (um caractere qualquer) casa com ele mesmo.
+        if (filter.idPrefix)
+            q = q.where('id', 'like', `${filter.idPrefix}%`);
         if (filter.clientId)
             q = q.where('client_id', filter.clientId);
         if (filter.accountId)
@@ -211,8 +212,8 @@ export class DelegationStore {
         return Number(row?.total ?? 0);
     }
     /** Conexões vivas de um protocolo por agente: `client_id` → número de grants. */
-    async countLiveGrantsByClient(now, protocol) {
-        const rows = await this.#live(now, { protocol })
+    async countLiveGrantsByClient(now, idPrefix) {
+        const rows = await this.#live(now, { idPrefix })
             .select('client_id')
             .count('* as total')
             .groupBy('client_id');