@adonis-agora/authkit-server 1.0.0-rc.1 → 1.0.0-rc.10

package/build/src/host/ui-dist/assets/{index-DTSmD4RU.css → index-WNIyCEPA.css}

@@ -1 +1 @@
-:root{--bg0:#07070d;--bg1:#0c0c16;--bg2:#12121f;--bg3:#181828;--line:#9797c41a;--line-strong:#9797c42e;--text:#e9e9f4;--muted:#9292ac;--faint:#5b5b74;--accent:#625fff;--accent-soft:#625fff24;--accent-hover:#625fff38;--green:#3ecf8e;--green-soft:#3ecf8e1f;--red:#ff5470;--red-soft:#ff54701f;--amber:#ffb454;--amber-soft:#ffb4541f;--blue:#4cc2ff;--blue-soft:#4cc2ff1f;--sans:"Sora", system-ui, -apple-system, sans-serif;--mono:"JetBrains Mono", ui-monospace, "SF Mono", Menlo, monospace;--sidebar-w:240px;--radius:10px;--topbar-h:54px}html.light{--bg0:#f7f7fb;--bg1:#fff;--bg2:#f0f0f6;--bg3:#e7e7f0;--line:#2828461a;--line-strong:#2828462e;--text:#1c1c28;--muted:#55556c;--faint:#8a8aa0;--accent-soft:#625fff1f;--accent-hover:#625fff2e;--amber-soft:#c4821e24;--green-soft:#1ea06424;--red-soft:#dc32501f;--blue-soft:#2896d21f}*,:before,:after{box-sizing:border-box;margin:0;padding:0}html,body,#root{height:100%}body{font-family:var(--sans);background:var(--bg0);color:var(--text);-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;font-size:13px;overflow:hidden}body:before{content:"";pointer-events:none;z-index:0;background:radial-gradient(1100px 500px at 15% -10%,#625fff1a,#0000 60%),radial-gradient(900px 420px at 90% 0,#3ecf8e0a,#0000 55%);position:fixed;inset:0}html.light body:before{display:none}::selection{background:#625fff4d}::-webkit-scrollbar{width:8px;height:8px}::-webkit-scrollbar-thumb{border:2px solid var(--bg0);background:#26263a;border-radius:6px}::-webkit-scrollbar-thumb:hover{background:#33334d}::-webkit-scrollbar-track{background:0 0}html.light ::-webkit-scrollbar-thumb{background:#cfcfe0}html.light ::-webkit-scrollbar-thumb:hover{background:#b8b8cc}#root{z-index:1;position:relative}.app-shell{height:100vh;display:flex;overflow:hidden}.sidebar{width:var(--sidebar-w);border-right:1px solid var(--line);-webkit-backdrop-filter:blur(10px);background:#0a0a12bf;flex-direction:column;flex-shrink:0;display:flex;overflow:hidden}html.light .sidebar{background:#ffffffd9}.main{flex-direction:column;flex:1;min-width:0;display:flex;overflow:hidden}.topbar{height:var(--topbar-h);border-bottom:1px solid var(--line);-webkit-backdrop-filter:blur(8px);background:#09091099;flex-shrink:0;align-items:center;gap:12px;padding:0 20px;display:flex}html.light .topbar{background:#ffffffb3}.content{flex:1;padding:24px 24px 60px;overflow-y:auto}.brand{border-bottom:1px solid var(--line);flex-shrink:0;align-items:center;gap:10px;padding:18px 18px 14px;display:flex}.brand-logo{background:var(--accent-soft);border:1px solid #625fff4d;border-radius:8px;flex-shrink:0;justify-content:center;align-items:center;width:30px;height:30px;display:flex;position:relative}.brand-logo svg{width:16px;height:16px;color:var(--accent)}.brand-logo .ring{border:1px solid #625fff59;border-radius:12px;animation:3s ease-out infinite ring-pulse;position:absolute;inset:-3px}@keyframes ring-pulse{0%{opacity:.9;transform:scale(.85)}70%{opacity:0;transform:scale(1.15)}to{opacity:0;transform:scale(1.15)}}.brand-text{overflow:hidden}.brand-name{letter-spacing:.03em;font-size:14px;font-weight:700}.brand-name span{color:var(--accent)}.brand-sub{color:var(--faint);letter-spacing:.08em;text-transform:uppercase;margin-top:1px;font-size:10px;font-weight:500}.nav{flex:1;padding:10px 10px 8px;overflow-y:auto}.nav-section{letter-spacing:.14em;text-transform:uppercase;color:var(--faint);padding:12px 8px 5px;font-size:9.5px;font-weight:600}.nav-item{color:var(--muted);cursor:pointer;-webkit-user-select:none;user-select:none;border:1px solid #0000;border-radius:8px;align-items:center;gap:9px;padding:7px 9px;font-size:12.5px;font-weight:500;text-decoration:none;transition:background .12s,color .12s;display:flex}.nav-item:hover{color:var(--text);background:#9797c40f}.nav-item.active{background:var(--accent-soft);color:var(--text);border-color:#625fff38}.nav-item.active .nav-ico{color:var(--accent)}.nav-ico{width:15px;height:15px;color:var(--faint);flex-shrink:0;transition:color .12s}.nav-item:hover .nav-ico{color:var(--muted)}.sidebar-foot{border-top:1px solid var(--line);flex-direction:column;flex-shrink:0;gap:10px;padding:12px 14px;display:flex}.user-row{cursor:default;border-radius:8px;align-items:center;gap:9px;padding:6px 8px;display:flex}.avatar{background:var(--accent-soft);width:28px;height:28px;color:var(--accent);border:1px solid #625fff4d;border-radius:50%;flex-shrink:0;justify-content:center;align-items:center;font-size:10.5px;font-weight:600;display:flex}.user-info{flex:1;min-width:0}.user-email{color:var(--text);text-overflow:ellipsis;white-space:nowrap;font-size:11px;font-weight:500;overflow:hidden}.user-role{color:var(--faint);font-size:9.5px;font-family:var(--mono)}.foot-actions{gap:6px;display:flex}.topbar-title{color:var(--text);font-size:14px;font-weight:600}.topbar-spacer{flex:1}.theme-btn{border:1px solid var(--line);background:var(--bg2);width:32px;height:32px;color:var(--muted);cursor:pointer;border-radius:8px;flex-shrink:0;justify-content:center;align-items:center;transition:all .13s;display:flex}.theme-btn:hover{background:var(--bg3);color:var(--text);border-color:var(--line-strong)}.theme-btn svg{width:14px;height:14px}.btn{background:var(--bg2);border:1px solid var(--line);height:32px;color:var(--muted);font-family:var(--sans);cursor:pointer;white-space:nowrap;border-radius:8px;align-items:center;gap:7px;padding:0 13px;font-size:12px;font-weight:500;text-decoration:none;transition:all .13s;display:inline-flex}.btn:hover{color:var(--text);border-color:var(--line-strong);background:var(--bg3)}.btn svg{flex-shrink:0;width:13px;height:13px}.btn.btn-primary{background:var(--accent);color:#fff;border-color:#0000}.btn.btn-primary:hover{background:#7472ff}.btn.btn-danger:hover{color:var(--red);background:var(--red-soft);border-color:#ff547066}.btn.btn-sm{border-radius:6px;height:26px;padding:0 10px;font-size:11px}.btn.btn-ghost{background:0 0;border-color:#0000}.btn.btn-ghost:hover{background:#9797c40f}.btn:disabled,.btn[disabled]{opacity:.45;pointer-events:none}.cards{grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:12px;margin-bottom:20px;display:grid}.card{border:1px solid var(--line);border-radius:var(--radius);background:linear-gradient(#9797c40a,#9797c403);padding:16px 18px 14px;animation:.45s cubic-bezier(.2,.7,.3,1) both rise}.card:nth-child(2){animation-delay:40ms}.card:nth-child(3){animation-delay:80ms}.card:nth-child(4){animation-delay:.12s}.card:nth-child(5){animation-delay:.16s}@keyframes rise{0%{opacity:0;transform:translateY(8px)}}.card-label{letter-spacing:.12em;text-transform:uppercase;color:var(--faint);margin-bottom:10px;font-size:10px;font-weight:600}.card-value{font-family:var(--mono);letter-spacing:-.02em;color:var(--text);font-size:26px;font-weight:600;line-height:1}.card-hint{color:var(--faint);font-size:10.5px;font-family:var(--mono);margin-top:8px}.card-hint b{color:var(--muted);font-weight:500}.card.c-accent .card-value{color:var(--accent)}.card.c-green .card-value{color:var(--green)}.card.c-amber .card-value{color:var(--amber)}.card.c-red .card-value{color:var(--red)}.card.c-blue .card-value{color:var(--blue)}.panel{border:1px solid var(--line);border-radius:var(--radius);background:linear-gradient(#9797c409,#9797c403);margin-bottom:16px;animation:.5s cubic-bezier(.2,.7,.3,1) both rise;overflow:hidden}.panel-head{border-bottom:1px solid var(--line);justify-content:space-between;align-items:center;gap:10px;padding:12px 16px;display:flex}.panel-head h3{letter-spacing:.02em;font-size:12.5px;font-weight:600}.panel-head .meta{font-family:var(--mono);color:var(--faint);font-size:10.5px}.panel-body{padding:12px 16px 16px}.grid-2{grid-template-columns:1fr 1fr;gap:16px;display:grid}@media (width<=1100px){.grid-2{grid-template-columns:1fr}}.page-header{margin-bottom:20px}.page-title{letter-spacing:.01em;margin-bottom:4px;font-size:18px;font-weight:700}.page-sub{color:var(--faint);font-size:12px}.page-actions{align-items:center;gap:8px;display:flex}.page-header-row{justify-content:space-between;align-items:center;gap:16px;margin-bottom:16px;display:flex}.tbl-wrap{overflow-x:auto}table{border-collapse:collapse;width:100%;font-size:12.5px}thead th{text-align:left;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);border-bottom:1px solid var(--line);white-space:nowrap;padding:8px 12px;font-size:10px;font-weight:600}tbody tr{border-bottom:1px solid var(--line);cursor:pointer;transition:background .1s}tbody tr:last-child{border-bottom:0}tbody tr:hover{background:#9797c40a}tbody td{color:var(--muted);vertical-align:middle;padding:10px 12px}tbody td b{color:var(--text);font-weight:500}tbody td.no-click{cursor:default}.badge{height:18px;font-family:var(--mono);white-space:nowrap;border-radius:99px;align-items:center;padding:0 8px;font-size:10px;font-weight:500;display:inline-flex}.badge-accent{background:var(--accent-soft);color:var(--accent);border:1px solid #625fff38}.badge-green{background:var(--green-soft);color:var(--green);border:1px solid #3ecf8e38}.badge-red{background:var(--red-soft);color:var(--red);border:1px solid #ff547038}.badge-amber{background:var(--amber-soft);color:var(--amber);border:1px solid #ffb45438}.badge-muted{color:var(--muted);border:1px solid var(--line);background:#9797c412}.badge-blue{background:var(--blue-soft);color:var(--blue);border:1px solid #4cc2ff38}.input{background:var(--bg2);border:1px solid var(--line);width:100%;height:34px;color:var(--text);font-family:var(--sans);border-radius:8px;outline:none;padding:0 12px;font-size:13px;transition:border-color .15s,box-shadow .15s}.input:focus{border-color:#625fff80;box-shadow:0 0 0 3px #625fff1c}.input::placeholder{color:var(--faint)}.input-mono{font-family:var(--mono);font-size:12px}textarea.input{resize:vertical;height:auto;padding:10px 12px}.search-input{position:relative}.search-input input{padding-left:32px}.search-ico{width:14px;height:14px;color:var(--faint);pointer-events:none;position:absolute;top:50%;left:10px;transform:translateY(-50%)}.field{margin-bottom:14px}.field label{color:var(--muted);letter-spacing:.02em;margin-bottom:5px;font-size:11px;font-weight:500;display:block}.field .hint{color:var(--faint);margin-top:4px;font-size:10.5px}.checkbox-row{cursor:pointer;align-items:center;gap:9px;padding:7px 0;display:flex}.checkbox-row input[type=checkbox]{width:14px;height:14px;accent-color:var(--accent);cursor:pointer}.checkbox-row .chk-label{color:var(--muted);font-size:12.5px}.checkbox-row:hover .chk-label{color:var(--text)}.toggle-row{border-bottom:1px solid var(--line);justify-content:space-between;align-items:center;padding:10px 0;display:flex}.toggle-row:last-child{border-bottom:0}.toggle-info{flex:1;min-width:0}.toggle-label{color:var(--text);font-size:12.5px;font-weight:500}.toggle-desc{color:var(--faint);margin-top:2px;font-size:11px}.toggle{flex-shrink:0;width:38px;height:20px;position:relative}.toggle input{opacity:0;width:0;height:0;position:absolute}.toggle-track{background:var(--bg3);border:1px solid var(--line-strong);cursor:pointer;border-radius:99px;transition:background .2s;position:absolute;inset:0}.toggle input:checked+.toggle-track{background:var(--accent);border-color:var(--accent)}.toggle-thumb{background:var(--faint);pointer-events:none;border-radius:50%;width:14px;height:14px;transition:transform .2s,background .2s;position:absolute;top:2px;left:2px}.toggle input:checked~.toggle-thumb{background:#fff;transform:translate(18px)}.modal-overlay{z-index:100;-webkit-backdrop-filter:blur(4px);backdrop-filter:blur(4px);background:#0009;justify-content:center;align-items:center;padding:20px;animation:.15s fade-in;display:flex;position:fixed;inset:0}@keyframes fade-in{0%{opacity:0}}.modal{background:var(--bg1);border:1px solid var(--line-strong);border-radius:14px;flex-direction:column;width:100%;max-width:520px;max-height:90vh;animation:.2s cubic-bezier(.2,.8,.3,1) modal-in;display:flex;overflow:hidden}@keyframes modal-in{0%{opacity:0;transform:scale(.96)translateY(8px)}}.modal.modal-lg{max-width:760px}.modal-head{border-bottom:1px solid var(--line);flex-shrink:0;justify-content:space-between;align-items:center;padding:16px 20px;display:flex}.modal-head h2{font-size:14px;font-weight:600}.modal-close{width:28px;height:28px;color:var(--faint);cursor:pointer;background:0 0;border:none;border-radius:6px;justify-content:center;align-items:center;transition:all .12s;display:flex}.modal-close:hover{color:var(--text);background:#9797c414}.modal-close svg{width:14px;height:14px}.modal-body{flex:1;padding:20px;overflow-y:auto}.modal-foot{border-top:1px solid var(--line);flex-shrink:0;justify-content:flex-end;gap:8px;padding:14px 20px;display:flex}.drawer-overlay{z-index:100;background:#00000080;animation:.15s fade-in;position:fixed;inset:0}.drawer{z-index:101;background:var(--bg1);border-left:1px solid var(--line-strong);flex-direction:column;width:480px;max-width:95vw;animation:.22s cubic-bezier(.2,.8,.3,1) drawer-in;display:flex;position:fixed;top:0;bottom:0;right:0;overflow:hidden}@keyframes drawer-in{0%{transform:translate(100%)}}.drawer-head{border-bottom:1px solid var(--line);flex-shrink:0;justify-content:space-between;align-items:center;padding:16px 20px;display:flex}.drawer-head h2{font-size:14px;font-weight:600}.drawer-body{flex:1;padding:20px;overflow-y:auto}.pagination{justify-content:flex-end;align-items:center;gap:6px;padding-top:16px;display:flex}.pag-info{font-family:var(--mono);color:var(--faint);margin-right:4px;font-size:11px}.empty-state{text-align:center;flex-direction:column;justify-content:center;align-items:center;gap:10px;padding:48px 24px;display:flex}.empty-state svg{width:36px;height:36px;color:var(--faint);margin-bottom:4px}.empty-state h4{color:var(--muted);font-size:14px;font-weight:600}.empty-state p{color:var(--faint);max-width:300px;font-size:12px}.spinner{border:2px solid var(--bg3);border-top-color:var(--accent);border-radius:50%;flex-shrink:0;width:20px;height:20px;animation:.7s linear infinite spin}.spinner.sm{width:14px;height:14px}.spinner.lg{border-width:3px;width:28px;height:28px}@keyframes spin{to{transform:rotate(360deg)}}.loading-row{color:var(--faint);justify-content:center;align-items:center;gap:12px;padding:40px;font-size:12px;display:flex}.error-box{background:var(--red-soft);border-radius:var(--radius);color:var(--red);border:1px solid #ff547040;padding:12px 16px;font-size:12px}.settings-section{margin-bottom:24px}.settings-section-head{border-bottom:1px solid var(--line);align-items:center;gap:10px;margin-bottom:4px;padding-bottom:10px;display:flex}.settings-section-head h3{font-size:13px;font-weight:600}.settings-section-head p{color:var(--faint);margin-top:1px;font-size:11px}.settings-row{border-bottom:1px solid var(--line);justify-content:space-between;align-items:flex-start;gap:20px;padding:12px 0;display:flex}.settings-row:last-child{border-bottom:0}.settings-info{flex:1;min-width:0}.settings-key{font-family:var(--mono);color:var(--text);font-size:12px;font-weight:500}.settings-desc{color:var(--faint);margin-top:2px;font-size:11px}.settings-badge{font-family:var(--mono);color:var(--faint);border:1px solid var(--line);background:#9797c412;border-radius:4px;margin-left:6px;padding:1px 6px;font-size:9.5px}.settings-control{flex-shrink:0;align-items:center;gap:8px;display:flex}.code{font-family:var(--mono);background:var(--bg2);border:1px solid var(--line);color:var(--muted);word-break:break-all;border-radius:6px;padding:2px 8px;font-size:11.5px}.sep{background:var(--line);height:1px;margin:16px 0}.flex{display:flex}.flex-center{align-items:center;display:flex}.gap-2{gap:8px}.gap-3{gap:12px}.ml-auto{margin-left:auto}.text-accent{color:var(--accent)}.text-muted{color:var(--muted)}.text-faint{color:var(--faint)}.text-green{color:var(--green)}.text-red{color:var(--red)}.text-amber{color:var(--amber)}.mono{font-family:var(--mono)}.text-sm{font-size:11px}.text-xs{font-size:10px}.truncate{text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.secret-box{background:var(--bg2);font-family:var(--mono);color:var(--accent);word-break:break-all;border:1px solid #625fff40;border-radius:8px;margin:8px 0;padding:12px 16px;font-size:12px}.secret-box small{color:var(--faint);font-size:10.5px;font-family:var(--sans);letter-spacing:.06em;text-transform:uppercase;margin-bottom:6px;display:block}.chart-svg{width:100%;height:90px;display:block;overflow:visible}.toast-container{z-index:200;flex-direction:column-reverse;gap:8px;display:flex;position:fixed;bottom:20px;right:20px}.toast{background:var(--bg2);border:1px solid var(--line-strong);color:var(--text);border-radius:10px;align-items:center;gap:10px;min-width:260px;max-width:380px;padding:10px 14px;font-size:12.5px;animation:.22s cubic-bezier(.2,.8,.3,1) toast-in;display:flex;box-shadow:0 4px 24px #0006}.toast svg{flex-shrink:0;width:15px;height:15px}.toast.toast-success svg{color:var(--green)}.toast.toast-error svg{color:var(--red)}.toast.toast-info svg{color:var(--accent)}@keyframes toast-in{0%{opacity:0;transform:translate(16px)}}.chart-tip{background:var(--panel,var(--bg));border:1px solid var(--line);color:var(--text);border-radius:8px;padding:7px 10px;font-size:11.5px;box-shadow:0 6px 24px #00000040}.chart-tip-label{color:var(--faint);margin-bottom:4px;font-size:10px}.chart-tip-row{align-items:center;gap:6px;display:flex}.chart-tip-row b{font-weight:600}.chart-tip-dot{border-radius:2px;flex:none;width:7px;height:7px}
+:root{--bg0:#07070d;--bg1:#0c0c16;--bg2:#12121f;--bg3:#181828;--line:#9797c41a;--line-strong:#9797c42e;--text:#e9e9f4;--muted:#9292ac;--faint:#5b5b74;--accent:#625fff;--accent-soft:#625fff24;--accent-hover:#625fff38;--green:#3ecf8e;--green-soft:#3ecf8e1f;--red:#ff5470;--red-soft:#ff54701f;--amber:#ffb454;--amber-soft:#ffb4541f;--blue:#4cc2ff;--blue-soft:#4cc2ff1f;--sans:"Sora", system-ui, -apple-system, sans-serif;--mono:"JetBrains Mono", ui-monospace, "SF Mono", Menlo, monospace;--sidebar-w:240px;--radius:10px;--topbar-h:54px}html.light{--bg0:#f7f7fb;--bg1:#fff;--bg2:#f0f0f6;--bg3:#e7e7f0;--line:#2828461a;--line-strong:#2828462e;--text:#1c1c28;--muted:#55556c;--faint:#8a8aa0;--accent-soft:#625fff1f;--accent-hover:#625fff2e;--amber-soft:#c4821e24;--green-soft:#1ea06424;--red-soft:#dc32501f;--blue-soft:#2896d21f}*,:before,:after{box-sizing:border-box;margin:0;padding:0}html,body,#root{height:100%}body{font-family:var(--sans);background:var(--bg0);color:var(--text);-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;font-size:13px;overflow:hidden}body:before{content:"";pointer-events:none;z-index:0;background:radial-gradient(1100px 500px at 15% -10%,#625fff1a,#0000 60%),radial-gradient(900px 420px at 90% 0,#3ecf8e0a,#0000 55%);position:fixed;inset:0}html.light body:before{display:none}::selection{background:#625fff4d}::-webkit-scrollbar{width:8px;height:8px}::-webkit-scrollbar-thumb{border:2px solid var(--bg0);background:#26263a;border-radius:6px}::-webkit-scrollbar-thumb:hover{background:#33334d}::-webkit-scrollbar-track{background:0 0}html.light ::-webkit-scrollbar-thumb{background:#cfcfe0}html.light ::-webkit-scrollbar-thumb:hover{background:#b8b8cc}#root{z-index:1;position:relative}.app-shell{height:100vh;display:flex;overflow:hidden}.sidebar{width:var(--sidebar-w);border-right:1px solid var(--line);-webkit-backdrop-filter:blur(10px);background:#0a0a12bf;flex-direction:column;flex-shrink:0;display:flex;overflow:hidden}html.light .sidebar{background:#ffffffd9}.main{flex-direction:column;flex:1;min-width:0;display:flex;overflow:hidden}.topbar{height:var(--topbar-h);border-bottom:1px solid var(--line);-webkit-backdrop-filter:blur(8px);background:#09091099;flex-shrink:0;align-items:center;gap:12px;padding:0 20px;display:flex}html.light .topbar{background:#ffffffb3}.content{flex:1;padding:24px 24px 60px;overflow-y:auto}.brand{border-bottom:1px solid var(--line);flex-shrink:0;align-items:center;gap:10px;padding:18px 18px 14px;display:flex}.brand-logo{background:var(--accent-soft);border:1px solid #625fff4d;border-radius:8px;flex-shrink:0;justify-content:center;align-items:center;width:30px;height:30px;display:flex;position:relative}.brand-logo svg{width:16px;height:16px;color:var(--accent)}.brand-logo .ring{border:1px solid #625fff59;border-radius:12px;animation:3s ease-out infinite ring-pulse;position:absolute;inset:-3px}@keyframes ring-pulse{0%{opacity:.9;transform:scale(.85)}70%{opacity:0;transform:scale(1.15)}to{opacity:0;transform:scale(1.15)}}.brand-text{overflow:hidden}.brand-name{letter-spacing:.03em;font-size:14px;font-weight:700}.brand-name span{color:var(--accent)}.brand-sub{color:var(--faint);letter-spacing:.08em;text-transform:uppercase;margin-top:1px;font-size:10px;font-weight:500}.nav{flex:1;padding:10px 10px 8px;overflow-y:auto}.nav-section{letter-spacing:.14em;text-transform:uppercase;color:var(--faint);padding:12px 8px 5px;font-size:9.5px;font-weight:600}.nav-item{color:var(--muted);cursor:pointer;-webkit-user-select:none;user-select:none;border:1px solid #0000;border-radius:8px;align-items:center;gap:9px;padding:7px 9px;font-size:12.5px;font-weight:500;text-decoration:none;transition:background .12s,color .12s;display:flex}.nav-item:hover{color:var(--text);background:#9797c40f}.nav-item.active{background:var(--accent-soft);color:var(--text);border-color:#625fff38}.nav-item.active .nav-ico{color:var(--accent)}.nav-ico{width:15px;height:15px;color:var(--faint);flex-shrink:0;transition:color .12s}.nav-item:hover .nav-ico{color:var(--muted)}.sidebar-foot{border-top:1px solid var(--line);flex-direction:column;flex-shrink:0;gap:10px;padding:12px 14px;display:flex}.user-row{cursor:default;border-radius:8px;align-items:center;gap:9px;padding:6px 8px;display:flex}.avatar{background:var(--accent-soft);width:28px;height:28px;color:var(--accent);border:1px solid #625fff4d;border-radius:50%;flex-shrink:0;justify-content:center;align-items:center;font-size:10.5px;font-weight:600;display:flex}.user-info{flex:1;min-width:0}.user-email{color:var(--text);text-overflow:ellipsis;white-space:nowrap;font-size:11px;font-weight:500;overflow:hidden}.user-role{color:var(--faint);font-size:9.5px;font-family:var(--mono)}.foot-actions{gap:6px;display:flex}.topbar-title{color:var(--text);font-size:14px;font-weight:600}.topbar-spacer{flex:1}.theme-btn{border:1px solid var(--line);background:var(--bg2);width:32px;height:32px;color:var(--muted);cursor:pointer;border-radius:8px;flex-shrink:0;justify-content:center;align-items:center;transition:all .13s;display:flex}.theme-btn:hover{background:var(--bg3);color:var(--text);border-color:var(--line-strong)}.theme-btn svg{width:14px;height:14px}.btn{background:var(--bg2);border:1px solid var(--line);height:32px;color:var(--muted);font-family:var(--sans);cursor:pointer;white-space:nowrap;border-radius:8px;align-items:center;gap:7px;padding:0 13px;font-size:12px;font-weight:500;text-decoration:none;transition:all .13s;display:inline-flex}.btn:hover{color:var(--text);border-color:var(--line-strong);background:var(--bg3)}.btn svg{flex-shrink:0;width:13px;height:13px}.btn.btn-primary{background:var(--accent);color:#fff;border-color:#0000}.btn.btn-primary:hover{background:#7472ff}.btn.btn-danger:hover{color:var(--red);background:var(--red-soft);border-color:#ff547066}.btn.btn-sm{border-radius:6px;height:26px;padding:0 10px;font-size:11px}.btn.btn-ghost{background:0 0;border-color:#0000}.btn.btn-ghost:hover{background:#9797c40f}.btn:disabled,.btn[disabled]{opacity:.45;pointer-events:none}.cards{grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:12px;margin-bottom:20px;display:grid}.card{border:1px solid var(--line);border-radius:var(--radius);background:linear-gradient(#9797c40a,#9797c403);padding:16px 18px 14px;animation:.45s cubic-bezier(.2,.7,.3,1) both rise}.card:nth-child(2){animation-delay:40ms}.card:nth-child(3){animation-delay:80ms}.card:nth-child(4){animation-delay:.12s}.card:nth-child(5){animation-delay:.16s}@keyframes rise{0%{opacity:0;transform:translateY(8px)}}.card-label{letter-spacing:.12em;text-transform:uppercase;color:var(--faint);margin-bottom:10px;font-size:10px;font-weight:600}.card-value{font-family:var(--mono);letter-spacing:-.02em;color:var(--text);font-size:26px;font-weight:600;line-height:1}.card-hint{color:var(--faint);font-size:10.5px;font-family:var(--mono);margin-top:8px}.card-hint b{color:var(--muted);font-weight:500}.card.c-accent .card-value{color:var(--accent)}.card.c-green .card-value{color:var(--green)}.card.c-amber .card-value{color:var(--amber)}.card.c-red .card-value{color:var(--red)}.card.c-blue .card-value{color:var(--blue)}.panel{border:1px solid var(--line);border-radius:var(--radius);background:linear-gradient(#9797c409,#9797c403);margin-bottom:16px;animation:.5s cubic-bezier(.2,.7,.3,1) both rise;overflow:hidden}.panel-head{border-bottom:1px solid var(--line);justify-content:space-between;align-items:center;gap:10px;padding:12px 16px;display:flex}.panel-head h3{letter-spacing:.02em;font-size:12.5px;font-weight:600}.panel-head .meta{font-family:var(--mono);color:var(--faint);font-size:10.5px}.panel-body{padding:12px 16px 16px}.grid-2{grid-template-columns:1fr 1fr;gap:16px;display:grid}@media (width<=1100px){.grid-2{grid-template-columns:1fr}}.page-header{margin-bottom:20px}.page-title{letter-spacing:.01em;margin-bottom:4px;font-size:18px;font-weight:700}.page-sub{color:var(--faint);font-size:12px}.page-actions{align-items:center;gap:8px;display:flex}.page-header-row{justify-content:space-between;align-items:center;gap:16px;margin-bottom:16px;display:flex}.tbl-wrap{overflow-x:auto}table{border-collapse:collapse;width:100%;font-size:12.5px}thead th{text-align:left;letter-spacing:.12em;text-transform:uppercase;color:var(--faint);border-bottom:1px solid var(--line);white-space:nowrap;padding:8px 12px;font-size:10px;font-weight:600}tbody tr{border-bottom:1px solid var(--line);cursor:pointer;transition:background .1s}tbody tr:last-child{border-bottom:0}tbody tr:hover{background:#9797c40a}tbody td{color:var(--muted);vertical-align:middle;padding:10px 12px}tbody td b{color:var(--text);font-weight:500}tbody td.no-click{cursor:default}.badge{height:18px;font-family:var(--mono);white-space:nowrap;border-radius:99px;align-items:center;padding:0 8px;font-size:10px;font-weight:500;display:inline-flex}.badge-accent{background:var(--accent-soft);color:var(--accent);border:1px solid #625fff38}.badge-green{background:var(--green-soft);color:var(--green);border:1px solid #3ecf8e38}.badge-red{background:var(--red-soft);color:var(--red);border:1px solid #ff547038}.badge-amber{background:var(--amber-soft);color:var(--amber);border:1px solid #ffb45438}.badge-muted{color:var(--muted);border:1px solid var(--line);background:#9797c412}.badge-blue{background:var(--blue-soft);color:var(--blue);border:1px solid #4cc2ff38}.input{background:var(--bg2);border:1px solid var(--line);width:100%;height:34px;color:var(--text);font-family:var(--sans);border-radius:8px;outline:none;padding:0 12px;font-size:13px;transition:border-color .15s,box-shadow .15s}.input:focus{border-color:#625fff80;box-shadow:0 0 0 3px #625fff1c}.input::placeholder{color:var(--faint)}.input-mono{font-family:var(--mono);font-size:12px}textarea.input{resize:vertical;height:auto;padding:10px 12px}.search-input{position:relative}.search-input input{padding-left:32px}.search-ico{width:14px;height:14px;color:var(--faint);pointer-events:none;position:absolute;top:50%;left:10px;transform:translateY(-50%)}.field{margin-bottom:14px}.field label{color:var(--muted);letter-spacing:.02em;margin-bottom:5px;font-size:11px;font-weight:500;display:block}.field .hint{color:var(--faint);margin-top:4px;font-size:10.5px}.checkbox-row{cursor:pointer;align-items:center;gap:9px;padding:7px 0;display:flex}.checkbox-row input[type=checkbox]{width:14px;height:14px;accent-color:var(--accent);cursor:pointer}.checkbox-row .chk-label{color:var(--muted);font-size:12.5px}.checkbox-row:hover .chk-label{color:var(--text)}.toggle-row{border-bottom:1px solid var(--line);justify-content:space-between;align-items:center;padding:10px 0;display:flex}.toggle-row:last-child{border-bottom:0}.toggle-info{flex:1;min-width:0}.toggle-label{color:var(--text);font-size:12.5px;font-weight:500}.toggle-desc{color:var(--faint);margin-top:2px;font-size:11px}.toggle{flex-shrink:0;width:38px;height:20px;position:relative}.toggle input{opacity:0;width:0;height:0;position:absolute}.toggle-track{background:var(--bg3);border:1px solid var(--line-strong);cursor:pointer;border-radius:99px;transition:background .2s;position:absolute;inset:0}.toggle input:checked+.toggle-track{background:var(--accent);border-color:var(--accent)}.toggle-thumb{background:var(--faint);pointer-events:none;border-radius:50%;width:14px;height:14px;transition:transform .2s,background .2s;position:absolute;top:2px;left:2px}.toggle input:checked~.toggle-thumb{background:#fff;transform:translate(18px)}.modal-overlay{z-index:100;-webkit-backdrop-filter:blur(4px);backdrop-filter:blur(4px);background:#0009;justify-content:center;align-items:center;padding:20px;animation:.15s fade-in;display:flex;position:fixed;inset:0}@keyframes fade-in{0%{opacity:0}}.modal{background:var(--bg1);border:1px solid var(--line-strong);border-radius:14px;flex-direction:column;width:100%;max-width:520px;max-height:90vh;animation:.2s cubic-bezier(.2,.8,.3,1) modal-in;display:flex;overflow:hidden}@keyframes modal-in{0%{opacity:0;transform:scale(.96)translateY(8px)}}.modal.modal-lg{max-width:760px}.modal-head{border-bottom:1px solid var(--line);flex-shrink:0;justify-content:space-between;align-items:center;padding:16px 20px;display:flex}.modal-head h2{font-size:14px;font-weight:600}.modal-close{width:28px;height:28px;color:var(--faint);cursor:pointer;background:0 0;border:none;border-radius:6px;justify-content:center;align-items:center;transition:all .12s;display:flex}.modal-close:hover{color:var(--text);background:#9797c414}.modal-close svg{width:14px;height:14px}.modal-body{flex:1;padding:20px;overflow-y:auto}.modal-foot{border-top:1px solid var(--line);flex-shrink:0;justify-content:flex-end;gap:8px;padding:14px 20px;display:flex}.drawer-overlay{z-index:100;background:#00000080;animation:.15s fade-in;position:fixed;inset:0}.drawer{z-index:101;background:var(--bg1);border-left:1px solid var(--line-strong);flex-direction:column;width:480px;max-width:95vw;animation:.22s cubic-bezier(.2,.8,.3,1) drawer-in;display:flex;position:fixed;top:0;bottom:0;right:0;overflow:hidden}@keyframes drawer-in{0%{transform:translate(100%)}}.drawer-head{border-bottom:1px solid var(--line);flex-shrink:0;justify-content:space-between;align-items:center;padding:16px 20px;display:flex}.drawer-head h2{font-size:14px;font-weight:600}.drawer-body{flex:1;padding:20px;overflow-y:auto}.pagination{justify-content:flex-end;align-items:center;gap:6px;padding-top:16px;display:flex}.pag-info{font-family:var(--mono);color:var(--faint);margin-right:4px;font-size:11px}.empty-state{text-align:center;flex-direction:column;justify-content:center;align-items:center;gap:10px;padding:48px 24px;display:flex}.empty-state svg{width:36px;height:36px;color:var(--faint);margin-bottom:4px}.empty-state h4{color:var(--muted);font-size:14px;font-weight:600}.empty-state p{color:var(--faint);max-width:300px;font-size:12px}.spinner{border:2px solid var(--bg3);border-top-color:var(--accent);border-radius:50%;flex-shrink:0;width:20px;height:20px;animation:.7s linear infinite spin}.spinner.sm{width:14px;height:14px}.spinner.lg{border-width:3px;width:28px;height:28px}@keyframes spin{to{transform:rotate(360deg)}}.loading-row{color:var(--faint);justify-content:center;align-items:center;gap:12px;padding:40px;font-size:12px;display:flex}.error-box{background:var(--red-soft);border-radius:var(--radius);color:var(--red);border:1px solid #ff547040;padding:12px 16px;font-size:12px}.settings-section{margin-bottom:24px}.settings-section-head{border-bottom:1px solid var(--line);align-items:center;gap:10px;margin-bottom:4px;padding-bottom:10px;display:flex}.settings-section-head h3{font-size:13px;font-weight:600}.settings-section-head p{color:var(--faint);margin-top:1px;font-size:11px}.settings-row{border-bottom:1px solid var(--line);justify-content:space-between;align-items:flex-start;gap:20px;padding:12px 0;display:flex}.settings-row:last-child{border-bottom:0}.settings-info{flex:1;min-width:0}.settings-key{font-family:var(--mono);color:var(--text);font-size:12px;font-weight:500}.settings-desc{color:var(--faint);margin-top:2px;font-size:11px}.settings-badge{font-family:var(--mono);color:var(--faint);border:1px solid var(--line);background:#9797c412;border-radius:4px;margin-left:6px;padding:1px 6px;font-size:9.5px}.settings-control{flex-shrink:0;align-items:center;gap:8px;display:flex}.code{font-family:var(--mono);background:var(--bg2);border:1px solid var(--line);color:var(--muted);word-break:break-all;border-radius:6px;padding:2px 8px;font-size:11.5px}.sep{background:var(--line);height:1px;margin:16px 0}.flex{display:flex}.flex-center{align-items:center;display:flex}.gap-2{gap:8px}.gap-3{gap:12px}.ml-auto{margin-left:auto}.text-accent{color:var(--accent)}.text-muted{color:var(--muted)}.text-faint{color:var(--faint)}.text-green{color:var(--green)}.text-red{color:var(--red)}.text-amber{color:var(--amber)}.mono{font-family:var(--mono)}.text-sm{font-size:11px}.text-xs{font-size:10px}.truncate{text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.secret-box{background:var(--bg2);font-family:var(--mono);color:var(--accent);word-break:break-all;border:1px solid #625fff40;border-radius:8px;margin:8px 0;padding:12px 16px;font-size:12px}.secret-box small{color:var(--faint);font-size:10.5px;font-family:var(--sans);letter-spacing:.06em;text-transform:uppercase;margin-bottom:6px;display:block}.chart-svg{width:100%;height:90px;display:block;overflow:visible}.toast-container{z-index:200;flex-direction:column-reverse;gap:8px;display:flex;position:fixed;bottom:20px;right:20px}.toast{background:var(--bg2);border:1px solid var(--line-strong);color:var(--text);border-radius:10px;align-items:center;gap:10px;min-width:260px;max-width:380px;padding:10px 14px;font-size:12.5px;animation:.22s cubic-bezier(.2,.8,.3,1) toast-in;display:flex;box-shadow:0 4px 24px #0006}.toast svg{flex-shrink:0;width:15px;height:15px}.toast.toast-success svg{color:var(--green)}.toast.toast-error svg{color:var(--red)}.toast.toast-info svg{color:var(--accent)}@keyframes toast-in{0%{opacity:0;transform:translate(16px)}}.chart-tip{background:var(--panel,var(--bg));border:1px solid var(--line);color:var(--text);border-radius:8px;padding:7px 10px;font-size:11.5px;box-shadow:0 6px 24px #00000040}.chart-tip-label{color:var(--faint);margin-bottom:4px;font-size:10px}.chart-tip-row{align-items:center;gap:6px;display:flex}.chart-tip-row b{font-weight:600}.chart-tip-dot{border-radius:2px;flex:none;width:7px;height:7px}.brand.switcher{padding:10px 10px 8px;position:relative}.switcher-button{width:100%;color:inherit;font:inherit;text-align:left;cursor:pointer;background:0 0;border:1px solid #0000;border-radius:8px;align-items:center;gap:10px;padding:8px;display:flex}.switcher-button:hover,.switcher-button[aria-expanded=true]{background:var(--bg2);border-color:var(--line)}.switcher-button:focus-visible{outline:2px solid var(--accent);outline-offset:1px}.switcher-chevron{color:var(--faint);flex-shrink:0;margin-left:auto}.switcher-menu{z-index:50;background:var(--bg1);border:1px solid var(--line-strong);border-radius:8px;padding:4px;position:absolute;top:calc(100% - 2px);left:10px;right:10px}.switcher-item{color:var(--muted);border-radius:6px;grid-template-columns:16px 1fr auto;align-items:center;column-gap:10px;padding:7px 8px;font-size:12.5px;text-decoration:none;display:grid}.switcher-item .switcher-package{font-family:var(--mono);color:var(--faint);grid-column:2/4;font-size:10px}.switcher-item.current{color:var(--text)}.switcher-check{color:var(--accent)}a.switcher-item:hover,a.switcher-item:focus-visible{background:var(--accent-soft);color:var(--text);outline:none}.switcher-title{text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.search-trigger{align-items:center;gap:6px;display:inline-flex}.search-trigger kbd{font-family:var(--mono);color:var(--faint);border:1px solid var(--line);border-radius:4px;padding:0 4px;font-size:10px}.search-overlay{align-items:flex-start;padding-top:12vh}.search-dialog{background:var(--bg1);border:1px solid var(--line-strong);border-radius:var(--radius);width:min(560px,100%);overflow:hidden}.search-input{border:0;border-bottom:1px solid var(--line);width:100%;color:var(--text);font:inherit;background:0 0;outline:none;padding:14px 16px;font-size:14px}.search-results{max-height:52vh;padding:6px;overflow-y:auto}.search-empty{color:var(--faint);padding:14px 10px;font-size:12.5px}.search-group+.search-group{margin-top:6px}.search-group-title{letter-spacing:.1em;text-transform:uppercase;color:var(--faint);align-items:center;gap:6px;padding:6px 10px 4px;font-size:10px;font-weight:600;display:flex}.search-hit{color:var(--text);border-radius:6px;flex-direction:column;gap:1px;padding:7px 10px;text-decoration:none;display:flex}.search-hit.active{background:var(--accent-soft)}.search-hit-title{font-size:13px}.search-hit-sub{color:var(--muted);font-size:11px}.consoles-panel{margin-top:16px}.console-grid{grid-template-columns:repeat(auto-fill,minmax(200px,1fr));gap:10px;display:grid}.console-card{border:1px solid var(--line);color:var(--text);border-radius:8px;align-items:center;gap:12px;padding:12px;text-decoration:none;display:flex}.console-card:hover,.console-card:focus-visible{border-color:var(--line-strong);background:var(--bg2);outline:none}.console-card-icon{background:var(--accent-soft);width:36px;height:36px;color:var(--accent);border-radius:8px;flex-shrink:0;justify-content:center;align-items:center;display:flex}.console-card-text{flex-direction:column;min-width:0;display:flex}.console-card-title{font-size:13px;font-weight:600}.console-card-path{font-family:var(--mono);color:var(--faint);font-size:10.5px}@media (width<=640px){.switcher-menu{border-radius:0;position:fixed;top:64px;left:0;right:0}}

package/build/src/host/ui-dist/index.html

@@ -8,8 +8,8 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Sora:wght@400;500;600;700&family=JetBrains+Mono:ital,wght@0,400;0,500;0,600;1,400&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="/__AUTHKIT_BASE__/assets/index-D0EIeyKK.js"></script>
-    <link rel="stylesheet" crossorigin href="/__AUTHKIT_BASE__/assets/index-DTSmD4RU.css">
+    <script type="module" crossorigin src="/__AUTHKIT_BASE__/assets/index-Dq3dJVBv.js"></script>
+    <link rel="stylesheet" crossorigin href="/__AUTHKIT_BASE__/assets/index-WNIyCEPA.css">
   </head>
   <body>
     <div id="root"></div>

package/build/src/provider/build_provider.js

@@ -3,6 +3,8 @@ import { pickModelAdapterClass } from '../adapters/factory.js';
 import { normalizeActiveOrg, readActiveOrgFromKoaCtx } from '../host/active_org_cookie.js';
 import { consoleSsoClientMetadata } from '../host/console_sso.js';
 import { findMcpResource, mcpAuthorizeMiddleware } from '../mcp/mcp_oauth.js';
+import { hideDisabledClients } from '../service_tenants/client_metadata.js';
+import { createServiceTenantHooks } from '../service_tenants/provider_hooks.js';
 import { createDeviceSources } from './device_sources.js';
 import { createLogoutSources } from './logout_sources.js';
 import { registrationPolicyMiddleware } from './registration_policy.js';
@@ -79,21 +81,35 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
         return key ? { key, rc: at.resources[key] } : null;
     };
     const mcp = config.mcp;
-    const resourceIndicatorFeatures = at.anyJwt || declaredResources.length > 0 || mcp.enabled
+    // Service tenants (`serviceTenants`): `client_credentials` clients with a partition,
+    // whose tokens are JWTs for a service-tenant resource. See `service_tenants/`.
+    const serviceTenants = createServiceTenantHooks({
+        serviceTenants: config.serviceTenants ?? { enabled: false, resources: {} },
+        AdapterClass: config.AdapterClass,
+        audit: config.audit,
+    });
+    const signAlg = config.jwks.keys[0]?.alg ?? 'RS256';
+    const resourceIndicatorFeatures = at.anyJwt || declaredResources.length > 0 || mcp.enabled || serviceTenants.enabled
         ? {
             resourceIndicators: {
                 enabled: true,
-                defaultResource: async (_ctx, _client, oneOf) => {
+                defaultResource: async (ctx, client, oneOf) => {
                     // Nas trocas (code/refresh/device), o provider passa `oneOf` com as
                     // resources já concedidas — devolvemos para não falhar a request.
                     if (oneOf)
                         return oneOf;
+                    const serviceResource = await serviceTenants.defaultResource(ctx, client);
+                    if (serviceResource)
+                        return serviceResource;
                     // Authorize/sem resource explícito: no modo JWT, liga ao resource
                     // default (modo simples). Só opaco: sem resource (AT de sempre).
                     return at.anyJwt ? at.audience : undefined;
                 },
                 useGrantedResource: async () => true,
-                getResourceServerInfo: (_ctx, resourceIndicator, _client) => {
+                getResourceServerInfo: async (ctx, resourceIndicator, client) => {
+                    const serviceInfo = await serviceTenants.resourceServerInfo(ctx, resourceIndicator, client, signAlg);
+                    if (serviceInfo)
+                        return serviceInfo;
                     const found = findResource(resourceIndicator);
                     const isDefault = at.anyJwt && resourceIndicator === at.audience;
                     // Servidores MCP (`mcp`): os declarados e os registrados em runtime.
@@ -122,7 +138,7 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
                         info.accessTokenTTL = ttl;
                     if (format === 'jwt') {
                         // Assina com a chave de assinatura corrente do keystore (mesma do JWKS).
-                        info.jwt = { sign: { alg: config.jwks.keys[0]?.alg ?? 'RS256' } };
+                        info.jwt = { sign: { alg: signAlg } };
                     }
                     return info;
                 },
@@ -138,13 +154,23 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
         // O ator (`act`, RFC 8693) dos access tokens de impersonation — ver
         // `impersonationExtraClaims` em `token_exchange.ts`. Sem isto o token trocado
         // não se distingue de um token do próprio alvo no resource server.
-        extraTokenClaims: async (_ctx, token) => impersonationExtraClaims(token),
+        // Service tenants add `partition`/`capabilities` (see `service_tenants/`).
+        extraTokenClaims: async (ctx, token) => {
+            const actor = impersonationExtraClaims(token);
+            const tenant = await serviceTenants.extraClaims(ctx, token);
+            return actor || tenant ? { ...tenant, ...actor } : undefined;
+        },
         // Dispatcher por modelo (suportado pelo oidc-provider: `Adapter` aceita
         // função `(name) => adapter` além de classe). Session-scoped vai pro
         // `SessionAdapterClass`, o resto pro `AdapterClass` — mesma regra de
         // `pickModelAdapterClass`, usada também pelos serviços que instanciam
         // adapter na mão. Sem `session.adapter`, as duas classes são a mesma.
-        adapter: ((name) => new (pickModelAdapterClass(name, config.AdapterClass, config.SessionAdapterClass))(name)),
+        // A disabled client (`authkit_disabled`) is "not found" for the provider: every
+        // endpoint answers `invalid_client` on the next request.
+        adapter: ((name) => {
+            const instance = new (pickModelAdapterClass(name, config.AdapterClass, config.SessionAdapterClass))(name);
+            return name === 'Client' ? hideDisabledClients(instance) : instance;
+        }),
         findAccount: options.findAccount,
         // Grant REAPROVEITADO (consent já lembrado): o org capturado no primeiro
         // consent ficaria VELHO se o usuário trocasse de org no console e voltasse a
@@ -244,6 +270,7 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
             backchannelLogout: { enabled: true },
             revocation: { enabled: true },
             introspection: { enabled: true },
+            ...(serviceTenants.enabled ? { clientCredentials: { enabled: true } } : {}),
             ...registrationFeatures,
             ...deviceFlowFeatures,
             ...dpopFeatures,
@@ -279,6 +306,10 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
                     ? sessionTtlHolder.transientSec
                     : sessionTtlHolder.rememberSec
                 : config.ttl.session,
+            // `client_credentials` tokens: the resource's lifetime (a service-tenant resource
+            // always sets one), else the access-token TTL.
+            ClientCredentials: (_ctx, token) => token?.resourceServer?.accessTokenTTL ??
+                (tokenTtlHolder ? tokenTtlHolder.accessTokenSec : config.ttl.accessToken),
             Interaction: 3600,
             Grant: tokenTtlHolder
                 ? () => tokenTtlHolder.refreshTokenSec

package/build/src/provider/oidc_service.d.ts

@@ -28,7 +28,7 @@ export declare class OidcService {
     };
     /**
      * @internal Segredo derivado da app key para um uso (`label`) — HMAC dos nonces
-     * DPoP do Poppy, por exemplo. Igual em todas as instâncias, sem expor a chave.
+     * DPoP de uma extension de personal agents, por exemplo. Igual em todas as instâncias, sem expor a chave.
      */
     deriveSecret(label: string): Buffer;
     /** Pathname do issuer sem barra final (ex.: `/oidc`). Vazio quando montado na raiz. */

package/build/src/provider/oidc_service.js

@@ -44,7 +44,7 @@ export class OidcService {
     }
     /**
      * @internal Segredo derivado da app key para um uso (`label`) — HMAC dos nonces
-     * DPoP do Poppy, por exemplo. Igual em todas as instâncias, sem expor a chave.
+     * DPoP de uma extension de personal agents, por exemplo. Igual em todas as instâncias, sem expor a chave.
      */
     deriveSecret(label) {
         return createHmac('sha256', this.#appKey).update(`authkit:${label}`).digest();

package/build/src/schema/ensure.d.ts

@@ -23,9 +23,15 @@
  * }
  * ```
  */
+import type { AuthkitTable } from '../agents/extension.js';
 export interface EnsureSchemaOptions {
     /** Conexão Lucid a usar. Default: conexão primária. */
     connection?: string;
+    /**
+     * Tabelas de `personalAgents.extensions` (`tables` de cada uma), garantidas junto. O provider
+     * passa as do config no boot.
+     */
+    tables?: readonly AuthkitTable[];
     /**
      * Tabela da conta, onde a coluna opcional `login_methods` pertence. Vem do
      * metadado `accountStore.accountTable` (o provider repassa no boot). Undefined
@@ -51,6 +57,14 @@ export interface EnsureSchemaReport {
         ensured: boolean;
     };
 }
+/**
+ * Garante tabelas lib-owned no formato {@link AuthkitTable} — o que `ensureAuthkitSchema` faz com as
+ * do authkit: cria as que faltam, adiciona colunas e índices novos, nunca dropa nem altera. Para
+ * uma extension expor o próprio `ensure*Schema()` para migrations do host. Estável no 1.x.
+ */
+export declare function ensureAuthkitTables(db: any, tables: readonly AuthkitTable[], options?: {
+    connection?: string;
+}): Promise<Pick<EnsureSchemaReport, 'created' | 'altered' | 'indexed'>>;
 /**
  * Garante que as tabelas do authkit existem e têm todas as colunas que esta
  * versão da lib espera. Aditivo e idempotente — seguro de rodar em todo boot

package/build/src/schema/ensure.js

@@ -309,7 +309,7 @@ const TABLES = [
         name: 'auth_agent_registry',
         /**
          * Agentes liberados (`allowed`) ou bloqueados (`blocked`) pelo console admin,
-         * somados ao `defineConfig` — PACT pelo `iss`, Poppy pelo `client_id`.
+         * somados ao `defineConfig` — PACT pelo `iss`; uma extension pelo identificador dela.
          */
         create: (t) => {
             t.string('id').primary();
@@ -333,135 +333,6 @@ const TABLES = [
             updated_at: (t) => t.dateTime('updated_at', { useTz: true, precision: 3 }).nullable(),
         },
     },
-    /*
-     * Personal Agent Protocol (Poppy). Os refresh tokens são grants de
-     * `auth_agent_grants` (prefixo `pgrant_`) com o hash em
-     * `auth_agent_refresh_tokens`; aqui ficam Sessions, access tokens, pedidos de
-     * sign-in e os `jti` vistos. Mesmas regras de data das tabelas acima.
-     */
-    {
-        name: 'auth_poppy_sessions',
-        /**
-         * Uma Session: um usuário do agente (`user_id`, opaco) num agente (`client_id`), com o
-         * `agent_id` opcional. `account_id` é a conta que já usou. `grant_id` e `scope` ficaram da
-         * Draft 0.1, sem uso (o schema só é aditivo).
-         */
-        create: (t) => {
-            t.string('id').primary();
-            t.string('client_id', 2048).notNullable();
-            t.string('user_id').notNullable();
-            t.string('agent_id').nullable();
-            t.string('account_id').nullable().index();
-            t.string('grant_id').nullable().index();
-            t.text('scope').notNullable();
-            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable();
-            t.dateTime('ended_at', { useTz: true, precision: 3 }).nullable();
-            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
-            t.dateTime('updated_at', { useTz: true, precision: 3 }).notNullable();
-        },
-        columns: {
-            client_id: (t) => t.string('client_id', 2048),
-            user_id: (t) => t.string('user_id'),
-            agent_id: (t) => t.string('agent_id').nullable(),
-            account_id: (t) => t.string('account_id').nullable().index(),
-            grant_id: (t) => t.string('grant_id').nullable().index(),
-            scope: (t) => t.text('scope'),
-            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
-            ended_at: (t) => t.dateTime('ended_at', { useTz: true, precision: 3 }).nullable(),
-            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
-            updated_at: (t) => t.dateTime('updated_at', { useTz: true, precision: 3 }).nullable(),
-        },
-    },
-    {
-        name: 'auth_poppy_tokens',
-        /**
-         * Access tokens — só o hash. `jkt` = chave DPoP; `null` = Bearer. `session_id` e `user_id`
-         * ficaram da Draft 0.1 e saem vazios: o sign-in não conhece a Session.
-         */
-        create: (t) => {
-            t.string('token_hash', 64).primary();
-            t.string('session_id').notNullable().index();
-            t.string('client_id', 2048).notNullable();
-            t.string('user_id').notNullable();
-            t.string('account_id').nullable();
-            t.string('grant_id').nullable().index();
-            t.text('scope').notNullable();
-            t.string('resource', 2048).nullable();
-            t.string('jkt', 64).nullable();
-            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable().index();
-            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
-        },
-        columns: {
-            session_id: (t) => t.string('session_id').index(),
-            client_id: (t) => t.string('client_id', 2048),
-            user_id: (t) => t.string('user_id'),
-            account_id: (t) => t.string('account_id').nullable(),
-            grant_id: (t) => t.string('grant_id').nullable().index(),
-            scope: (t) => t.text('scope'),
-            resource: (t) => t.string('resource', 2048).nullable(),
-            jkt: (t) => t.string('jkt', 64).nullable(),
-            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
-            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
-        },
-    },
-    {
-        name: 'auth_poppy_requests',
-        /**
-         * Pedidos: `authorize` (Direct — vira código após o consentimento), `device` (RFC 8628),
-         * `mediated` (aguardando o código de uso único) e `browser` (entrada de um navegador, §6).
-         * Códigos só como hash. Linhas expiradas são apagadas no próximo pedido.
-         */
-        create: (t) => {
-            t.string('id').primary();
-            t.string('kind', 16).notNullable();
-            t.string('code_hash', 64).nullable().unique();
-            t.string('user_code', 16).nullable().unique();
-            t.string('client_id', 2048).notNullable();
-            t.string('session_id').nullable();
-            t.string('account_id').nullable();
-            t.text('requested_scope').notNullable();
-            t.text('granted_scope').nullable();
-            t.string('redirect_uri', 2048).nullable();
-            t.string('code_challenge', 128).nullable();
-            t.string('status', 16).notNullable();
-            t.integer('attempts').notNullable().defaultTo(0);
-            t.integer('interval_seconds').nullable();
-            t.dateTime('last_polled_at', { useTz: true, precision: 3 }).nullable();
-            t.text('data').nullable();
-            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable().index();
-            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
-        },
-        columns: {
-            kind: (t) => t.string('kind', 16),
-            code_hash: (t) => t.string('code_hash', 64).nullable(),
-            user_code: (t) => t.string('user_code', 16).nullable(),
-            client_id: (t) => t.string('client_id', 2048),
-            session_id: (t) => t.string('session_id').nullable(),
-            account_id: (t) => t.string('account_id').nullable(),
-            requested_scope: (t) => t.text('requested_scope'),
-            granted_scope: (t) => t.text('granted_scope').nullable(),
-            redirect_uri: (t) => t.string('redirect_uri', 2048).nullable(),
-            code_challenge: (t) => t.string('code_challenge', 128).nullable(),
-            status: (t) => t.string('status', 16),
-            attempts: (t) => t.integer('attempts').defaultTo(0),
-            interval_seconds: (t) => t.integer('interval_seconds').nullable(),
-            last_polled_at: (t) => t.dateTime('last_polled_at', { useTz: true, precision: 3 }).nullable(),
-            data: (t) => t.text('data').nullable(),
-            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
-            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
-        },
-    },
-    {
-        name: 'auth_poppy_jtis',
-        /** `jti` já aceitos (client assertions, Session JWTs, provas DPoP), até expirarem — anti-replay entre instâncias. */
-        create: (t) => {
-            t.string('key', 100).primary();
-            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable().index();
-        },
-        columns: {
-            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
-        },
-    },
 ];
 /** Linhas de um `rawQuery`, no formato de cada driver (pg, mysql2, sqlite). */
 function catalogRows(result) {
@@ -586,26 +457,9 @@ async function ensureIndex(conn, table, index) {
         throw error;
     }
 }
-/**
- * Garante que as tabelas do authkit existem e têm todas as colunas que esta
- * versão da lib espera. Aditivo e idempotente — seguro de rodar em todo boot
- * e dentro de migrations.
- *
- * `db` é o manager (`Database`, no boot) ou o client da própria migration
- * (`this.db`, um `QueryClient`/`TransactionClient`, usado como está).
- */
-export async function ensureAuthkitSchema(db, options = {}) {
-    const conn = typeof db.connection !== 'function'
-        ? db
-        : options.connection
-            ? db.connection(options.connection)
-            : db.connection();
-    const report = {
-        created: [],
-        altered: {},
-        loginMethods: { table: options.accountTable ?? 'users', ensured: false },
-    };
-    for (const def of TABLES) {
+/** Cria/completa as tabelas (o miolo de {@link ensureAuthkitSchema}). */
+async function ensureTables(conn, tables, report) {
+    for (const def of tables) {
         if (!(await tableExists(conn, def.name))) {
             try {
                 await conn.schema.createTable(def.name, def.create);
@@ -639,6 +493,45 @@ export async function ensureAuthkitSchema(db, options = {}) {
             report.indexed[def.name].push(index.name);
         }
     }
+}
+/**
+ * Garante tabelas lib-owned no formato {@link AuthkitTable} — o que `ensureAuthkitSchema` faz com as
+ * do authkit: cria as que faltam, adiciona colunas e índices novos, nunca dropa nem altera. Para
+ * uma extension expor o próprio `ensure*Schema()` para migrations do host. Estável no 1.x.
+ */
+export async function ensureAuthkitTables(db, tables, options = {}) {
+    const conn = typeof db.connection !== 'function'
+        ? db
+        : options.connection
+            ? db.connection(options.connection)
+            : db.connection();
+    const report = {
+        created: [],
+        altered: {},
+    };
+    await ensureTables(conn, tables, report);
+    return report;
+}
+/**
+ * Garante que as tabelas do authkit existem e têm todas as colunas que esta
+ * versão da lib espera. Aditivo e idempotente — seguro de rodar em todo boot
+ * e dentro de migrations.
+ *
+ * `db` é o manager (`Database`, no boot) ou o client da própria migration
+ * (`this.db`, um `QueryClient`/`TransactionClient`, usado como está).
+ */
+export async function ensureAuthkitSchema(db, options = {}) {
+    const conn = typeof db.connection !== 'function'
+        ? db
+        : options.connection
+            ? db.connection(options.connection)
+            : db.connection();
+    const report = {
+        created: [],
+        altered: {},
+        loginMethods: { table: options.accountTable ?? 'users', ensured: false },
+    };
+    await ensureTables(conn, [...TABLES, ...(options.tables ?? [])], report);
     // Coluna `login_methods` na tabela da CONTA — a tabela é HOST-owned (não está
     // em TABLES porque o nome/shape são decisão do app), mas a LIB consome a
     // coluna (LoginMethodsPreferenceCapability). Alguns deploys de host só migram

package/build/src/service_tenants/client_metadata.d.ts

@@ -0,0 +1,39 @@
+import type { OidcAdapter } from '../adapters/adapter_contract.js';
+/**
+ * authkit-owned keys in a persisted `Client` payload. oidc-provider strips unknown
+ * metadata when it builds a `Client` (and when dynamic registration persists one), so
+ * these keys can only be written by authkit itself (console, Admin API, CLI) and are
+ * read straight from the adapter.
+ */
+export declare const SERVICE_TENANT_KEY = "authkit_service_tenant";
+export declare const CLIENT_DISABLED_KEY = "authkit_disabled";
+/** The service-tenant part of a client. */
+export interface ServiceTenantInfo {
+    /** Partition (tenant) the client acts as. Emitted as the `partition` claim. */
+    partition: string;
+    /** Granted capabilities. Emitted as the `capabilities` claim when non-empty. */
+    capabilities: string[];
+}
+/** Letters, digits, `.`, `_`, `:` and `-`; starts with a letter or digit; up to 128 chars. */
+export declare const PARTITION_PATTERN: RegExp;
+/** Like {@link PARTITION_PATTERN}, plus `*` and `/`. */
+export declare const CAPABILITY_PATTERN: RegExp;
+export declare const MAX_CAPABILITIES = 64;
+/** Reads the service-tenant metadata from a raw client payload, or `null`. */
+export declare function serviceTenantOf(payload: Record<string, unknown> | undefined | null): ServiceTenantInfo | null;
+/** `true` when the raw client payload is disabled. */
+export declare function isClientDisabled(payload: Record<string, unknown> | undefined | null): boolean;
+/**
+ * Validates and normalizes service-tenant input. Returns an error message or the
+ * normalized value (trimmed, de-duplicated capabilities).
+ */
+export declare function normalizeServiceTenant(input: {
+    partition: string;
+    capabilities?: string[];
+}): ServiceTenantInfo | string;
+/**
+ * Wraps the provider's `Client` adapter so a disabled client is "not found": every
+ * endpoint answers `invalid_client` from the next request on, on every instance that
+ * shares the adapter. Writes are untouched.
+ */
+export declare function hideDisabledClients<T extends OidcAdapter>(adapter: T): T;

package/build/src/service_tenants/client_metadata.js

@@ -0,0 +1,80 @@
+/**
+ * authkit-owned keys in a persisted `Client` payload. oidc-provider strips unknown
+ * metadata when it builds a `Client` (and when dynamic registration persists one), so
+ * these keys can only be written by authkit itself (console, Admin API, CLI) and are
+ * read straight from the adapter.
+ */
+export const SERVICE_TENANT_KEY = 'authkit_service_tenant';
+export const CLIENT_DISABLED_KEY = 'authkit_disabled';
+/** Letters, digits, `.`, `_`, `:` and `-`; starts with a letter or digit; up to 128 chars. */
+export const PARTITION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+/** Like {@link PARTITION_PATTERN}, plus `*` and `/`. */
+export const CAPABILITY_PATTERN = /^[A-Za-z0-9*][A-Za-z0-9._:*/-]{0,127}$/;
+export const MAX_CAPABILITIES = 64;
+/** Reads the service-tenant metadata from a raw client payload, or `null`. */
+export function serviceTenantOf(payload) {
+    const raw = payload?.[SERVICE_TENANT_KEY];
+    if (!raw || typeof raw !== 'object')
+        return null;
+    if (typeof raw.partition !== 'string' || !PARTITION_PATTERN.test(raw.partition))
+        return null;
+    const capabilities = Array.isArray(raw.capabilities)
+        ? raw.capabilities.filter((c) => typeof c === 'string' && c.length > 0)
+        : [];
+    return { partition: raw.partition, capabilities };
+}
+/** `true` when the raw client payload is disabled. */
+export function isClientDisabled(payload) {
+    return payload?.[CLIENT_DISABLED_KEY] === true;
+}
+/**
+ * Validates and normalizes service-tenant input. Returns an error message or the
+ * normalized value (trimmed, de-duplicated capabilities).
+ */
+export function normalizeServiceTenant(input) {
+    // Called directly too (not only behind the HTTP validators): check the types here.
+    const rawPartition = input?.partition;
+    const partition = typeof rawPartition === 'string' ? rawPartition.trim() : '';
+    if (!PARTITION_PATTERN.test(partition)) {
+        return `partition "${partition}" is invalid: use letters, digits, ".", "_", ":" or "-" (max 128 chars)`;
+    }
+    const rawCapabilities = input.capabilities ?? [];
+    if (!Array.isArray(rawCapabilities))
+        return 'capabilities must be an array of strings';
+    const capabilities = [];
+    for (const raw of rawCapabilities) {
+        if (typeof raw !== 'string')
+            return 'capabilities must be an array of strings';
+        const cap = raw.trim();
+        if (!CAPABILITY_PATTERN.test(cap)) {
+            return `capability "${cap}" is invalid: use letters, digits, ".", "_", ":", "*", "/" or "-" (max 128 chars)`;
+        }
+        if (!capabilities.includes(cap))
+            capabilities.push(cap);
+    }
+    if (capabilities.length > MAX_CAPABILITIES) {
+        return `at most ${MAX_CAPABILITIES} capabilities per client`;
+    }
+    return { partition, capabilities };
+}
+/**
+ * Wraps the provider's `Client` adapter so a disabled client is "not found": every
+ * endpoint answers `invalid_client` from the next request on, on every instance that
+ * shares the adapter. Writes are untouched.
+ */
+export function hideDisabledClients(adapter) {
+    return new Proxy(adapter, {
+        get(target, prop, receiver) {
+            if (prop === 'find') {
+                return async (id) => {
+                    const payload = await target.find(id);
+                    return isClientDisabled(payload)
+                        ? undefined
+                        : payload;
+                };
+            }
+            const value = Reflect.get(target, prop, receiver);
+            return typeof value === 'function' ? value.bind(target) : value;
+        },
+    });
+}

package/build/src/service_tenants/config.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Service tenants: confidential `client_credentials` clients that act as a partition
+ * (`partition` claim) of a resource server (e.g. a durable control plane). Their tokens
+ * are JWT access tokens (RFC 9068) whose `aud` is the resource (RFC 8707).
+ */
+/** One resource that issues service-tenant tokens. */
+export interface ServiceTenantResourceInput {
+    /** `aud` of the token. Default: the resource indicator itself. */
+    audience?: string;
+    /** Token lifetime in seconds. Default: 600 (10 minutes). */
+    expiresIn?: number;
+    /** Scopes a service tenant may request for this resource. Default: none. */
+    scopes?: string[];
+}
+export interface ServiceTenantsConfigInput {
+    /**
+     * Resource indicators (RFC 8707) that issue service-tenant tokens, e.g.
+     * `{ 'urn:agora:durable': {} }`. Only service-tenant clients can get tokens for them.
+     */
+    resources: Record<string, ServiceTenantResourceInput>;
+}
+export interface ResolvedServiceTenantResource {
+    audience: string;
+    expiresIn: number;
+    scopes: string[];
+}
+export interface ResolvedServiceTenantsConfig {
+    /** `true` when at least one resource is declared. */
+    enabled: boolean;
+    resources: Record<string, ResolvedServiceTenantResource>;
+}
+/** Default token lifetime: 10 minutes. */
+export declare const DEFAULT_SERVICE_TENANT_TTL = 600;
+/**
+ * Resolves `serviceTenants`. Throws on an invalid resource indicator, a non-positive
+ * `expiresIn`, or a resource also declared in `accessTokens.resources` (a resource is
+ * either for users or for service tenants, never both).
+ */
+export declare function resolveServiceTenants(input: ServiceTenantsConfigInput | undefined, accessTokenResources?: Record<string, unknown>): ResolvedServiceTenantsConfig;
+/** Finds a declared service-tenant resource, tolerating a trailing slash. */
+export declare function findServiceTenantResource(config: ResolvedServiceTenantsConfig, indicator: string): {
+    key: string;
+    resource: ResolvedServiceTenantResource;
+} | null;