@adonis-agora/authkit-server 1.0.0-rc.1 → 1.0.0-rc.11

package/CHANGELOG.md

@@ -1,5 +1,112 @@
 # @adonis-agora/authkit-server
 
+## 1.0.0-rc.11
+
+### Patch Changes
+
+- [#473](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/473) [`427c4a3`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/427c4a301907dc78d8e7c5405d4e73e29b8a2be4) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Every table AuthKit owns now uses one Lucid connection: `schema.connection` (default: the primary connection). Before, some of them followed other connections, so with the account model on a named connection the boot created a table on one connection and the code read it on another:
+  
+  - `auth_settings` (runtime settings, the settings CLI, `authkit:expire-scan`, the SDK's embedded driver) followed the account model's connection.
+  - `auth_mfa` and `auth_password_history` used the account model's connection.
+  - The built-in organization models had no connection, so they always used the primary one.
+  - `adapters.database()` and the `lucid` keystore without their own `connection` used the primary connection.
+  
+  They all use `schema.connection` now; `adapters.database({ connection })` and `jwks.store: { driver: 'lucid', connection }` still win when set. The app's account table stays on the account model's connection, and the boot adds the `login_methods` column there. If your app had `schema.connection` unset and the account model on a named connection, those tables move to the primary connection: set `schema.connection` to the connection where they already are.
+
+## 1.0.0-rc.10
+
+### Minor Changes
+
+- [#471](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/471) [`66ccc36`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/66ccc365dbbd7d9d5bf22dba7aad196aff9f5d4b) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Account console extensions from another app. An app that signs in through an authkit IdP can now add pages to the IdP's account console:
+  
+  - authkit-client binds the same `authkit.accountExtensions` registry, so packages register their pages the same way in both setups. With `accountConsole: { remote: true }` the app serves them at `/.well-known/agora-account-extensions` (mounted by `registerOidcClient`, or `registerAccountExtensionsEndpoint(router)`), only to requests the IdP signed for its client id with the scope `authkit:account-extensions`. `accountConsole.subject` maps the IdP account to the app's user.
+  - authkit-server: `accountConsole.remote: [{ clientId, url }]` lists those apps; their pages show in the console next to the in-process ones, with the same sign-in, sudo, confirmation, rate limit and audit rules.
+  - The contract types and validation now live in authkit-core (still exported from `@adonis-agora/authkit-server/account-extension`).
+
+### Patch Changes
+
+- Updated dependencies [[`66ccc36`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/66ccc365dbbd7d9d5bf22dba7aad196aff9f5d4b)]:
+  - @adonis-agora/authkit-core@1.0.0-rc.1
+
+## 1.0.0-rc.9
+
+### Minor Changes
+
+- [#470](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/470) [`d8ee87a`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/d8ee87abd875e8c141cde051023f1035d8274513) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Account console extensions: other packages (and your app) can add pages to `/account/*`.
+  
+  - New subpath `@adonis-agora/authkit-server/account-extension` with the stable contract (`AccountExtension`, blocks, actions) and the `authkit.accountExtensions` registry binding. Contributors register from their provider's `boot()`; AuthKit renders the pages (Edge or your Inertia page) behind the account sign-in, with CSRF, sudo for sensitive actions, a per-account rate limit, and audit of external redirects.
+  - Blocks: `notice`, `keyValue`, `list`, `table`, `meter`, `actions`, `link`, `toolPreview` (approve/reject previews) and `component` (a provider's card fields, scripts loaded with the response's CSP nonce, with a link fallback).
+  - `accountConsole` in `config/authkit.ts`: one `subject(account, { activeOrg, tenant })` mapping shared by every extension, host overrides to disable, rename or reorder pages, and `loadTimeoutMs`.
+  - The account screens share one navigation (`accountNav`) that lists the mounted screens and the extension pages; `AuthHostRouteMap.account.extensions` lists the pages.
+  - JSON API: `GET {prefix}/api/extensions`, `GET {prefix}/api/x/:pageId`, `POST {prefix}/api/x/:pageId/actions/:action`.
+  - authkit-react: `<AccountExtensionPage>`, `useAccountExtensions()`, the page/action query options and `client.account.extensions.*`.
+
+## 1.0.0-rc.8
+
+### Minor Changes
+
+- [#467](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/467) [`65dea93`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/65dea936568e24a450f64834cae8d1e5885dde57) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Admin console: switch between the `@adonis-agora` consoles. The admin console registers itself in the shared `agora.consoles` registry (title "Identity"); the sidebar brand becomes a menu of the other consoles the viewer may open, the Overview page shows them as a "Consoles" grid, and Ctrl/Cmd-K searches users and organizations plus every other console the viewer may open. New routes `GET {prefix}/api/consoles` and `GET {prefix}/api/consoles/search?q=`. `registerAgoraConsole` is exported for consoles you mount yourself, and `isAgoraProbe(ctx)` tells an auditing `authorize` that another console is only checking access (the structural `ctx.agoraProbe` marker). Nothing to configure.
+
+## 1.0.0-rc.7
+
+### Minor Changes
+
+- [#465](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/465) [`6bd9575`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/6bd95759752c0fac14a061875abebb38c0e238b7) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - The active organization is published as the request's tenant in `@adonis-agora/context`: `Context.tenant()` returns `{ id, kind: 'organization', source: 'authkit', slug, role }` (and `tenantId` as before). New client option `tenancy`: `eager` resolves the session at request start (default on when `config/context.ts` enables tenancy and the resolver is `jwt`), `personal` makes the user the tenant when there is no active organization (off by default), and `resolve` maps the session to your own (optionally nested) tenants. A tenant the app sets itself with `Context.setTenant` is never overwritten. authkit-server ships `authkitTenantLabels()`, a label resolver for `config/context.ts` → `tenancy.label` that shows organization names in the consoles, and account stores gain the optional `findOrgsByIds` (implemented by the Lucid store).
+
+## 1.0.0-rc.6
+
+### Minor Changes
+
+- [#464](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/464) [`3250c35`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/3250c35eee328e8e3780df32001323be45fe1bae) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Developer tools over MCP. When the app runs `@adonis-agora/agent`'s dev tools endpoint (`/mcp/agora`), the admin console's data is served there with no config: `authkit_get_overview`, `authkit_list_users`, `authkit_get_user`, `authkit_list_user_sessions`, `authkit_list_user_grants`, `authkit_list_orgs`, `authkit_get_org`, `authkit_list_clients`, `authkit_list_audit`, and the destructive actions `authkit_revoke_user_sessions` and `authkit_disable_user` (hidden until the endpoint allows actions; audited with `mcp:<caller>` as actor). Access follows `admin.authorize`; when it allows the MCP request, `admin.roles` is not checked. Without `admin.authorize`, production refuses and other environments need an AuthKit sign-in holding one of `admin.roles`.
+  
+  `@adonis-agora/authkit-poppy` offers the `agora:dev` scope when the app serves those dev tools (`devTools` option to force it on or off). The consent screen never ticks it for the person, and Mediated Sign-In can't grant it. The personal-agent consent screen supports opt-in scopes (`optIn`, `descriptionKey` on each scope of `agents/consent`).
+
+## 1.0.0-rc.5
+
+### Minor Changes
+
+- [#463](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/463) [`e9f02d8`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/e9f02d8e6858f9ec8e5cdb2b77409fd0c31cb13d) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - `node ace agora:doctor`: one health check for every installed `@adonis-agora` lib. authkit registers its checks (every `authkit:doctor` finding under a stable id such as `authkit.issuer`, plus `authkit.signing-key-age`, `authkit.console-gate`, `authkit.peers` and `authkit.agora-siblings`). Flags: `--json`, `--strict`, `--deep`, `--lib`, `--only`, `--verbose`, `--no-boot`; exit `0` / `1` (error, or warning with `--strict`) / `2` (the doctor could not run). New `@adonis-agora/authkit-server/doctor` entry exports the checks for `--no-boot`. `authkit:doctor` is unchanged.
+
+## 1.0.0-rc.4
+
+### Patch Changes
+
+- fix(deps): update dependency jose to v6.2.16 ([#454](https://github.com/DavideCarvalho/adonis-agora-authkit/issues/454))
+
+## 1.0.0-rc.3
+
+### Minor Changes
+
+- [#460](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/460) [`1858ee8`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/1858ee837bb4edcf0578f86d224693ac9a86a495) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Service tenants: a client can act as one partition of another service, such as a durable control plane.
+  
+  - `serviceTenants: { resources: { 'urn:agora:durable': { expiresIn: 600 } } }` in `config/authkit.ts` declares the resources (RFC 8707) that issue service-tenant tokens: JWT access tokens (RFC 9068) with `aud` = the resource and the client's `partition` and `capabilities` as claims.
+  - A service-tenant client is confidential, uses only `client_credentials` and has no redirect URIs. Create and edit it from the console (**Service tenant** kind), the Admin API and the SDKs (`serviceTenant: { partition, capabilities? }`), or `node ace authkit:clients:create --partition=acme --capability=reports`.
+  - Any client can now be disabled and enabled again (console, `POST /clients/:id/disable|enable`, SDK `clients.disable/enable`): the token endpoint answers `invalid_client` from the next request on.
+  - `authkitTenantVerifier()` (authkit-server) verifies those tokens against the local issuer and keys and returns `{ tenant, capabilities }`; `authkitTenantToken({ issuer, clientId, clientSecret, resource })` (authkit-client) fetches, caches and refreshes them on the tenant side. Both fit durable's `verifyTenant` and `tenant.token` as a function or a class, without depending on durable.
+  - New audit events: `client.disabled`, `client.enabled`, `service_tenant.token_issued`.
+  - Access-token verification (`oidcBearerGuard`, in-process and remote) now refuses a token whose `sub` is a client (a `client_credentials` token), so a service-tenant token never authenticates a user.
+
+## 1.0.0-rc.2
+
+### Major Changes
+
+- [#456](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/456) [`9c12ef9`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/9c12ef9c1c49db9d54a7da6d241264499ad76e18) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Poppy (the Personal Agent Protocol) moves out of `@adonis-agora/authkit-server` into the new `@adonis-agora/authkit-poppy` package, and authkit-server gains a stable extension surface for personal-agent protocols. See [Install `@adonis-agora/authkit-poppy` for Poppy](https://github.com/DavideCarvalho/adonis-agora-authkit/blob/main/apps/docs/content/docs/migrating-to-1-0.mdx#install-adonis-agoraauthkit-poppy-for-poppy).
+  
+  Breaking changes (`@adonis-agora/authkit-server`):
+  
+  - `personalAgents.poppy` is removed: install `@adonis-agora/authkit-poppy` and use `personalAgents: { extensions: [poppy({ ... })] }` with the same options. A config that still has `personalAgents.poppy` fails at boot. Routes, tables, tokens and sessions are unchanged, so no data migration is needed.
+  - Every Poppy export (`PoppyConfigInput` and the other `Poppy*` types, `poppyEmailCodeSignIn`, `verifyPoppyRequest`, `poppyAuth`, `poppyOf`, `poppyWebSession`, `poppyWebSessionOf`, `installPoppySlots`, `POPPY_AUTHENTICATE_SLOT`, `POPPY_WEB_SESSION_KEY`, `PoppyError`, `verifyDpopProof`, `accessTokenHash`, `hmacNonceSource`, `databaseReplayStore`, `memoryReplayStore`, `redisReplayStore`, `safeFetchJson`, `isBlockedAddress`, `SafeFetchError`, `maskEmail`) now comes from `@adonis-agora/authkit-poppy`.
+  - `mail.onPoppySignInCode` is removed: pass `sendCode` to `poppyEmailCodeSignIn()`.
+  - `authkitCsrfExceptions` no longer takes `poppyPrefix`; extensions' endpoints are exempted from the config (`personalAgentExtensions: false` turns that off).
+  - `ensureAuthkitSchema()` no longer creates the `auth_poppy_*` tables (the extension's tables are ensured at boot; `ensurePoppySchema()` for migrations).
+  - Admin console API: an extension's `protocols` entry is `{ label, requireRegistration, hostResolver, allowHttpIdentifiers, identifierLabel, identifierPlaceholder }`.
+  
+  New, stable for 1.x: `personalAgents.extensions` and the types `PersonalAgentExtension`, `PersonalAgentExtensionDefinition`, `PersonalAgentExtensionContext`, `PersonalAgentRouteKit`, `PersonalAgentHost`, `PersonalAgentGrantLedger`, `PersonalAgentGrant`, `PersonalAgentRefreshToken`, `PersonalAgentAccessTokens`, `PersonalAgentProtocolRuntime`, `PersonalAgentGrantSummary`, `PersonalAgentConsoleSummary`, `ResolvedPersonalAgentExtension`, `AuthkitTable`; the functions `personalAgentExtensionRuntime`, `ensureAuthkitTables`, `sendAuthkitCodeEmail`, `signInAccountSession` and `signOutAccountSession`; and the `tables` option of `ensureAuthkitSchema`.
+  
+  Breaking changes (`@adonis-agora/authkit-react`):
+  
+  - `PersonalAgentProtocol` is `'pact'` or any extension id, and `PersonalAgentsOverview.protocols` has one entry per extension (`PersonalAgentExtensionOverview`) instead of a fixed `poppy` key. `AccountAgentGrant.protocol` uses `PersonalAgentProtocol`.
+
 ## 1.0.0-rc.1
 
 ### Major Changes

package/README.md

@@ -15,11 +15,10 @@ wrapper around [`oidc-provider`](https://github.com/panva/node-oidc-provider).
   auth via `acr_values`, Dynamic Client Registration (RFC 7591/7592).
 - **Personal agents** — AI assistants acting for your users: agent identity by signed JWT
   (JWKS, no shared secrets) and user-approved, revocable delegation with scopes you define,
-  over a pluggable protocol adapter ([PACT](https://openpactprotocol.org) built in).
-  Plus the [Personal Agent Protocol ("Poppy")](https://personalagentprotocol.org/docs/spec):
-  discovery, signed `Poppy-Session` agent sessions, Direct/Device/Mediated sign-in, MCP and browser sessions.
-  ⚠️ **Experimental** — tracks the spec's Draft 0.3 and will change (possibly breaking, outside
-  semver majors) while the spec is a draft.
+  over a pluggable protocol adapter ([PACT](https://openpactprotocol.org) built in), plus
+  `personalAgents.extensions` for protocols shipped as their own packages — the
+  [Personal Agent Protocol ("Poppy")](https://personalagentprotocol.org/docs/spec) is
+  [`@adonis-agora/authkit-poppy`](https://www.npmjs.com/package/@adonis-agora/authkit-poppy).
 - **Native apps** — RFC 8252 native clients (`authkit:clients:create --native`: private-use
   scheme / claimed https / loopback redirects, always public + PKCE) and the `@adonisjs/auth`
   guards `oidcRpGuard` (session) and `oidcBearerGuard` (`Authorization: Bearer` access tokens,

package/build/commands/agora_doctor.d.ts

@@ -0,0 +1,22 @@
+import { BaseCommand } from '@adonisjs/core/ace';
+import type { CommandOptions } from '@adonisjs/core/types/ace';
+/**
+ * `node ace agora:doctor`: one health check for every installed `@adonis-agora` lib. Exit code `0`
+ * when nothing is an error (`--strict`: nor a warning), `1` otherwise, `2` when the doctor itself
+ * cannot run.
+ */
+export default class AgoraDoctor extends BaseCommand {
+    static commandName: string;
+    static description: string;
+    static options: CommandOptions;
+    /** A `<lib>:doctor` alias sets this to pre-filter its lib. */
+    protected presetLib: string | undefined;
+    json: boolean;
+    lib?: string;
+    deep: boolean;
+    only?: string;
+    strict: boolean;
+    verbose: boolean;
+    boot: boolean;
+    run(): Promise<void>;
+}

package/build/commands/agora_doctor.js

@@ -0,0 +1,109 @@
+// agora-doctor command v1 — keep identical across libs
+// Revision 1.1 (see the canonical README for the changelog).
+// Every @adonis-agora lib ships this command (commands/agora_doctor.ts); whichever copy Ace loads
+// last wins, and they all behave the same. Each repo's CI checks its sha256 against the pinned
+// canonical one. Never edit a lib's copy: change the canonical copy, then re-copy it into every lib.
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { BaseCommand, flags } from '@adonisjs/core/ace';
+import { AgoraDoctorUsageError, discoverDoctorChecks, readDoctorChecks, renderAgoraDoctor, runAgoraDoctor, } from '../src/doctor/agora_doctor.js';
+/**
+ * `node ace agora:doctor`: one health check for every installed `@adonis-agora` lib. Exit code `0`
+ * when nothing is an error (`--strict`: nor a warning), `1` otherwise, `2` when the doctor itself
+ * cannot run.
+ */
+export default class AgoraDoctor extends BaseCommand {
+    static commandName = 'agora:doctor';
+    static description = 'Check the configuration of every installed @adonis-agora lib';
+    // The app is booted by `run()` itself, so `--no-boot` can skip it.
+    static options = { startApp: false };
+    /** A `<lib>:doctor` alias sets this to pre-filter its lib. */
+    presetLib = undefined;
+    async run() {
+        const err = (line) => process.stderr.write(`${line}\n`);
+        try {
+            let checks;
+            if (this.boot === false) {
+                checks = await discoverDoctorChecks(this.app);
+            }
+            else {
+                if (!this.app.isReady) {
+                    try {
+                        await this.app.boot();
+                        await this.app.start(() => { });
+                    }
+                    catch (error) {
+                        const reason = error instanceof Error ? error.message : String(error);
+                        throw new AgoraDoctorUsageError(`the app did not boot (${reason}). Fix the boot error, or run with --no-boot.`);
+                    }
+                }
+                checks = await readDoctorChecks(this.app.container);
+            }
+            const libs = (this.lib ?? this.presetLib)
+                ?.split(',')
+                .map((name) => name.trim())
+                .filter(Boolean);
+            const { report, exitCode } = await runAgoraDoctor(this.app, checks, {
+                ...(libs ? { libs } : {}),
+                ...(this.only ? { only: this.only } : {}),
+                deep: this.deep === true,
+                noBoot: this.boot === false,
+                strict: this.strict === true,
+            });
+            if (this.json) {
+                process.stdout.write(`${JSON.stringify(report)}\n`);
+            }
+            else {
+                const fancy = process.stdout.isTTY === true && !process.env.NO_COLOR;
+                const c = this.colors;
+                process.stdout.write(renderAgoraDoctor(report, {
+                    verbose: this.verbose === true,
+                    fancy,
+                    paint: {
+                        green: (t) => c.green(t),
+                        yellow: (t) => c.yellow(t),
+                        red: (t) => c.red(t),
+                        dim: (t) => c.dim(t),
+                        bold: (t) => c.bold(t),
+                    },
+                }));
+            }
+            this.exitCode = exitCode;
+        }
+        catch (error) {
+            if (!(error instanceof AgoraDoctorUsageError))
+                throw error;
+            err(`agora:doctor: ${error.message}`);
+            this.exitCode = 2;
+        }
+    }
+}
+__decorate([
+    flags.boolean({ description: 'Print one JSON object to stdout' })
+], AgoraDoctor.prototype, "json", void 0);
+__decorate([
+    flags.string({ description: 'Only these libs, comma separated (durable,payments)' })
+], AgoraDoctor.prototype, "lib", void 0);
+__decorate([
+    flags.boolean({ description: 'Also run checks that touch the database, Redis or the network' })
+], AgoraDoctor.prototype, "deep", void 0);
+__decorate([
+    flags.string({ description: 'Run one check by id' })
+], AgoraDoctor.prototype, "only", void 0);
+__decorate([
+    flags.boolean({ description: 'Fail (exit 1) on warnings too' })
+], AgoraDoctor.prototype, "strict", void 0);
+__decorate([
+    flags.boolean({ description: 'Show skipped checks and every message' })
+], AgoraDoctor.prototype, "verbose", void 0);
+__decorate([
+    flags.boolean({
+        description: 'Boot the app first; --no-boot checks the config only (when boot itself fails)',
+        default: true,
+        showNegatedVariantInHelp: true,
+    })
+], AgoraDoctor.prototype, "boot", void 0);

package/build/commands/clients_create.d.ts

@@ -11,8 +11,10 @@ import type { CommandOptions } from '@adonisjs/core/types/ace';
  *   node ace authkit:clients:create --client-id=my-api --redirect-uri=https://api/cb --redirect-uri=https://api/cb2 --grant=client_credentials
  *   node ace authkit:clients:create --redirect-uri=https://app/cb --json
  *   node ace authkit:clients:create --client-id=my-mobile --native --redirect-uri=com.example.app:/oauth
+ *   node ace authkit:clients:create --client-id=worker-acme --partition=acme --capability=reports
  */
 export default class AuthkitClientsCreate extends BaseCommand {
+    #private;
     static commandName: string;
     static description: string;
     static help: string[];
@@ -25,6 +27,8 @@ export default class AuthkitClientsCreate extends BaseCommand {
     native?: boolean;
     backchannelLogoutUri?: string;
     clientSecret?: string;
+    partition?: string;
+    capability?: string[];
     json?: boolean;
     run(): Promise<void>;
 }

package/build/commands/clients_create.js

@@ -16,6 +16,7 @@ import { BaseCommand, flags } from '@adonisjs/core/ace';
  *   node ace authkit:clients:create --client-id=my-api --redirect-uri=https://api/cb --redirect-uri=https://api/cb2 --grant=client_credentials
  *   node ace authkit:clients:create --redirect-uri=https://app/cb --json
  *   node ace authkit:clients:create --client-id=my-mobile --native --redirect-uri=com.example.app:/oauth
+ *   node ace authkit:clients:create --client-id=worker-acme --partition=acme --capability=reports
  */
 export default class AuthkitClientsCreate extends BaseCommand {
     static commandName = 'authkit:clients:create';
@@ -41,9 +42,18 @@ export default class AuthkitClientsCreate extends BaseCommand {
         '  node ace authkit:clients:create --redirect-uri=https://app/cb --backchannel-logout-uri=https://app/bc',
         '  node ace authkit:clients:create --client-id=my-app --redirect-uri=https://a/cb --redirect-uri=https://b/cb --json',
         '  node ace authkit:clients:create --client-id=my-mobile --native --redirect-uri=com.example.app:/oauth',
+        '',
+        'Service tenant (a process that acts as one partition, e.g. a durable tenant pod):',
+        'use --partition (and --capability, repeatable). Implies a confidential client with',
+        'only the client_credentials grant and no redirect URIs. Needs serviceTenants.resources',
+        'in config/authkit.ts.',
+        '  node ace authkit:clients:create --client-id=worker-acme --partition=acme --capability=reports',
     ];
     static options = { startApp: true };
     async run() {
+        if (this.partition !== undefined || this.capability?.length) {
+            return this.#createServiceTenant();
+        }
         const redirectUris = this.redirectUri ?? [];
         if (redirectUris.length === 0) {
             this.logger.logError('❌ --redirect-uri é obrigatório. Passe ao menos uma URI de callback.');
@@ -120,6 +130,83 @@ export default class AuthkitClientsCreate extends BaseCommand {
             this.logger.info('');
         }
     }
+    /** `--partition`: a service tenant (client_credentials only, `partition` claim). */
+    async #createServiceTenant() {
+        if (!this.partition) {
+            this.logger.logError('❌ --capability needs --partition.');
+            this.exitCode = 1;
+            return;
+        }
+        const conflicting = [
+            this.redirectUri?.length && '--redirect-uri',
+            this.postLogoutUri?.length && '--post-logout-uri',
+            this.public && '--public',
+            this.native && '--native',
+            this.backchannelLogoutUri && '--backchannel-logout-uri',
+            this.grant?.some((g) => g !== 'client_credentials') && '--grant',
+        ].filter(Boolean);
+        if (conflicting.length) {
+            this.logger.logError(`❌ ${conflicting.join(', ')} cannot be used with --partition (a service tenant only uses client_credentials).`);
+            this.exitCode = 1;
+            return;
+        }
+        const service = await this.app.container.make('authkit.server');
+        const { AdminClientsService } = await import('../src/host/admin_clients_service.js');
+        const { ClientMetadataError } = await import('../src/host/client_metadata.js');
+        const svc = new AdminClientsService(service);
+        const input = {
+            clientId: this.clientId,
+            applicationType: 'web',
+            redirectUris: [],
+            postLogoutRedirectUris: [],
+            grantTypes: ['client_credentials'],
+            tokenEndpointAuthMethod: 'client_secret_basic',
+            serviceTenant: { partition: this.partition, capabilities: this.capability ?? [] },
+        };
+        let created;
+        try {
+            created = this.clientSecret
+                ? await svc.createWithSecret(input, this.clientSecret)
+                : await svc.create(input);
+        }
+        catch (err) {
+            if (err instanceof ClientMetadataError) {
+                this.logger.logError(`❌ ${err.message}`);
+                this.exitCode = 1;
+                return;
+            }
+            throw err;
+        }
+        const tenant = (await svc.find(created.clientId))?.serviceTenant;
+        await service.config.audit
+            ?.record({
+            type: 'client.created',
+            clientId: created.clientId,
+            ip: null,
+            metadata: { actor: 'cli', partition: tenant?.partition },
+        })
+            .catch(() => { });
+        if (this.json) {
+            this.logger.info(JSON.stringify({
+                clientId: created.clientId,
+                clientSecret: created.clientSecret,
+                grantTypes: ['client_credentials'],
+                serviceTenant: tenant,
+                resources: Object.keys(service.config.serviceTenants.resources),
+            }, null, 2));
+            return;
+        }
+        this.logger.success(`Service tenant created: ${created.clientId}`);
+        this.logger.info(`  partition:     ${tenant?.partition}`);
+        if (tenant?.capabilities.length) {
+            this.logger.info(`  capabilities:  ${tenant.capabilities.join(', ')}`);
+        }
+        this.logger.info(`  resources:     ${Object.keys(service.config.serviceTenants.resources).join(', ')}`);
+        this.logger.info('');
+        this.logger.success('CLIENT SECRET (shown ONCE - store it now):');
+        this.logger.success(`  ${created.clientSecret}`);
+        this.logger.info('');
+    }
 }
 __decorate([
     flags.string({ description: 'client_id desejado. Omitir gera um UUID aleatório.' })
@@ -155,6 +242,16 @@ __decorate([
         description: 'Usa este client_secret em vez de gerar um (client confidencial). Útil para manter o secret que os RPs já usam.',
     })
 ], AuthkitClientsCreate.prototype, "clientSecret", void 0);
+__decorate([
+    flags.string({
+        description: 'Service tenant: the partition its tokens act as (`partition` claim). Implies client_credentials only, no redirect URIs.',
+    })
+], AuthkitClientsCreate.prototype, "partition", void 0);
+__decorate([
+    flags.array({
+        description: 'Service tenant: capability granted in its tokens (repeatable). Needs --partition.',
+    })
+], AuthkitClientsCreate.prototype, "capability", void 0);
 __decorate([
     flags.boolean({
         description: 'Output em JSON machine-readable (inclui clientId e clientSecret).',

package/build/commands/commands.json

@@ -130,6 +130,20 @@
           "type": "string",
           "description": "Usa este client_secret em vez de gerar um (client confidencial)."
         },
+        {
+          "name": "partition",
+          "flagName": "partition",
+          "required": false,
+          "type": "string",
+          "description": "Service tenant: the partition its tokens act as (`partition` claim). Implies client_credentials only, no redirect URIs."
+        },
+        {
+          "name": "capability",
+          "flagName": "capability",
+          "required": false,
+          "type": "array",
+          "description": "Service tenant: capability granted in its tokens (repeatable). Needs --partition."
+        },
         {
           "name": "json",
           "flagName": "json",
@@ -319,6 +333,70 @@
       "args": [],
       "options": { "startApp": true },
       "filePath": "expire_scan.js"
+    },
+    {
+      "commandName": "agora:doctor",
+      "description": "Check the configuration of every installed @adonis-agora lib",
+      "namespace": "agora",
+      "aliases": [],
+      "flags": [
+        {
+          "name": "json",
+          "flagName": "json",
+          "required": false,
+          "type": "boolean",
+          "description": "Print one JSON object to stdout"
+        },
+        {
+          "name": "lib",
+          "flagName": "lib",
+          "required": false,
+          "type": "string",
+          "description": "Only these libs, comma separated (durable,payments)"
+        },
+        {
+          "name": "deep",
+          "flagName": "deep",
+          "required": false,
+          "type": "boolean",
+          "description": "Also run checks that touch the database, Redis or the network"
+        },
+        {
+          "name": "only",
+          "flagName": "only",
+          "required": false,
+          "type": "string",
+          "description": "Run one check by id"
+        },
+        {
+          "name": "strict",
+          "flagName": "strict",
+          "required": false,
+          "type": "boolean",
+          "description": "Fail (exit 1) on warnings too"
+        },
+        {
+          "name": "verbose",
+          "flagName": "verbose",
+          "required": false,
+          "type": "boolean",
+          "description": "Show skipped checks and every message"
+        },
+        {
+          "name": "boot",
+          "flagName": "boot",
+          "required": false,
+          "type": "boolean",
+          "description": "Boot the app first; --no-boot checks the config only (when boot itself fails)",
+          "default": true,
+          "showNegatedVariantInHelp": true
+        }
+      ],
+      "args": [],
+      "options": {
+        "startApp": false
+      },
+      "filePath": "agora_doctor.js"
     }
   ]
 }

package/build/commands/doctor.js

@@ -1,43 +1,6 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
 import { BaseCommand } from '@adonisjs/core/ace';
-import { DatabaseAdapter } from '../src/adapters/database_adapter.js';
-import { resolveAuthkitConfig } from '../src/commands/resolve_config.js';
-import { defaultEncryptForStore } from '../src/define_config.js';
-import { hasErrors, runAllChecks, signingKeyAgeFinding, } from '../src/doctor/checks.js';
-import { signingKeyAgeDays } from '../src/keys/keystore.js';
-import { KeystoreCodec } from '../src/keys/keystore_codec.js';
-import { loadEncryptionService } from '../src/keys/keystore_crypto.js';
-import { KeystoreManager, resolveKeystoreVault } from '../src/keys/keystore_manager.js';
-/**
- * Tenta importar um peer; `true` se importável.
- *
- * Distingue "não instalado" de "instalado mas quebrado": só um erro de
- * módulo-não-encontrado (`ERR_MODULE_NOT_FOUND`/`MODULE_NOT_FOUND`) é tratado como
- * peer ausente (silencioso — é o caso esperado). Qualquer outro erro significa que
- * o peer ESTÁ presente mas falhou ao carregar (import circular, erro de sintaxe,
- * config inválida) — isso o doctor precisa gritar, senão um peer quebrado aparece
- * como "ausente" e o diagnóstico mente.
- */
-async function canImport(specifier, logger) {
-    try {
-        await import(__rewriteRelativeImportExtension(specifier));
-        return true;
-    }
-    catch (err) {
-        const code = err?.code;
-        if (code !== 'ERR_MODULE_NOT_FOUND' && code !== 'MODULE_NOT_FOUND') {
-            logger?.warning(`⚠️  ${specifier} está instalado mas falhou ao carregar: ${err.message}`);
-        }
-        return false;
-    }
-}
+import { hasErrors, runAllChecks } from '../src/doctor/checks.js';
+import { buildDoctorInput, managedSigningKeyAgeFinding } from '../src/doctor/doctor_input.js';
 export default class AuthkitDoctor extends BaseCommand {
     static commandName = 'authkit:doctor';
     static description = 'Valida a configuração do AuthKit no host e imprime achados (✅/⚠️/❌). Sai com código !=0 se houver erros.';
@@ -48,50 +11,21 @@ export default class AuthkitDoctor extends BaseCommand {
     ];
     static options = { startApp: true };
     async run() {
-        const config = await this.app.container.make('config');
-        // `defineConfig` exporta um config provider — resolve antes de inspecionar,
-        // senão todo campo aparece como "ausente" (provider cru não tem issuer etc.).
-        let authkitConfig = null;
+        // `buildDoctorInput` resolve o config provider de `config/authkit.ts` antes de inspecionar.
+        let input;
         try {
-            authkitConfig = await resolveAuthkitConfig(this.app, config.get('authkit', null));
+            input = await buildDoctorInput(this.app, this.logger);
         }
         catch (error) {
             this.logger.logError(`❌ config/authkit.ts falhou ao resolver: ${error.message}`);
             this.exitCode = 1;
             return;
         }
-        const sessionConfig = config.get('session', null) ?? null;
-        const input = {
-            authkitConfig,
-            sessionConfig,
-            peers: {
-                session: await canImport('@adonisjs/session', this.logger),
-                shield: await canImport('@adonisjs/shield', this.logger),
-                ally: await canImport('@adonisjs/ally', this.logger),
-                limiter: await canImport('@adonisjs/limiter', this.logger),
-            },
-            __adapterClasses: { DatabaseAdapter },
-        };
         const findings = runAllChecks(input);
         // Adiciona o finding de idade da chave de assinatura managed (best-effort).
-        const jwksInput = (authkitConfig?.jwksConfig ?? authkitConfig?.jwks);
-        if (jwksInput?.source === 'managed' && jwksInput?.store) {
-            try {
-                const vault = resolveKeystoreVault(jwksInput.store, {
-                    makePath: (p) => this.app.makePath(p),
-                    container: this.app.container,
-                });
-                const encrypt = jwksInput.encrypt ?? defaultEncryptForStore(jwksInput.store);
-                const enc = encrypt ? await loadEncryptionService().catch(() => undefined) : undefined;
-                const mgr = new KeystoreManager(vault, new KeystoreCodec({ encrypt, enc }), jwksInput.algorithm ?? 'RS256');
-                const store = await mgr.read().catch(() => null);
-                const maxAge = jwksInput.rotationDays ?? 90;
-                findings.push(signingKeyAgeFinding(signingKeyAgeDays(store), maxAge));
-            }
-            catch {
-                /* idade é best-effort no doctor */
-            }
-        }
+        const keyAge = await managedSigningKeyAgeFinding(this.app, input.authkitConfig);
+        if (keyAge)
+            findings.push(keyAge);
         this.print(findings);
         if (hasErrors(findings)) {
             this.exitCode = 1;

package/build/host/views/account/apps.edge

@@ -17,11 +17,7 @@
       </form>
     </div>
 
-    <nav class="mb-6 flex gap-4 text-sm font-medium">
-      <a href="{{ accountPaths?.tokens ?? '/account/tokens' }}" class="text-gray-500 hover:underline">{{ t('account.tokens.title') }}</a>
-      <a href="{{ accountPaths?.security ?? '/account/security' }}" class="text-gray-500 hover:underline">{{ t('account.security.title') }}</a>
-      <a href="{{ accountPaths?.apps ?? '/account/apps' }}" class="text-gray-900 underline">{{ t('account.apps.title') }}</a>
-    </nav>
+    @include('authkit::account/partials/nav')
 
     @if(revoked)
       <div class="mb-6 rounded-lg border border-emerald-300 bg-emerald-50 p-4">