@adonis-agora/authkit-server 1.0.0-rc.1 → 1.0.0-rc.11

package/build/src/host/admin_console/admin_console_entry.js

@@ -0,0 +1,80 @@
+import { getBootedApp } from '../../../services/booted_app.js';
+import { supportsOrganizations } from '../../accounts/account_store.js';
+import { readAgoraConsoles, } from '../../console_switcher.js';
+/** The admin console's id in the `'agora.consoles'` registry. */
+export const ADMIN_CONSOLE_ID = 'authkit';
+/** The `'agora.consoles'` registry, or `null` (none bound, or no booted app). */
+export async function consoleRegistry() {
+    try {
+        return await readAgoraConsoles(getBootedApp());
+    }
+    catch {
+        return null;
+    }
+}
+const ORG_CACHE_MS = 30_000;
+const orgCache = new WeakMap();
+/** The store's organizations, cached for 30 s per store so a search session does one query. */
+function cachedOrgs(store, load) {
+    const hit = orgCache.get(store);
+    if (hit && Date.now() - hit.at < ORG_CACHE_MS)
+        return hit.rows;
+    const rows = load();
+    orgCache.set(store, { at: Date.now(), rows });
+    rows.catch(() => orgCache.delete(store));
+    return rows;
+}
+/**
+ * Global search of the admin console: users by email (as the account store's `listAccounts`
+ * search matches them), and organizations by name or slug.
+ * Each hit opens the matching drawer in the console.
+ */
+export async function searchAdminConsole(ctx, adminPrefix, query, limit) {
+    const service = await ctx.containerResolver.make('authkit.server');
+    const store = service.config.accountStore;
+    const hits = [];
+    const accounts = await store.listAccounts({ search: query, page: 1, size: limit });
+    for (const account of accounts.data.slice(0, limit)) {
+        hits.push({
+            title: account.email,
+            subtitle: account.name ? `User · ${account.name}` : 'User',
+            href: `${adminPrefix}?view=users&user=${encodeURIComponent(account.id)}`,
+        });
+    }
+    // Organizations only from a store that lists them in one query, for queries of 2+ characters,
+    // from a list cached briefly per process: search runs on every (debounced) keystroke.
+    if (hits.length < limit && query.length >= 2 && supportsOrganizations(store)) {
+        const listAll = store
+            .listAllOrgsWithMemberCount;
+        if (typeof listAll === 'function') {
+            const needle = query.toLowerCase();
+            const orgs = await cachedOrgs(store, () => listAll.call(store));
+            for (const org of orgs) {
+                if (hits.length >= limit)
+                    break;
+                if (!org.name.toLowerCase().includes(needle) && !org.slug.toLowerCase().includes(needle)) {
+                    continue;
+                }
+                hits.push({
+                    title: org.name,
+                    subtitle: `Organization · ${org.slug}`,
+                    href: `${adminPrefix}?view=orgs&org=${encodeURIComponent(org.id)}`,
+                });
+            }
+        }
+    }
+    return hits;
+}
+/** The admin console's registry entry, for the shell mounted at `adminPrefix`. */
+export function adminConsoleEntry(adminPrefix, authorize) {
+    return {
+        id: ADMIN_CONSOLE_ID,
+        title: 'Identity',
+        package: '@adonis-agora/authkit-server',
+        icon: 'identity',
+        path: adminPrefix,
+        order: 90,
+        authorize,
+        search: (ctx, query, limit) => searchAdminConsole(ctx, adminPrefix, query, limit),
+    };
+}

package/build/src/host/admin_console/admin_shell_controller.js

@@ -1,8 +1,10 @@
 import { readFile } from 'node:fs/promises';
 import { extname } from 'node:path';
+import { countOtherConsoles } from '../../console_switcher.js';
 import { accountPath } from '../account_paths.js';
 import { resolveAccountRoles, rolesManagedExternally } from '../account_roles.js';
 import { getAdminPrefix } from '../admin_prefix.js';
+import { ADMIN_CONSOLE_ID, consoleRegistry } from './admin_console_entry.js';
 // ─── Shell HTML cache ─────────────────────────────────────────────────────────
 /**
  * Points to the Vite-built index.html inside build/host/ui-dist/.
@@ -141,6 +143,9 @@ export default class AdminShellController {
             }
         }
         const adminBase = getAdminPrefix();
+        // Console switcher: only announced when other `@adonis-agora` consoles are registered; the SPA
+        // then asks the endpoint which of them this viewer may open.
+        const others = countOtherConsoles(await consoleRegistry(), ADMIN_CONSOLE_ID);
         const authkitConfig = {
             adminBase,
             csrfToken: ctx.request.csrfToken ?? null,
@@ -152,6 +157,9 @@ export default class AdminShellController {
                 // Confirmação de identidade (sudo) das ações destrutivas.
                 confirm: accountPath('confirm'),
             },
+            ...(others > 0 ? { switcher: { endpoint: `${adminBase}/api/consoles`, others } } : {}),
+            // Global search (Ctrl/Cmd-K) across this console and every other one the viewer may open.
+            search: { endpoint: `${adminBase}/api/consoles/search` },
             features: {
                 // A página de personal agents só aparece com `personalAgents` no config.
                 personalAgents: !!cfg.personalAgents,

package/build/src/host/admin_console/console_clients_controller.d.ts

@@ -9,8 +9,11 @@ import type { HttpContext } from '@adonisjs/core/http';
  * PATCH  {prefix}/api/clients/:id             → atualizar metadata
  * DELETE {prefix}/api/clients/:id             → remover client
  * POST   {prefix}/api/clients/:id/regenerate-secret → gerar novo secret
+ * POST   {prefix}/api/clients/:id/disable     → stop issuing tokens to the client
+ * POST   {prefix}/api/clients/:id/enable      → issue tokens again
  */
 export default class ConsoleClientsController {
+    #private;
     /** GET {prefix}/api/clients */
     index(ctx: HttpContext): Promise<{
         data: {
@@ -25,6 +28,8 @@ export default class ConsoleClientsController {
             backchannelLogoutSessionRequired: boolean;
             clientName: string | null;
             logoUri: string | null;
+            disabled: boolean;
+            serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
         }[];
         canList: boolean;
     }>;
@@ -41,6 +46,8 @@ export default class ConsoleClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     /** POST {prefix}/api/clients */
     store(ctx: HttpContext): Promise<void | {
@@ -60,12 +67,46 @@ export default class ConsoleClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     /** DELETE {prefix}/api/clients/:id */
     destroy(ctx: HttpContext): Promise<void | {
         ok: boolean;
         deleted: string;
     }>;
+    /** POST {prefix}/api/clients/:id/disable */
+    disable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
+    /** POST {prefix}/api/clients/:id/enable */
+    enable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
     /** POST {prefix}/api/clients/:id/regenerate-secret */
     regenerateSecret(ctx: HttpContext): Promise<void | {
         clientId: string;

package/build/src/host/admin_console/console_clients_controller.js

@@ -19,6 +19,8 @@ function invalidMetadata(ctx, err) {
  * PATCH  {prefix}/api/clients/:id             → atualizar metadata
  * DELETE {prefix}/api/clients/:id             → remover client
  * POST   {prefix}/api/clients/:id/regenerate-secret → gerar novo secret
+ * POST   {prefix}/api/clients/:id/disable     → stop issuing tokens to the client
+ * POST   {prefix}/api/clients/:id/enable      → issue tokens again
  */
 export default class ConsoleClientsController {
     /** GET {prefix}/api/clients */
@@ -107,6 +109,34 @@ export default class ConsoleClientsController {
         });
         return { ok: true, deleted: id };
     }
+    /** POST {prefix}/api/clients/:id/disable */
+    async disable(ctx) {
+        return this.#setDisabled(ctx, true);
+    }
+    /** POST {prefix}/api/clients/:id/enable */
+    async enable(ctx) {
+        return this.#setDisabled(ctx, false);
+    }
+    /** Disabled clients get `invalid_client` from the next request on. */
+    async #setDisabled(ctx, disabled) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const svc = new AdminClientsService(service);
+        const id = ctx.request.param('id');
+        if (!(await svc.setDisabled(id, disabled))) {
+            return ctx.response.notFound(apiError('not_found', 'Client não encontrado.'));
+        }
+        const client = await svc.find(id);
+        await service.config.audit?.record({
+            type: disabled ? 'client.disabled' : 'client.enabled',
+            clientId: id,
+            ip: ctx.request.ip?.() ?? null,
+            metadata: {
+                actor: 'admin-console',
+                ...(client?.serviceTenant ? { partition: client.serviceTenant.partition } : {}),
+            },
+        });
+        return clientDto(client);
+    }
     /** POST {prefix}/api/clients/:id/regenerate-secret */
     async regenerateSecret(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');
@@ -129,7 +159,10 @@ export default class ConsoleClientsController {
             type: 'client.secret_regenerated',
             clientId: id,
             ip: ctx.request.ip?.() ?? null,
-            metadata: { actor: 'admin-console' },
+            metadata: {
+                actor: 'admin-console',
+                ...(existing.serviceTenant ? { partition: existing.serviceTenant.partition } : {}),
+            },
         });
         return { clientId: id, clientSecret: newSecret };
     }

package/build/src/host/admin_console/console_personal_agents_controller.d.ts

@@ -22,7 +22,7 @@ interface AgentEntry {
     connections: number;
 }
 /**
- * Endpoints JSON de personal agents (PACT e Poppy) do console admin React.
+ * Endpoints JSON de personal agents (PACT e `personalAgents.extensions`) do console admin React.
  *
  * GET    {prefix}/api/personal-agents                          → agentes (config + console + conectados)
  * GET    {prefix}/api/personal-agents/connections?clientId=&accountId=&protocol=&page=&size=
@@ -41,11 +41,6 @@ export default class ConsolePersonalAgentsController {
                 /** A lista do config é uma função do host (o console não enxerga). */
                 hostResolver: boolean;
             } | null;
-            poppy: {
-                requireRegistration: boolean;
-                hostResolver: boolean;
-                allowInsecureClientIds: boolean;
-            } | null;
         };
         agents: AgentEntry[];
     }>;

package/build/src/host/admin_console/console_personal_agents_controller.js

@@ -31,10 +31,21 @@ function enabledProtocols(runtime) {
     const out = [];
     if (runtime.config.pact)
         out.push('pact');
-    if (runtime.config.poppy)
-        out.push('poppy');
+    out.push(...runtime.extensions.keys());
     return out;
 }
+/** O protocolo dono de um grant, pelo prefixo do id. */
+function protocolOfGrant(runtime, grantId) {
+    for (const [id, { extension }] of runtime.extensions) {
+        if (grantId.startsWith(extension.grantIdPrefix))
+            return id;
+    }
+    return 'pact';
+}
+/** Prefixo de id dos grants de um protocolo (`agrant_` = PACT). */
+function grantPrefixOf(runtime, protocol) {
+    return runtime.extensions.get(protocol)?.extension.grantIdPrefix ?? 'agrant_';
+}
 function isUrl(value, allowHttp) {
     if (typeof value !== 'string' || value.length > 2048)
         return false;
@@ -52,14 +63,14 @@ function isUrl(value, allowHttp) {
 async function agentName(runtime, protocol, identifier, fallback) {
     if (fallback)
         return fallback;
-    if (protocol === 'poppy' && runtime.poppy) {
-        return runtime.poppy.registry.displayName(identifier);
-    }
+    const extension = runtime.extensions.get(protocol);
+    if (extension)
+        return extension.runtime.displayName(identifier);
     const registration = await runtime.config.resolveAgent(identifier);
     return displayNameFor(registration ?? { issuer: identifier, jwksUri: '' });
 }
 /**
- * Endpoints JSON de personal agents (PACT e Poppy) do console admin React.
+ * Endpoints JSON de personal agents (PACT e `personalAgents.extensions`) do console admin React.
  *
  * GET    {prefix}/api/personal-agents                          → agentes (config + console + conectados)
  * GET    {prefix}/api/personal-agents/connections?clientId=&accountId=&protocol=&page=&size=
@@ -105,17 +116,20 @@ export default class ConsolePersonalAgentsController {
                 e.jwksUri = agent.jwksUri;
                 names.set(keyOf('pact', agent.issuer), agent.name ?? null);
             }
-            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, 'pact')) {
+            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, 'agrant_')) {
                 entry('pact', clientId).connections = count;
             }
         }
-        if (cfg.poppy) {
-            for (const id of cfg.poppy.clients.registeredList ?? [])
-                entry('poppy', id).config = 'allowed';
-            for (const id of cfg.poppy.clients.blockedList ?? [])
-                entry('poppy', id).config = 'blocked';
-            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, 'poppy')) {
-                entry('poppy', clientId).connections = count;
+        const summaries = {};
+        for (const [protocol, { extension, runtime: ext }] of runtime.extensions) {
+            const summary = ext.consoleSummary();
+            summaries[protocol] = { label: extension.label, ...summary };
+            for (const id of summary.configured.allowed)
+                entry(protocol, id).config = 'allowed';
+            for (const id of summary.configured.blocked)
+                entry(protocol, id).config = 'blocked';
+            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, extension.grantIdPrefix)) {
+                entry(protocol, clientId).connections = count;
             }
         }
         for (const row of await runtime.registry.list()) {
@@ -153,13 +167,17 @@ export default class ConsolePersonalAgentsController {
                         hostResolver: cfg.staticAgents === null,
                     }
                     : null,
-                poppy: cfg.poppy
-                    ? {
-                        requireRegistration: cfg.poppy.clients.requireRegistration,
-                        hostResolver: cfg.poppy.clients.registeredList === null || cfg.poppy.clients.blockedList === null,
-                        allowInsecureClientIds: cfg.poppy.allowInsecureClientIds,
-                    }
-                    : null,
+                ...Object.fromEntries(Object.entries(summaries).map(([protocol, summary]) => [
+                    protocol,
+                    {
+                        label: summary.label,
+                        requireRegistration: summary.requireRegistration,
+                        hostResolver: summary.hostResolver,
+                        allowHttpIdentifiers: summary.allowHttpIdentifiers,
+                        identifierLabel: summary.identifierLabel,
+                        identifierPlaceholder: summary.identifierPlaceholder ?? null,
+                    },
+                ])),
             },
             agents,
         };
@@ -172,11 +190,9 @@ export default class ConsolePersonalAgentsController {
         const qs = ctx.request.qs();
         const page = parseListPage(qs.page);
         const size = parseListSize(qs.size);
-        const protocol = qs.protocol === 'pact' || qs.protocol === 'poppy'
-            ? qs.protocol
-            : undefined;
+        const protocol = qs.protocol && enabledProtocols(runtime).includes(qs.protocol) ? qs.protocol : undefined;
         const filter = {
-            protocol,
+            idPrefix: protocol ? grantPrefixOf(runtime, protocol) : undefined,
             clientId: qs.clientId?.trim() || undefined,
             accountId: qs.accountId?.trim() || undefined,
         };
@@ -189,7 +205,7 @@ export default class ConsolePersonalAgentsController {
         const emails = new Map();
         const nameCache = new Map();
         const data = await Promise.all(rows.map(async (g) => {
-            const rowProtocol = g.id.startsWith('pgrant_') ? 'poppy' : 'pact';
+            const rowProtocol = protocolOfGrant(runtime, g.id);
             if (!emails.has(g.accountId)) {
                 const account = await store.findById(g.accountId).catch(() => null);
                 emails.set(g.accountId, account?.email ?? null);
@@ -248,17 +264,21 @@ export default class ConsolePersonalAgentsController {
         const invalid = (message) => ctx.response.unprocessableEntity(apiError('invalid_request', message));
         const protocol = body.protocol;
         if (!enabledProtocols(runtime).includes(protocol)) {
-            return invalid('`protocol` precisa ser um protocolo ligado (`pact` ou `poppy`).');
+            return invalid(`\`protocol\` precisa ser um protocolo ligado (${enabledProtocols(runtime)
+                .map((p) => `\`${p}\``)
+                .join(', ')}).`);
         }
         const status = body.status;
         if (status !== 'allowed' && status !== 'blocked') {
             return invalid('`status` precisa ser `allowed` ou `blocked`.');
         }
-        const allowHttp = protocol === 'poppy' && !!runtime.config.poppy?.allowInsecureClientIds;
+        const extension = runtime.extensions.get(protocol);
+        const summary = extension?.runtime.consoleSummary();
+        const allowHttp = !!summary?.allowHttpIdentifiers;
         const identifier = typeof body.identifier === 'string' ? body.identifier.trim() : '';
         if (!isUrl(identifier, allowHttp)) {
-            return invalid(protocol === 'poppy'
-                ? '`identifier` precisa ser o `client_id` do agente (URL HTTPS do documento de metadata).'
+            return invalid(summary
+                ? `\`identifier\` precisa ser uma URL ${allowHttp ? 'http(s)' : 'HTTPS'}: ${summary.identifierLabel}.`
                 : '`identifier` precisa ser o `iss` do agente (URL HTTPS).');
         }
         const name = typeof body.name === 'string' && body.name.trim() ? body.name.trim().slice(0, 200) : null;

package/build/src/host/admin_console/console_switcher_controller.d.ts

@@ -0,0 +1,11 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * The console switcher endpoints of the admin console (behind the admin console's own guard).
+ *
+ * GET {prefix}/api/consoles           → the other consoles this viewer may open
+ * GET {prefix}/api/consoles/search?q= → hits from every console this viewer may open
+ */
+export default class ConsoleSwitcherController {
+    index(ctx: HttpContext): Promise<import("../../console_switcher.js").VisibleConsoles>;
+    search(ctx: HttpContext): Promise<import("../../console_switcher.js").ConsoleSearchResults>;
+}

package/build/src/host/admin_console/console_switcher_controller.js

@@ -0,0 +1,23 @@
+import { listVisibleConsoles, searchConsoles } from '../../console_switcher.js';
+import { ADMIN_CONSOLE_ID, consoleRegistry } from './admin_console_entry.js';
+/**
+ * The console switcher endpoints of the admin console (behind the admin console's own guard).
+ *
+ * GET {prefix}/api/consoles           → the other consoles this viewer may open
+ * GET {prefix}/api/consoles/search?q= → hits from every console this viewer may open
+ */
+export default class ConsoleSwitcherController {
+    async index(ctx) {
+        const body = await listVisibleConsoles(await consoleRegistry(), ADMIN_CONSOLE_ID, ctx, {
+            logger: ctx.logger,
+        });
+        ctx.response.header('Cache-Control', 'private, no-store');
+        return body;
+    }
+    async search(ctx) {
+        const q = ctx.request.input('q', '');
+        const body = await searchConsoles(await consoleRegistry(), ADMIN_CONSOLE_ID, ctx, typeof q === 'string' ? q : '', { logger: ctx.logger });
+        ctx.response.header('Cache-Control', 'private, no-store');
+        return body;
+    }
+}

package/build/src/host/admin_sessions_service.js

@@ -87,7 +87,7 @@ export class AdminSessionsService {
     /**
      * Revogação total também corta os personal agents: "sair de todas as sessões",
      * reset de senha, a ação do admin e a exclusão de conta não podem deixar um
-     * agente agindo na conta (delegações do PACT e refresh tokens do Poppy). Sem
+     * agente agindo na conta (delegações do PACT e conexões das extensions). Sem
      * `personalAgents` é no-op — e aí nem resolve o banco. Diferente do
      * `recordSubRevocation`, uma falha AQUI propaga: não há outra camada que corte
      * esses tokens.
@@ -142,11 +142,14 @@ export class AdminSessionsService {
             return [];
         return (await adapter.list()).filter((r) => grantIds.has(r.payload.grantId));
     }
-    /** Grants da conta, exceto os espelhos `pgrant_` de refresh tokens do Poppy. */
+    /**
+     * Grants da conta, exceto os espelhos dos grants das `personalAgents.extensions` (os access
+     * tokens de MCP que elas emitem pelo oidc-provider usam o id do grant delas) — aparecem e são
+     * revogados como personal agent, não como app OIDC.
+     */
     async #accountGrants(accountId) {
-        // Os grants `pgrant_` são o espelho de um refresh token do Poppy (Bearer de MCP) — aparecem e
-        // são revogados como personal agent, não como app OIDC.
-        return (await this.#listModelOfAccount('Grant', accountId)).filter((r) => !r.id.startsWith('pgrant_'));
+        const prefixes = (this.#oidc.config.personalAgents?.extensions ?? []).map((e) => e.grantIdPrefix);
+        return (await this.#listModelOfAccount('Grant', accountId)).filter((r) => !prefixes.some((prefix) => r.id.startsWith(prefix)));
     }
     /**
      * Conta TODAS as sessões ativas do IdP (todas as contas). 0 quando o adapter não

package/build/src/host/admin_validators.d.ts

@@ -17,6 +17,19 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     backchannelLogoutSessionRequired: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineBoolean>;
     clientName: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
     logoUri: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
+    serviceTenant: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").NullableModifier<import("@vinejs/vine").VineObject<{
+        partition: import("@vinejs/vine").VineString;
+        capabilities: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").VineArray<import("@vinejs/vine").VineString>>;
+    }, {
+        capabilities?: string[] | null | undefined;
+        partition: string;
+    }, {
+        capabilities?: string[] | undefined;
+        partition: string;
+    }, {
+        capabilities?: string[] | undefined;
+        partition: string;
+    }>>>;
 }, {
     applicationType?: "native" | "web" | null | undefined;
     backchannelLogoutSessionRequired?: string | number | boolean | null | undefined;
@@ -27,6 +40,10 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | null | undefined;
     redirectUris?: string[] | null | undefined;
+    serviceTenant?: {
+        capabilities?: string[] | null | undefined;
+        partition: string;
+    } | null | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | null | undefined;
 }, {
     applicationType?: "native" | "web" | undefined;
@@ -38,6 +55,10 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | undefined;
     redirectUris?: string[] | undefined;
+    serviceTenant?: {
+        capabilities?: string[] | undefined;
+        partition: string;
+    } | null | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | undefined;
 }, {
     applicationType?: "native" | "web" | undefined;
@@ -49,6 +70,10 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | undefined;
     redirectUris?: string[] | undefined;
+    serviceTenant?: {
+        capabilities?: string[] | undefined;
+        partition: string;
+    } | null | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | undefined;
 }>, Record<string, any> | undefined>;
 /** Forma validada de um client (saída do {@link clientInputValidator}). */
@@ -63,6 +88,10 @@ export type ClientInputFields = {
     backchannelLogoutSessionRequired?: boolean;
     clientName?: string | null;
     logoUri?: string | null;
+    serviceTenant?: {
+        partition: string;
+        capabilities?: string[];
+    } | null;
 };
 /**
  * Mapeia o input validado para um {@link ClientInput} COMPLETO (create), com defaults.

package/build/src/host/admin_validators.js

@@ -1,4 +1,5 @@
 import vine from '@vinejs/vine';
+import { CAPABILITY_PATTERN, MAX_CAPABILITIES, PARTITION_PATTERN, } from '../service_tenants/client_metadata.js';
 import { APPLICATION_TYPES, redirectUriProblem } from './client_metadata.js';
 import { normalizeEmailIdentifier } from './email_identifier.js';
 /**
@@ -103,6 +104,18 @@ export const clientInputValidator = vine.compile(vine.object({
     // `null` (update) removes them.
     clientName: vine.string().trim().maxLength(200).nullable().optional(),
     logoUri: vine.string().trim().url(URL_OPTS).nullable().optional(),
+    // Service tenant (`client_credentials` + partition claim). `null` (update) turns it
+    // back into a regular client.
+    serviceTenant: vine
+        .object({
+        partition: vine.string().trim().regex(PARTITION_PATTERN),
+        capabilities: vine
+            .array(vine.string().trim().regex(CAPABILITY_PATTERN))
+            .maxLength(MAX_CAPABILITIES)
+            .optional(),
+    })
+        .nullable()
+        .optional(),
 }));
 /**
  * Mapeia o input validado para um {@link ClientInput} COMPLETO (create), com defaults.
@@ -111,6 +124,21 @@ export const clientInputValidator = vine.compile(vine.object({
  */
 export function clientCreateInput(v) {
     const applicationType = v.applicationType ?? 'web';
+    // A service tenant only uses client_credentials: that is its default grant.
+    if (v.serviceTenant) {
+        return {
+            clientId: v.clientId?.trim() || undefined,
+            applicationType,
+            redirectUris: v.redirectUris ?? [],
+            postLogoutRedirectUris: v.postLogoutRedirectUris ?? [],
+            grantTypes: v.grantTypes ?? ['client_credentials'],
+            tokenEndpointAuthMethod: v.tokenEndpointAuthMethod ?? 'client_secret_basic',
+            backchannelLogoutUri: v.backchannelLogoutUri || undefined,
+            clientName: v.clientName || undefined,
+            logoUri: v.logoUri || undefined,
+            serviceTenant: v.serviceTenant,
+        };
+    }
     return {
         clientId: v.clientId?.trim() || undefined,
         applicationType,
@@ -148,6 +176,8 @@ export function clientPartialInput(v) {
         out.clientName = v.clientName?.trim() || null;
     if (v.logoUri !== undefined)
         out.logoUri = v.logoUri?.trim() || null;
+    if (v.serviceTenant !== undefined)
+        out.serviceTenant = v.serviceTenant;
     return out;
 }
 // ─── Usuários ───────────────────────────────────────────────────────────────

package/build/src/host/auth_host_config.d.ts

@@ -1,4 +1,6 @@
 import type { HttpContext } from '@adonisjs/core/http';
+import type { AccountConsoleConfig } from '../account/runtime.js';
+import type { ResolvedPersonalAgentExtension } from '../agents/extension.js';
 import type { AuthSocialConfig, ResolvedRateLimitConfig } from '../define_config.js';
 import type { PolicyRouteOption } from './config_locks.js';
 import type { AuthHostOptions } from './register_auth_host.js';
@@ -35,16 +37,21 @@ export interface AuthHostRuntimeConfig {
      * Ver `deriveLockedRouteOptions`.
      */
     lockedRouteOptions?: PolicyRouteOption[];
-    /** Personal agents ligados → prefixo das rotas deles (`/agents`) e do Poppy (`/poppy`). */
+    /**
+     * Personal agents ligados → prefixo das rotas do PACT (`/agents`) e as
+     * `personalAgents.extensions` resolvidas (rotas, isenções de CSRF, navegador do agente).
+     */
     personalAgents?: {
         prefix: string;
-        poppyPrefix?: string;
+        extensions?: readonly ResolvedPersonalAgentExtension[];
     };
     /**
      * `accountSession.acceptIdpSession: false` com `authMethods: { password: false }`:
      * o console só entra por um `accountLoginUrl` do host (`registerAuthHost` recusa sem ele).
      */
     consoleNeedsLoginUrl?: boolean;
+    /** `accountConsole` do config: os overrides das páginas de extension. */
+    accountConsole?: AccountConsoleConfig;
     /**
      * API headless (Clerk-style). Presente quando o host a declarou — o provider o
      * stash no boot para `registerAuthHost` montar as rotas sem reler o config inteiro.