@adonis-agora/authkit-server 1.0.0-rc.1 → 1.0.0-rc.3

package/build/src/host/admin_api/dto.d.ts

@@ -40,6 +40,8 @@ export declare function clientDto(client: AdminClient): {
     backchannelLogoutSessionRequired: boolean;
     clientName: string | null;
     logoUri: string | null;
+    disabled: boolean;
+    serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
 };
 /** Inclui o secret (mostrado UMA vez) em create/regenerate. */
 export declare function createdClientDto(created: CreatedClient): {
@@ -67,7 +69,7 @@ export declare function grantDto(grant: AdminGrant): {
 };
 export declare function auditDto(event: StoredAuditEvent): {
     id: string;
-    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.locked" | "account.signed_out_all" | "agent.allowed" | "agent.blocked" | "agent.delegation_approved" | "agent.delegation_denied" | "agent.grant_revoked" | "agent.grant_revoked_by_admin" | "agent.registry_removed" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "impersonation.stopped" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "mfa.recovery_codes_regenerated" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
+    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.locked" | "account.signed_out_all" | "agent.allowed" | "agent.blocked" | "agent.delegation_approved" | "agent.delegation_denied" | "agent.grant_revoked" | "agent.grant_revoked_by_admin" | "agent.registry_removed" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.disabled" | "client.enabled" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "impersonation.stopped" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "mfa.recovery_codes_regenerated" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "service_tenant.token_issued" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
     accountId: string | null;
     email: string | null;
     clientId: string | null;

package/build/src/host/admin_api/dto.js

@@ -32,6 +32,8 @@ export function clientDto(client) {
         backchannelLogoutSessionRequired: client.backchannelLogoutSessionRequired ?? false,
         clientName: client.clientName,
         logoUri: client.logoUri,
+        disabled: client.disabled,
+        serviceTenant: client.serviceTenant,
     };
 }
 /** Inclui o secret (mostrado UMA vez) em create/regenerate. */

package/build/src/host/admin_clients_service.d.ts

@@ -1,4 +1,5 @@
 import type { OidcService } from '../provider/oidc_service.js';
+import { type ServiceTenantInfo } from '../service_tenants/client_metadata.js';
 import { type ApplicationType } from './client_metadata.js';
 /** Métodos de autenticação no token endpoint suportados pelo formulário admin. */
 export type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';
@@ -30,6 +31,15 @@ export interface ClientInput {
      * `backchannelLogoutUri` não está definido.
      */
     backchannelLogoutSessionRequired?: boolean;
+    /**
+     * Makes the client a service tenant: confidential, `client_credentials` only, no
+     * redirect URIs; its tokens carry `partition` and `capabilities`. On update, `null`
+     * turns it back into a regular client; absent keeps the current value.
+     */
+    serviceTenant?: {
+        partition: string;
+        capabilities?: string[];
+    } | null;
 }
 /** Client persistido, apresentado ao console admin. */
 export interface AdminClient {
@@ -49,6 +59,10 @@ export interface AdminClient {
     clientName: string | null;
     /** `logo_uri` registrado, ou `null`. */
     logoUri: string | null;
+    /** Disabled clients get no tokens (`invalid_client`) until enabled again. */
+    disabled: boolean;
+    /** Service-tenant settings, or `null` for a regular client. */
+    serviceTenant: ServiceTenantInfo | null;
 }
 /** Resultado de uma criação: o client + o secret em claro (mostrado UMA vez). */
 export interface CreatedClient {
@@ -94,6 +108,12 @@ export declare class AdminClientsService {
      * PRESERVANDO o client_secret existente. Lança se o client não existe.
      */
     update(clientId: string, input: Partial<ClientInput>): Promise<void>;
+    /**
+     * Disables or re-enables a client. A disabled client gets `invalid_client` on every
+     * endpoint from the next request on (tokens already issued stay valid until they
+     * expire). Returns `false` when the client does not exist.
+     */
+    setDisabled(clientId: string, disabled: boolean): Promise<boolean>;
     /**
      * Regenera o client_secret de um client confidencial, preservando o resto da
      * metadata. Retorna o novo secret em claro (mostrado UMA vez). Lança se o

package/build/src/host/admin_clients_service.js

@@ -1,4 +1,5 @@
 import { randomBytes } from 'node:crypto';
+import { CLIENT_DISABLED_KEY, isClientDisabled, normalizeServiceTenant, SERVICE_TENANT_KEY, serviceTenantOf, } from '../service_tenants/client_metadata.js';
 import { assertClientMetadata, ClientMetadataError, } from './client_metadata.js';
 import { CONSOLE_SSO_CLIENT_ID } from './console_sso.js';
 /** Métodos públicos (sem segredo) — espelham os "non-secret" do oidc-provider. */
@@ -111,14 +112,37 @@ export class AdminClientsService {
             logoUri: input.logoUri === null
                 ? undefined
                 : (input.logoUri ?? existing.logo_uri),
+            serviceTenant: input.serviceTenant === undefined
+                ? serviceTenantOf(existing)
+                : input.serviceTenant,
         };
         const confidential = !PUBLIC_AUTH_METHODS.has(merged.tokenEndpointAuthMethod);
         // Mantém o secret atual se continua confidencial; se virou public, remove-o.
         const clientSecret = confidential ? (previousSecret ?? randomId()) : undefined;
         const payload = this.#buildPayload(clientId, merged, clientSecret);
+        if (isClientDisabled(existing))
+            payload[CLIENT_DISABLED_KEY] = true;
         await this.#adapter.upsert(clientId, payload, 0);
         await this.oidc.evictDynamicClientCache();
     }
+    /**
+     * Disables or re-enables a client. A disabled client gets `invalid_client` on every
+     * endpoint from the next request on (tokens already issued stay valid until they
+     * expire). Returns `false` when the client does not exist.
+     */
+    async setDisabled(clientId, disabled) {
+        const existing = await this.#adapter.find(clientId);
+        if (!existing)
+            return false;
+        const payload = { ...existing };
+        if (disabled)
+            payload[CLIENT_DISABLED_KEY] = true;
+        else
+            delete payload[CLIENT_DISABLED_KEY];
+        await this.#adapter.upsert(clientId, payload, 0);
+        await this.oidc.evictDynamicClientCache();
+        return true;
+    }
     /**
      * Regenera o client_secret de um client confidencial, preservando o resto da
      * metadata. Retorna o novo secret em claro (mostrado UMA vez). Lança se o
@@ -148,6 +172,8 @@ export class AdminClientsService {
      * `client_metadata.ts`). Lança `ClientMetadataError`.
      */
     #assertValid(input) {
+        if (input.serviceTenant)
+            this.#assertServiceTenant(input);
         assertClientMetadata({
             applicationType: input.applicationType ?? 'web',
             tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
@@ -156,6 +182,27 @@ export class AdminClientsService {
             postLogoutRedirectUris: input.postLogoutRedirectUris,
         });
     }
+    /** Rules of a service-tenant client (see {@link ClientInput.serviceTenant}). */
+    #assertServiceTenant(input) {
+        if (!this.oidc.config.serviceTenants?.enabled) {
+            throw new ClientMetadataError('service tenants are not enabled: declare serviceTenants.resources in config/authkit.ts');
+        }
+        if (PUBLIC_AUTH_METHODS.has(input.tokenEndpointAuthMethod)) {
+            throw new ClientMetadataError('a service tenant must be confidential (it has a secret)');
+        }
+        if ((input.applicationType ?? 'web') !== 'web') {
+            throw new ClientMetadataError('a service tenant must be a web (server) client');
+        }
+        if (input.grantTypes.length !== 1 || input.grantTypes[0] !== 'client_credentials') {
+            throw new ClientMetadataError('a service tenant can only use the client_credentials grant');
+        }
+        if (input.redirectUris.length || input.postLogoutRedirectUris.length) {
+            throw new ClientMetadataError('a service tenant has no redirect URIs');
+        }
+        if (input.backchannelLogoutUri) {
+            throw new ClientMetadataError('a service tenant has no back-channel logout URI');
+        }
+    }
     /**
      * Monta o payload na forma snake_case que o oidc-provider espera/persiste —
      * verificada contra o que o registro dinâmico (RFC 7591) grava. As chaves de
@@ -193,6 +240,12 @@ export class AdminClientsService {
                 payload.backchannel_logout_session_required = input.backchannelLogoutSessionRequired;
             }
         }
+        if (input.serviceTenant) {
+            const tenant = normalizeServiceTenant(input.serviceTenant);
+            if (typeof tenant === 'string')
+                throw new ClientMetadataError(tenant);
+            payload[SERVICE_TENANT_KEY] = tenant;
+        }
         return payload;
     }
     /** Projeta um payload persistido para a forma exibida no console admin. */
@@ -209,6 +262,8 @@ export class AdminClientsService {
             applicationType: p.application_type === 'native' ? 'native' : 'web',
             clientName: typeof p.client_name === 'string' && p.client_name ? p.client_name : null,
             logoUri: typeof p.logo_uri === 'string' && p.logo_uri ? p.logo_uri : null,
+            disabled: isClientDisabled(p),
+            serviceTenant: serviceTenantOf(p),
         };
         if (p.backchannel_logout_uri) {
             result.backchannelLogoutUri = p.backchannel_logout_uri;

package/build/src/host/admin_console/console_clients_controller.d.ts

@@ -9,8 +9,11 @@ import type { HttpContext } from '@adonisjs/core/http';
  * PATCH  {prefix}/api/clients/:id             → atualizar metadata
  * DELETE {prefix}/api/clients/:id             → remover client
  * POST   {prefix}/api/clients/:id/regenerate-secret → gerar novo secret
+ * POST   {prefix}/api/clients/:id/disable     → stop issuing tokens to the client
+ * POST   {prefix}/api/clients/:id/enable      → issue tokens again
  */
 export default class ConsoleClientsController {
+    #private;
     /** GET {prefix}/api/clients */
     index(ctx: HttpContext): Promise<{
         data: {
@@ -25,6 +28,8 @@ export default class ConsoleClientsController {
             backchannelLogoutSessionRequired: boolean;
             clientName: string | null;
             logoUri: string | null;
+            disabled: boolean;
+            serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
         }[];
         canList: boolean;
     }>;
@@ -41,6 +46,8 @@ export default class ConsoleClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     /** POST {prefix}/api/clients */
     store(ctx: HttpContext): Promise<void | {
@@ -60,12 +67,46 @@ export default class ConsoleClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     /** DELETE {prefix}/api/clients/:id */
     destroy(ctx: HttpContext): Promise<void | {
         ok: boolean;
         deleted: string;
     }>;
+    /** POST {prefix}/api/clients/:id/disable */
+    disable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
+    /** POST {prefix}/api/clients/:id/enable */
+    enable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
     /** POST {prefix}/api/clients/:id/regenerate-secret */
     regenerateSecret(ctx: HttpContext): Promise<void | {
         clientId: string;

package/build/src/host/admin_console/console_clients_controller.js

@@ -19,6 +19,8 @@ function invalidMetadata(ctx, err) {
  * PATCH  {prefix}/api/clients/:id             → atualizar metadata
  * DELETE {prefix}/api/clients/:id             → remover client
  * POST   {prefix}/api/clients/:id/regenerate-secret → gerar novo secret
+ * POST   {prefix}/api/clients/:id/disable     → stop issuing tokens to the client
+ * POST   {prefix}/api/clients/:id/enable      → issue tokens again
  */
 export default class ConsoleClientsController {
     /** GET {prefix}/api/clients */
@@ -107,6 +109,34 @@ export default class ConsoleClientsController {
         });
         return { ok: true, deleted: id };
     }
+    /** POST {prefix}/api/clients/:id/disable */
+    async disable(ctx) {
+        return this.#setDisabled(ctx, true);
+    }
+    /** POST {prefix}/api/clients/:id/enable */
+    async enable(ctx) {
+        return this.#setDisabled(ctx, false);
+    }
+    /** Disabled clients get `invalid_client` from the next request on. */
+    async #setDisabled(ctx, disabled) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const svc = new AdminClientsService(service);
+        const id = ctx.request.param('id');
+        if (!(await svc.setDisabled(id, disabled))) {
+            return ctx.response.notFound(apiError('not_found', 'Client não encontrado.'));
+        }
+        const client = await svc.find(id);
+        await service.config.audit?.record({
+            type: disabled ? 'client.disabled' : 'client.enabled',
+            clientId: id,
+            ip: ctx.request.ip?.() ?? null,
+            metadata: {
+                actor: 'admin-console',
+                ...(client?.serviceTenant ? { partition: client.serviceTenant.partition } : {}),
+            },
+        });
+        return clientDto(client);
+    }
     /** POST {prefix}/api/clients/:id/regenerate-secret */
     async regenerateSecret(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');
@@ -129,7 +159,10 @@ export default class ConsoleClientsController {
             type: 'client.secret_regenerated',
             clientId: id,
             ip: ctx.request.ip?.() ?? null,
-            metadata: { actor: 'admin-console' },
+            metadata: {
+                actor: 'admin-console',
+                ...(existing.serviceTenant ? { partition: existing.serviceTenant.partition } : {}),
+            },
         });
         return { clientId: id, clientSecret: newSecret };
     }

package/build/src/host/admin_console/console_personal_agents_controller.d.ts

@@ -22,7 +22,7 @@ interface AgentEntry {
     connections: number;
 }
 /**
- * Endpoints JSON de personal agents (PACT e Poppy) do console admin React.
+ * Endpoints JSON de personal agents (PACT e `personalAgents.extensions`) do console admin React.
  *
  * GET    {prefix}/api/personal-agents                          → agentes (config + console + conectados)
  * GET    {prefix}/api/personal-agents/connections?clientId=&accountId=&protocol=&page=&size=
@@ -41,11 +41,6 @@ export default class ConsolePersonalAgentsController {
                 /** A lista do config é uma função do host (o console não enxerga). */
                 hostResolver: boolean;
             } | null;
-            poppy: {
-                requireRegistration: boolean;
-                hostResolver: boolean;
-                allowInsecureClientIds: boolean;
-            } | null;
         };
         agents: AgentEntry[];
     }>;

package/build/src/host/admin_console/console_personal_agents_controller.js

@@ -31,10 +31,21 @@ function enabledProtocols(runtime) {
     const out = [];
     if (runtime.config.pact)
         out.push('pact');
-    if (runtime.config.poppy)
-        out.push('poppy');
+    out.push(...runtime.extensions.keys());
     return out;
 }
+/** O protocolo dono de um grant, pelo prefixo do id. */
+function protocolOfGrant(runtime, grantId) {
+    for (const [id, { extension }] of runtime.extensions) {
+        if (grantId.startsWith(extension.grantIdPrefix))
+            return id;
+    }
+    return 'pact';
+}
+/** Prefixo de id dos grants de um protocolo (`agrant_` = PACT). */
+function grantPrefixOf(runtime, protocol) {
+    return runtime.extensions.get(protocol)?.extension.grantIdPrefix ?? 'agrant_';
+}
 function isUrl(value, allowHttp) {
     if (typeof value !== 'string' || value.length > 2048)
         return false;
@@ -52,14 +63,14 @@ function isUrl(value, allowHttp) {
 async function agentName(runtime, protocol, identifier, fallback) {
     if (fallback)
         return fallback;
-    if (protocol === 'poppy' && runtime.poppy) {
-        return runtime.poppy.registry.displayName(identifier);
-    }
+    const extension = runtime.extensions.get(protocol);
+    if (extension)
+        return extension.runtime.displayName(identifier);
     const registration = await runtime.config.resolveAgent(identifier);
     return displayNameFor(registration ?? { issuer: identifier, jwksUri: '' });
 }
 /**
- * Endpoints JSON de personal agents (PACT e Poppy) do console admin React.
+ * Endpoints JSON de personal agents (PACT e `personalAgents.extensions`) do console admin React.
  *
  * GET    {prefix}/api/personal-agents                          → agentes (config + console + conectados)
  * GET    {prefix}/api/personal-agents/connections?clientId=&accountId=&protocol=&page=&size=
@@ -105,17 +116,20 @@ export default class ConsolePersonalAgentsController {
                 e.jwksUri = agent.jwksUri;
                 names.set(keyOf('pact', agent.issuer), agent.name ?? null);
             }
-            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, 'pact')) {
+            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, 'agrant_')) {
                 entry('pact', clientId).connections = count;
             }
         }
-        if (cfg.poppy) {
-            for (const id of cfg.poppy.clients.registeredList ?? [])
-                entry('poppy', id).config = 'allowed';
-            for (const id of cfg.poppy.clients.blockedList ?? [])
-                entry('poppy', id).config = 'blocked';
-            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, 'poppy')) {
-                entry('poppy', clientId).connections = count;
+        const summaries = {};
+        for (const [protocol, { extension, runtime: ext }] of runtime.extensions) {
+            const summary = ext.consoleSummary();
+            summaries[protocol] = { label: extension.label, ...summary };
+            for (const id of summary.configured.allowed)
+                entry(protocol, id).config = 'allowed';
+            for (const id of summary.configured.blocked)
+                entry(protocol, id).config = 'blocked';
+            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, extension.grantIdPrefix)) {
+                entry(protocol, clientId).connections = count;
             }
         }
         for (const row of await runtime.registry.list()) {
@@ -153,13 +167,17 @@ export default class ConsolePersonalAgentsController {
                         hostResolver: cfg.staticAgents === null,
                     }
                     : null,
-                poppy: cfg.poppy
-                    ? {
-                        requireRegistration: cfg.poppy.clients.requireRegistration,
-                        hostResolver: cfg.poppy.clients.registeredList === null || cfg.poppy.clients.blockedList === null,
-                        allowInsecureClientIds: cfg.poppy.allowInsecureClientIds,
-                    }
-                    : null,
+                ...Object.fromEntries(Object.entries(summaries).map(([protocol, summary]) => [
+                    protocol,
+                    {
+                        label: summary.label,
+                        requireRegistration: summary.requireRegistration,
+                        hostResolver: summary.hostResolver,
+                        allowHttpIdentifiers: summary.allowHttpIdentifiers,
+                        identifierLabel: summary.identifierLabel,
+                        identifierPlaceholder: summary.identifierPlaceholder ?? null,
+                    },
+                ])),
             },
             agents,
         };
@@ -172,11 +190,9 @@ export default class ConsolePersonalAgentsController {
         const qs = ctx.request.qs();
         const page = parseListPage(qs.page);
         const size = parseListSize(qs.size);
-        const protocol = qs.protocol === 'pact' || qs.protocol === 'poppy'
-            ? qs.protocol
-            : undefined;
+        const protocol = qs.protocol && enabledProtocols(runtime).includes(qs.protocol) ? qs.protocol : undefined;
         const filter = {
-            protocol,
+            idPrefix: protocol ? grantPrefixOf(runtime, protocol) : undefined,
             clientId: qs.clientId?.trim() || undefined,
             accountId: qs.accountId?.trim() || undefined,
         };
@@ -189,7 +205,7 @@ export default class ConsolePersonalAgentsController {
         const emails = new Map();
         const nameCache = new Map();
         const data = await Promise.all(rows.map(async (g) => {
-            const rowProtocol = g.id.startsWith('pgrant_') ? 'poppy' : 'pact';
+            const rowProtocol = protocolOfGrant(runtime, g.id);
             if (!emails.has(g.accountId)) {
                 const account = await store.findById(g.accountId).catch(() => null);
                 emails.set(g.accountId, account?.email ?? null);
@@ -248,17 +264,21 @@ export default class ConsolePersonalAgentsController {
         const invalid = (message) => ctx.response.unprocessableEntity(apiError('invalid_request', message));
         const protocol = body.protocol;
         if (!enabledProtocols(runtime).includes(protocol)) {
-            return invalid('`protocol` precisa ser um protocolo ligado (`pact` ou `poppy`).');
+            return invalid(`\`protocol\` precisa ser um protocolo ligado (${enabledProtocols(runtime)
+                .map((p) => `\`${p}\``)
+                .join(', ')}).`);
         }
         const status = body.status;
         if (status !== 'allowed' && status !== 'blocked') {
             return invalid('`status` precisa ser `allowed` ou `blocked`.');
         }
-        const allowHttp = protocol === 'poppy' && !!runtime.config.poppy?.allowInsecureClientIds;
+        const extension = runtime.extensions.get(protocol);
+        const summary = extension?.runtime.consoleSummary();
+        const allowHttp = !!summary?.allowHttpIdentifiers;
         const identifier = typeof body.identifier === 'string' ? body.identifier.trim() : '';
         if (!isUrl(identifier, allowHttp)) {
-            return invalid(protocol === 'poppy'
-                ? '`identifier` precisa ser o `client_id` do agente (URL HTTPS do documento de metadata).'
+            return invalid(summary
+                ? `\`identifier\` precisa ser uma URL ${allowHttp ? 'http(s)' : 'HTTPS'}: ${summary.identifierLabel}.`
                 : '`identifier` precisa ser o `iss` do agente (URL HTTPS).');
         }
         const name = typeof body.name === 'string' && body.name.trim() ? body.name.trim().slice(0, 200) : null;

package/build/src/host/admin_sessions_service.js

@@ -87,7 +87,7 @@ export class AdminSessionsService {
     /**
      * Revogação total também corta os personal agents: "sair de todas as sessões",
      * reset de senha, a ação do admin e a exclusão de conta não podem deixar um
-     * agente agindo na conta (delegações do PACT e refresh tokens do Poppy). Sem
+     * agente agindo na conta (delegações do PACT e conexões das extensions). Sem
      * `personalAgents` é no-op — e aí nem resolve o banco. Diferente do
      * `recordSubRevocation`, uma falha AQUI propaga: não há outra camada que corte
      * esses tokens.
@@ -142,11 +142,14 @@ export class AdminSessionsService {
             return [];
         return (await adapter.list()).filter((r) => grantIds.has(r.payload.grantId));
     }
-    /** Grants da conta, exceto os espelhos `pgrant_` de refresh tokens do Poppy. */
+    /**
+     * Grants da conta, exceto os espelhos dos grants das `personalAgents.extensions` (os access
+     * tokens de MCP que elas emitem pelo oidc-provider usam o id do grant delas) — aparecem e são
+     * revogados como personal agent, não como app OIDC.
+     */
     async #accountGrants(accountId) {
-        // Os grants `pgrant_` são o espelho de um refresh token do Poppy (Bearer de MCP) — aparecem e
-        // são revogados como personal agent, não como app OIDC.
-        return (await this.#listModelOfAccount('Grant', accountId)).filter((r) => !r.id.startsWith('pgrant_'));
+        const prefixes = (this.#oidc.config.personalAgents?.extensions ?? []).map((e) => e.grantIdPrefix);
+        return (await this.#listModelOfAccount('Grant', accountId)).filter((r) => !prefixes.some((prefix) => r.id.startsWith(prefix)));
     }
     /**
      * Conta TODAS as sessões ativas do IdP (todas as contas). 0 quando o adapter não

package/build/src/host/admin_validators.d.ts

@@ -17,6 +17,19 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     backchannelLogoutSessionRequired: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineBoolean>;
     clientName: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
     logoUri: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
+    serviceTenant: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").NullableModifier<import("@vinejs/vine").VineObject<{
+        partition: import("@vinejs/vine").VineString;
+        capabilities: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").VineArray<import("@vinejs/vine").VineString>>;
+    }, {
+        capabilities?: string[] | null | undefined;
+        partition: string;
+    }, {
+        capabilities?: string[] | undefined;
+        partition: string;
+    }, {
+        capabilities?: string[] | undefined;
+        partition: string;
+    }>>>;
 }, {
     applicationType?: "native" | "web" | null | undefined;
     backchannelLogoutSessionRequired?: string | number | boolean | null | undefined;
@@ -27,6 +40,10 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | null | undefined;
     redirectUris?: string[] | null | undefined;
+    serviceTenant?: {
+        capabilities?: string[] | null | undefined;
+        partition: string;
+    } | null | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | null | undefined;
 }, {
     applicationType?: "native" | "web" | undefined;
@@ -38,6 +55,10 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | undefined;
     redirectUris?: string[] | undefined;
+    serviceTenant?: {
+        capabilities?: string[] | undefined;
+        partition: string;
+    } | null | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | undefined;
 }, {
     applicationType?: "native" | "web" | undefined;
@@ -49,6 +70,10 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | undefined;
     redirectUris?: string[] | undefined;
+    serviceTenant?: {
+        capabilities?: string[] | undefined;
+        partition: string;
+    } | null | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | undefined;
 }>, Record<string, any> | undefined>;
 /** Forma validada de um client (saída do {@link clientInputValidator}). */
@@ -63,6 +88,10 @@ export type ClientInputFields = {
     backchannelLogoutSessionRequired?: boolean;
     clientName?: string | null;
     logoUri?: string | null;
+    serviceTenant?: {
+        partition: string;
+        capabilities?: string[];
+    } | null;
 };
 /**
  * Mapeia o input validado para um {@link ClientInput} COMPLETO (create), com defaults.

package/build/src/host/admin_validators.js

@@ -1,4 +1,5 @@
 import vine from '@vinejs/vine';
+import { CAPABILITY_PATTERN, MAX_CAPABILITIES, PARTITION_PATTERN, } from '../service_tenants/client_metadata.js';
 import { APPLICATION_TYPES, redirectUriProblem } from './client_metadata.js';
 import { normalizeEmailIdentifier } from './email_identifier.js';
 /**
@@ -103,6 +104,18 @@ export const clientInputValidator = vine.compile(vine.object({
     // `null` (update) removes them.
     clientName: vine.string().trim().maxLength(200).nullable().optional(),
     logoUri: vine.string().trim().url(URL_OPTS).nullable().optional(),
+    // Service tenant (`client_credentials` + partition claim). `null` (update) turns it
+    // back into a regular client.
+    serviceTenant: vine
+        .object({
+        partition: vine.string().trim().regex(PARTITION_PATTERN),
+        capabilities: vine
+            .array(vine.string().trim().regex(CAPABILITY_PATTERN))
+            .maxLength(MAX_CAPABILITIES)
+            .optional(),
+    })
+        .nullable()
+        .optional(),
 }));
 /**
  * Mapeia o input validado para um {@link ClientInput} COMPLETO (create), com defaults.
@@ -111,6 +124,21 @@ export const clientInputValidator = vine.compile(vine.object({
  */
 export function clientCreateInput(v) {
     const applicationType = v.applicationType ?? 'web';
+    // A service tenant only uses client_credentials: that is its default grant.
+    if (v.serviceTenant) {
+        return {
+            clientId: v.clientId?.trim() || undefined,
+            applicationType,
+            redirectUris: v.redirectUris ?? [],
+            postLogoutRedirectUris: v.postLogoutRedirectUris ?? [],
+            grantTypes: v.grantTypes ?? ['client_credentials'],
+            tokenEndpointAuthMethod: v.tokenEndpointAuthMethod ?? 'client_secret_basic',
+            backchannelLogoutUri: v.backchannelLogoutUri || undefined,
+            clientName: v.clientName || undefined,
+            logoUri: v.logoUri || undefined,
+            serviceTenant: v.serviceTenant,
+        };
+    }
     return {
         clientId: v.clientId?.trim() || undefined,
         applicationType,
@@ -148,6 +176,8 @@ export function clientPartialInput(v) {
         out.clientName = v.clientName?.trim() || null;
     if (v.logoUri !== undefined)
         out.logoUri = v.logoUri?.trim() || null;
+    if (v.serviceTenant !== undefined)
+        out.serviceTenant = v.serviceTenant;
     return out;
 }
 // ─── Usuários ───────────────────────────────────────────────────────────────