@adonis-agora/authkit-server 1.0.0-rc.11 → 1.0.0-rc.12

package/build/src/agents/delegation_store.js

@@ -63,13 +63,17 @@ function affected(result) {
 }
 export class DelegationStore {
     conn;
+    t;
     /** `conn` = uma conexão Lucid (`db.connection(name?)`) — ou uma transação. */
-    constructor(conn) {
+    constructor(conn, 
+    /** Nome da tabela como os statements o escrevem (`schema.tabela` com `schema.name`). */
+    t = (name) => name) {
         this.conn = conn;
+        this.t = t;
     }
     // ─── device codes ─────────────────────────────────────────────────────────
     async insertDevice(row) {
-        await this.conn().table(DEVICE_TABLE).insert({
+        await this.conn().table(this.t(DEVICE_TABLE)).insert({
             id: row.id,
             device_code_hash: row.deviceCodeHash,
             user_code: row.userCode,
@@ -83,19 +87,22 @@ export class DelegationStore {
         });
     }
     async findDeviceByCodeHash(hash) {
-        const row = await this.conn().from(DEVICE_TABLE).where('device_code_hash', hash).first();
+        const row = await this.conn()
+            .from(this.t(DEVICE_TABLE))
+            .where('device_code_hash', hash)
+            .first();
         return row ? toDevice(row) : null;
     }
     async findDeviceByUserCode(userCode) {
-        const row = await this.conn().from(DEVICE_TABLE).where('user_code', userCode).first();
+        const row = await this.conn().from(this.t(DEVICE_TABLE)).where('user_code', userCode).first();
         return row ? toDevice(row) : null;
     }
     /** Liga o pedido aprovado ao grant — a partir daqui o polling do agente recebe o token. */
     async setDeviceGrant(id, grantId) {
-        await this.conn().from(DEVICE_TABLE).where('id', id).update({ grant_id: grantId });
+        await this.conn().from(this.t(DEVICE_TABLE)).where('id', id).update({ grant_id: grantId });
     }
     async markPolled(id, at) {
-        await this.conn().from(DEVICE_TABLE).where('id', id).update({ last_polled_at: at });
+        await this.conn().from(this.t(DEVICE_TABLE)).where('id', id).update({ last_polled_at: at });
     }
     /**
      * Transição de estado ATÔMICA: só aplica se o pedido ainda está em `from`.
@@ -108,7 +115,7 @@ export class DelegationStore {
         if (patch.grantId !== undefined)
             update.grant_id = patch.grantId;
         const result = await this.conn()
-            .from(DEVICE_TABLE)
+            .from(this.t(DEVICE_TABLE))
             .where('id', id)
             .where('status', from)
             .update(update);
@@ -119,11 +126,11 @@ export class DelegationStore {
      * vai pelo mesmo binding do INSERT, então a comparação é coerente no dialeto.
      */
     async deleteDevicesExpiredBefore(before) {
-        await this.conn().from(DEVICE_TABLE).where('expires_at', '<', before).delete();
+        await this.conn().from(this.t(DEVICE_TABLE)).where('expires_at', '<', before).delete();
     }
     // ─── grants ───────────────────────────────────────────────────────────────
     async insertGrant(row) {
-        await this.conn().table(GRANT_TABLE).insert({
+        await this.conn().table(this.t(GRANT_TABLE)).insert({
             id: row.id,
             account_id: row.accountId,
             client_id: row.clientId,
@@ -135,13 +142,13 @@ export class DelegationStore {
         });
     }
     async findGrant(id) {
-        const row = await this.conn().from(GRANT_TABLE).where('id', id).first();
+        const row = await this.conn().from(this.t(GRANT_TABLE)).where('id', id).first();
         return row ? toGrant(row) : null;
     }
     /** Grants NÃO revogados da tripla (conta, agente, usuário do agente). */
     async findGrantsFor(accountId, clientId, agentSub) {
         const rows = await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('account_id', accountId)
             .where('client_id', clientId)
             .where('agent_sub', agentSub)
@@ -151,7 +158,7 @@ export class DelegationStore {
     /** Atualiza um grant NÃO revogado. `false` = revogado (ou sumiu) nesse meio-tempo. */
     async updateGrant(id, patch) {
         const result = await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('id', id)
             .whereNull('revoked_at')
             .update({ scope: patch.scope, expires_at: patch.expiresAt, updated_at: patch.updatedAt });
@@ -159,7 +166,7 @@ export class DelegationStore {
     }
     async listGrants(accountId) {
         const rows = await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('account_id', accountId)
             .whereNull('revoked_at')
             .orderBy('created_at', 'desc');
@@ -168,7 +175,7 @@ export class DelegationStore {
     /** Revoga um grant DA CONTA. `false` = não existe, é de outra conta ou já revogado. */
     async revokeGrant(accountId, id, at) {
         const result = await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('id', id)
             .where('account_id', accountId)
             .whereNull('revoked_at')
@@ -177,7 +184,7 @@ export class DelegationStore {
     }
     async revokeAllGrants(accountId, at) {
         const result = await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('account_id', accountId)
             .whereNull('revoked_at')
             .update({ revoked_at: at, updated_at: at });
@@ -189,7 +196,10 @@ export class DelegationStore {
      * protocolo sai do prefixo do id: `agrant_` (PACT) ou o `grantIdPrefix` de uma extension.
      */
     #live(now, filter = {}) {
-        let q = this.conn().from(GRANT_TABLE).whereNull('revoked_at').where('expires_at', '>', now);
+        let q = this.conn()
+            .from(this.t(GRANT_TABLE))
+            .whereNull('revoked_at')
+            .where('expires_at', '>', now);
         // O prefixo é `[a-z0-9]+_`: o `_` do LIKE (um caractere qualquer) casa com ele mesmo.
         if (filter.idPrefix)
             q = q.where('id', 'like', `${filter.idPrefix}%`);
@@ -222,7 +232,7 @@ export class DelegationStore {
     /** Ids dos grants não revogados de um agente (vivos ou não) — para revogar todos. */
     async unrevokedGrantIdsOfClient(clientId) {
         const rows = await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('client_id', clientId)
             .whereNull('revoked_at')
             .select('id');
@@ -231,14 +241,14 @@ export class DelegationStore {
     /** Revoga um grant sem checar a conta — reação a reuso de refresh token. */
     async revokeGrantById(id, at) {
         await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('id', id)
             .whereNull('revoked_at')
             .update({ revoked_at: at, updated_at: at });
     }
     // ─── refresh tokens ───────────────────────────────────────────────────────
     async insertRefreshToken(row) {
-        await this.conn().table(REFRESH_TABLE).insert({
+        await this.conn().table(this.t(REFRESH_TABLE)).insert({
             token_hash: row.tokenHash,
             grant_id: row.grantId,
             expires_at: row.expiresAt,
@@ -246,7 +256,10 @@ export class DelegationStore {
         });
     }
     async findRefreshToken(tokenHash) {
-        const row = await this.conn().from(REFRESH_TABLE).where('token_hash', tokenHash).first();
+        const row = await this.conn()
+            .from(this.t(REFRESH_TABLE))
+            .where('token_hash', tokenHash)
+            .first();
         return row
             ? {
                 grantId: row.grant_id,
@@ -258,7 +271,7 @@ export class DelegationStore {
     /** Marca o refresh como usado (uso único, atômico). `false` = já tinha sido usado. */
     async useRefreshToken(tokenHash, at) {
         const result = await this.conn()
-            .from(REFRESH_TABLE)
+            .from(this.t(REFRESH_TABLE))
             .where('token_hash', tokenHash)
             .whereNull('used_at')
             .update({ used_at: at });

package/build/src/agents/extension.d.ts

@@ -27,10 +27,18 @@ import type { HttpContext } from '@adonisjs/core/http';
  * A lib-owned table: created when missing, new columns added with `ALTER ADD`, never dropped or
  * altered. The builders receive a Knex `TableBuilder`.
  */
+/** What {@link AuthkitTable.create} receives next to the table builder. */
+export interface AuthkitTableContext {
+    /** `name` as AuthKit's tables are addressed: `schema.name` + `.` + `name` when a schema is set. */
+    table(name: string): string;
+}
 export interface AuthkitTable {
     name: string;
-    /** Full builder — runs when the table does not exist. */
-    create: (table: any) => void;
+    /**
+     * Full builder — runs when the table does not exist. A foreign key into another lib-owned
+     * table names it through `context.table(name)` (qualified with `schema.name` when set).
+     */
+    create: (table: any, context: AuthkitTableContext) => void;
     /**
      * One builder per column — runs (`ALTER ADD`) when the table exists but the column does not.
      * No constraints that break on populated tables (unique/FK belong in `create`).
@@ -125,6 +133,12 @@ export interface PersonalAgentHost {
     readonly issuer: string;
     /** The Lucid connection AuthKit's tables live on (`schema.connection`). */
     db(): any;
+    /**
+     * `name` as every statement must write it: `schema.name` + `.` + `name` when the app puts
+     * AuthKit's tables in a database schema (knex quotes each part), else `name`. Name every
+     * lib-owned table through it — the shared ledger tables and the extension's own.
+     */
+    table(name: string): string;
     readonly grants: PersonalAgentGrantLedger;
     /** The admin console's verdict on an agent of this protocol. `null` = not listed. */
     registryStatus(identifier: string): Promise<'allowed' | 'blocked' | null>;

package/build/src/agents/registry_store.d.ts

@@ -22,6 +22,7 @@ export declare class AgentRegistryStore {
     #private;
     constructor(conn: () => any, options?: {
         now?: () => number;
+        table?: (name: string) => string;
     });
     /** Todas as linhas, mais recentes primeiro. Lê do banco (console). */
     list(): Promise<AgentRegistryRow[]>;

package/build/src/agents/registry_store.js

@@ -47,13 +47,15 @@ export class AgentRegistryStore {
     #now;
     #snapshot = null;
     #loading = null;
+    #table;
     constructor(conn, options = {}) {
         this.#conn = conn;
+        this.#table = (options.table ?? ((name) => name))(REGISTRY_TABLE);
         this.#now = options.now ?? Date.now;
     }
     /** Todas as linhas, mais recentes primeiro. Lê do banco (console). */
     async list() {
-        const rows = await this.#conn().from(REGISTRY_TABLE).orderBy('updated_at', 'desc');
+        const rows = await this.#conn().from(this.#table).orderBy('updated_at', 'desc');
         return rows.map(toRow);
     }
     /** A linha do agente, pelo snapshot. `null` = o console não diz nada sobre ele. */
@@ -61,14 +63,14 @@ export class AgentRegistryStore {
         return (await this.#rows()).get(key(protocol, identifier)) ?? null;
     }
     async findById(id) {
-        const row = await this.#conn().from(REGISTRY_TABLE).where('id', id).first();
+        const row = await this.#conn().from(this.#table).where('id', id).first();
         return row ? toRow(row) : null;
     }
     /** Cria ou troca a linha de (protocolo, identificador). */
     async upsert(input) {
         const now = new Date(this.#now());
         const existing = await this.#conn()
-            .from(REGISTRY_TABLE)
+            .from(this.#table)
             .where('protocol', input.protocol)
             .where('identifier', input.identifier)
             .first();
@@ -80,11 +82,11 @@ export class AgentRegistryStore {
             updated_at: now,
         };
         if (existing) {
-            await this.#conn().from(REGISTRY_TABLE).where('id', existing.id).update(values);
+            await this.#conn().from(this.#table).where('id', existing.id).update(values);
         }
         else {
             await this.#conn()
-                .table(REGISTRY_TABLE)
+                .table(this.#table)
                 .insert({
                 id: `areg_${randomBytes(12).toString('base64url')}`,
                 protocol: input.protocol,
@@ -95,14 +97,14 @@ export class AgentRegistryStore {
         }
         this.invalidate();
         const row = await this.#conn()
-            .from(REGISTRY_TABLE)
+            .from(this.#table)
             .where('protocol', input.protocol)
             .where('identifier', input.identifier)
             .first();
         return toRow(row);
     }
     async delete(id) {
-        const result = await this.#conn().from(REGISTRY_TABLE).where('id', id).delete();
+        const result = await this.#conn().from(this.#table).where('id', id).delete();
         this.invalidate();
         return (typeof result === 'number' ? result : Array.isArray(result) ? result.length : 0) > 0;
     }
@@ -116,7 +118,7 @@ export class AgentRegistryStore {
         if (!this.#loading) {
             this.#loading = (async () => {
                 try {
-                    const rows = (await this.#conn().from(REGISTRY_TABLE)).map(toRow);
+                    const rows = (await this.#conn().from(this.#table)).map(toRow);
                     const map = new Map(rows.map((r) => [key(r.protocol, r.identifier), r]));
                     this.#snapshot = { rows: map, expiresAt: this.#now() + SNAPSHOT_TTL_MS };
                     return map;

package/build/src/agents/runtime.js

@@ -1,6 +1,7 @@
 import { getBootedApp } from '../../services/booted_app.js';
 import { supportsAccountStatus } from '../accounts/account_store.js';
 import { findMcpResource } from '../mcp/mcp_oauth.js';
+import { authkitTable } from '../schema/tables_location.js';
 import { PersonalAgentVerifier } from './agent_identity.js';
 import { PersonalAgentDelegation } from './delegation_service.js';
 import { DelegationStore } from './delegation_store.js';
@@ -156,8 +157,10 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
                     conn = null;
                 }
             }
-            const store = conn ? new DelegationStore(conn) : null;
-            const registry = conn ? new AgentRegistryStore(conn) : null;
+            // Com `schema.name`, cada statement escreve `schema.tabela`.
+            const tableName = (name) => authkitTable({ schema: service.config.schema.name }, name);
+            const store = conn ? new DelegationStore(conn, tableName) : null;
+            const registry = conn ? new AgentRegistryStore(conn, { table: tableName }) : null;
             const effective = registry ? withRegistry(config, registry) : config;
             let delegation = null;
             if (config.delegation && store) {
@@ -179,6 +182,7 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
                         protocol: extension.id,
                         issuer: service.config.issuer,
                         db: () => db(),
+                        table: tableName,
                         grants: scopedLedger(store, extension.grantIdPrefix),
                         registryStatus: async (identifier) => (await registry.find(extension.id, identifier))?.status ?? null,
                         deriveSecret: (label) => service.deriveSecret(label),

package/build/src/commands/expire_scan_command.js

@@ -27,7 +27,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { RuntimeSettings } from '../host/runtime_settings.js';
+import { RuntimeSettings, settingsLocation } from '../host/runtime_settings.js';
 import { resolveEffectiveAccountExpiration } from '../host/runtime_toggles.js';
 import { ADMIN_LIST_DEFAULT_SIZE, LIST_FIRST_PAGE } from '../pagination.js';
 import { resolveAuthkitConfig } from './resolve_config.js';
@@ -54,8 +54,7 @@ export async function runExpireScan(app, opts) {
     let runtimeSettings = null;
     try {
         const db = await app.container.make('lucid.db');
-        const connection = cfg.schema?.connection;
-        runtimeSettings = new RuntimeSettings(db, connection ? { connection } : {});
+        runtimeSettings = new RuntimeSettings(db, settingsLocation(cfg));
     }
     catch {
         // Sem DB → usa defaults.

package/build/src/commands/settings_commands.js

@@ -14,7 +14,7 @@
  *
  * Todas suportam --json para output machine-readable.
  */
-import { RuntimeSettings } from '../host/runtime_settings.js';
+import { RuntimeSettings, settingsLocation } from '../host/runtime_settings.js';
 import { SETTING_KEYS } from '../host/runtime_toggles.js';
 import { resolveAuthkitConfig } from './resolve_config.js';
 // ---------------------------------------------------------------------------
@@ -132,15 +132,15 @@ async function resolveSettingsService(app) {
     try {
         const db = await app.container.make('lucid.db');
         // `auth_settings` vive na conexão das tabelas do authkit (`schema.connection`).
-        let connection;
+        let location = {};
         try {
             const cfg = await resolveCfg(app);
-            connection = cfg?.schema?.connection;
+            location = settingsLocation(cfg);
         }
         catch {
             // Silencioso: sem config → default connection.
         }
-        return new RuntimeSettings(db, connection ? { connection } : {});
+        return new RuntimeSettings(db, location);
     }
     catch {
         return null;

package/build/src/define_config.d.ts

@@ -1194,10 +1194,17 @@ export interface AuthServerConfigInput {
      *   primária) — as acima, o `authkit_keystore`, as de extensions e a do
      *   `adapters.database()`/keystore `lucid` quando eles não declaram a própria.
      *   A tabela da conta NÃO entra: fica na conexão do model da conta.
+     * - `name`: o schema do banco dessas tabelas (MySQL: o database), ex.: `'auth'`
+     *   → `"auth"."auth_settings"`. Vai escrito em cada statement; o boot cria o
+     *   schema quando falta (com `autoManage`). Default: o schema corrente da
+     *   conexão. SQLite não tem schemas: com `name`, o boot falha. NÃO use
+     *   `searchPath` na conexão para isso — atrás de um PgBouncer em modo
+     *   transaction, o `SET search_path` vaza para as conexões de outros clientes.
      */
     schema?: {
         autoManage?: boolean;
         connection?: string;
+        name?: string;
     };
     /**
      * Ciclo de vida da conta (LGPD/GDPR). OPT-IN para workflows DURÁVEIS:
@@ -1407,6 +1414,7 @@ export interface ResolvedServerConfig {
     schema: {
         autoManage: boolean;
         connection?: string;
+        name?: string;
     };
     /**
      * Ciclo de vida da conta resolvido. `durable` default `false` → caminho

package/build/src/define_config.js

@@ -17,7 +17,7 @@ import { loadEncryptionService } from './keys/keystore_crypto.js';
 import { KeystoreManager, resolveKeystoreVault } from './keys/keystore_manager.js';
 import { mcpClientRegistration, resolveMcpOAuth, } from './mcp/mcp_oauth.js';
 import { OPEN_REGISTRATION_REDIRECT_POLICY, resolveRedirectUriPolicy, } from './provider/registration_policy.js';
-import { bindTablesLocation } from './schema/tables_location.js';
+import { assertSchemaSupported, authkitTablesClient, bindTablesLocation, validateSchemaName, } from './schema/tables_location.js';
 import { resolveServiceTenants, } from './service_tenants/config.js';
 export { adapters };
 const RATE_LIMIT_DEFAULTS = {
@@ -288,9 +288,20 @@ export function defineConfig(config) {
     // Toda tabela do AuthKit vive em `schema.connection` — inclusive as que o store da
     // conta lê (auth_mfa, auth_password_history, organizations), que antes seguiam a
     // conexão do model da conta.
-    bindTablesLocation(config.accountStore, { connection: config.schema?.connection });
+    const tablesSchema = validateSchemaName(config.schema?.name);
+    bindTablesLocation(config.accountStore, {
+        connection: config.schema?.connection,
+        schema: tablesSchema,
+    });
     return configProvider.create(async (app) => {
-        const tablesContext = { connection: config.schema?.connection };
+        const tablesContext = { connection: config.schema?.connection, schema: tablesSchema };
+        if (tablesSchema) {
+            // Schema num dialeto sem schemas (SQLite) falha aqui, na resolução do config — nunca
+            // cai em silêncio para tabelas sem schema.
+            const db = await app.container.make('lucid.db').catch(() => null);
+            if (db)
+                assertSchemaSupported(authkitTablesClient(db, tablesContext), tablesSchema);
+        }
         const AdapterClass = await config.adapter.resolver(app, tablesContext);
         // `session.adapter` ausente ⇒ mesma classe do default (back-compat: o
         // dispatcher vira identidade e tudo continua no adapter único de hoje).
@@ -310,12 +321,17 @@ export function defineConfig(config) {
                     store: 'tmp/authkit_jwks.json',
                 }
             : config.jwks;
-        // Keystore no Lucid sem conexão própria fica na conexão das tabelas do authkit.
+        // Keystore no Lucid sem conexão/schema próprios fica onde estão as tabelas do authkit.
         const jwksStore = jwksInput.store;
-        const jwksConfig = jwksStore?.driver === 'lucid' && !jwksStore.connection && config.schema?.connection
+        const jwksConfig = jwksStore?.driver === 'lucid' &&
+            ((!jwksStore.connection && config.schema?.connection) || (!jwksStore.schema && tablesSchema))
             ? {
                 ...jwksInput,
-                store: { ...jwksStore, connection: config.schema.connection },
+                store: {
+                    ...jwksStore,
+                    connection: jwksStore.connection ?? config.schema?.connection,
+                    schema: jwksStore.schema ?? tablesSchema,
+                },
             }
             : jwksInput;
         if (config.jwks === 'auto' && !process.env.AUTHKIT_JWKS) {
@@ -504,6 +520,7 @@ export function defineConfig(config) {
             schema: {
                 autoManage: config.schema?.autoManage !== false,
                 connection: config.schema?.connection,
+                name: tablesSchema,
             },
             // OPT-IN: default false → caminho síncrono de sempre (byte-idêntico).
             accountLifecycle: {

package/build/src/doctor/agora_checks.js

@@ -134,6 +134,19 @@ export function authkitDoctorChecks() {
             const { managedSigningKeyAgeFinding } = await import('./doctor_input.js');
             return toResults(await managedSigningKeyAgeFinding(app, input.authkitConfig));
         },
+    }, {
+        id: 'authkit.db-schema',
+        lib: 'authkit',
+        package: AUTHKIT_DOCTOR_PACKAGE,
+        title: 'Database schema',
+        cost: 'deep',
+        async run(app) {
+            const { input, notBooted } = await prepare(app);
+            if (notBooted || !input?.authkitConfig?.schema?.name)
+                return [];
+            const { dbSchemaResults } = await import('./db_schema_check.js');
+            return dbSchemaResults(input.authkitConfig, () => app.container.make('lucid.db'), AUTHKIT_DOCTOR_DOCS);
+        },
     }, {
         id: 'authkit.console-gate',
         lib: 'authkit',

package/build/src/doctor/db_schema_check.d.ts

@@ -0,0 +1,6 @@
+import type { AgoraDoctorResult } from './agora_doctor.js';
+/**
+ * `agora:doctor` check for `schema.name`: the schema exists, AuthKit's tables are in it, and the
+ * connection can write there. No result at all without `schema.name`.
+ */
+export declare function dbSchemaResults(config: Record<string, any> | null, makeDb: () => Promise<any>, docs: string): Promise<AgoraDoctorResult[]>;

package/build/src/doctor/db_schema_check.js

@@ -0,0 +1,87 @@
+/** Thrown inside the probe transaction so the probe row is never kept. */
+class ProbeRollback extends Error {
+}
+function rows(result) {
+    if (Array.isArray(result))
+        return Array.isArray(result[0]) ? result[0] : result;
+    return result?.rows ?? [];
+}
+/**
+ * `agora:doctor` check for `schema.name`: the schema exists, AuthKit's tables are in it, and the
+ * connection can write there. No result at all without `schema.name`.
+ */
+export async function dbSchemaResults(config, makeDb, docs) {
+    const schema = config?.schema?.name;
+    if (!schema)
+        return [];
+    const [{ AUTHKIT_TABLE_NAMES }, { authkitTable, authkitTablesClient, dialectOf }] = await Promise.all([import('../schema/ensure.js'), import('../schema/tables_location.js')]);
+    const client = authkitTablesClient(await makeDb(), { connection: config?.schema?.connection });
+    const dialect = dialectOf(client);
+    if (dialect !== 'postgres' && dialect !== 'mysql') {
+        return [
+            {
+                status: 'error',
+                message: `schema.name "${schema}" is set, but the connection uses ${dialect ?? 'an unknown dialect'}, which has no schemas`,
+                fix: 'Remove schema.name from config/authkit.ts, or use Postgres or MySQL',
+                docs,
+            },
+        ];
+    }
+    const exists = rows(await client.rawQuery('select 1 as ok from information_schema.schemata where schema_name = ?', [
+        schema,
+    ]));
+    if (exists.length === 0) {
+        return [
+            {
+                status: 'error',
+                message: `database schema "${schema}" does not exist on this connection`,
+                fix: dialect === 'mysql'
+                    ? `Boot the app once with schema.autoManage on, or run CREATE DATABASE \`${schema}\``
+                    : `Boot the app once with schema.autoManage on, or run CREATE SCHEMA "${schema}"`,
+                docs,
+            },
+        ];
+    }
+    const found = new Set(rows(await client.rawQuery('select table_name as name from information_schema.tables where table_schema = ?', [schema])).map((r) => String(r.name ?? r.NAME ?? r.TABLE_NAME)));
+    const missing = AUTHKIT_TABLE_NAMES.filter((name) => !found.has(name));
+    if (missing.length > 0) {
+        return [
+            {
+                status: 'error',
+                message: `AuthKit tables missing from schema "${schema}": ${missing.join(', ')}`,
+                fix: 'Boot the app once with schema.autoManage on, or run ensureAuthkitSchema(db, { schema }) in a migration',
+                docs,
+            },
+        ];
+    }
+    try {
+        await client.transaction(async (trx) => {
+            await trx.table(authkitTable({ schema }, 'auth_settings')).insert({
+                key: '__authkit_doctor_probe',
+                organization_id: null,
+                value: 'null',
+            });
+            throw new ProbeRollback();
+        });
+    }
+    catch (error) {
+        if (!(error instanceof ProbeRollback)) {
+            return [
+                {
+                    status: 'error',
+                    message: `the connection cannot write to schema "${schema}": ${error?.message ?? error}`,
+                    fix: dialect === 'mysql'
+                        ? `GRANT INSERT, UPDATE, DELETE ON \`${schema}\`.* TO the app user`
+                        : `GRANT USAGE ON SCHEMA "${schema}" and INSERT, UPDATE, DELETE on its tables to the app role`,
+                    docs,
+                },
+            ];
+        }
+    }
+    return [
+        {
+            status: 'ok',
+            message: `AuthKit tables are in schema "${schema}" and the connection can write there`,
+        },
+    ];
+}

package/build/src/host/admin_sessions_service.js

@@ -1,6 +1,7 @@
 import { getBootedApp } from '../../services/booted_app.js';
 import { pickModelAdapterClass } from '../adapters/factory.js';
 import { buildPersonalAgentsRuntime } from '../agents/runtime.js';
+import { authkitTable } from '../schema/tables_location.js';
 import { normalizeActiveOrg } from './active_org_cookie.js';
 /**
  * Serviço de inspeção/revogação das SESSÕES e GRANTS ativos de uma conta.
@@ -22,8 +23,10 @@ export class AdminSessionsService {
     #AdapterClass;
     #SessionAdapterClass;
     #accountStore;
-    /** Conexão Lucid das tabelas authkit (schema `auth`) — onde vive auth_session_revocations. */
+    /** Conexão Lucid das tabelas authkit (`schema.connection`) — onde vive auth_session_revocations. */
     #schemaConnection;
+    /** `auth_session_revocations`, qualificada com `schema.name` quando há um. */
+    #revocationsTable;
     #oidc;
     constructor(oidc) {
         this.#oidc = oidc;
@@ -34,6 +37,7 @@ export class AdminSessionsService {
         this.#SessionAdapterClass = oidc.config.SessionAdapterClass ?? oidc.config.AdapterClass;
         this.#accountStore = oidc.config.accountStore;
         this.#schemaConnection = oidc.config.schema?.connection;
+        this.#revocationsTable = authkitTable({ schema: oidc.config.schema?.name }, 'auth_session_revocations');
     }
     #adapter(model) {
         return new (pickModelAdapterClass(model, this.#AdapterClass, this.#SessionAdapterClass))(model);
@@ -70,7 +74,7 @@ export class AdminSessionsService {
             const conn = this.#schemaConnection
                 ? db.connection(this.#schemaConnection)
                 : db.connection();
-            await conn.insertQuery().table('auth_session_revocations').insert({
+            await conn.insertQuery().table(this.#revocationsTable).insert({
                 sid: null,
                 sub: accountId,
                 revoked_at: revokedAt,

package/build/src/host/runtime_settings.d.ts

@@ -98,7 +98,20 @@ export interface RuntimeSettingsOptions {
      * Ausente (ou undefined) → conexão default.
      */
     connection?: string;
+    /**
+     * Schema do banco de `auth_settings` (MySQL: o database) — o `schema.name` do
+     * `defineConfig`. Escrito em cada statement (`"auth"."auth_settings"`).
+     */
+    schema?: string;
 }
+/**
+ * `{ connection, schema }` das tabelas do authkit a partir do config resolvido
+ * (`schema.connection`/`schema.name`), no formato de {@link RuntimeSettingsOptions}.
+ */
+export declare function settingsLocation(config: any): {
+    connection?: string;
+    schema?: string;
+};
 /**
  * Implementação default do SettingsCapability sobre um `Database` Lucid.
  *
@@ -108,6 +121,8 @@ export declare class RuntimeSettings implements SettingsCapability {
     private readonly db;
     private readonly ttlMs;
     private readonly connectionName;
+    /** `auth_settings`, qualificada com o schema quando há um. */
+    private readonly table;
     private readonly shared;
     constructor(db: any, opts?: RuntimeSettingsOptions);
     private get cache();