@adonis-agora/authkit-server 1.0.0-rc.11 → 1.0.0-rc.13

package/build/src/agents/delegation_store.js

@@ -63,13 +63,17 @@ function affected(result) {
 }
 export class DelegationStore {
     conn;
+    t;
     /** `conn` = uma conexão Lucid (`db.connection(name?)`) — ou uma transação. */
-    constructor(conn) {
+    constructor(conn, 
+    /** Nome da tabela como os statements o escrevem (`schema.tabela` com `schema.name`). */
+    t = (name) => name) {
         this.conn = conn;
+        this.t = t;
     }
     // ─── device codes ─────────────────────────────────────────────────────────
     async insertDevice(row) {
-        await this.conn().table(DEVICE_TABLE).insert({
+        await this.conn().table(this.t(DEVICE_TABLE)).insert({
             id: row.id,
             device_code_hash: row.deviceCodeHash,
             user_code: row.userCode,
@@ -83,19 +87,22 @@ export class DelegationStore {
         });
     }
     async findDeviceByCodeHash(hash) {
-        const row = await this.conn().from(DEVICE_TABLE).where('device_code_hash', hash).first();
+        const row = await this.conn()
+            .from(this.t(DEVICE_TABLE))
+            .where('device_code_hash', hash)
+            .first();
         return row ? toDevice(row) : null;
     }
     async findDeviceByUserCode(userCode) {
-        const row = await this.conn().from(DEVICE_TABLE).where('user_code', userCode).first();
+        const row = await this.conn().from(this.t(DEVICE_TABLE)).where('user_code', userCode).first();
         return row ? toDevice(row) : null;
     }
     /** Liga o pedido aprovado ao grant — a partir daqui o polling do agente recebe o token. */
     async setDeviceGrant(id, grantId) {
-        await this.conn().from(DEVICE_TABLE).where('id', id).update({ grant_id: grantId });
+        await this.conn().from(this.t(DEVICE_TABLE)).where('id', id).update({ grant_id: grantId });
     }
     async markPolled(id, at) {
-        await this.conn().from(DEVICE_TABLE).where('id', id).update({ last_polled_at: at });
+        await this.conn().from(this.t(DEVICE_TABLE)).where('id', id).update({ last_polled_at: at });
     }
     /**
      * Transição de estado ATÔMICA: só aplica se o pedido ainda está em `from`.
@@ -108,7 +115,7 @@ export class DelegationStore {
         if (patch.grantId !== undefined)
             update.grant_id = patch.grantId;
         const result = await this.conn()
-            .from(DEVICE_TABLE)
+            .from(this.t(DEVICE_TABLE))
             .where('id', id)
             .where('status', from)
             .update(update);
@@ -119,11 +126,11 @@ export class DelegationStore {
      * vai pelo mesmo binding do INSERT, então a comparação é coerente no dialeto.
      */
     async deleteDevicesExpiredBefore(before) {
-        await this.conn().from(DEVICE_TABLE).where('expires_at', '<', before).delete();
+        await this.conn().from(this.t(DEVICE_TABLE)).where('expires_at', '<', before).delete();
     }
     // ─── grants ───────────────────────────────────────────────────────────────
     async insertGrant(row) {
-        await this.conn().table(GRANT_TABLE).insert({
+        await this.conn().table(this.t(GRANT_TABLE)).insert({
             id: row.id,
             account_id: row.accountId,
             client_id: row.clientId,
@@ -135,13 +142,13 @@ export class DelegationStore {
         });
     }
     async findGrant(id) {
-        const row = await this.conn().from(GRANT_TABLE).where('id', id).first();
+        const row = await this.conn().from(this.t(GRANT_TABLE)).where('id', id).first();
         return row ? toGrant(row) : null;
     }
     /** Grants NÃO revogados da tripla (conta, agente, usuário do agente). */
     async findGrantsFor(accountId, clientId, agentSub) {
         const rows = await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('account_id', accountId)
             .where('client_id', clientId)
             .where('agent_sub', agentSub)
@@ -151,7 +158,7 @@ export class DelegationStore {
     /** Atualiza um grant NÃO revogado. `false` = revogado (ou sumiu) nesse meio-tempo. */
     async updateGrant(id, patch) {
         const result = await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('id', id)
             .whereNull('revoked_at')
             .update({ scope: patch.scope, expires_at: patch.expiresAt, updated_at: patch.updatedAt });
@@ -159,7 +166,7 @@ export class DelegationStore {
     }
     async listGrants(accountId) {
         const rows = await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('account_id', accountId)
             .whereNull('revoked_at')
             .orderBy('created_at', 'desc');
@@ -168,7 +175,7 @@ export class DelegationStore {
     /** Revoga um grant DA CONTA. `false` = não existe, é de outra conta ou já revogado. */
     async revokeGrant(accountId, id, at) {
         const result = await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('id', id)
             .where('account_id', accountId)
             .whereNull('revoked_at')
@@ -177,7 +184,7 @@ export class DelegationStore {
     }
     async revokeAllGrants(accountId, at) {
         const result = await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('account_id', accountId)
             .whereNull('revoked_at')
             .update({ revoked_at: at, updated_at: at });
@@ -189,7 +196,10 @@ export class DelegationStore {
      * protocolo sai do prefixo do id: `agrant_` (PACT) ou o `grantIdPrefix` de uma extension.
      */
     #live(now, filter = {}) {
-        let q = this.conn().from(GRANT_TABLE).whereNull('revoked_at').where('expires_at', '>', now);
+        let q = this.conn()
+            .from(this.t(GRANT_TABLE))
+            .whereNull('revoked_at')
+            .where('expires_at', '>', now);
         // O prefixo é `[a-z0-9]+_`: o `_` do LIKE (um caractere qualquer) casa com ele mesmo.
         if (filter.idPrefix)
             q = q.where('id', 'like', `${filter.idPrefix}%`);
@@ -222,7 +232,7 @@ export class DelegationStore {
     /** Ids dos grants não revogados de um agente (vivos ou não) — para revogar todos. */
     async unrevokedGrantIdsOfClient(clientId) {
         const rows = await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('client_id', clientId)
             .whereNull('revoked_at')
             .select('id');
@@ -231,14 +241,14 @@ export class DelegationStore {
     /** Revoga um grant sem checar a conta — reação a reuso de refresh token. */
     async revokeGrantById(id, at) {
         await this.conn()
-            .from(GRANT_TABLE)
+            .from(this.t(GRANT_TABLE))
             .where('id', id)
             .whereNull('revoked_at')
             .update({ revoked_at: at, updated_at: at });
     }
     // ─── refresh tokens ───────────────────────────────────────────────────────
     async insertRefreshToken(row) {
-        await this.conn().table(REFRESH_TABLE).insert({
+        await this.conn().table(this.t(REFRESH_TABLE)).insert({
             token_hash: row.tokenHash,
             grant_id: row.grantId,
             expires_at: row.expiresAt,
@@ -246,7 +256,10 @@ export class DelegationStore {
         });
     }
     async findRefreshToken(tokenHash) {
-        const row = await this.conn().from(REFRESH_TABLE).where('token_hash', tokenHash).first();
+        const row = await this.conn()
+            .from(this.t(REFRESH_TABLE))
+            .where('token_hash', tokenHash)
+            .first();
         return row
             ? {
                 grantId: row.grant_id,
@@ -258,7 +271,7 @@ export class DelegationStore {
     /** Marca o refresh como usado (uso único, atômico). `false` = já tinha sido usado. */
     async useRefreshToken(tokenHash, at) {
         const result = await this.conn()
-            .from(REFRESH_TABLE)
+            .from(this.t(REFRESH_TABLE))
             .where('token_hash', tokenHash)
             .whereNull('used_at')
             .update({ used_at: at });

package/build/src/agents/extension.d.ts

@@ -27,10 +27,18 @@ import type { HttpContext } from '@adonisjs/core/http';
  * A lib-owned table: created when missing, new columns added with `ALTER ADD`, never dropped or
  * altered. The builders receive a Knex `TableBuilder`.
  */
+/** What {@link AuthkitTable.create} receives next to the table builder. */
+export interface AuthkitTableContext {
+    /** `name` as AuthKit's tables are addressed: `schema.name` + `.` + `name` when a schema is set. */
+    table(name: string): string;
+}
 export interface AuthkitTable {
     name: string;
-    /** Full builder — runs when the table does not exist. */
-    create: (table: any) => void;
+    /**
+     * Full builder — runs when the table does not exist. A foreign key into another lib-owned
+     * table names it through `context.table(name)` (qualified with `schema.name` when set).
+     */
+    create: (table: any, context: AuthkitTableContext) => void;
     /**
      * One builder per column — runs (`ALTER ADD`) when the table exists but the column does not.
      * No constraints that break on populated tables (unique/FK belong in `create`).
@@ -125,6 +133,12 @@ export interface PersonalAgentHost {
     readonly issuer: string;
     /** The Lucid connection AuthKit's tables live on (`schema.connection`). */
     db(): any;
+    /**
+     * `name` as every statement must write it: `schema.name` + `.` + `name` when the app puts
+     * AuthKit's tables in a database schema (knex quotes each part), else `name`. Name every
+     * lib-owned table through it — the shared ledger tables and the extension's own.
+     */
+    table(name: string): string;
     readonly grants: PersonalAgentGrantLedger;
     /** The admin console's verdict on an agent of this protocol. `null` = not listed. */
     registryStatus(identifier: string): Promise<'allowed' | 'blocked' | null>;

package/build/src/agents/registry_store.d.ts

@@ -22,6 +22,7 @@ export declare class AgentRegistryStore {
     #private;
     constructor(conn: () => any, options?: {
         now?: () => number;
+        table?: (name: string) => string;
     });
     /** Todas as linhas, mais recentes primeiro. Lê do banco (console). */
     list(): Promise<AgentRegistryRow[]>;

package/build/src/agents/registry_store.js

@@ -47,13 +47,15 @@ export class AgentRegistryStore {
     #now;
     #snapshot = null;
     #loading = null;
+    #table;
     constructor(conn, options = {}) {
         this.#conn = conn;
+        this.#table = (options.table ?? ((name) => name))(REGISTRY_TABLE);
         this.#now = options.now ?? Date.now;
     }
     /** Todas as linhas, mais recentes primeiro. Lê do banco (console). */
     async list() {
-        const rows = await this.#conn().from(REGISTRY_TABLE).orderBy('updated_at', 'desc');
+        const rows = await this.#conn().from(this.#table).orderBy('updated_at', 'desc');
         return rows.map(toRow);
     }
     /** A linha do agente, pelo snapshot. `null` = o console não diz nada sobre ele. */
@@ -61,14 +63,14 @@ export class AgentRegistryStore {
         return (await this.#rows()).get(key(protocol, identifier)) ?? null;
     }
     async findById(id) {
-        const row = await this.#conn().from(REGISTRY_TABLE).where('id', id).first();
+        const row = await this.#conn().from(this.#table).where('id', id).first();
         return row ? toRow(row) : null;
     }
     /** Cria ou troca a linha de (protocolo, identificador). */
     async upsert(input) {
         const now = new Date(this.#now());
         const existing = await this.#conn()
-            .from(REGISTRY_TABLE)
+            .from(this.#table)
             .where('protocol', input.protocol)
             .where('identifier', input.identifier)
             .first();
@@ -80,11 +82,11 @@ export class AgentRegistryStore {
             updated_at: now,
         };
         if (existing) {
-            await this.#conn().from(REGISTRY_TABLE).where('id', existing.id).update(values);
+            await this.#conn().from(this.#table).where('id', existing.id).update(values);
         }
         else {
             await this.#conn()
-                .table(REGISTRY_TABLE)
+                .table(this.#table)
                 .insert({
                 id: `areg_${randomBytes(12).toString('base64url')}`,
                 protocol: input.protocol,
@@ -95,14 +97,14 @@ export class AgentRegistryStore {
         }
         this.invalidate();
         const row = await this.#conn()
-            .from(REGISTRY_TABLE)
+            .from(this.#table)
             .where('protocol', input.protocol)
             .where('identifier', input.identifier)
             .first();
         return toRow(row);
     }
     async delete(id) {
-        const result = await this.#conn().from(REGISTRY_TABLE).where('id', id).delete();
+        const result = await this.#conn().from(this.#table).where('id', id).delete();
         this.invalidate();
         return (typeof result === 'number' ? result : Array.isArray(result) ? result.length : 0) > 0;
     }
@@ -116,7 +118,7 @@ export class AgentRegistryStore {
         if (!this.#loading) {
             this.#loading = (async () => {
                 try {
-                    const rows = (await this.#conn().from(REGISTRY_TABLE)).map(toRow);
+                    const rows = (await this.#conn().from(this.#table)).map(toRow);
                     const map = new Map(rows.map((r) => [key(r.protocol, r.identifier), r]));
                     this.#snapshot = { rows: map, expiresAt: this.#now() + SNAPSHOT_TTL_MS };
                     return map;

package/build/src/agents/runtime.js

@@ -1,6 +1,7 @@
 import { getBootedApp } from '../../services/booted_app.js';
 import { supportsAccountStatus } from '../accounts/account_store.js';
 import { findMcpResource } from '../mcp/mcp_oauth.js';
+import { authkitTable } from '../schema/tables_location.js';
 import { PersonalAgentVerifier } from './agent_identity.js';
 import { PersonalAgentDelegation } from './delegation_service.js';
 import { DelegationStore } from './delegation_store.js';
@@ -156,8 +157,10 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
                     conn = null;
                 }
             }
-            const store = conn ? new DelegationStore(conn) : null;
-            const registry = conn ? new AgentRegistryStore(conn) : null;
+            // Com `schema.name`, cada statement escreve `schema.tabela`.
+            const tableName = (name) => authkitTable({ schema: service.config.schema.name }, name);
+            const store = conn ? new DelegationStore(conn, tableName) : null;
+            const registry = conn ? new AgentRegistryStore(conn, { table: tableName }) : null;
             const effective = registry ? withRegistry(config, registry) : config;
             let delegation = null;
             if (config.delegation && store) {
@@ -179,6 +182,7 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
                         protocol: extension.id,
                         issuer: service.config.issuer,
                         db: () => db(),
+                        table: tableName,
                         grants: scopedLedger(store, extension.grantIdPrefix),
                         registryStatus: async (identifier) => (await registry.find(extension.id, identifier))?.status ?? null,
                         deriveSecret: (label) => service.deriveSecret(label),

package/build/src/commands/expire_scan_command.js

@@ -27,7 +27,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { RuntimeSettings } from '../host/runtime_settings.js';
+import { RuntimeSettings, settingsLocation } from '../host/runtime_settings.js';
 import { resolveEffectiveAccountExpiration } from '../host/runtime_toggles.js';
 import { ADMIN_LIST_DEFAULT_SIZE, LIST_FIRST_PAGE } from '../pagination.js';
 import { resolveAuthkitConfig } from './resolve_config.js';
@@ -54,8 +54,7 @@ export async function runExpireScan(app, opts) {
     let runtimeSettings = null;
     try {
         const db = await app.container.make('lucid.db');
-        const connection = cfg.schema?.connection;
-        runtimeSettings = new RuntimeSettings(db, connection ? { connection } : {});
+        runtimeSettings = new RuntimeSettings(db, settingsLocation(cfg));
     }
     catch {
         // Sem DB → usa defaults.

package/build/src/commands/settings_commands.js

@@ -14,7 +14,7 @@
  *
  * Todas suportam --json para output machine-readable.
  */
-import { RuntimeSettings } from '../host/runtime_settings.js';
+import { RuntimeSettings, settingsLocation } from '../host/runtime_settings.js';
 import { SETTING_KEYS } from '../host/runtime_toggles.js';
 import { resolveAuthkitConfig } from './resolve_config.js';
 // ---------------------------------------------------------------------------
@@ -132,15 +132,15 @@ async function resolveSettingsService(app) {
     try {
         const db = await app.container.make('lucid.db');
         // `auth_settings` vive na conexão das tabelas do authkit (`schema.connection`).
-        let connection;
+        let location = {};
         try {
             const cfg = await resolveCfg(app);
-            connection = cfg?.schema?.connection;
+            location = settingsLocation(cfg);
         }
         catch {
             // Silencioso: sem config → default connection.
         }
-        return new RuntimeSettings(db, connection ? { connection } : {});
+        return new RuntimeSettings(db, location);
     }
     catch {
         return null;

package/build/src/define_config.d.ts

@@ -1194,10 +1194,17 @@ export interface AuthServerConfigInput {
      *   primária) — as acima, o `authkit_keystore`, as de extensions e a do
      *   `adapters.database()`/keystore `lucid` quando eles não declaram a própria.
      *   A tabela da conta NÃO entra: fica na conexão do model da conta.
+     * - `name`: o schema do banco dessas tabelas (MySQL: o database), ex.: `'auth'`
+     *   → `"auth"."auth_settings"`. Vai escrito em cada statement; o boot cria o
+     *   schema quando falta (com `autoManage`). Default: o schema corrente da
+     *   conexão. SQLite não tem schemas: com `name`, o boot falha. NÃO use
+     *   `searchPath` na conexão para isso — atrás de um PgBouncer em modo
+     *   transaction, o `SET search_path` vaza para as conexões de outros clientes.
      */
     schema?: {
         autoManage?: boolean;
         connection?: string;
+        name?: string;
     };
     /**
      * Ciclo de vida da conta (LGPD/GDPR). OPT-IN para workflows DURÁVEIS:
@@ -1407,6 +1414,7 @@ export interface ResolvedServerConfig {
     schema: {
         autoManage: boolean;
         connection?: string;
+        name?: string;
     };
     /**
      * Ciclo de vida da conta resolvido. `durable` default `false` → caminho

package/build/src/define_config.js

@@ -17,7 +17,7 @@ import { loadEncryptionService } from './keys/keystore_crypto.js';
 import { KeystoreManager, resolveKeystoreVault } from './keys/keystore_manager.js';
 import { mcpClientRegistration, resolveMcpOAuth, } from './mcp/mcp_oauth.js';
 import { OPEN_REGISTRATION_REDIRECT_POLICY, resolveRedirectUriPolicy, } from './provider/registration_policy.js';
-import { bindTablesLocation } from './schema/tables_location.js';
+import { assertSchemaSupported, authkitTablesClient, bindTablesLocation, validateSchemaName, } from './schema/tables_location.js';
 import { resolveServiceTenants, } from './service_tenants/config.js';
 export { adapters };
 const RATE_LIMIT_DEFAULTS = {
@@ -288,9 +288,20 @@ export function defineConfig(config) {
     // Toda tabela do AuthKit vive em `schema.connection` — inclusive as que o store da
     // conta lê (auth_mfa, auth_password_history, organizations), que antes seguiam a
     // conexão do model da conta.
-    bindTablesLocation(config.accountStore, { connection: config.schema?.connection });
+    const tablesSchema = validateSchemaName(config.schema?.name);
+    bindTablesLocation(config.accountStore, {
+        connection: config.schema?.connection,
+        schema: tablesSchema,
+    });
     return configProvider.create(async (app) => {
-        const tablesContext = { connection: config.schema?.connection };
+        const tablesContext = { connection: config.schema?.connection, schema: tablesSchema };
+        if (tablesSchema) {
+            // Schema num dialeto sem schemas (SQLite) falha aqui, na resolução do config — nunca
+            // cai em silêncio para tabelas sem schema.
+            const db = await app.container.make('lucid.db').catch(() => null);
+            if (db)
+                assertSchemaSupported(authkitTablesClient(db, tablesContext), tablesSchema);
+        }
         const AdapterClass = await config.adapter.resolver(app, tablesContext);
         // `session.adapter` ausente ⇒ mesma classe do default (back-compat: o
         // dispatcher vira identidade e tudo continua no adapter único de hoje).
@@ -310,12 +321,17 @@ export function defineConfig(config) {
                     store: 'tmp/authkit_jwks.json',
                 }
             : config.jwks;
-        // Keystore no Lucid sem conexão própria fica na conexão das tabelas do authkit.
+        // Keystore no Lucid sem conexão/schema próprios fica onde estão as tabelas do authkit.
         const jwksStore = jwksInput.store;
-        const jwksConfig = jwksStore?.driver === 'lucid' && !jwksStore.connection && config.schema?.connection
+        const jwksConfig = jwksStore?.driver === 'lucid' &&
+            ((!jwksStore.connection && config.schema?.connection) || (!jwksStore.schema && tablesSchema))
             ? {
                 ...jwksInput,
-                store: { ...jwksStore, connection: config.schema.connection },
+                store: {
+                    ...jwksStore,
+                    connection: jwksStore.connection ?? config.schema?.connection,
+                    schema: jwksStore.schema ?? tablesSchema,
+                },
             }
             : jwksInput;
         if (config.jwks === 'auto' && !process.env.AUTHKIT_JWKS) {
@@ -504,6 +520,7 @@ export function defineConfig(config) {
             schema: {
                 autoManage: config.schema?.autoManage !== false,
                 connection: config.schema?.connection,
+                name: tablesSchema,
             },
             // OPT-IN: default false → caminho síncrono de sempre (byte-idêntico).
             accountLifecycle: {

package/build/src/doctor/agora_checks.js

@@ -134,6 +134,19 @@ export function authkitDoctorChecks() {
             const { managedSigningKeyAgeFinding } = await import('./doctor_input.js');
             return toResults(await managedSigningKeyAgeFinding(app, input.authkitConfig));
         },
+    }, {
+        id: 'authkit.db-schema',
+        lib: 'authkit',
+        package: AUTHKIT_DOCTOR_PACKAGE,
+        title: 'Database schema',
+        cost: 'deep',
+        async run(app) {
+            const { input, notBooted } = await prepare(app);
+            if (notBooted || !input?.authkitConfig?.schema?.name)
+                return [];
+            const { dbSchemaResults } = await import('./db_schema_check.js');
+            return dbSchemaResults(input.authkitConfig, () => app.container.make('lucid.db'), AUTHKIT_DOCTOR_DOCS);
+        },
     }, {
         id: 'authkit.console-gate',
         lib: 'authkit',

package/build/src/doctor/checks.d.ts

@@ -27,6 +27,11 @@ export interface DoctorInput {
      * Provided by the doctor command; undefined = not checked (doctor runs old version).
      */
     settingsTablePresent?: boolean;
+    /**
+     * The app's `config('shield')` (only its `csrf` block is read). `null` = no shield config;
+     * `undefined` = not collected (the CSRF check then cannot tell, and says so).
+     */
+    shieldConfig?: Record<string, any> | null;
     /**
      * Classes de adapter para detecção de volatilidade (injetadas pelo doctor command
      * em runtime). Quando ausente, o check de volatilidade usa heurística conservadora.
@@ -71,7 +76,32 @@ export declare function checkAccountStore(input: DoctorInput): Finding[];
 export declare function checkAccountStoreColumns(input: DoctorInput): Finding[];
 /** session provider configurado + warn se cookie store com tokenSets grandes. */
 export declare function checkSession(input: DoctorInput): Finding[];
-/** Hint de exceções de CSRF do shield para o mountPath. */
+/** A POST endpoint authkit mounts that is called without a browser CSRF token. */
+export interface CsrfExemptEndpoint {
+    /** A concrete request path (what `ctx.request.url()` returns). */
+    path: string;
+    /** The route pattern shield compares against an `exceptRoutes` array (`ctx.route.pattern`). */
+    pattern: string;
+}
+/**
+ * The server-to-server POST endpoints authkit mounts, which shield's CSRF check must not reject:
+ * the OIDC provider's token, introspection and revocation endpoints (under the `${mountPath}/*`
+ * wildcard route), PAT introspection, and — with `personalAgents` on — the agents' OAuth
+ * endpoints plus every extension's `csrfExemptPaths`.
+ */
+export declare function authkitCsrfExemptEndpoints(authkitConfig: Record<string, any> | null): CsrfExemptEndpoint[];
+/**
+ * Whether shield's CSRF check (as configured in `config/shield.ts`) would reject a token-less POST
+ * to `endpoint`, mirroring `@adonisjs/shield`: CSRF off → no; a non-empty `methods` without POST →
+ * no (an empty or missing `methods` checks every method); `exceptRoutes` as a function → rejected
+ * unless it returns a truthy value for that request; as an array → rejected unless it holds the route
+ * pattern. `'unknown'` when the function throws on the probe context.
+ */
+export declare function csrfRejects(shieldConfig: Record<string, any> | null | undefined, endpoint: CsrfExemptEndpoint): boolean | 'unknown';
+/**
+ * `authkit.shield`: evaluates the app's real `config/shield.ts` against the server-to-server POST
+ * endpoints authkit mounts, and warns only about the ones shield would actually reject.
+ */
 export declare function checkShield(input: DoctorInput): Finding;
 /** ally só é necessário quando social está configurado. */
 export declare function checkAlly(input: DoctorInput): Finding;