@revealui/auth 0.4.10 → 0.5.0

package/dist/server/audit-storage.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Audit storage boundary + signer composition — the ONE shared home (GAP-338).
+ *
+ * Moved here from `apps/server/src/lib/{audit-storage,audit-signer}.ts` so BOTH
+ * server processes (Hono api + Next.js admin) can swap the process-wide
+ * `@revealui/security` AuditSystem onto persistent storage. Before this move the
+ * boundary was stranded in apps/server, so every admin-process audit emit
+ * (including the GAP-334 login receipts wired through `audit-bridge.ts` in this
+ * package) landed in that process's default `InMemoryAuditStorage` and
+ * evaporated on restart. `@revealui/auth` is the home because it already sits
+ * above `@revealui/security`, `@revealui/db`, and `@revealui/core`, is consumed
+ * by both apps, and owns the auth→audit bridge whose emits this rescues.
+ *
+ * This is THE boundary between two audit models that intentionally differ
+ * (see docs/decisions/2026-07-12-audit-receipt-architecture.md §5):
+ *
+ *   - `@revealui/security` emits `AuditEvent` with severity
+ *     `low | medium | high | critical` (the request-middleware vocabulary).
+ *   - `@revealui/db` / `@revealui/ai` own `audit_log`, whose CHECK constraint
+ *     accepts only `info | warn | critical`. That model wins; the security
+ *     vocabulary is mapped here, at the boundary, so every emitted event lands
+ *     instead of being silently rejected by the constraint.
+ *
+ * Signing (GAP-355 Stage 3): the `DrizzleAuditStore` is built via
+ * `createAuditStore`, which injects the process-wide Ed25519 row signer. On a
+ * signing deployment every row lands with a `v1.ed25519` signature verifiable
+ * offline from the published public key; in dev/test (no key) rows stay honestly
+ * unsigned. `previous_signature` is never written (the hash chain is abandoned),
+ * which is what makes the two-writer topology (api + admin processes appending
+ * to one `audit_log`) safe: rows are independent, each signed at its own door
+ * with the same env-derived key. Ruled for GAP-338 — see the gap file.
+ */
+import type { AuditRowSignerFn, DrizzleAuditStore as DrizzleAuditStoreType } from '@revealui/db';
+import type { Database } from '@revealui/db/client';
+import type { AuditEvent, AuditQuery, AuditSeverity, AuditStorage, AuditSystem } from '@revealui/security/server';
+/**
+ * The process-wide audit-row signer (composed once from `process.env`), or
+ * `undefined` in unsigned mode. Cached so the mode is resolved and logged
+ * exactly once per process (GAP-355 Stage 3, spec D5/D6: key present → SIGNING;
+ * absent → UNSIGNED, legal only in dev/test — a production signing deployment
+ * refuses to boot without the key).
+ */
+export declare function getAuditRowSigner(): AuditRowSignerFn | undefined;
+/**
+ * Construct a `DrizzleAuditStore` wired to the process-wide signer. Every audit
+ * writer builds its store through this helper so a row written through the one
+ * door on a signing deployment always carries a signature.
+ */
+export declare function createAuditStore(db: Database): DrizzleAuditStoreType;
+/** Test-only reset of the cached signer (re-reads env on next `getAuditRowSigner`). */
+export declare function __resetAuditSignerForTest(): void;
+/** DB-side severity vocabulary — matches the `audit_log_severity_check` constraint. */
+type DbSeverity = 'info' | 'warn' | 'critical';
+export declare function mapSeverityToDb(severity: AuditSeverity): DbSeverity;
+/**
+ * `AuditStorage` implementation backed by `DrizzleAuditStore`. Re-homes the
+ * row-storing responsibility onto `DrizzleAuditStore.append()` and keeps the
+ * security-model boundary mapping (severity + columns) here, so `@revealui/db`
+ * stays free of a dependency on the security package.
+ */
+export declare class DrizzleBackedAuditStorage implements AuditStorage {
+    private readonly store;
+    constructor(db: Database);
+    write(event: AuditEvent): Promise<void>;
+    query(query: AuditQuery): Promise<AuditEvent[]>;
+    count(query: AuditQuery): Promise<number>;
+}
+/**
+ * Synchronous env-parity assertion for the audit write path — GAP-355 Stage 1
+ * closure, owner-ruled 2026-07-17.
+ *
+ * A serving process installs audit storage but cannot always run the async
+ * round-trip self-test (serverless has no clean "refuse to serve" for a
+ * boot-time DB round trip). This asserts the audit path's ENV preconditions
+ * SYNCHRONOUSLY at the install point, so a deploy whose audit-critical env has
+ * diverged (a required var missing or empty) FAILS THE DEPLOY rather than
+ * serving with an audit sink that silently drops every row.
+ *
+ * Scope, honestly: this catches env-var ABSENCE/emptiness synchronously — which
+ * `installAuditStorage()` itself does not, because `getClient()` is a lazy pool
+ * factory, so a missing connection URL would otherwise surface only on the
+ * first write, at request time. It does NOT, and on serverless cannot, catch
+ * migration-state divergence (the `audit_log` table missing or misshapen on the
+ * target DB); that needs the write-read round trip of `auditStorageSelfTest`.
+ */
+export declare function assertAuditStorageEnv(env?: NodeJS.ProcessEnv): void;
+/**
+ * Swap the process-wide `audit` system onto persistent Postgres storage.
+ * Synchronous and side-effect-free at call time: `getClient()` is a lazy pool
+ * factory (no connection opened here), so this is safe to run on a serverless
+ * cold-start path. WITHOUT this call, audit events fall into the default
+ * `InMemoryAuditStorage` and evaporate on restart — which is exactly what
+ * happened to every admin-process emit before GAP-338.
+ *
+ * Call `assertAuditStorageEnv()` before this at each install site so a
+ * diverged-env deploy fails loudly instead of installing a store that can
+ * never write.
+ */
+export declare function installAuditStorage(): void;
+/**
+ * Boot-time round-trip self-test. Writes a synthetic audit event through the
+ * REAL installed path (AuditSystem → boundary → DrizzleAuditStore → audit_log)
+ * and reads it back. Throws if the round trip fails, so a runtime that cannot
+ * record agent actions REFUSES TO SERVE rather than silently dropping them
+ * (fail-closed integrity — ADR §2a).
+ *
+ * Uses `severity: 'low'` deliberately: that value would be rejected by the DB
+ * CHECK constraint if the boundary mapping regressed, so this exercises the
+ * exact defect Stage 1 fixes. A healthy audit path lets startup proceed.
+ *
+ * Runs on the long-running worker (once per deploy) and the dev boot path,
+ * where an async boot chain already exists and `process.exit(1)` gives
+ * "refuse to serve" clean semantics. It is NOT run on serverless cold-start
+ * paths, which stay free of per-invocation DB round-trips (storage is still
+ * installed there synchronously by `installAuditStorage()`).
+ */
+export declare function auditStorageSelfTest(auditSystem?: AuditSystem): Promise<void>;
+export {};
+//# sourceMappingURL=audit-storage.d.ts.map

package/dist/server/audit-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-storage.d.ts","sourceRoot":"","sources":["../../src/server/audit-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,IAAI,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEjG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACZ,WAAW,EACZ,MAAM,2BAA2B,CAAC;AAWnC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,gBAAgB,GAAG,SAAS,CAgBhE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,qBAAqB,CAEpE;AAED,uFAAuF;AACvF,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD;AAED,uFAAuF;AACvF,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAe/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,UAAU,CAEnE;AASD;;;;;GAKG;AACH,qBAAa,yBAA0B,YAAW,YAAY;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;gBAElC,EAAE,EAAE,QAAQ;IAOlB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BvC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IA4B/C,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;CAMhD;AAgCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CA0ChF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,GAAE,WAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB1F"}

package/dist/server/audit-storage.js

@@ -0,0 +1,295 @@
+/**
+ * Audit storage boundary + signer composition — the ONE shared home (GAP-338).
+ *
+ * Moved here from `apps/server/src/lib/{audit-storage,audit-signer}.ts` so BOTH
+ * server processes (Hono api + Next.js admin) can swap the process-wide
+ * `@revealui/security` AuditSystem onto persistent storage. Before this move the
+ * boundary was stranded in apps/server, so every admin-process audit emit
+ * (including the GAP-334 login receipts wired through `audit-bridge.ts` in this
+ * package) landed in that process's default `InMemoryAuditStorage` and
+ * evaporated on restart. `@revealui/auth` is the home because it already sits
+ * above `@revealui/security`, `@revealui/db`, and `@revealui/core`, is consumed
+ * by both apps, and owns the auth→audit bridge whose emits this rescues.
+ *
+ * This is THE boundary between two audit models that intentionally differ
+ * (see docs/decisions/2026-07-12-audit-receipt-architecture.md §5):
+ *
+ *   - `@revealui/security` emits `AuditEvent` with severity
+ *     `low | medium | high | critical` (the request-middleware vocabulary).
+ *   - `@revealui/db` / `@revealui/ai` own `audit_log`, whose CHECK constraint
+ *     accepts only `info | warn | critical`. That model wins; the security
+ *     vocabulary is mapped here, at the boundary, so every emitted event lands
+ *     instead of being silently rejected by the constraint.
+ *
+ * Signing (GAP-355 Stage 3): the `DrizzleAuditStore` is built via
+ * `createAuditStore`, which injects the process-wide Ed25519 row signer. On a
+ * signing deployment every row lands with a `v1.ed25519` signature verifiable
+ * offline from the published public key; in dev/test (no key) rows stay honestly
+ * unsigned. `previous_signature` is never written (the hash chain is abandoned),
+ * which is what makes the two-writer topology (api + admin processes appending
+ * to one `audit_log`) safe: rows are independent, each signed at its own door
+ * with the same env-derived key. Ruled for GAP-338 — see the gap file.
+ */
+import { randomUUID } from 'node:crypto';
+import { logger } from '@revealui/core/observability/logger';
+import { DrizzleAuditStore, getClient, hasDatabaseConnectionEnv } from '@revealui/db';
+import { audit, classifyAuditWriteFailure, createAuditRowSignerFromEnv, recordAuditWriteResult, } from '@revealui/security/server';
+let cachedSigner;
+let resolved = false;
+/**
+ * The process-wide audit-row signer (composed once from `process.env`), or
+ * `undefined` in unsigned mode. Cached so the mode is resolved and logged
+ * exactly once per process (GAP-355 Stage 3, spec D5/D6: key present → SIGNING;
+ * absent → UNSIGNED, legal only in dev/test — a production signing deployment
+ * refuses to boot without the key).
+ */
+export function getAuditRowSigner() {
+    if (!resolved) {
+        const { signer, mode, kid } = createAuditRowSignerFromEnv(process.env);
+        if (mode === 'signed') {
+            logger.info(`AUDIT SIGNING: ENABLED (alg=ed25519, kid=${kid})`);
+        }
+        else {
+            logger.warn('AUDIT SIGNING: DISABLED — audit rows will be written UNSIGNED (no ' +
+                'REVEALUI_AUDIT_SIGNING_KEY). Legal only in dev/test; a production signing ' +
+                'deployment refuses to boot without the key.');
+        }
+        cachedSigner = signer;
+        resolved = true;
+    }
+    return cachedSigner;
+}
+/**
+ * Construct a `DrizzleAuditStore` wired to the process-wide signer. Every audit
+ * writer builds its store through this helper so a row written through the one
+ * door on a signing deployment always carries a signature.
+ */
+export function createAuditStore(db) {
+    return new DrizzleAuditStore(db, getAuditRowSigner());
+}
+/** Test-only reset of the cached signer (re-reads env on next `getAuditRowSigner`). */
+export function __resetAuditSignerForTest() {
+    cachedSigner = undefined;
+    resolved = false;
+}
+/**
+ * Severity mapping AT THE BOUNDARY (ADR §5). Total over the security
+ * vocabulary; every value lands in the DB CHECK vocabulary. Declared as a
+ * `Record<AuditSeverity, ...>` so the compiler rejects any future severity
+ * that is not mapped.
+ */
+const SEVERITY_TO_DB = {
+    low: 'info',
+    medium: 'warn',
+    high: 'critical',
+    critical: 'critical',
+};
+export function mapSeverityToDb(severity) {
+    return SEVERITY_TO_DB[severity];
+}
+/** Reverse map for reconstructing legacy rows written without a full payload. */
+const DB_TO_SEVERITY = {
+    info: 'low',
+    warn: 'medium',
+    critical: 'critical',
+};
+/**
+ * `AuditStorage` implementation backed by `DrizzleAuditStore`. Re-homes the
+ * row-storing responsibility onto `DrizzleAuditStore.append()` and keeps the
+ * security-model boundary mapping (severity + columns) here, so `@revealui/db`
+ * stays free of a dependency on the security package.
+ */
+export class DrizzleBackedAuditStorage {
+    store;
+    constructor(db) {
+        // createAuditStore injects the process-wide Ed25519 signer (GAP-355 Stage 3),
+        // so rows land signed on a signing deployment and NULL-signature in unsigned
+        // (dev/test) mode. The severity/column boundary mapping stays here.
+        this.store = createAuditStore(db);
+    }
+    async write(event) {
+        try {
+            // The injected signer (createAuditStore) signs the row at the door on a
+            // signing deployment; a signer failure makes append THROW (fail-closed),
+            // caught below and routed through the write-result rails.
+            await this.store.append({
+                id: event.id,
+                timestamp: new Date(event.timestamp),
+                eventType: event.type,
+                severity: mapSeverityToDb(event.severity),
+                agentId: event.actor.id,
+                payload: event,
+                policyViolations: [],
+            });
+            recordAuditWriteResult({ ok: true, eventId: event.id, eventType: event.type });
+        }
+        catch (err) {
+            recordAuditWriteResult({
+                ok: false,
+                reason: classifyAuditWriteFailure(err),
+                eventId: event.id,
+                eventType: event.type,
+            });
+            throw err;
+        }
+    }
+    async query(query) {
+        const dbSeverities = query.severity && query.severity.length > 0
+            ? [...new Set(query.severity.map(mapSeverityToDb))]
+            : undefined;
+        const entries = await this.store.query({
+            agentId: query.actorId,
+            eventTypes: query.types ? [...query.types] : undefined,
+            severity: dbSeverities,
+            startTime: query.startDate,
+            endTime: query.endDate,
+            limit: query.limit ?? 100,
+            offset: query.offset ?? 0,
+        });
+        return entries
+            .map((entry) => reconstructEvent(entry))
+            .filter((event) => {
+            if (query.resourceType && event.resource?.type !== query.resourceType)
+                return false;
+            if (query.resourceId && event.resource?.id !== query.resourceId)
+                return false;
+            if (query.result && query.result.length > 0 && !query.result.includes(event.result)) {
+                return false;
+            }
+            return true;
+        });
+    }
+    async count(query) {
+        // Count ignores pagination (matches InMemoryAuditStorage semantics). Query
+        // with an unbounded limit and count the post-filtered results.
+        const events = await this.query({ ...query, limit: Number.MAX_SAFE_INTEGER, offset: 0 });
+        return events.length;
+    }
+}
+/**
+ * Reconstruct the full `AuditEvent` from a stored row. The complete event is
+ * persisted in the `payload` column, so it round-trips exactly. Rows written
+ * before this adapter (or by another writer without a full-event payload) fall
+ * back to a column-derived event.
+ */
+function reconstructEvent(entry) {
+    const stored = entry.payload;
+    if (stored && typeof stored === 'object' && 'type' in stored) {
+        return stored;
+    }
+    return {
+        id: entry.id,
+        timestamp: entry.timestamp.toISOString(),
+        type: entry.eventType,
+        severity: DB_TO_SEVERITY[entry.severity] ?? 'low',
+        actor: { id: entry.agentId, type: 'system' },
+        action: entry.eventType,
+        result: 'success',
+        metadata: stored ?? undefined,
+    };
+}
+/**
+ * Synchronous env-parity assertion for the audit write path — GAP-355 Stage 1
+ * closure, owner-ruled 2026-07-17.
+ *
+ * A serving process installs audit storage but cannot always run the async
+ * round-trip self-test (serverless has no clean "refuse to serve" for a
+ * boot-time DB round trip). This asserts the audit path's ENV preconditions
+ * SYNCHRONOUSLY at the install point, so a deploy whose audit-critical env has
+ * diverged (a required var missing or empty) FAILS THE DEPLOY rather than
+ * serving with an audit sink that silently drops every row.
+ *
+ * Scope, honestly: this catches env-var ABSENCE/emptiness synchronously — which
+ * `installAuditStorage()` itself does not, because `getClient()` is a lazy pool
+ * factory, so a missing connection URL would otherwise surface only on the
+ * first write, at request time. It does NOT, and on serverless cannot, catch
+ * migration-state divergence (the `audit_log` table missing or misshapen on the
+ * target DB); that needs the write-read round trip of `auditStorageSelfTest`.
+ */
+export function assertAuditStorageEnv(env = process.env) {
+    // GAP-417 item 5: the predicate is OWNED by @revealui/db and matches
+    // getClient()'s resolution exactly (config url, then POSTGRES_URL /
+    // DATABASE_URL). The previous local triple also accepted DATABASE_HOST,
+    // which getClient() never consults — so the assert passed, the install then
+    // threw, and production silently kept the in-memory sink (proven in the
+    // #2161 re-review). Never re-inline this check.
+    if (!hasDatabaseConnectionEnv(env)) {
+        throw new Error('AUDIT STORAGE ENV PARITY FAILED: no usable database connection is configured ' +
+            '(set POSTGRES_URL or DATABASE_URL, or provide @revealui/config database.url), ' +
+            'so the audit write path cannot persist rows. Refusing to serve — an agent ' +
+            'action that cannot be recorded must not execute (fail-closed integrity, ' +
+            'docs/decisions/2026-07-12-audit-receipt-architecture.md §2a).');
+    }
+    // Signing key (GAP-355 Stage 3): a production signing deployment must have the
+    // Ed25519 key so rows land signed. Absence is a diverged-env deploy — fail it
+    // synchronously here (the serverless serving process's refuse-to-serve), the
+    // same rail the DB-connection check above uses. Full Ed25519 PKCS#8 parsing is
+    // done by validate-startup; this is the audit-owned presence parity check, so
+    // the contract cannot silently drift on one serving process. Dev/test
+    // (NODE_ENV !== 'production') runs unsigned by design and is exempt.
+    //
+    // GAP-417 items 1-2 (owner-countersigned 2026-07-25): SKIP_ENV_VALIDATION no
+    // longer exempts this check. The audit path has NO escape hatch — a
+    // production process that cannot sign must not boot, because unsigned rows
+    // are indistinguishable from tampering AND permanently stall anchor
+    // contiguity once the sweep filters them. SKIP still covers non-audit env
+    // validation elsewhere; it never buys an unsigned production audit log.
+    if (env.NODE_ENV === 'production') {
+        if (!env.REVEALUI_AUDIT_SIGNING_KEY) {
+            throw new Error('AUDIT STORAGE ENV PARITY FAILED: REVEALUI_AUDIT_SIGNING_KEY is not set on a ' +
+                'production deployment, so the audit write path cannot sign rows. Refusing to ' +
+                'serve — an unsigned row in the post-Stage-3 era is indistinguishable from ' +
+                'tampering (docs/decisions/2026-07-12-audit-receipt-architecture.md §2a). ' +
+                'SKIP_ENV_VALIDATION does not exempt the audit path (GAP-417).');
+        }
+    }
+}
+/**
+ * Swap the process-wide `audit` system onto persistent Postgres storage.
+ * Synchronous and side-effect-free at call time: `getClient()` is a lazy pool
+ * factory (no connection opened here), so this is safe to run on a serverless
+ * cold-start path. WITHOUT this call, audit events fall into the default
+ * `InMemoryAuditStorage` and evaporate on restart — which is exactly what
+ * happened to every admin-process emit before GAP-338.
+ *
+ * Call `assertAuditStorageEnv()` before this at each install site so a
+ * diverged-env deploy fails loudly instead of installing a store that can
+ * never write.
+ */
+export function installAuditStorage() {
+    audit.setStorage(new DrizzleBackedAuditStorage(getClient()));
+}
+/**
+ * Boot-time round-trip self-test. Writes a synthetic audit event through the
+ * REAL installed path (AuditSystem → boundary → DrizzleAuditStore → audit_log)
+ * and reads it back. Throws if the round trip fails, so a runtime that cannot
+ * record agent actions REFUSES TO SERVE rather than silently dropping them
+ * (fail-closed integrity — ADR §2a).
+ *
+ * Uses `severity: 'low'` deliberately: that value would be rejected by the DB
+ * CHECK constraint if the boundary mapping regressed, so this exercises the
+ * exact defect Stage 1 fixes. A healthy audit path lets startup proceed.
+ *
+ * Runs on the long-running worker (once per deploy) and the dev boot path,
+ * where an async boot chain already exists and `process.exit(1)` gives
+ * "refuse to serve" clean semantics. It is NOT run on serverless cold-start
+ * paths, which stay free of per-invocation DB round-trips (storage is still
+ * installed there synchronously by `installAuditStorage()`).
+ */
+export async function auditStorageSelfTest(auditSystem = audit) {
+    const marker = `__audit-self-test__:${randomUUID()}`;
+    const written = await auditSystem.log({
+        type: 'security.audit_self_test',
+        severity: 'low',
+        actor: { id: marker, type: 'system' },
+        action: 'audit-storage-self-test',
+        result: 'success',
+        metadata: { synthetic: true },
+    });
+    const found = await auditSystem.query({ actorId: marker, limit: 5 });
+    if (!found.some((event) => event.id === written.id)) {
+        throw new Error('AUDIT STORAGE SELF-TEST FAILED: wrote a synthetic audit event but could not read it ' +
+            'back. Refusing to serve — a runtime that cannot record agent actions must not accept ' +
+            'traffic (fail-closed integrity, docs/decisions/2026-07-12-audit-receipt-architecture.md §2a).');
+    }
+}

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,+BAA+B,EAC/B,6BAA6B,EAC7B,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,aAAa,EACb,eAAe,EACf,UAAU,EACV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,+BAA+B,EAC/B,6BAA6B,EAC7B,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,aAAa,EACb,eAAe,EACf,UAAU,EACV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -6,6 +6,12 @@
  */
 // Audit bridge
 export { auditAccountLocked, auditLoginFailure, auditLoginSuccess, auditMfaDisabled, auditMfaEnabled, auditPasswordChange, auditPasswordReset, auditSessionRevoked, } from './audit-bridge.js';
+// NOTE (GAP-338): the audit storage boundary lives at the DEDICATED subpath
+// `@revealui/auth/audit-storage`, deliberately NOT re-exported from this
+// barrel. `@revealui/auth/server` is the fleet's most-mocked module (route
+// tests bare-mock it for getSession), and a bare vi.mock of this barrel must
+// never swallow the audit write path (it broke the GAP-352 + mcp-endpoint
+// integration suites when the boundary briefly lived here).
 export { isSignupAllowed, signIn, signUp } from './auth.js';
 export { clearFailedAttempts, configureBruteForce, getFailedAttemptCount, isAccountLocked, recordFailedAttempt, resetBruteForceConfig, } from './brute-force.js';
 export { AuthError, AuthenticationError, DatabaseError, OAuthAccountConflictError, SessionError, TokenError, } from './errors.js';

package/dist/utils/database.d.ts

@@ -18,7 +18,7 @@ export declare function getTestDatabaseUrl(): string;
 /**
  * Creates a test database client
  */
-export declare function createTestDatabaseClient(): import("@revealui/db/client").Database;
+export declare function createTestDatabaseClient(): import("@revealui/db").DatabaseClient;
 /**
  * Cleans up test data from database
  */

package/dist/utils/database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/utils/database.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAU3C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,2CAMvC;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBtE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B7E;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CASxE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAStF;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAC7B,gBAAgB,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAClC,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAI3C"}
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/utils/database.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAU3C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,0CAMvC;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBtE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B7E;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CASxE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAStF;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAC7B,gBAAgB,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAClC,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAI3C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/auth",
-  "version": "0.4.10",
+  "version": "0.5.0",
   "description": "Database-backed session auth for Hono and Next.js — bcrypt, OAuth, brute-force protection, rate limiting, password reset. Ships with RevealUI.",
   "keywords": [
     "auth",
@@ -16,9 +16,9 @@
     "zod": "^4.4.3",
     "@revealui/config": "0.6.0",
     "@revealui/contracts": "0.8.1",
-    "@revealui/core": "0.12.1",
-    "@revealui/db": "0.9.0",
-    "@revealui/security": "0.5.1"
+    "@revealui/core": "0.12.2",
+    "@revealui/db": "0.10.0",
+    "@revealui/security": "0.6.0"
   },
   "devDependencies": {
     "@simplewebauthn/browser": "^13.3.0",
@@ -46,6 +46,11 @@
       "import": "./dist/server/index.js",
       "default": "./dist/server/index.js"
     },
+    "./audit-storage": {
+      "types": "./dist/server/audit-storage.d.ts",
+      "import": "./dist/server/audit-storage.js",
+      "default": "./dist/server/audit-storage.js"
+    },
     "./react": {
       "types": "./dist/react/index.d.ts",
       "import": "./dist/react/index.js",