@revealui/auth 0.4.10 → 0.5.1

package/dist/react/useSignIn.d.ts

@@ -19,7 +19,7 @@ export interface UseSignInResult {
     } | {
         success: false;
         requiresMfa: true;
-        mfaUserId: string;
+        mfaUserId?: string;
     }>;
     isLoading: boolean;
     error: Error | null;

package/dist/react/useSignIn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSignIn.d.ts","sourceRoot":"","sources":["../../src/react/useSignIn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAuCxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CACN,KAAK,EAAE,WAAW,KACf,OAAO,CACR;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAC7B;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAC3D,CAAC;IACF,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,IAAI,eAAe,CA2E3C"}
+{"version":3,"file":"useSignIn.d.ts","sourceRoot":"","sources":["../../src/react/useSignIn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAuCxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CACnC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAC7B;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAGhD;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAC5D,CAAC;IACF,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,IAAI,eAAe,CA+E3C"}

package/dist/react/useSignIn.js

@@ -94,13 +94,17 @@ export function useSignIn() {
                     code: errorData.code,
                 };
             }
-            // Check for MFA challenge before parsing as full success
+            // MFA challenge is HTTP 200 with { requiresMfa: true } and no `user`.
+            // The server may omit mfaUserId from the body (identity lives in the
+            // httpOnly mfa-pending cookie). Requiring mfaUserId here forced the
+            // success schema parse, which threw "expected object, received undefined"
+            // on `user` and locked MFA-enabled accounts out of the login UI.
             const jsonObj = json;
-            if (jsonObj.requiresMfa === true && typeof jsonObj.mfaUserId === 'string') {
+            if (jsonObj.requiresMfa === true) {
                 return {
                     success: false,
                     requiresMfa: true,
-                    mfaUserId: jsonObj.mfaUserId,
+                    ...(typeof jsonObj.mfaUserId === 'string' ? { mfaUserId: jsonObj.mfaUserId } : {}),
                 };
             }
             const successData = SignInSuccessResponseSchema.parse(json);

package/dist/server/audit-storage.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Audit storage boundary + signer composition — the ONE shared home (GAP-338).
+ *
+ * Moved here from `apps/server/src/lib/{audit-storage,audit-signer}.ts` so BOTH
+ * server processes (Hono api + Next.js admin) can swap the process-wide
+ * `@revealui/security` AuditSystem onto persistent storage. Before this move the
+ * boundary was stranded in apps/server, so every admin-process audit emit
+ * (including the GAP-334 login receipts wired through `audit-bridge.ts` in this
+ * package) landed in that process's default `InMemoryAuditStorage` and
+ * evaporated on restart. `@revealui/auth` is the home because it already sits
+ * above `@revealui/security`, `@revealui/db`, and `@revealui/core`, is consumed
+ * by both apps, and owns the auth→audit bridge whose emits this rescues.
+ *
+ * This is THE boundary between two audit models that intentionally differ
+ * (see docs/decisions/2026-07-12-audit-receipt-architecture.md §5):
+ *
+ *   - `@revealui/security` emits `AuditEvent` with severity
+ *     `low | medium | high | critical` (the request-middleware vocabulary).
+ *   - `@revealui/db` / `@revealui/ai` own `audit_log`, whose CHECK constraint
+ *     accepts only `info | warn | critical`. That model wins; the security
+ *     vocabulary is mapped here, at the boundary, so every emitted event lands
+ *     instead of being silently rejected by the constraint.
+ *
+ * Signing (GAP-355 Stage 3): the `DrizzleAuditStore` is built via
+ * `createAuditStore`, which injects the process-wide Ed25519 row signer. On a
+ * signing deployment every row lands with a `v1.ed25519` signature verifiable
+ * offline from the published public key; in dev/test (no key) rows stay honestly
+ * unsigned. `previous_signature` is never written (the hash chain is abandoned),
+ * which is what makes the two-writer topology (api + admin processes appending
+ * to one `audit_log`) safe: rows are independent, each signed at its own door
+ * with the same env-derived key. Ruled for GAP-338 — see the gap file.
+ */
+import type { AuditRowSignerFn, DrizzleAuditStoreOptions, DrizzleAuditStore as DrizzleAuditStoreType } from '@revealui/db';
+import type { Database } from '@revealui/db/client';
+import type { AuditEvent, AuditQuery, AuditSeverity, AuditStorage, AuditSystem } from '@revealui/security/server';
+/**
+ * The process-wide audit-row signer (composed once from `process.env`), or
+ * `undefined` in unsigned mode. Cached so the mode is resolved and logged
+ * exactly once per process (GAP-355 Stage 3, spec D5/D6: key present → SIGNING;
+ * absent → UNSIGNED, legal only in dev/test — a production signing deployment
+ * refuses to boot without the key).
+ */
+export declare function getAuditRowSigner(): AuditRowSignerFn | undefined;
+/**
+ * Construct a `DrizzleAuditStore` wired to the process-wide signer. Every audit
+ * writer builds its store through this helper so a row written through the one
+ * door on a signing deployment always carries a signature.
+ *
+ * @param options Optional store options (GAP-417 residual): pass `targetEnv`
+ *   from CLI writers that resolve a deployment target independent of NODE_ENV.
+ */
+export declare function createAuditStore(db: Database, options?: DrizzleAuditStoreOptions): DrizzleAuditStoreType;
+/** Test-only reset of the cached signer (re-reads env on next `getAuditRowSigner`). */
+export declare function __resetAuditSignerForTest(): void;
+/** DB-side severity vocabulary — matches the `audit_log_severity_check` constraint. */
+type DbSeverity = 'info' | 'warn' | 'critical';
+export declare function mapSeverityToDb(severity: AuditSeverity): DbSeverity;
+/**
+ * `AuditStorage` implementation backed by `DrizzleAuditStore`. Re-homes the
+ * row-storing responsibility onto `DrizzleAuditStore.append()` and keeps the
+ * security-model boundary mapping (severity + columns) here, so `@revealui/db`
+ * stays free of a dependency on the security package.
+ */
+export declare class DrizzleBackedAuditStorage implements AuditStorage {
+    private readonly store;
+    constructor(db: Database);
+    write(event: AuditEvent): Promise<void>;
+    query(query: AuditQuery): Promise<AuditEvent[]>;
+    count(query: AuditQuery): Promise<number>;
+}
+/**
+ * Synchronous env-parity assertion for the audit write path — GAP-355 Stage 1
+ * closure, owner-ruled 2026-07-17.
+ *
+ * A serving process installs audit storage but cannot always run the async
+ * round-trip self-test (serverless has no clean "refuse to serve" for a
+ * boot-time DB round trip). This asserts the audit path's ENV preconditions
+ * SYNCHRONOUSLY at the install point, so a deploy whose audit-critical env has
+ * diverged (a required var missing or empty) FAILS THE DEPLOY rather than
+ * serving with an audit sink that silently drops every row.
+ *
+ * Scope, honestly: this catches env-var ABSENCE/emptiness synchronously — which
+ * `installAuditStorage()` itself does not, because `getClient()` is a lazy pool
+ * factory, so a missing connection URL would otherwise surface only on the
+ * first write, at request time. It does NOT, and on serverless cannot, catch
+ * migration-state divergence (the `audit_log` table missing or misshapen on the
+ * target DB); that needs the write-read round trip of `auditStorageSelfTest`.
+ */
+export declare function assertAuditStorageEnv(env?: NodeJS.ProcessEnv): void;
+/**
+ * Swap the process-wide `audit` system onto persistent Postgres storage.
+ * Synchronous and side-effect-free at call time: `getClient()` is a lazy pool
+ * factory (no connection opened here), so this is safe to run on a serverless
+ * cold-start path. WITHOUT this call, audit events fall into the default
+ * `InMemoryAuditStorage` and evaporate on restart — which is exactly what
+ * happened to every admin-process emit before GAP-338.
+ *
+ * Call `assertAuditStorageEnv()` before this at each install site so a
+ * diverged-env deploy fails loudly instead of installing a store that can
+ * never write.
+ */
+export declare function installAuditStorage(): void;
+/**
+ * Boot-time round-trip self-test. Writes a synthetic audit event through the
+ * REAL installed path (AuditSystem → boundary → DrizzleAuditStore → audit_log)
+ * and reads it back. Throws if the round trip fails, so a runtime that cannot
+ * record agent actions REFUSES TO SERVE rather than silently dropping them
+ * (fail-closed integrity — ADR §2a).
+ *
+ * Uses `severity: 'low'` deliberately: that value would be rejected by the DB
+ * CHECK constraint if the boundary mapping regressed, so this exercises the
+ * exact defect Stage 1 fixes. A healthy audit path lets startup proceed.
+ *
+ * Runs on the long-running worker (once per deploy) and the dev boot path,
+ * where an async boot chain already exists and `process.exit(1)` gives
+ * "refuse to serve" clean semantics. It is NOT run on serverless cold-start
+ * paths, which stay free of per-invocation DB round-trips (storage is still
+ * installed there synchronously by `installAuditStorage()`).
+ */
+export declare function auditStorageSelfTest(auditSystem?: AuditSystem): Promise<void>;
+export {};
+//# sourceMappingURL=audit-storage.d.ts.map

package/dist/server/audit-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-storage.d.ts","sourceRoot":"","sources":["../../src/server/audit-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,IAAI,qBAAqB,EAC3C,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACZ,WAAW,EACZ,MAAM,2BAA2B,CAAC;AAWnC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,gBAAgB,GAAG,SAAS,CAgBhE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,OAAO,CAAC,EAAE,wBAAwB,GACjC,qBAAqB,CAEvB;AAED,uFAAuF;AACvF,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD;AAED,uFAAuF;AACvF,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAe/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,UAAU,CAEnE;AASD;;;;;GAKG;AACH,qBAAa,yBAA0B,YAAW,YAAY;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;gBAElC,EAAE,EAAE,QAAQ;IAOlB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BvC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IA4B/C,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;CAMhD;AAgCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CA0ChF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,GAAE,WAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB1F"}

package/dist/server/audit-storage.js

@@ -0,0 +1,298 @@
+/**
+ * Audit storage boundary + signer composition — the ONE shared home (GAP-338).
+ *
+ * Moved here from `apps/server/src/lib/{audit-storage,audit-signer}.ts` so BOTH
+ * server processes (Hono api + Next.js admin) can swap the process-wide
+ * `@revealui/security` AuditSystem onto persistent storage. Before this move the
+ * boundary was stranded in apps/server, so every admin-process audit emit
+ * (including the GAP-334 login receipts wired through `audit-bridge.ts` in this
+ * package) landed in that process's default `InMemoryAuditStorage` and
+ * evaporated on restart. `@revealui/auth` is the home because it already sits
+ * above `@revealui/security`, `@revealui/db`, and `@revealui/core`, is consumed
+ * by both apps, and owns the auth→audit bridge whose emits this rescues.
+ *
+ * This is THE boundary between two audit models that intentionally differ
+ * (see docs/decisions/2026-07-12-audit-receipt-architecture.md §5):
+ *
+ *   - `@revealui/security` emits `AuditEvent` with severity
+ *     `low | medium | high | critical` (the request-middleware vocabulary).
+ *   - `@revealui/db` / `@revealui/ai` own `audit_log`, whose CHECK constraint
+ *     accepts only `info | warn | critical`. That model wins; the security
+ *     vocabulary is mapped here, at the boundary, so every emitted event lands
+ *     instead of being silently rejected by the constraint.
+ *
+ * Signing (GAP-355 Stage 3): the `DrizzleAuditStore` is built via
+ * `createAuditStore`, which injects the process-wide Ed25519 row signer. On a
+ * signing deployment every row lands with a `v1.ed25519` signature verifiable
+ * offline from the published public key; in dev/test (no key) rows stay honestly
+ * unsigned. `previous_signature` is never written (the hash chain is abandoned),
+ * which is what makes the two-writer topology (api + admin processes appending
+ * to one `audit_log`) safe: rows are independent, each signed at its own door
+ * with the same env-derived key. Ruled for GAP-338 — see the gap file.
+ */
+import { randomUUID } from 'node:crypto';
+import { logger } from '@revealui/core/observability/logger';
+import { DrizzleAuditStore, getClient, hasDatabaseConnectionEnv } from '@revealui/db';
+import { audit, classifyAuditWriteFailure, createAuditRowSignerFromEnv, recordAuditWriteResult, } from '@revealui/security/server';
+let cachedSigner;
+let resolved = false;
+/**
+ * The process-wide audit-row signer (composed once from `process.env`), or
+ * `undefined` in unsigned mode. Cached so the mode is resolved and logged
+ * exactly once per process (GAP-355 Stage 3, spec D5/D6: key present → SIGNING;
+ * absent → UNSIGNED, legal only in dev/test — a production signing deployment
+ * refuses to boot without the key).
+ */
+export function getAuditRowSigner() {
+    if (!resolved) {
+        const { signer, mode, kid } = createAuditRowSignerFromEnv(process.env);
+        if (mode === 'signed') {
+            logger.info(`AUDIT SIGNING: ENABLED (alg=ed25519, kid=${kid})`);
+        }
+        else {
+            logger.warn('AUDIT SIGNING: DISABLED — audit rows will be written UNSIGNED (no ' +
+                'REVEALUI_AUDIT_SIGNING_KEY). Legal only in dev/test; a production signing ' +
+                'deployment refuses to boot without the key.');
+        }
+        cachedSigner = signer;
+        resolved = true;
+    }
+    return cachedSigner;
+}
+/**
+ * Construct a `DrizzleAuditStore` wired to the process-wide signer. Every audit
+ * writer builds its store through this helper so a row written through the one
+ * door on a signing deployment always carries a signature.
+ *
+ * @param options Optional store options (GAP-417 residual): pass `targetEnv`
+ *   from CLI writers that resolve a deployment target independent of NODE_ENV.
+ */
+export function createAuditStore(db, options) {
+    return new DrizzleAuditStore(db, getAuditRowSigner(), options);
+}
+/** Test-only reset of the cached signer (re-reads env on next `getAuditRowSigner`). */
+export function __resetAuditSignerForTest() {
+    cachedSigner = undefined;
+    resolved = false;
+}
+/**
+ * Severity mapping AT THE BOUNDARY (ADR §5). Total over the security
+ * vocabulary; every value lands in the DB CHECK vocabulary. Declared as a
+ * `Record<AuditSeverity, ...>` so the compiler rejects any future severity
+ * that is not mapped.
+ */
+const SEVERITY_TO_DB = {
+    low: 'info',
+    medium: 'warn',
+    high: 'critical',
+    critical: 'critical',
+};
+export function mapSeverityToDb(severity) {
+    return SEVERITY_TO_DB[severity];
+}
+/** Reverse map for reconstructing legacy rows written without a full payload. */
+const DB_TO_SEVERITY = {
+    info: 'low',
+    warn: 'medium',
+    critical: 'critical',
+};
+/**
+ * `AuditStorage` implementation backed by `DrizzleAuditStore`. Re-homes the
+ * row-storing responsibility onto `DrizzleAuditStore.append()` and keeps the
+ * security-model boundary mapping (severity + columns) here, so `@revealui/db`
+ * stays free of a dependency on the security package.
+ */
+export class DrizzleBackedAuditStorage {
+    store;
+    constructor(db) {
+        // createAuditStore injects the process-wide Ed25519 signer (GAP-355 Stage 3),
+        // so rows land signed on a signing deployment and NULL-signature in unsigned
+        // (dev/test) mode. The severity/column boundary mapping stays here.
+        this.store = createAuditStore(db);
+    }
+    async write(event) {
+        try {
+            // The injected signer (createAuditStore) signs the row at the door on a
+            // signing deployment; a signer failure makes append THROW (fail-closed),
+            // caught below and routed through the write-result rails.
+            await this.store.append({
+                id: event.id,
+                timestamp: new Date(event.timestamp),
+                eventType: event.type,
+                severity: mapSeverityToDb(event.severity),
+                agentId: event.actor.id,
+                payload: event,
+                policyViolations: [],
+            });
+            recordAuditWriteResult({ ok: true, eventId: event.id, eventType: event.type });
+        }
+        catch (err) {
+            recordAuditWriteResult({
+                ok: false,
+                reason: classifyAuditWriteFailure(err),
+                eventId: event.id,
+                eventType: event.type,
+            });
+            throw err;
+        }
+    }
+    async query(query) {
+        const dbSeverities = query.severity && query.severity.length > 0
+            ? [...new Set(query.severity.map(mapSeverityToDb))]
+            : undefined;
+        const entries = await this.store.query({
+            agentId: query.actorId,
+            eventTypes: query.types ? [...query.types] : undefined,
+            severity: dbSeverities,
+            startTime: query.startDate,
+            endTime: query.endDate,
+            limit: query.limit ?? 100,
+            offset: query.offset ?? 0,
+        });
+        return entries
+            .map((entry) => reconstructEvent(entry))
+            .filter((event) => {
+            if (query.resourceType && event.resource?.type !== query.resourceType)
+                return false;
+            if (query.resourceId && event.resource?.id !== query.resourceId)
+                return false;
+            if (query.result && query.result.length > 0 && !query.result.includes(event.result)) {
+                return false;
+            }
+            return true;
+        });
+    }
+    async count(query) {
+        // Count ignores pagination (matches InMemoryAuditStorage semantics). Query
+        // with an unbounded limit and count the post-filtered results.
+        const events = await this.query({ ...query, limit: Number.MAX_SAFE_INTEGER, offset: 0 });
+        return events.length;
+    }
+}
+/**
+ * Reconstruct the full `AuditEvent` from a stored row. The complete event is
+ * persisted in the `payload` column, so it round-trips exactly. Rows written
+ * before this adapter (or by another writer without a full-event payload) fall
+ * back to a column-derived event.
+ */
+function reconstructEvent(entry) {
+    const stored = entry.payload;
+    if (stored && typeof stored === 'object' && 'type' in stored) {
+        return stored;
+    }
+    return {
+        id: entry.id,
+        timestamp: entry.timestamp.toISOString(),
+        type: entry.eventType,
+        severity: DB_TO_SEVERITY[entry.severity] ?? 'low',
+        actor: { id: entry.agentId, type: 'system' },
+        action: entry.eventType,
+        result: 'success',
+        metadata: stored ?? undefined,
+    };
+}
+/**
+ * Synchronous env-parity assertion for the audit write path — GAP-355 Stage 1
+ * closure, owner-ruled 2026-07-17.
+ *
+ * A serving process installs audit storage but cannot always run the async
+ * round-trip self-test (serverless has no clean "refuse to serve" for a
+ * boot-time DB round trip). This asserts the audit path's ENV preconditions
+ * SYNCHRONOUSLY at the install point, so a deploy whose audit-critical env has
+ * diverged (a required var missing or empty) FAILS THE DEPLOY rather than
+ * serving with an audit sink that silently drops every row.
+ *
+ * Scope, honestly: this catches env-var ABSENCE/emptiness synchronously — which
+ * `installAuditStorage()` itself does not, because `getClient()` is a lazy pool
+ * factory, so a missing connection URL would otherwise surface only on the
+ * first write, at request time. It does NOT, and on serverless cannot, catch
+ * migration-state divergence (the `audit_log` table missing or misshapen on the
+ * target DB); that needs the write-read round trip of `auditStorageSelfTest`.
+ */
+export function assertAuditStorageEnv(env = process.env) {
+    // GAP-417 item 5: the predicate is OWNED by @revealui/db and matches
+    // getClient()'s resolution exactly (config url, then POSTGRES_URL /
+    // DATABASE_URL). The previous local triple also accepted DATABASE_HOST,
+    // which getClient() never consults — so the assert passed, the install then
+    // threw, and production silently kept the in-memory sink (proven in the
+    // #2161 re-review). Never re-inline this check.
+    if (!hasDatabaseConnectionEnv(env)) {
+        throw new Error('AUDIT STORAGE ENV PARITY FAILED: no usable database connection is configured ' +
+            '(set POSTGRES_URL or DATABASE_URL, or provide @revealui/config database.url), ' +
+            'so the audit write path cannot persist rows. Refusing to serve — an agent ' +
+            'action that cannot be recorded must not execute (fail-closed integrity, ' +
+            'docs/decisions/2026-07-12-audit-receipt-architecture.md §2a).');
+    }
+    // Signing key (GAP-355 Stage 3): a production signing deployment must have the
+    // Ed25519 key so rows land signed. Absence is a diverged-env deploy — fail it
+    // synchronously here (the serverless serving process's refuse-to-serve), the
+    // same rail the DB-connection check above uses. Full Ed25519 PKCS#8 parsing is
+    // done by validate-startup; this is the audit-owned presence parity check, so
+    // the contract cannot silently drift on one serving process. Dev/test
+    // (NODE_ENV !== 'production') runs unsigned by design and is exempt.
+    //
+    // GAP-417 items 1-2 (owner-countersigned 2026-07-25): SKIP_ENV_VALIDATION no
+    // longer exempts this check. The audit path has NO escape hatch — a
+    // production process that cannot sign must not boot, because unsigned rows
+    // are indistinguishable from tampering AND permanently stall anchor
+    // contiguity once the sweep filters them. SKIP still covers non-audit env
+    // validation elsewhere; it never buys an unsigned production audit log.
+    if (env.NODE_ENV === 'production') {
+        if (!env.REVEALUI_AUDIT_SIGNING_KEY) {
+            throw new Error('AUDIT STORAGE ENV PARITY FAILED: REVEALUI_AUDIT_SIGNING_KEY is not set on a ' +
+                'production deployment, so the audit write path cannot sign rows. Refusing to ' +
+                'serve — an unsigned row in the post-Stage-3 era is indistinguishable from ' +
+                'tampering (docs/decisions/2026-07-12-audit-receipt-architecture.md §2a). ' +
+                'SKIP_ENV_VALIDATION does not exempt the audit path (GAP-417).');
+        }
+    }
+}
+/**
+ * Swap the process-wide `audit` system onto persistent Postgres storage.
+ * Synchronous and side-effect-free at call time: `getClient()` is a lazy pool
+ * factory (no connection opened here), so this is safe to run on a serverless
+ * cold-start path. WITHOUT this call, audit events fall into the default
+ * `InMemoryAuditStorage` and evaporate on restart — which is exactly what
+ * happened to every admin-process emit before GAP-338.
+ *
+ * Call `assertAuditStorageEnv()` before this at each install site so a
+ * diverged-env deploy fails loudly instead of installing a store that can
+ * never write.
+ */
+export function installAuditStorage() {
+    audit.setStorage(new DrizzleBackedAuditStorage(getClient()));
+}
+/**
+ * Boot-time round-trip self-test. Writes a synthetic audit event through the
+ * REAL installed path (AuditSystem → boundary → DrizzleAuditStore → audit_log)
+ * and reads it back. Throws if the round trip fails, so a runtime that cannot
+ * record agent actions REFUSES TO SERVE rather than silently dropping them
+ * (fail-closed integrity — ADR §2a).
+ *
+ * Uses `severity: 'low'` deliberately: that value would be rejected by the DB
+ * CHECK constraint if the boundary mapping regressed, so this exercises the
+ * exact defect Stage 1 fixes. A healthy audit path lets startup proceed.
+ *
+ * Runs on the long-running worker (once per deploy) and the dev boot path,
+ * where an async boot chain already exists and `process.exit(1)` gives
+ * "refuse to serve" clean semantics. It is NOT run on serverless cold-start
+ * paths, which stay free of per-invocation DB round-trips (storage is still
+ * installed there synchronously by `installAuditStorage()`).
+ */
+export async function auditStorageSelfTest(auditSystem = audit) {
+    const marker = `__audit-self-test__:${randomUUID()}`;
+    const written = await auditSystem.log({
+        type: 'security.audit_self_test',
+        severity: 'low',
+        actor: { id: marker, type: 'system' },
+        action: 'audit-storage-self-test',
+        result: 'success',
+        metadata: { synthetic: true },
+    });
+    const found = await auditSystem.query({ actorId: marker, limit: 5 });
+    if (!found.some((event) => event.id === written.id)) {
+        throw new Error('AUDIT STORAGE SELF-TEST FAILED: wrote a synthetic audit event but could not read it ' +
+            'back. Refusing to serve — a runtime that cannot record agent actions must not accept ' +
+            'traffic (fail-closed integrity, docs/decisions/2026-07-12-audit-receipt-architecture.md §2a).');
+    }
+}

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AAUpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CAyLvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAqOvB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AAWpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CA0PvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAyOvB"}

package/dist/server/auth.js

@@ -12,6 +12,7 @@ import { and, eq, isNull } from 'drizzle-orm';
 import { auditLoginFailure, auditLoginSuccess } from './audit-bridge.js';
 import { clearFailedAttempts, isAccountLocked, recordFailedAttempt } from './brute-force.js';
 import { validatePasswordStrength } from './password-validation.js';
+import { ensureAccountOwnerPlatformAdmin } from './platform-roles.js';
 import { checkRateLimit } from './rate-limit.js';
 import { createSession, rotateSession } from './session.js';
 /** Grace period after signup during which unverified users can still sign in (24 hours) */
@@ -26,9 +27,27 @@ const EMAIL_VERIFICATION_GRACE_PERIOD_MS = 24 * 60 * 60 * 1000;
  */
 export async function signIn(email, password, options) {
     try {
-        // Rate limiting by IP address
+        // Rate limiting by IP address. The storage backend (DatabaseStorage in
+        // production) can throw for reasons unrelated to the credential check
+        // itself (pool exhaustion, a transaction-pooling quirk, a storage
+        // misconfiguration) — guard it like every other DB-touching step below so
+        // a throw here fails closed with a diagnosable reason instead of falling
+        // through to the generic outer catch.
         const ipKey = options?.ipAddress || 'unknown';
-        const rateLimit = await checkRateLimit(`signin:${ipKey}`);
+        let rateLimit;
+        try {
+            rateLimit = await checkRateLimit(`signin:${ipKey}`);
+        }
+        catch (rateLimitError) {
+            logger.error('Error checking rate limit', rateLimitError instanceof Error ? rateLimitError : undefined, {
+                message: rateLimitError instanceof Error ? rateLimitError.message : String(rateLimitError),
+            });
+            return {
+                success: false,
+                reason: 'database_error',
+                error: 'Database error',
+            };
+        }
         if (!rateLimit.allowed) {
             return {
                 success: false,
@@ -36,8 +55,23 @@ export async function signIn(email, password, options) {
                 error: 'Too many login attempts. Please try again later.',
             };
         }
-        // Brute force protection by email
-        const bruteForceCheck = await isAccountLocked(email);
+        // Brute force protection by email. Same rationale as the rate-limit
+        // guard above — the storage backend can throw independently of whether
+        // the account is actually locked.
+        let bruteForceCheck;
+        try {
+            bruteForceCheck = await isAccountLocked(email);
+        }
+        catch (lockCheckError) {
+            logger.error('Error checking account lock status', lockCheckError instanceof Error ? lockCheckError : undefined, {
+                message: lockCheckError instanceof Error ? lockCheckError.message : String(lockCheckError),
+            });
+            return {
+                success: false,
+                reason: 'database_error',
+                error: 'Database error',
+            };
+        }
         if (bruteForceCheck.locked) {
             const lockMinutes = bruteForceCheck.lockUntil
                 ? Math.ceil((bruteForceCheck.lockUntil - Date.now()) / (60 * 1000))
@@ -118,11 +152,27 @@ export async function signIn(email, password, options) {
         if (!isValid) {
             return failInvalidCredentials();
         }
-        // Successful login - clear failed attempts
-        await clearFailedAttempts(email);
-        // Check email verification (with grace period for new accounts)
+        // Successful login - clear failed attempts. Best-effort: this is
+        // bookkeeping on an already-successful credential check, not a gate, so a
+        // storage hiccup here must not fail an otherwise-valid login (it can only
+        // make a future lockout trigger slightly sooner, never bypass one).
+        try {
+            await clearFailedAttempts(email);
+        }
+        catch (clearAttemptsError) {
+            logger.error('Error clearing failed attempts after successful login', clearAttemptsError instanceof Error ? clearAttemptsError : undefined, {
+                message: clearAttemptsError instanceof Error
+                    ? clearAttemptsError.message
+                    : String(clearAttemptsError),
+            });
+        }
+        // Check email verification (with grace period for new accounts).
+        // Coerce createdAt: the Postgres storage path returns timestamps as strings
+        // (not Date objects), so calling .getTime() directly threw a TypeError that
+        // fell through to the outer catch and turned a valid login into a generic
+        // "unexpected error" on real deploys. new Date() accepts a Date or a string.
         if (!user.emailVerified) {
-            const accountAge = Date.now() - user.createdAt.getTime();
+            const accountAge = Date.now() - new Date(user.createdAt).getTime();
             if (accountAge > EMAIL_VERIFICATION_GRACE_PERIOD_MS) {
                 return {
                     success: false,
@@ -177,8 +227,12 @@ export async function signIn(email, password, options) {
             sessionToken: token,
         };
     }
-    catch {
-        logger.error('Unexpected error in signIn');
+    catch (err) {
+        logger.error('Unexpected error in signIn', err instanceof Error ? err : undefined, {
+            message: err instanceof Error ? err.message : String(err),
+            name: err instanceof Error ? err.name : 'unknown',
+            stack: err instanceof Error ? err.stack : undefined,
+        });
         return {
             success: false,
             reason: 'unexpected_error',
@@ -422,6 +476,10 @@ export async function signUp(email, password, name, options) {
                     createdAt: now,
                     updatedAt: now,
                 });
+                // First membership owner of a hosted account gets platform shell
+                // admin (users.role), not super-admin. Unlocks /settings + API keys
+                // without granting fleet control-plane power.
+                await ensureAccountOwnerPlatformAdmin(db, user.id);
             }
             catch {
                 logger.error('Failed to provision personal account at signup (billing webhook will backfill)', undefined, { userId: user.id });

package/dist/server/index.d.ts

@@ -21,10 +21,12 @@ export { configurePasskey, countUserCredentials, deletePasskey, generateAuthenti
 export type { ChangePasswordResult, PasswordResetResult, PasswordResetToken, } from './password-reset.js';
 export { changePassword, generatePasswordResetToken, invalidatePasswordResetToken, resetPasswordWithToken, validatePasswordResetToken, } from './password-reset.js';
 export { meetsMinimumPasswordRequirements, validatePasswordStrength, } from './password-validation.js';
+export { ensureAccountOwnerPlatformAdmin, isPlatformShellAdminRole, PLATFORM_SHELL_ADMIN_COOKIE_ROLES, PLATFORM_SHELL_ADMIN_ROLES, platformRoleForAccountOwner, } from './platform-roles.js';
 export { checkRateLimit, configureRateLimit, getRateLimitStatus, resetRateLimit, resetRateLimitConfig, } from './rate-limit.js';
 export type { RequestContext, SessionBindingConfig, SessionData } from './session.js';
 export { configureSessionBinding, createSession, deleteAllUserSessions, deleteOtherUserSessions, deleteSession, getSession, isRecoverySession, resetSessionBindingConfig, rotateSession, validateSessionBinding, } from './session.js';
 export { signCookiePayload, verifyCookiePayload } from './signed-cookie.js';
+export { type BuildOidcAuthorizationUrlInput, type BuildSamlAuthorizeUrlFailureReason, type BuildSamlAuthorizeUrlResult, buildOidcAuthorizationUrl, buildSamlAuthorizeUrl, buildSamlSpMetadata, createOidcRemoteJwkSet, type ExchangeOidcCodeFailureReason, type ExchangeOidcCodeInput, type ExchangeOidcCodeResult, type ExchangeOidcCodeSuccess, exchangeOidcCode, extractGroupsFromClaim, type FetchOidcDiscoveryOptions, type FetchOidcDiscoveryResult, fetchIdpMetadata, fetchOidcDiscovery, type GenerateSsoStateInput, type GenerateSsoStateResult, generateSsoState, type JWTPayload, type JWTVerifyGetKey, type KeyLike, type MapSsoGroupsFailureReason, type MapSsoGroupsInput, type MapSsoGroupsResult, mapSsoGroupsToRole, normalizeIdpCertPem, normalizeSsoUserRole, type OidcDiscoveryDocument, type OidcDiscoveryFailureReason, type ParseIdpMetadataFailureReason, type ParseIdpMetadataResult, parseIdpMetadataXml, type SamlSpConfig, type SsoStatePayload, type UpsertSsoUserInput, upsertSsoUser, type ValidatedIdTokenClaims, type ValidatedSamlAssertion, type ValidateIdTokenFailureReason, type ValidateIdTokenResult, type ValidateOidcIdTokenOptions, type ValidateSamlResponseFailureReason, type ValidateSamlResponseResult, type VerifiedSsoState, validateOidcIdToken, validateSamlPostResponse, verifySsoState, } from './sso/index.js';
 export type { Storage } from './storage/index.js';
 export { createStorage, DatabaseStorage, getStorage, InMemoryStorage, resetStorage, } from './storage/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,+BAA+B,EAC/B,6BAA6B,EAC7B,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,aAAa,EACb,eAAe,EACf,UAAU,EACV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,+BAA+B,EAC/B,6BAA6B,EAC7B,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,EACxB,iCAAiC,EACjC,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,EACL,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,aAAa,EACb,eAAe,EACf,UAAU,EACV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -6,6 +6,12 @@
  */
 // Audit bridge
 export { auditAccountLocked, auditLoginFailure, auditLoginSuccess, auditMfaDisabled, auditMfaEnabled, auditPasswordChange, auditPasswordReset, auditSessionRevoked, } from './audit-bridge.js';
+// NOTE (GAP-338): the audit storage boundary lives at the DEDICATED subpath
+// `@revealui/auth/audit-storage`, deliberately NOT re-exported from this
+// barrel. `@revealui/auth/server` is the fleet's most-mocked module (route
+// tests bare-mock it for getSession), and a bare vi.mock of this barrel must
+// never swallow the audit write path (it broke the GAP-352 + mcp-endpoint
+// integration suites when the boundary briefly lived here).
 export { isSignupAllowed, signIn, signUp } from './auth.js';
 export { clearFailedAttempts, configureBruteForce, getFailedAttemptCount, isAccountLocked, recordFailedAttempt, resetBruteForceConfig, } from './brute-force.js';
 export { AuthError, AuthenticationError, DatabaseError, OAuthAccountConflictError, SessionError, TokenError, } from './errors.js';
@@ -16,8 +22,11 @@ export { buildAuthUrl, exchangeCode, fetchProviderUser, generateOAuthState, getL
 export { configurePasskey, countUserCredentials, deletePasskey, generateAuthenticationChallenge, generateRegistrationChallenge, listPasskeys, renamePasskey, resetPasskeyConfig, storePasskey, verifyAuthentication, verifyRegistration, } from './passkey.js';
 export { changePassword, generatePasswordResetToken, invalidatePasswordResetToken, resetPasswordWithToken, validatePasswordResetToken, } from './password-reset.js';
 export { meetsMinimumPasswordRequirements, validatePasswordStrength, } from './password-validation.js';
+export { ensureAccountOwnerPlatformAdmin, isPlatformShellAdminRole, PLATFORM_SHELL_ADMIN_COOKIE_ROLES, PLATFORM_SHELL_ADMIN_ROLES, platformRoleForAccountOwner, } from './platform-roles.js';
 export { checkRateLimit, configureRateLimit, getRateLimitStatus, resetRateLimit, resetRateLimitConfig, } from './rate-limit.js';
 export { configureSessionBinding, createSession, deleteAllUserSessions, deleteOtherUserSessions, deleteSession, getSession, isRecoverySession, resetSessionBindingConfig, rotateSession, validateSessionBinding, } from './session.js';
 // Signed Cookie
 export { signCookiePayload, verifyCookiePayload } from './signed-cookie.js';
+// Enterprise SSO pure layer (GAP-464) — OIDC + SAML SP helpers
+export { buildOidcAuthorizationUrl, buildSamlAuthorizeUrl, buildSamlSpMetadata, createOidcRemoteJwkSet, exchangeOidcCode, extractGroupsFromClaim, fetchIdpMetadata, fetchOidcDiscovery, generateSsoState, mapSsoGroupsToRole, normalizeIdpCertPem, normalizeSsoUserRole, parseIdpMetadataXml, upsertSsoUser, validateOidcIdToken, validateSamlPostResponse, verifySsoState, } from './sso/index.js';
 export { createStorage, DatabaseStorage, getStorage, InMemoryStorage, resetStorage, } from './storage/index.js';