@revealui/auth 0.4.6 → 0.4.7

package/dist/react/useSignIn.d.ts

@@ -15,6 +15,7 @@ export interface UseSignInResult {
     } | {
         success: false;
         error: string;
+        code?: string;
     } | {
         success: false;
         requiresMfa: true;

package/dist/react/useSignIn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSignIn.d.ts","sourceRoot":"","sources":["../../src/react/useSignIn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAkCxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CACN,KAAK,EAAE,WAAW,KACf,OAAO,CACR;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAC7B;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACjC;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAC3D,CAAC;IACF,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,IAAI,eAAe,CAsE3C"}
+{"version":3,"file":"useSignIn.d.ts","sourceRoot":"","sources":["../../src/react/useSignIn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAuCxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CACN,KAAK,EAAE,WAAW,KACf,OAAO,CACR;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAC7B;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAC3D,CAAC;IACF,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,IAAI,eAAe,CA2E3C"}

package/dist/react/useSignIn.js

@@ -27,9 +27,14 @@ const SignInUserSchema = z
 function toUser(validated) {
     return validated;
 }
-// Validation schemas for sign-in response
+// Validation schemas for sign-in response. The error body carries both a
+// human-readable `message` and a machine `code` (see createApplicationErrorResponseData
+// in @revealui/core); `error` mirrors the code. All optional so a terse body
+// still parses.
 const SignInErrorResponseSchema = z.object({
     error: z.string().optional(),
+    message: z.string().optional(),
+    code: z.string().optional(),
 });
 const SignInSuccessResponseSchema = z.object({
     user: SignInUserSchema,
@@ -79,9 +84,14 @@ export function useSignIn() {
             const json = await response.json();
             if (!response.ok) {
                 const errorData = SignInErrorResponseSchema.parse(json);
+                // Prefer the human-readable `message` for display; fall back to the
+                // machine `error` code, then a generic default. `code` (e.g.
+                // 'EMAIL_NOT_VERIFIED') lets callers branch — e.g. offer a
+                // resend-verification action — without string-matching display copy.
                 return {
                     success: false,
-                    error: errorData.error || 'Failed to sign in',
+                    error: errorData.message || errorData.error || 'Failed to sign in',
+                    code: errorData.code,
                 };
             }
             // Check for MFA challenge before parsing as full success

package/dist/server/audit-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-bridge.d.ts","sourceRoot":"","sources":["../../src/server/audit-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgCH;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASnF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjF;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/E;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf"}
+{"version":3,"file":"audit-bridge.d.ts","sourceRoot":"","sources":["../../src/server/audit-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAyCH;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASnF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjF;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/E;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/server/audit-bridge.js

@@ -5,6 +5,7 @@
  * via the AuditSystem from @revealui/security/server. Uses lazy import to
  * avoid circular dependency issues at module load time.
  */
+import { logger } from '@revealui/core/observability/logger';
 /**
  * Lazily resolve the global audit system from @revealui/security/server.
  * Returns null if the module cannot be loaded (e.g. in test environments
@@ -20,15 +21,24 @@ async function getAudit() {
     }
 }
 /**
- * Internal helper  -  logs an audit event, silently skipping if the
- * audit system is unavailable.
+ * Internal helper  -  logs an audit event best-effort. Silently skips when the
+ * audit system is unavailable, and swallows (but logs) a write failure so the
+ * operation being audited  -  e.g. a login  -  never fails because its audit
+ * record could not be persisted.
  */
 async function logAuditEvent(event) {
     const auditSystem = await getAudit();
     if (!auditSystem) {
         return;
     }
-    await auditSystem.log(event);
+    try {
+        await auditSystem.log(event);
+    }
+    catch (error) {
+        logger.error('Failed to write audit event', error instanceof Error ? error : undefined, {
+            type: event.type,
+        });
+    }
 }
 /**
  * Record a successful login to the audit trail.

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AASpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CAiLvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAgMvB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AAUpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CAyLvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAoOvB"}

package/dist/server/auth.js

@@ -6,9 +6,10 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { logger } from '@revealui/core/observability/logger';
 import { getClient } from '@revealui/db/client';
-import { oauthAccounts, users } from '@revealui/db/schema';
+import { accountMemberships, accounts, oauthAccounts, users } from '@revealui/db/schema';
 import bcrypt from 'bcryptjs';
 import { and, eq, isNull } from 'drizzle-orm';
+import { auditLoginFailure, auditLoginSuccess } from './audit-bridge.js';
 import { clearFailedAttempts, isAccountLocked, recordFailedAttempt } from './brute-force.js';
 import { validatePasswordStrength } from './password-validation.js';
 import { checkRateLimit } from './rate-limit.js';
@@ -85,22 +86,25 @@ export async function signIn(email, password, options) {
         }
         // Always return same error message to prevent user enumeration
         const invalidCredentialsMessage = 'Invalid email or password';
-        if (!user) {
+        // Record a failed credential attempt: bump the brute-force counter AND
+        // land a failed-login receipt in the audit trail. recordFailedAttempt only
+        // feeds lockout accounting; without the audit emit a failed sign-in leaves
+        // no receipt. auditLoginFailure is best-effort and never throws.
+        const failInvalidCredentials = async () => {
             await recordFailedAttempt(email);
+            await auditLoginFailure(email, options?.ipAddress ?? 'unknown', options?.userAgent ?? 'unknown', 'invalid_credentials');
             return {
                 success: false,
                 reason: 'invalid_credentials',
                 error: invalidCredentialsMessage,
             };
+        };
+        if (!user) {
+            return failInvalidCredentials();
         }
         // Check if user has a password (not OAuth-only user)
         if (!user.password) {
-            await recordFailedAttempt(email);
-            return {
-                success: false,
-                reason: 'invalid_credentials',
-                error: invalidCredentialsMessage,
-            };
+            return failInvalidCredentials();
         }
         // Verify password hash
         let isValid;
@@ -109,20 +113,10 @@ export async function signIn(email, password, options) {
         }
         catch {
             logger.error('Error comparing password');
-            await recordFailedAttempt(email);
-            return {
-                success: false,
-                reason: 'invalid_credentials',
-                error: invalidCredentialsMessage,
-            };
+            return failInvalidCredentials();
         }
         if (!isValid) {
-            await recordFailedAttempt(email);
-            return {
-                success: false,
-                reason: 'invalid_credentials',
-                error: invalidCredentialsMessage,
-            };
+            return failInvalidCredentials();
         }
         // Successful login - clear failed attempts
         await clearFailedAttempts(email);
@@ -164,6 +158,10 @@ export async function signIn(email, password, options) {
                 error: 'Failed to create session',
             };
         }
+        // A fresh session was minted: the login succeeded. Land a success receipt
+        // in the audit trail (best-effort; auditLoginSuccess never throws, so an
+        // audit-write failure cannot fail the login).
+        await auditLoginSuccess(user.id, options?.ipAddress ?? 'unknown', options?.userAgent ?? 'unknown');
         // Check if password rotation is required (e.g., bootstrapped admin accounts)
         if (user.mustRotatePassword) {
             return {
@@ -396,6 +394,38 @@ export async function signUp(email, password, name, options) {
                 error: 'Failed to create session',
             };
         }
+        // Provision a personal billing account + owner membership so a hosted tenant
+        // exists from signup. Best-effort: the Stripe billing webhook
+        // (ensureHostedAccount) is idempotent on an active membership and backfills
+        // this if it fails here, so a transient error never blocks signup. Skipped on
+        // self-hosted (Forge) deployments — single-tenant, no per-user accounts (mode
+        // detected by the license signing key, as in apps/server validate-startup).
+        if (process.env.REVEALUI_LICENSE_PRIVATE_KEY) {
+            try {
+                const accountId = crypto.randomUUID();
+                const now = new Date();
+                await db.insert(accounts).values({
+                    id: accountId,
+                    name: `${user.name || 'RevealUI'} Workspace`,
+                    slug: `acct-${accountId}`,
+                    status: 'active',
+                    createdAt: now,
+                    updatedAt: now,
+                });
+                await db.insert(accountMemberships).values({
+                    id: crypto.randomUUID(),
+                    accountId,
+                    userId: user.id,
+                    role: 'owner',
+                    status: 'active',
+                    createdAt: now,
+                    updatedAt: now,
+                });
+            }
+            catch {
+                logger.error('Failed to provision personal account at signup (billing webhook will backfill)', undefined, { userId: user.id });
+            }
+        }
         // Return the raw (unhashed) token so the caller can include it in the
         // verification email link. The DB holds only the hash.
         const userWithRawToken = { ...user, emailVerificationToken: rawEmailVerificationToken };

package/dist/server/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAQjD,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;CACzB;AAUD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAEtF;AAED,qCAAqC;AACrC,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CA0B3F;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAI1E;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAkH7B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAmE9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoC9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA+BtE;AAED;;;;GAIG;AACH;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBzE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAQjD,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;CACzB;AAaD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAEtF;AAED,qCAAqC;AACrC,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CA0B3F;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAI1E;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAgI7B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAmE9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoC9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA+BtE;AAED;;;;GAIG;AACH;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBzE"}

package/dist/server/session.js

@@ -15,6 +15,8 @@ const DEFAULT_SESSION_BINDING = {
     enforceIp: false,
     warnOnIpChange: true,
 };
+/** Minimum interval between users.lastActiveAt writes for a given user. */
+const LAST_ACTIVE_THROTTLE_MS = 60 * 60 * 1000;
 let sessionBindingConfig = { ...DEFAULT_SESSION_BINDING };
 /** Override session binding behaviour (useful for tests or strict deployments). */
 export function configureSessionBinding(overrides) {
@@ -169,6 +171,19 @@ export async function getSession(headers, requestContext) {
             // Log but don't fail - last activity update is not critical
             logger.warn('Error updating last activity');
         }
+        // Throttled users.lastActiveAt writer  -  fire-and-forget, never awaited,
+        // so auth latency is unaffected. Only touches the row when the stored
+        // value is null or older than the throttle window, keeping write volume
+        // to roughly one row-update per active user per hour instead of one per
+        // request.
+        if (!user.lastActiveAt || Date.now() - user.lastActiveAt.getTime() > LAST_ACTIVE_THROTTLE_MS) {
+            db.update(users)
+                .set({ lastActiveAt: new Date() })
+                .where(eq(users.id, user.id))
+                .catch(() => {
+                logger.warn('Error updating user lastActiveAt');
+            });
+        }
         return {
             session,
             user,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/auth",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Database-backed session auth for Hono and Next.js — bcrypt, OAuth, brute-force protection, rate limiting, password reset. Ships with RevealUI.",
   "keywords": [
     "auth",
@@ -10,26 +10,26 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@simplewebauthn/server": "^13.3.1",
+    "@simplewebauthn/server": "^13.3.2",
     "bcryptjs": "^3.0.3",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@revealui/config": "0.4.3",
-    "@revealui/contracts": "0.6.1",
-    "@revealui/core": "0.10.2",
-    "@revealui/db": "0.7.2",
-    "@revealui/security": "0.4.1"
+    "@revealui/config": "0.5.0",
+    "@revealui/contracts": "0.6.2",
+    "@revealui/core": "0.11.0",
+    "@revealui/db": "0.7.3",
+    "@revealui/security": "0.4.2"
   },
   "devDependencies": {
     "@simplewebauthn/browser": "^13.3.0",
     "@testing-library/react": "^16.3.2",
-    "@types/node": "^25.9.1",
+    "@types/node": "^25.9.4",
     "@types/react": "^19.2.17",
-    "@vitest/coverage-v8": "^4.1.8",
-    "happy-dom": "^20.10.3",
+    "@vitest/coverage-v8": "^4.1.10",
+    "happy-dom": "^20.10.6",
     "react": "^19.2.7",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.8",
+    "vitest": "^4.1.10",
     "@revealui/dev": "0.1.0"
   },
   "engines": {