@revealui/auth 0.4.9 → 0.5.0

package/dist/react/csrf.d.ts

@@ -1,17 +1,10 @@
 /**
  * CSRF Double-Submit Token Helper
  *
- * Shared by the react auth hooks (`usePasskey`, `useMFA`, `useSignOut`) whose
- * POSTs target the RevealUI admin proxy's CSRF-gated endpoints.
+ * Re-exports the canonical browser cookie reader from
+ * `@revealui/core/admin/utils/csrf` (fleet-redundancy P2-C). Shared by the
+ * react auth hooks (`usePasskey`, `useMFA`, `useSignOut`) whose POSTs target
+ * the RevealUI admin proxy's CSRF-gated endpoints.
  */
-/**
- * Read the JS-readable `revealui-csrf` cookie. The RevealUI admin proxy
- * (`apps/admin/src/proxy.ts`) requires it as an `X-CSRF-Token` header on any
- * session-cookie-bearing unsafe request, and may re-issue the cookie on any
- * response — so call this immediately before each fetch rather than once per
- * flow. Returns undefined outside the browser or when the cookie is
- * absent/empty. Mirrors the cookie-read in `@revealui/core`'s admin APIClient
- * (`request()`) and `@revealui/ai`'s `useAgentStream`.
- */
-export declare function readCsrfToken(): string | undefined;
+export { readCsrfToken } from '@revealui/core/admin/utils/csrf';
 //# sourceMappingURL=csrf.d.ts.map

package/dist/react/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/react/csrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAgBlD"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/react/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/react/csrf.js

@@ -1,36 +1,9 @@
 /**
  * CSRF Double-Submit Token Helper
  *
- * Shared by the react auth hooks (`usePasskey`, `useMFA`, `useSignOut`) whose
- * POSTs target the RevealUI admin proxy's CSRF-gated endpoints.
+ * Re-exports the canonical browser cookie reader from
+ * `@revealui/core/admin/utils/csrf` (fleet-redundancy P2-C). Shared by the
+ * react auth hooks (`usePasskey`, `useMFA`, `useSignOut`) whose POSTs target
+ * the RevealUI admin proxy's CSRF-gated endpoints.
  */
-/**
- * Read the JS-readable `revealui-csrf` cookie. The RevealUI admin proxy
- * (`apps/admin/src/proxy.ts`) requires it as an `X-CSRF-Token` header on any
- * session-cookie-bearing unsafe request, and may re-issue the cookie on any
- * response — so call this immediately before each fetch rather than once per
- * flow. Returns undefined outside the browser or when the cookie is
- * absent/empty. Mirrors the cookie-read in `@revealui/core`'s admin APIClient
- * (`request()`) and `@revealui/ai`'s `useAgentStream`.
- */
-export function readCsrfToken() {
-    if (typeof document === 'undefined')
-        return undefined;
-    for (const part of document.cookie.split(';')) {
-        const eqIdx = part.indexOf('=');
-        if (eqIdx === -1)
-            continue;
-        if (part.slice(0, eqIdx).trim() === 'revealui-csrf') {
-            const raw = part.slice(eqIdx + 1).trim();
-            if (!raw)
-                return undefined;
-            try {
-                return decodeURIComponent(raw);
-            }
-            catch {
-                return raw;
-            }
-        }
-    }
-    return undefined;
-}
+export { readCsrfToken } from '@revealui/core/admin/utils/csrf';

package/dist/server/audit-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-bridge.d.ts","sourceRoot":"","sources":["../../src/server/audit-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAyCH;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASnF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjF;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/E;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf"}
+{"version":3,"file":"audit-bridge.d.ts","sourceRoot":"","sources":["../../src/server/audit-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2CH;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASnF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjF;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/E;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/server/audit-bridge.js

@@ -6,6 +6,7 @@
  * avoid circular dependency issues at module load time.
  */
 import { logger } from '@revealui/core/observability/logger';
+import { evaluateSecurityAlert } from './security-alerts.js';
 /**
  * Lazily resolve the global audit system from @revealui/security/server.
  * Returns null if the module cannot be loaded (e.g. in test environments
@@ -28,17 +29,18 @@ async function getAudit() {
  */
 async function logAuditEvent(event) {
     const auditSystem = await getAudit();
-    if (!auditSystem) {
-        return;
-    }
-    try {
-        await auditSystem.log(event);
-    }
-    catch (error) {
-        logger.error('Failed to write audit event', error instanceof Error ? error : undefined, {
-            type: event.type,
-        });
+    if (auditSystem) {
+        try {
+            await auditSystem.log(event);
+        }
+        catch (error) {
+            logger.error('Failed to write audit event', error instanceof Error ? error : undefined, {
+                type: event.type,
+            });
+        }
     }
+    // Threshold alerts (failed logins, MFA disable, lockouts, …) — C11 WIRE
+    await evaluateSecurityAlert(event);
 }
 /**
  * Record a successful login to the audit trail.

package/dist/server/audit-storage.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Audit storage boundary + signer composition — the ONE shared home (GAP-338).
+ *
+ * Moved here from `apps/server/src/lib/{audit-storage,audit-signer}.ts` so BOTH
+ * server processes (Hono api + Next.js admin) can swap the process-wide
+ * `@revealui/security` AuditSystem onto persistent storage. Before this move the
+ * boundary was stranded in apps/server, so every admin-process audit emit
+ * (including the GAP-334 login receipts wired through `audit-bridge.ts` in this
+ * package) landed in that process's default `InMemoryAuditStorage` and
+ * evaporated on restart. `@revealui/auth` is the home because it already sits
+ * above `@revealui/security`, `@revealui/db`, and `@revealui/core`, is consumed
+ * by both apps, and owns the auth→audit bridge whose emits this rescues.
+ *
+ * This is THE boundary between two audit models that intentionally differ
+ * (see docs/decisions/2026-07-12-audit-receipt-architecture.md §5):
+ *
+ *   - `@revealui/security` emits `AuditEvent` with severity
+ *     `low | medium | high | critical` (the request-middleware vocabulary).
+ *   - `@revealui/db` / `@revealui/ai` own `audit_log`, whose CHECK constraint
+ *     accepts only `info | warn | critical`. That model wins; the security
+ *     vocabulary is mapped here, at the boundary, so every emitted event lands
+ *     instead of being silently rejected by the constraint.
+ *
+ * Signing (GAP-355 Stage 3): the `DrizzleAuditStore` is built via
+ * `createAuditStore`, which injects the process-wide Ed25519 row signer. On a
+ * signing deployment every row lands with a `v1.ed25519` signature verifiable
+ * offline from the published public key; in dev/test (no key) rows stay honestly
+ * unsigned. `previous_signature` is never written (the hash chain is abandoned),
+ * which is what makes the two-writer topology (api + admin processes appending
+ * to one `audit_log`) safe: rows are independent, each signed at its own door
+ * with the same env-derived key. Ruled for GAP-338 — see the gap file.
+ */
+import type { AuditRowSignerFn, DrizzleAuditStore as DrizzleAuditStoreType } from '@revealui/db';
+import type { Database } from '@revealui/db/client';
+import type { AuditEvent, AuditQuery, AuditSeverity, AuditStorage, AuditSystem } from '@revealui/security/server';
+/**
+ * The process-wide audit-row signer (composed once from `process.env`), or
+ * `undefined` in unsigned mode. Cached so the mode is resolved and logged
+ * exactly once per process (GAP-355 Stage 3, spec D5/D6: key present → SIGNING;
+ * absent → UNSIGNED, legal only in dev/test — a production signing deployment
+ * refuses to boot without the key).
+ */
+export declare function getAuditRowSigner(): AuditRowSignerFn | undefined;
+/**
+ * Construct a `DrizzleAuditStore` wired to the process-wide signer. Every audit
+ * writer builds its store through this helper so a row written through the one
+ * door on a signing deployment always carries a signature.
+ */
+export declare function createAuditStore(db: Database): DrizzleAuditStoreType;
+/** Test-only reset of the cached signer (re-reads env on next `getAuditRowSigner`). */
+export declare function __resetAuditSignerForTest(): void;
+/** DB-side severity vocabulary — matches the `audit_log_severity_check` constraint. */
+type DbSeverity = 'info' | 'warn' | 'critical';
+export declare function mapSeverityToDb(severity: AuditSeverity): DbSeverity;
+/**
+ * `AuditStorage` implementation backed by `DrizzleAuditStore`. Re-homes the
+ * row-storing responsibility onto `DrizzleAuditStore.append()` and keeps the
+ * security-model boundary mapping (severity + columns) here, so `@revealui/db`
+ * stays free of a dependency on the security package.
+ */
+export declare class DrizzleBackedAuditStorage implements AuditStorage {
+    private readonly store;
+    constructor(db: Database);
+    write(event: AuditEvent): Promise<void>;
+    query(query: AuditQuery): Promise<AuditEvent[]>;
+    count(query: AuditQuery): Promise<number>;
+}
+/**
+ * Synchronous env-parity assertion for the audit write path — GAP-355 Stage 1
+ * closure, owner-ruled 2026-07-17.
+ *
+ * A serving process installs audit storage but cannot always run the async
+ * round-trip self-test (serverless has no clean "refuse to serve" for a
+ * boot-time DB round trip). This asserts the audit path's ENV preconditions
+ * SYNCHRONOUSLY at the install point, so a deploy whose audit-critical env has
+ * diverged (a required var missing or empty) FAILS THE DEPLOY rather than
+ * serving with an audit sink that silently drops every row.
+ *
+ * Scope, honestly: this catches env-var ABSENCE/emptiness synchronously — which
+ * `installAuditStorage()` itself does not, because `getClient()` is a lazy pool
+ * factory, so a missing connection URL would otherwise surface only on the
+ * first write, at request time. It does NOT, and on serverless cannot, catch
+ * migration-state divergence (the `audit_log` table missing or misshapen on the
+ * target DB); that needs the write-read round trip of `auditStorageSelfTest`.
+ */
+export declare function assertAuditStorageEnv(env?: NodeJS.ProcessEnv): void;
+/**
+ * Swap the process-wide `audit` system onto persistent Postgres storage.
+ * Synchronous and side-effect-free at call time: `getClient()` is a lazy pool
+ * factory (no connection opened here), so this is safe to run on a serverless
+ * cold-start path. WITHOUT this call, audit events fall into the default
+ * `InMemoryAuditStorage` and evaporate on restart — which is exactly what
+ * happened to every admin-process emit before GAP-338.
+ *
+ * Call `assertAuditStorageEnv()` before this at each install site so a
+ * diverged-env deploy fails loudly instead of installing a store that can
+ * never write.
+ */
+export declare function installAuditStorage(): void;
+/**
+ * Boot-time round-trip self-test. Writes a synthetic audit event through the
+ * REAL installed path (AuditSystem → boundary → DrizzleAuditStore → audit_log)
+ * and reads it back. Throws if the round trip fails, so a runtime that cannot
+ * record agent actions REFUSES TO SERVE rather than silently dropping them
+ * (fail-closed integrity — ADR §2a).
+ *
+ * Uses `severity: 'low'` deliberately: that value would be rejected by the DB
+ * CHECK constraint if the boundary mapping regressed, so this exercises the
+ * exact defect Stage 1 fixes. A healthy audit path lets startup proceed.
+ *
+ * Runs on the long-running worker (once per deploy) and the dev boot path,
+ * where an async boot chain already exists and `process.exit(1)` gives
+ * "refuse to serve" clean semantics. It is NOT run on serverless cold-start
+ * paths, which stay free of per-invocation DB round-trips (storage is still
+ * installed there synchronously by `installAuditStorage()`).
+ */
+export declare function auditStorageSelfTest(auditSystem?: AuditSystem): Promise<void>;
+export {};
+//# sourceMappingURL=audit-storage.d.ts.map

package/dist/server/audit-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-storage.d.ts","sourceRoot":"","sources":["../../src/server/audit-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,IAAI,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEjG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACZ,WAAW,EACZ,MAAM,2BAA2B,CAAC;AAWnC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,gBAAgB,GAAG,SAAS,CAgBhE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,qBAAqB,CAEpE;AAED,uFAAuF;AACvF,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD;AAED,uFAAuF;AACvF,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAe/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,UAAU,CAEnE;AASD;;;;;GAKG;AACH,qBAAa,yBAA0B,YAAW,YAAY;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;gBAElC,EAAE,EAAE,QAAQ;IAOlB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BvC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IA4B/C,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;CAMhD;AAgCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CA0ChF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,GAAE,WAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB1F"}

package/dist/server/audit-storage.js

@@ -0,0 +1,295 @@
+/**
+ * Audit storage boundary + signer composition — the ONE shared home (GAP-338).
+ *
+ * Moved here from `apps/server/src/lib/{audit-storage,audit-signer}.ts` so BOTH
+ * server processes (Hono api + Next.js admin) can swap the process-wide
+ * `@revealui/security` AuditSystem onto persistent storage. Before this move the
+ * boundary was stranded in apps/server, so every admin-process audit emit
+ * (including the GAP-334 login receipts wired through `audit-bridge.ts` in this
+ * package) landed in that process's default `InMemoryAuditStorage` and
+ * evaporated on restart. `@revealui/auth` is the home because it already sits
+ * above `@revealui/security`, `@revealui/db`, and `@revealui/core`, is consumed
+ * by both apps, and owns the auth→audit bridge whose emits this rescues.
+ *
+ * This is THE boundary between two audit models that intentionally differ
+ * (see docs/decisions/2026-07-12-audit-receipt-architecture.md §5):
+ *
+ *   - `@revealui/security` emits `AuditEvent` with severity
+ *     `low | medium | high | critical` (the request-middleware vocabulary).
+ *   - `@revealui/db` / `@revealui/ai` own `audit_log`, whose CHECK constraint
+ *     accepts only `info | warn | critical`. That model wins; the security
+ *     vocabulary is mapped here, at the boundary, so every emitted event lands
+ *     instead of being silently rejected by the constraint.
+ *
+ * Signing (GAP-355 Stage 3): the `DrizzleAuditStore` is built via
+ * `createAuditStore`, which injects the process-wide Ed25519 row signer. On a
+ * signing deployment every row lands with a `v1.ed25519` signature verifiable
+ * offline from the published public key; in dev/test (no key) rows stay honestly
+ * unsigned. `previous_signature` is never written (the hash chain is abandoned),
+ * which is what makes the two-writer topology (api + admin processes appending
+ * to one `audit_log`) safe: rows are independent, each signed at its own door
+ * with the same env-derived key. Ruled for GAP-338 — see the gap file.
+ */
+import { randomUUID } from 'node:crypto';
+import { logger } from '@revealui/core/observability/logger';
+import { DrizzleAuditStore, getClient, hasDatabaseConnectionEnv } from '@revealui/db';
+import { audit, classifyAuditWriteFailure, createAuditRowSignerFromEnv, recordAuditWriteResult, } from '@revealui/security/server';
+let cachedSigner;
+let resolved = false;
+/**
+ * The process-wide audit-row signer (composed once from `process.env`), or
+ * `undefined` in unsigned mode. Cached so the mode is resolved and logged
+ * exactly once per process (GAP-355 Stage 3, spec D5/D6: key present → SIGNING;
+ * absent → UNSIGNED, legal only in dev/test — a production signing deployment
+ * refuses to boot without the key).
+ */
+export function getAuditRowSigner() {
+    if (!resolved) {
+        const { signer, mode, kid } = createAuditRowSignerFromEnv(process.env);
+        if (mode === 'signed') {
+            logger.info(`AUDIT SIGNING: ENABLED (alg=ed25519, kid=${kid})`);
+        }
+        else {
+            logger.warn('AUDIT SIGNING: DISABLED — audit rows will be written UNSIGNED (no ' +
+                'REVEALUI_AUDIT_SIGNING_KEY). Legal only in dev/test; a production signing ' +
+                'deployment refuses to boot without the key.');
+        }
+        cachedSigner = signer;
+        resolved = true;
+    }
+    return cachedSigner;
+}
+/**
+ * Construct a `DrizzleAuditStore` wired to the process-wide signer. Every audit
+ * writer builds its store through this helper so a row written through the one
+ * door on a signing deployment always carries a signature.
+ */
+export function createAuditStore(db) {
+    return new DrizzleAuditStore(db, getAuditRowSigner());
+}
+/** Test-only reset of the cached signer (re-reads env on next `getAuditRowSigner`). */
+export function __resetAuditSignerForTest() {
+    cachedSigner = undefined;
+    resolved = false;
+}
+/**
+ * Severity mapping AT THE BOUNDARY (ADR §5). Total over the security
+ * vocabulary; every value lands in the DB CHECK vocabulary. Declared as a
+ * `Record<AuditSeverity, ...>` so the compiler rejects any future severity
+ * that is not mapped.
+ */
+const SEVERITY_TO_DB = {
+    low: 'info',
+    medium: 'warn',
+    high: 'critical',
+    critical: 'critical',
+};
+export function mapSeverityToDb(severity) {
+    return SEVERITY_TO_DB[severity];
+}
+/** Reverse map for reconstructing legacy rows written without a full payload. */
+const DB_TO_SEVERITY = {
+    info: 'low',
+    warn: 'medium',
+    critical: 'critical',
+};
+/**
+ * `AuditStorage` implementation backed by `DrizzleAuditStore`. Re-homes the
+ * row-storing responsibility onto `DrizzleAuditStore.append()` and keeps the
+ * security-model boundary mapping (severity + columns) here, so `@revealui/db`
+ * stays free of a dependency on the security package.
+ */
+export class DrizzleBackedAuditStorage {
+    store;
+    constructor(db) {
+        // createAuditStore injects the process-wide Ed25519 signer (GAP-355 Stage 3),
+        // so rows land signed on a signing deployment and NULL-signature in unsigned
+        // (dev/test) mode. The severity/column boundary mapping stays here.
+        this.store = createAuditStore(db);
+    }
+    async write(event) {
+        try {
+            // The injected signer (createAuditStore) signs the row at the door on a
+            // signing deployment; a signer failure makes append THROW (fail-closed),
+            // caught below and routed through the write-result rails.
+            await this.store.append({
+                id: event.id,
+                timestamp: new Date(event.timestamp),
+                eventType: event.type,
+                severity: mapSeverityToDb(event.severity),
+                agentId: event.actor.id,
+                payload: event,
+                policyViolations: [],
+            });
+            recordAuditWriteResult({ ok: true, eventId: event.id, eventType: event.type });
+        }
+        catch (err) {
+            recordAuditWriteResult({
+                ok: false,
+                reason: classifyAuditWriteFailure(err),
+                eventId: event.id,
+                eventType: event.type,
+            });
+            throw err;
+        }
+    }
+    async query(query) {
+        const dbSeverities = query.severity && query.severity.length > 0
+            ? [...new Set(query.severity.map(mapSeverityToDb))]
+            : undefined;
+        const entries = await this.store.query({
+            agentId: query.actorId,
+            eventTypes: query.types ? [...query.types] : undefined,
+            severity: dbSeverities,
+            startTime: query.startDate,
+            endTime: query.endDate,
+            limit: query.limit ?? 100,
+            offset: query.offset ?? 0,
+        });
+        return entries
+            .map((entry) => reconstructEvent(entry))
+            .filter((event) => {
+            if (query.resourceType && event.resource?.type !== query.resourceType)
+                return false;
+            if (query.resourceId && event.resource?.id !== query.resourceId)
+                return false;
+            if (query.result && query.result.length > 0 && !query.result.includes(event.result)) {
+                return false;
+            }
+            return true;
+        });
+    }
+    async count(query) {
+        // Count ignores pagination (matches InMemoryAuditStorage semantics). Query
+        // with an unbounded limit and count the post-filtered results.
+        const events = await this.query({ ...query, limit: Number.MAX_SAFE_INTEGER, offset: 0 });
+        return events.length;
+    }
+}
+/**
+ * Reconstruct the full `AuditEvent` from a stored row. The complete event is
+ * persisted in the `payload` column, so it round-trips exactly. Rows written
+ * before this adapter (or by another writer without a full-event payload) fall
+ * back to a column-derived event.
+ */
+function reconstructEvent(entry) {
+    const stored = entry.payload;
+    if (stored && typeof stored === 'object' && 'type' in stored) {
+        return stored;
+    }
+    return {
+        id: entry.id,
+        timestamp: entry.timestamp.toISOString(),
+        type: entry.eventType,
+        severity: DB_TO_SEVERITY[entry.severity] ?? 'low',
+        actor: { id: entry.agentId, type: 'system' },
+        action: entry.eventType,
+        result: 'success',
+        metadata: stored ?? undefined,
+    };
+}
+/**
+ * Synchronous env-parity assertion for the audit write path — GAP-355 Stage 1
+ * closure, owner-ruled 2026-07-17.
+ *
+ * A serving process installs audit storage but cannot always run the async
+ * round-trip self-test (serverless has no clean "refuse to serve" for a
+ * boot-time DB round trip). This asserts the audit path's ENV preconditions
+ * SYNCHRONOUSLY at the install point, so a deploy whose audit-critical env has
+ * diverged (a required var missing or empty) FAILS THE DEPLOY rather than
+ * serving with an audit sink that silently drops every row.
+ *
+ * Scope, honestly: this catches env-var ABSENCE/emptiness synchronously — which
+ * `installAuditStorage()` itself does not, because `getClient()` is a lazy pool
+ * factory, so a missing connection URL would otherwise surface only on the
+ * first write, at request time. It does NOT, and on serverless cannot, catch
+ * migration-state divergence (the `audit_log` table missing or misshapen on the
+ * target DB); that needs the write-read round trip of `auditStorageSelfTest`.
+ */
+export function assertAuditStorageEnv(env = process.env) {
+    // GAP-417 item 5: the predicate is OWNED by @revealui/db and matches
+    // getClient()'s resolution exactly (config url, then POSTGRES_URL /
+    // DATABASE_URL). The previous local triple also accepted DATABASE_HOST,
+    // which getClient() never consults — so the assert passed, the install then
+    // threw, and production silently kept the in-memory sink (proven in the
+    // #2161 re-review). Never re-inline this check.
+    if (!hasDatabaseConnectionEnv(env)) {
+        throw new Error('AUDIT STORAGE ENV PARITY FAILED: no usable database connection is configured ' +
+            '(set POSTGRES_URL or DATABASE_URL, or provide @revealui/config database.url), ' +
+            'so the audit write path cannot persist rows. Refusing to serve — an agent ' +
+            'action that cannot be recorded must not execute (fail-closed integrity, ' +
+            'docs/decisions/2026-07-12-audit-receipt-architecture.md §2a).');
+    }
+    // Signing key (GAP-355 Stage 3): a production signing deployment must have the
+    // Ed25519 key so rows land signed. Absence is a diverged-env deploy — fail it
+    // synchronously here (the serverless serving process's refuse-to-serve), the
+    // same rail the DB-connection check above uses. Full Ed25519 PKCS#8 parsing is
+    // done by validate-startup; this is the audit-owned presence parity check, so
+    // the contract cannot silently drift on one serving process. Dev/test
+    // (NODE_ENV !== 'production') runs unsigned by design and is exempt.
+    //
+    // GAP-417 items 1-2 (owner-countersigned 2026-07-25): SKIP_ENV_VALIDATION no
+    // longer exempts this check. The audit path has NO escape hatch — a
+    // production process that cannot sign must not boot, because unsigned rows
+    // are indistinguishable from tampering AND permanently stall anchor
+    // contiguity once the sweep filters them. SKIP still covers non-audit env
+    // validation elsewhere; it never buys an unsigned production audit log.
+    if (env.NODE_ENV === 'production') {
+        if (!env.REVEALUI_AUDIT_SIGNING_KEY) {
+            throw new Error('AUDIT STORAGE ENV PARITY FAILED: REVEALUI_AUDIT_SIGNING_KEY is not set on a ' +
+                'production deployment, so the audit write path cannot sign rows. Refusing to ' +
+                'serve — an unsigned row in the post-Stage-3 era is indistinguishable from ' +
+                'tampering (docs/decisions/2026-07-12-audit-receipt-architecture.md §2a). ' +
+                'SKIP_ENV_VALIDATION does not exempt the audit path (GAP-417).');
+        }
+    }
+}
+/**
+ * Swap the process-wide `audit` system onto persistent Postgres storage.
+ * Synchronous and side-effect-free at call time: `getClient()` is a lazy pool
+ * factory (no connection opened here), so this is safe to run on a serverless
+ * cold-start path. WITHOUT this call, audit events fall into the default
+ * `InMemoryAuditStorage` and evaporate on restart — which is exactly what
+ * happened to every admin-process emit before GAP-338.
+ *
+ * Call `assertAuditStorageEnv()` before this at each install site so a
+ * diverged-env deploy fails loudly instead of installing a store that can
+ * never write.
+ */
+export function installAuditStorage() {
+    audit.setStorage(new DrizzleBackedAuditStorage(getClient()));
+}
+/**
+ * Boot-time round-trip self-test. Writes a synthetic audit event through the
+ * REAL installed path (AuditSystem → boundary → DrizzleAuditStore → audit_log)
+ * and reads it back. Throws if the round trip fails, so a runtime that cannot
+ * record agent actions REFUSES TO SERVE rather than silently dropping them
+ * (fail-closed integrity — ADR §2a).
+ *
+ * Uses `severity: 'low'` deliberately: that value would be rejected by the DB
+ * CHECK constraint if the boundary mapping regressed, so this exercises the
+ * exact defect Stage 1 fixes. A healthy audit path lets startup proceed.
+ *
+ * Runs on the long-running worker (once per deploy) and the dev boot path,
+ * where an async boot chain already exists and `process.exit(1)` gives
+ * "refuse to serve" clean semantics. It is NOT run on serverless cold-start
+ * paths, which stay free of per-invocation DB round-trips (storage is still
+ * installed there synchronously by `installAuditStorage()`).
+ */
+export async function auditStorageSelfTest(auditSystem = audit) {
+    const marker = `__audit-self-test__:${randomUUID()}`;
+    const written = await auditSystem.log({
+        type: 'security.audit_self_test',
+        severity: 'low',
+        actor: { id: marker, type: 'system' },
+        action: 'audit-storage-self-test',
+        result: 'success',
+        metadata: { synthetic: true },
+    });
+    const found = await auditSystem.query({ actorId: marker, limit: 5 });
+    if (!found.some((event) => event.id === written.id)) {
+        throw new Error('AUDIT STORAGE SELF-TEST FAILED: wrote a synthetic audit event but could not read it ' +
+            'back. Refusing to serve — a runtime that cannot record agent actions must not accept ' +
+            'traffic (fail-closed integrity, docs/decisions/2026-07-12-audit-receipt-architecture.md §2a).');
+    }
+}

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AAUpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CAyLvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAoOvB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AAUpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CAyLvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAqOvB"}

package/dist/server/auth.js

@@ -398,9 +398,10 @@ export async function signUp(email, password, name, options) {
         // exists from signup. Best-effort: the Stripe billing webhook
         // (ensureHostedAccount) is idempotent on an active membership and backfills
         // this if it fails here, so a transient error never blocks signup. Skipped on
-        // self-hosted (Forge) deployments — single-tenant, no per-user accounts (mode
-        // detected by the license signing key, as in apps/server validate-startup).
-        if (process.env.REVEALUI_LICENSE_PRIVATE_KEY) {
+        // self-hosted (Forge) deployments — single-tenant, no per-user accounts
+        // (GAP-260 P4-1: REVEALUI_DEPLOYMENT_MODE, fallback private-key presence).
+        const { isHostedDeployment } = await import('@revealui/core/deployment-mode');
+        if (isHostedDeployment(process.env)) {
             try {
                 const accountId = crypto.randomUUID();
                 const now = new Date();

package/dist/server/index.d.ts

@@ -14,7 +14,7 @@ export { configureMagicLink, createMagicLink, resetMagicLinkConfig, verifyMagicL
 export type { MFAConfig, MFADisableProof, MFASetupResult } from './mfa.js';
 export { configureMFA, disableMFA, initiateMFASetup, isMFAEnabled, regenerateBackupCodes, resetMFAConfig, verifyBackupCode, verifyMFACode, verifyMFASetup, } from './mfa.js';
 export type { MfaCheckResult, MfaEnforcementOptions, MfaErrorResponse, MfaRequest, MfaSession, MfaSessionUser, } from './mfa-enforcement.js';
-export { requireMfa } from './mfa-enforcement.js';
+export { checkSessionMfa, requireMfa, toMfaSession } from './mfa-enforcement.js';
 export { buildAuthUrl, exchangeCode, fetchProviderUser, generateOAuthState, getLinkedProviders, linkOAuthAccount, type ProviderUser, type UpsertOAuthOptions, unlinkOAuthAccount, upsertOAuthUser, verifyOAuthState, } from './oauth.js';
 export type { PasskeyConfig } from './passkey.js';
 export { configurePasskey, countUserCredentials, deletePasskey, generateAuthenticationChallenge, generateRegistrationChallenge, listPasskeys, renamePasskey, resetPasskeyConfig, storePasskey, verifyAuthentication, verifyRegistration, } from './passkey.js';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,+BAA+B,EAC/B,6BAA6B,EAC7B,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,aAAa,EACb,eAAe,EACf,UAAU,EACV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,+BAA+B,EAC/B,6BAA6B,EAC7B,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,aAAa,EACb,eAAe,EACf,UAAU,EACV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -6,12 +6,18 @@
  */
 // Audit bridge
 export { auditAccountLocked, auditLoginFailure, auditLoginSuccess, auditMfaDisabled, auditMfaEnabled, auditPasswordChange, auditPasswordReset, auditSessionRevoked, } from './audit-bridge.js';
+// NOTE (GAP-338): the audit storage boundary lives at the DEDICATED subpath
+// `@revealui/auth/audit-storage`, deliberately NOT re-exported from this
+// barrel. `@revealui/auth/server` is the fleet's most-mocked module (route
+// tests bare-mock it for getSession), and a bare vi.mock of this barrel must
+// never swallow the audit write path (it broke the GAP-352 + mcp-endpoint
+// integration suites when the boundary briefly lived here).
 export { isSignupAllowed, signIn, signUp } from './auth.js';
 export { clearFailedAttempts, configureBruteForce, getFailedAttemptCount, isAccountLocked, recordFailedAttempt, resetBruteForceConfig, } from './brute-force.js';
 export { AuthError, AuthenticationError, DatabaseError, OAuthAccountConflictError, SessionError, TokenError, } from './errors.js';
 export { configureMagicLink, createMagicLink, resetMagicLinkConfig, verifyMagicLink, } from './magic-link.js';
 export { configureMFA, disableMFA, initiateMFASetup, isMFAEnabled, regenerateBackupCodes, resetMFAConfig, verifyBackupCode, verifyMFACode, verifyMFASetup, } from './mfa.js';
-export { requireMfa } from './mfa-enforcement.js';
+export { checkSessionMfa, requireMfa, toMfaSession } from './mfa-enforcement.js';
 export { buildAuthUrl, exchangeCode, fetchProviderUser, generateOAuthState, getLinkedProviders, linkOAuthAccount, unlinkOAuthAccount, upsertOAuthUser, verifyOAuthState, } from './oauth.js';
 export { configurePasskey, countUserCredentials, deletePasskey, generateAuthenticationChallenge, generateRegistrationChallenge, listPasskeys, renamePasskey, resetPasskeyConfig, storePasskey, verifyAuthentication, verifyRegistration, } from './passkey.js';
 export { changePassword, generatePasswordResetToken, invalidatePasswordResetToken, resetPasswordWithToken, validatePasswordResetToken, } from './password-reset.js';

package/dist/server/mfa-enforcement.d.ts

@@ -73,4 +73,33 @@ export interface MfaCheckResult {
  * ```
  */
 export declare function requireMfa(options?: MfaEnforcementOptions): (request: MfaRequest) => MfaCheckResult;
+/**
+ * Build MFA session shape from getSession / rotateSession results.
+ * `mfaVerified` comes from session.metadata set after MFA login (verify/backup).
+ */
+export declare function toMfaSession(sessionData: {
+    user: {
+        id: string;
+        role: string;
+        mfaEnabled?: boolean | null;
+    };
+    session: {
+        metadata?: Record<string, unknown> | null;
+    };
+}): MfaSession;
+/**
+ * One-shot MFA check for a SessionData-like object (Next.js / Hono handlers).
+ */
+export declare function checkSessionMfa(sessionData: {
+    user: {
+        id: string;
+        role: string;
+        mfaEnabled?: boolean | null;
+    };
+    session: {
+        metadata?: Record<string, unknown> | null;
+    };
+}, options?: MfaEnforcementOptions & {
+    operation?: string;
+}): MfaCheckResult;
 //# sourceMappingURL=mfa-enforcement.d.ts.map

package/dist/server/mfa-enforcement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mfa-enforcement.d.ts","sourceRoot":"","sources":["../../src/server/mfa-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,kDAAkD;AAClD,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,eAAe;IACf,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,UAAU,EAAE,OAAO,CAAC;IACpB,gDAAgD;IAChD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,6DAA6D;AAC7D,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,gDAAgD;AAChD,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,cAAc,GAAG,qBAAqB,CAAC;CAC9C;AAED,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAQD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,UAAU,CACxB,OAAO,GAAE,qBAA0B,GAClC,CAAC,OAAO,EAAE,UAAU,KAAK,cAAc,CAgDzC"}
+{"version":3,"file":"mfa-enforcement.d.ts","sourceRoot":"","sources":["../../src/server/mfa-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,kDAAkD;AAClD,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,eAAe;IACf,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,UAAU,EAAE,OAAO,CAAC;IACpB,gDAAgD;IAChD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,6DAA6D;AAC7D,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,gDAAgD;AAChD,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,cAAc,GAAG,qBAAqB,CAAC;CAC9C;AAED,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AASD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,UAAU,CACxB,OAAO,GAAE,qBAA0B,GAClC,CAAC,OAAO,EAAE,UAAU,KAAK,cAAc,CAgDzC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE;IACxC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IAChE,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;CACxD,GAAG,UAAU,CAUb;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE;IACX,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IAChE,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;CACxD,EACD,OAAO,CAAC,EAAE,qBAAqB,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD,cAAc,CAMhB"}

package/dist/server/mfa-enforcement.js

@@ -7,7 +7,8 @@
 // =============================================================================
 // Middleware
 // =============================================================================
-const DEFAULT_ROLES = ['admin'];
+/** Admin-level DB roles that require MFA for sensitive operations (C11). */
+const DEFAULT_ROLES = ['admin', 'owner'];
 /**
  * Create an MFA enforcement checker.
  *
@@ -74,3 +75,28 @@ export function requireMfa(options = {}) {
         return { allowed: true };
     };
 }
+/**
+ * Build MFA session shape from getSession / rotateSession results.
+ * `mfaVerified` comes from session.metadata set after MFA login (verify/backup).
+ */
+export function toMfaSession(sessionData) {
+    const meta = sessionData.session.metadata ?? null;
+    return {
+        user: {
+            id: sessionData.user.id,
+            role: sessionData.user.role,
+            mfaEnabled: sessionData.user.mfaEnabled === true,
+            mfaVerified: meta?.mfaVerified === true,
+        },
+    };
+}
+/**
+ * One-shot MFA check for a SessionData-like object (Next.js / Hono handlers).
+ */
+export function checkSessionMfa(sessionData, options) {
+    const check = requireMfa(options);
+    return check({
+        session: toMfaSession(sessionData),
+        operation: options?.operation,
+    });
+}

package/dist/server/security-alerts.d.ts

@@ -0,0 +1,17 @@
+/**
+ * SecurityAlertService bridge (fleet-redundancy C11).
+ *
+ * Lazy singleton: evaluates auth/security audit events against DEFAULT_THRESHOLDS
+ * and logs via LogAlertHandler. Best-effort — never throws into the login path.
+ */
+import type { AuditEvent } from '@revealui/security/server';
+type AuditEventInput = Omit<AuditEvent, 'id' | 'timestamp'>;
+/** Reset singleton (tests only). */
+export declare function resetSecurityAlertService(): void;
+/**
+ * Feed an audit-shaped event into SecurityAlertService.evaluateEvent.
+ * Never throws; failures are logged and swallowed.
+ */
+export declare function evaluateSecurityAlert(event: AuditEventInput): Promise<void>;
+export {};
+//# sourceMappingURL=security-alerts.d.ts.map

package/dist/server/security-alerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-alerts.d.ts","sourceRoot":"","sources":["../../src/server/security-alerts.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,KAAK,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC;AA6B5D,oCAAoC;AACpC,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAejF"}

package/dist/server/security-alerts.js

@@ -0,0 +1,55 @@
+/**
+ * SecurityAlertService bridge (fleet-redundancy C11).
+ *
+ * Lazy singleton: evaluates auth/security audit events against DEFAULT_THRESHOLDS
+ * and logs via LogAlertHandler. Best-effort — never throws into the login path.
+ */
+import { logger } from '@revealui/core/observability/logger';
+let service;
+/**
+ * Lazily construct the process-wide SecurityAlertService, or null if the
+ * security package cannot be loaded (e.g. partial test mocks).
+ */
+async function getAlertService() {
+    if (service !== undefined) {
+        return service;
+    }
+    try {
+        const { SecurityAlertService: AlertService, DEFAULT_THRESHOLDS, LogAlertHandler, } = await import('@revealui/security');
+        service = new AlertService({
+            thresholds: DEFAULT_THRESHOLDS,
+            handlers: [new LogAlertHandler()],
+        });
+        return service;
+    }
+    catch {
+        service = null;
+        return null;
+    }
+}
+/** Reset singleton (tests only). */
+export function resetSecurityAlertService() {
+    service = undefined;
+}
+/**
+ * Feed an audit-shaped event into SecurityAlertService.evaluateEvent.
+ * Never throws; failures are logged and swallowed.
+ */
+export async function evaluateSecurityAlert(event) {
+    try {
+        const alerts = await getAlertService();
+        if (!alerts)
+            return;
+        const full = {
+            id: crypto.randomUUID(),
+            timestamp: new Date().toISOString(),
+            ...event,
+        };
+        await alerts.evaluateEvent(full);
+    }
+    catch (error) {
+        logger.error('Failed to evaluate security alert', error instanceof Error ? error : undefined, {
+            type: event.type,
+        });
+    }
+}

package/dist/server/session.d.ts

@@ -86,6 +86,8 @@ export declare function rotateSession(userId: string, options?: {
     persistent?: boolean;
     userAgent?: string;
     ipAddress?: string;
+    /** Session metadata (e.g. `{ mfaVerified: true }` after MFA login). */
+    metadata?: Record<string, unknown>;
 }): Promise<{
     token: string;
     session: Session;

package/dist/server/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAQjD,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;CACzB;AAaD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAEtF;AAED,qCAAqC;AACrC,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CA0B3F;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAI1E;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAgI7B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAmE9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoC9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA+BtE;AAED;;;;GAIG;AACH;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBzE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAQjD,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;CACzB;AAaD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAEtF;AAED,qCAAqC;AACrC,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CA0B3F;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAI1E;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAgI7B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAmE9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAqC9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA+BtE;AAED;;;;GAIG;AACH;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBzE"}

package/dist/server/session.js

@@ -312,6 +312,7 @@ export async function rotateSession(userId, options) {
             persistent: options?.persistent,
             userAgent: options?.userAgent,
             ipAddress: options?.ipAddress,
+            metadata: options?.metadata,
         });
     }
     catch (err) {

package/dist/utils/database.d.ts

@@ -18,7 +18,7 @@ export declare function getTestDatabaseUrl(): string;
 /**
  * Creates a test database client
  */
-export declare function createTestDatabaseClient(): import("@revealui/db/client").Database;
+export declare function createTestDatabaseClient(): import("@revealui/db").DatabaseClient;
 /**
  * Cleans up test data from database
  */

package/dist/utils/database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/utils/database.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAU3C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,2CAMvC;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBtE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B7E;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CASxE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAStF;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAC7B,gBAAgB,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAClC,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAI3C"}
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/utils/database.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAU3C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,0CAMvC;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBtE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B7E;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAC3B,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CASxE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAStF;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,EAC7B,gBAAgB,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAClC,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAI3C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/auth",
-  "version": "0.4.9",
+  "version": "0.5.0",
   "description": "Database-backed session auth for Hono and Next.js — bcrypt, OAuth, brute-force protection, rate limiting, password reset. Ships with RevealUI.",
   "keywords": [
     "auth",
@@ -15,10 +15,10 @@
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
     "@revealui/config": "0.6.0",
-    "@revealui/contracts": "0.8.0",
-    "@revealui/core": "0.12.0",
-    "@revealui/db": "0.9.0",
-    "@revealui/security": "0.5.0"
+    "@revealui/contracts": "0.8.1",
+    "@revealui/core": "0.12.2",
+    "@revealui/db": "0.10.0",
+    "@revealui/security": "0.6.0"
   },
   "devDependencies": {
     "@simplewebauthn/browser": "^13.3.0",
@@ -38,15 +38,23 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     },
     "./server": {
       "types": "./dist/server/index.d.ts",
-      "import": "./dist/server/index.js"
+      "import": "./dist/server/index.js",
+      "default": "./dist/server/index.js"
+    },
+    "./audit-storage": {
+      "types": "./dist/server/audit-storage.d.ts",
+      "import": "./dist/server/audit-storage.js",
+      "default": "./dist/server/audit-storage.js"
     },
     "./react": {
       "types": "./dist/react/index.d.ts",
-      "import": "./dist/react/index.js"
+      "import": "./dist/react/index.js",
+      "default": "./dist/react/index.js"
     }
   },
   "files": [