@revealui/auth 0.5.2 → 0.5.4

package/dist/server/admission-waitlist.d.ts

@@ -0,0 +1,34 @@
+/**
+ * GAP-256 PR-4 — admission_waitlist I/O (NOT marketing waitlist).
+ *
+ * Stores only SHA-256 of claim tokens. Raw token returned once at enqueue.
+ */
+import { type AdmissionWaitlistRow } from '@revealui/db/schema';
+export declare function hashAdmissionToken(raw: string): string;
+export declare function generateAdmissionToken(): string;
+export interface EnqueueAdmissionWaitlistParams {
+    email: string;
+    snapshotId: string | null;
+    modeAtEnqueue?: string;
+    source?: string;
+    now?: Date;
+}
+export interface EnqueueAdmissionWaitlistResult {
+    waitlistToken: string;
+    positionEstimate: number | null;
+    id: string;
+}
+/**
+ * Insert or rotate a pending admission waitlist row for email.
+ * Returns a fresh raw token (never stored).
+ */
+export declare function enqueueAdmissionWaitlist(params: EnqueueAdmissionWaitlistParams): Promise<EnqueueAdmissionWaitlistResult>;
+/** Active claim rows: pending or invited, not past expiresAt. */
+export declare function getAdmissionWaitlistByToken(rawToken: string): Promise<AdmissionWaitlistRow | null>;
+export declare function getAdmissionWaitlistByTokenAnyStatus(rawToken: string): Promise<AdmissionWaitlistRow | null>;
+export declare function markAdmissionWaitlistConverted(id: string, now?: Date): Promise<void>;
+/** Mask email for public status (anti-enumeration still requires valid token). */
+export declare function maskAdmissionEmail(email: string): string;
+/** Position estimate among pending (best-effort; null on failure). */
+export declare function estimateAdmissionWaitlistPosition(id: string): Promise<number | null>;
+//# sourceMappingURL=admission-waitlist.d.ts.map

package/dist/server/admission-waitlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-waitlist.d.ts","sourceRoot":"","sources":["../../src/server/admission-waitlist.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,KAAK,oBAAoB,EAAqB,MAAM,qBAAqB,CAAC;AAKnF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA0BD,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,8BAA8B;IAC7C,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,8BAA8B,GACrC,OAAO,CAAC,8BAA8B,CAAC,CA8FzC;AAED,iEAAiE;AACjE,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAqBtC;AAED,wBAAsB,oCAAoC,CACxD,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAYtC;AAED,wBAAsB,8BAA8B,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAU1F;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUxD;AAED,sEAAsE;AACtE,wBAAsB,iCAAiC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B1F"}

package/dist/server/admission-waitlist.js

@@ -0,0 +1,210 @@
+/**
+ * GAP-256 PR-4 — admission_waitlist I/O (NOT marketing waitlist).
+ *
+ * Stores only SHA-256 of claim tokens. Raw token returned once at enqueue.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { logger } from '@revealui/core/observability/logger';
+import { getClient } from '@revealui/db';
+import { admissionWaitlist } from '@revealui/db/schema';
+import { and, count, eq, gt, inArray, isNull, or, sql } from 'drizzle-orm';
+const TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+export function hashAdmissionToken(raw) {
+    return createHash('sha256').update(raw).digest('hex');
+}
+export function generateAdmissionToken() {
+    return randomBytes(32).toString('hex');
+}
+function normalizeEmail(email) {
+    return email.trim().toLowerCase();
+}
+function expiresAtFrom(now) {
+    return new Date(now.getTime() + TOKEN_TTL_MS);
+}
+async function countPendingRows() {
+    try {
+        const db = getClient();
+        const [row] = await db
+            .select({ total: count() })
+            .from(admissionWaitlist)
+            .where(eq(admissionWaitlist.status, 'pending'));
+        return row?.total ?? 0;
+    }
+    catch (err) {
+        logger.warn('[admission-waitlist] pending count failed', {
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return null;
+    }
+}
+/**
+ * Insert or rotate a pending admission waitlist row for email.
+ * Returns a fresh raw token (never stored).
+ */
+export async function enqueueAdmissionWaitlist(params) {
+    const db = getClient();
+    const email = normalizeEmail(params.email);
+    const now = params.now ?? new Date();
+    const rawToken = generateAdmissionToken();
+    const tokenHash = hashAdmissionToken(rawToken);
+    const expiresAt = expiresAtFrom(now);
+    const modeAtEnqueue = params.modeAtEnqueue ?? 'waitlist';
+    const source = params.source ?? 'free_signup';
+    const [existing] = await db
+        .select({
+        id: admissionWaitlist.id,
+        position: admissionWaitlist.position,
+    })
+        .from(admissionWaitlist)
+        .where(and(eq(admissionWaitlist.email, email), eq(admissionWaitlist.status, 'pending')))
+        .limit(1);
+    if (existing) {
+        await db
+            .update(admissionWaitlist)
+            .set({
+            tokenHash,
+            snapshotId: params.snapshotId,
+            modeAtEnqueue,
+            source,
+            expiresAt,
+        })
+            .where(eq(admissionWaitlist.id, existing.id));
+        return {
+            waitlistToken: rawToken,
+            positionEstimate: existing.position,
+            id: existing.id,
+        };
+    }
+    const pendingCount = await countPendingRows();
+    const positionEstimate = pendingCount === null ? null : pendingCount + 1;
+    const id = crypto.randomUUID();
+    try {
+        await db.insert(admissionWaitlist).values({
+            id,
+            email,
+            status: 'pending',
+            tokenHash,
+            snapshotId: params.snapshotId,
+            modeAtEnqueue,
+            position: positionEstimate,
+            source,
+            metadata: {},
+            createdAt: now,
+            expiresAt,
+        });
+    }
+    catch (err) {
+        // Race on unique pending email: rotate the winning row's token.
+        logger.warn('[admission-waitlist] insert conflict; rotating existing pending', {
+            error: err instanceof Error ? err.message : String(err),
+        });
+        const [raced] = await db
+            .select({
+            id: admissionWaitlist.id,
+            position: admissionWaitlist.position,
+        })
+            .from(admissionWaitlist)
+            .where(and(eq(admissionWaitlist.email, email), eq(admissionWaitlist.status, 'pending')))
+            .limit(1);
+        if (!raced) {
+            throw err instanceof Error ? err : new Error(String(err));
+        }
+        await db
+            .update(admissionWaitlist)
+            .set({
+            tokenHash,
+            snapshotId: params.snapshotId,
+            modeAtEnqueue,
+            source,
+            expiresAt,
+        })
+            .where(eq(admissionWaitlist.id, raced.id));
+        return {
+            waitlistToken: rawToken,
+            positionEstimate: raced.position,
+            id: raced.id,
+        };
+    }
+    return {
+        waitlistToken: rawToken,
+        positionEstimate,
+        id,
+    };
+}
+/** Active claim rows: pending or invited, not past expiresAt. */
+export async function getAdmissionWaitlistByToken(rawToken) {
+    if (!rawToken || rawToken.trim() === '') {
+        return null;
+    }
+    const db = getClient();
+    const tokenHash = hashAdmissionToken(rawToken);
+    const now = new Date();
+    const [row] = await db
+        .select()
+        .from(admissionWaitlist)
+        .where(and(eq(admissionWaitlist.tokenHash, tokenHash), inArray(admissionWaitlist.status, ['pending', 'invited']), or(isNull(admissionWaitlist.expiresAt), gt(admissionWaitlist.expiresAt, now))))
+        .limit(1);
+    return row ?? null;
+}
+export async function getAdmissionWaitlistByTokenAnyStatus(rawToken) {
+    if (!rawToken || rawToken.trim() === '') {
+        return null;
+    }
+    const db = getClient();
+    const tokenHash = hashAdmissionToken(rawToken);
+    const [row] = await db
+        .select()
+        .from(admissionWaitlist)
+        .where(eq(admissionWaitlist.tokenHash, tokenHash))
+        .limit(1);
+    return row ?? null;
+}
+export async function markAdmissionWaitlistConverted(id, now) {
+    const db = getClient();
+    const convertedAt = now ?? new Date();
+    await db
+        .update(admissionWaitlist)
+        .set({
+        status: 'converted',
+        convertedAt,
+    })
+        .where(eq(admissionWaitlist.id, id));
+}
+/** Mask email for public status (anti-enumeration still requires valid token). */
+export function maskAdmissionEmail(email) {
+    const normalized = normalizeEmail(email);
+    const at = normalized.indexOf('@');
+    if (at <= 0) {
+        return '***';
+    }
+    const local = normalized.slice(0, at);
+    const domain = normalized.slice(at + 1);
+    const visible = local.slice(0, 1);
+    return `${visible}***@${domain}`;
+}
+/** Position estimate among pending (best-effort; null on failure). */
+export async function estimateAdmissionWaitlistPosition(id) {
+    try {
+        const db = getClient();
+        const [self] = await db
+            .select({
+            position: admissionWaitlist.position,
+            createdAt: admissionWaitlist.createdAt,
+        })
+            .from(admissionWaitlist)
+            .where(eq(admissionWaitlist.id, id))
+            .limit(1);
+        if (!self)
+            return null;
+        if (self.position != null)
+            return self.position;
+        const [row] = await db
+            .select({ total: count() })
+            .from(admissionWaitlist)
+            .where(and(eq(admissionWaitlist.status, 'pending'), sql `${admissionWaitlist.createdAt} <= ${self.createdAt}`));
+        return row?.total ?? null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/server/audit-bridge.d.ts

@@ -66,4 +66,36 @@ export declare function auditSessionRevoked(userId: string, sessionId: string, i
  * @param failedAttempts - Number of failed attempts that triggered the lockout
  */
 export declare function auditAccountLocked(email: string, ip: string, failedAttempts: number): Promise<void>;
+/**
+ * Structured fields required by GAP-464 / #449 Audit wiring.
+ * `userId` may be absent on pre-JIT login failures.
+ */
+export interface SsoAuditContext {
+    providerType?: string;
+    accountId?: string;
+    userId?: string;
+    issuer?: string;
+    providerId?: string;
+    ip?: string;
+    userAgent?: string;
+}
+/**
+ * Record a successful Enterprise SSO login (OIDC or SAML ACS).
+ * Persists via the audit door before the HTTP response returns.
+ */
+export declare function auditSsoLoginSuccess(context: SsoAuditContext): Promise<void>;
+/**
+ * Record a failed Enterprise SSO login attempt.
+ * Persists via the audit door before the HTTP response returns.
+ */
+export declare function auditSsoLoginFailure(context: SsoAuditContext & {
+    reason: string;
+}): Promise<void>;
+/**
+ * Record an SSO provider create / update / delete (or equivalent mapping change).
+ * Persists via the audit door before the HTTP response returns.
+ */
+export declare function auditSsoConfigChanged(context: SsoAuditContext & {
+    action: string;
+}): Promise<void>;
 //# sourceMappingURL=audit-bridge.d.ts.map

package/dist/server/audit-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-bridge.d.ts","sourceRoot":"","sources":["../../src/server/audit-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2CH;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASnF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjF;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/E;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf"}
+{"version":3,"file":"audit-bridge.d.ts","sourceRoot":"","sources":["../../src/server/audit-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2CH;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASnF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjF;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/E;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAYD;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBlF;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAiBf"}

package/dist/server/audit-bridge.js

@@ -179,3 +179,78 @@ export async function auditAccountLocked(email, ip, failedAttempts) {
         metadata: { email, failedAttempts },
     });
 }
+function ssoMetadata(context) {
+    return {
+        providerType: context.providerType ?? null,
+        accountId: context.accountId ?? null,
+        userId: context.userId ?? null,
+        issuer: context.issuer ?? null,
+        providerId: context.providerId ?? null,
+    };
+}
+/**
+ * Record a successful Enterprise SSO login (OIDC or SAML ACS).
+ * Persists via the audit door before the HTTP response returns.
+ */
+export async function auditSsoLoginSuccess(context) {
+    const actorId = context.userId ?? context.accountId ?? 'unknown';
+    await logAuditEvent({
+        type: 'sso_login_success',
+        severity: 'low',
+        actor: {
+            id: actorId,
+            type: 'user',
+            ip: context.ip,
+            userAgent: context.userAgent,
+        },
+        resource: context.providerId ? { type: 'sso_provider', id: context.providerId } : undefined,
+        action: 'sso_login',
+        result: 'success',
+        message: 'SSO login succeeded',
+        metadata: ssoMetadata(context),
+    });
+}
+/**
+ * Record a failed Enterprise SSO login attempt.
+ * Persists via the audit door before the HTTP response returns.
+ */
+export async function auditSsoLoginFailure(context) {
+    const actorId = context.userId ?? context.accountId ?? 'unknown';
+    await logAuditEvent({
+        type: 'sso_login_failure',
+        severity: 'medium',
+        actor: {
+            id: actorId,
+            type: 'user',
+            ip: context.ip,
+            userAgent: context.userAgent,
+        },
+        resource: context.providerId ? { type: 'sso_provider', id: context.providerId } : undefined,
+        action: 'sso_login',
+        result: 'failure',
+        message: `SSO login failed: ${context.reason}`,
+        metadata: { ...ssoMetadata(context), reason: context.reason },
+    });
+}
+/**
+ * Record an SSO provider create / update / delete (or equivalent mapping change).
+ * Persists via the audit door before the HTTP response returns.
+ */
+export async function auditSsoConfigChanged(context) {
+    const actorId = context.userId ?? context.accountId ?? 'unknown';
+    await logAuditEvent({
+        type: 'sso_config_changed',
+        severity: 'medium',
+        actor: {
+            id: actorId,
+            type: 'user',
+            ip: context.ip,
+            userAgent: context.userAgent,
+        },
+        resource: context.providerId ? { type: 'sso_provider', id: context.providerId } : undefined,
+        action: context.action,
+        result: 'success',
+        message: `SSO provider ${context.action}`,
+        metadata: { ...ssoMetadata(context), action: context.action },
+    });
+}

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AAWpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CA0PvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAyOvB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AAWpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CA0QvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAyOvB"}

package/dist/server/auth.js

@@ -192,6 +192,7 @@ export async function signIn(email, password, options) {
         // Rotate session: delete all existing sessions for this user, then create
         // a fresh one. This prevents session fixation attacks where an attacker
         // plants a session token that the victim later authenticates.
+        // createSession also repairs membership-owner shell role (GAP-473).
         let token;
         try {
             const sessionResult = await rotateSession(user.id, {
@@ -208,6 +209,21 @@ export async function signIn(email, password, options) {
                 error: 'Failed to create session',
             };
         }
+        // Re-read role after session mint so revealui-role cookie matches DB when
+        // ensureShellAdminIfAccountOwner promoted viewer → admin (GAP-473).
+        try {
+            const [roleRow] = await db
+                .select({ role: users.role })
+                .from(users)
+                .where(eq(users.id, user.id))
+                .limit(1);
+            if (roleRow && roleRow.role !== user.role) {
+                user = { ...user, role: roleRow.role };
+            }
+        }
+        catch {
+            // Cookie may lag one login; next getSession still sees repaired DB role.
+        }
         // A fresh session was minted: the login succeeded. Land a success receipt
         // in the audit trail (best-effort; auditLoginSuccess never throws, so an
         // audit-write failure cannot fail the login).

package/dist/server/index.d.ts

@@ -5,12 +5,14 @@
  * Inspired by Better Auth and Neon Auth patterns.
  */
 export type { SignInResult, SignUpResult } from '../types.js';
-export { auditAccountLocked, auditLoginFailure, auditLoginSuccess, auditMfaDisabled, auditMfaEnabled, auditPasswordChange, auditPasswordReset, auditSessionRevoked, } from './audit-bridge.js';
+export { type EnqueueAdmissionWaitlistParams, type EnqueueAdmissionWaitlistResult, enqueueAdmissionWaitlist, estimateAdmissionWaitlistPosition, generateAdmissionToken, getAdmissionWaitlistByToken, getAdmissionWaitlistByTokenAnyStatus, hashAdmissionToken, markAdmissionWaitlistConverted, maskAdmissionEmail, } from './admission-waitlist.js';
+export { auditAccountLocked, auditLoginFailure, auditLoginSuccess, auditMfaDisabled, auditMfaEnabled, auditPasswordChange, auditPasswordReset, auditSessionRevoked, auditSsoConfigChanged, auditSsoLoginFailure, auditSsoLoginSuccess, type SsoAuditContext, } from './audit-bridge.js';
 export { isSignupAllowed, signIn, signUp } from './auth.js';
 export { clearFailedAttempts, configureBruteForce, getFailedAttemptCount, isAccountLocked, recordFailedAttempt, resetBruteForceConfig, } from './brute-force.js';
 export { AuthError, AuthenticationError, DatabaseError, OAuthAccountConflictError, SessionError, TokenError, } from './errors.js';
 export type { MagicLinkConfig } from './magic-link.js';
 export { configureMagicLink, createMagicLink, resetMagicLinkConfig, verifyMagicLink, } from './magic-link.js';
+export { type AdmitFreeIntakeInput, type AdmitFreeIntakeResult, admitFreeIntake, ensureFreeSignupEntitlement, OPEN_FREE_LIMITS, provisionHostedPersonalAccount, } from './margin-admit.js';
 export type { MFAConfig, MFADisableProof, MFASetupResult } from './mfa.js';
 export { configureMFA, disableMFA, initiateMFASetup, isMFAEnabled, regenerateBackupCodes, resetMFAConfig, verifyBackupCode, verifyMFACode, verifyMFASetup, } from './mfa.js';
 export type { MfaCheckResult, MfaEnforcementOptions, MfaErrorResponse, MfaRequest, MfaSession, MfaSessionUser, } from './mfa-enforcement.js';
@@ -21,7 +23,8 @@ export { configurePasskey, countUserCredentials, deletePasskey, generateAuthenti
 export type { ChangePasswordResult, PasswordResetResult, PasswordResetToken, } from './password-reset.js';
 export { changePassword, generatePasswordResetToken, invalidatePasswordResetToken, resetPasswordWithToken, validatePasswordResetToken, } from './password-reset.js';
 export { meetsMinimumPasswordRequirements, validatePasswordStrength, } from './password-validation.js';
-export { ensureAccountOwnerPlatformAdmin, isPlatformShellAdminRole, PLATFORM_SHELL_ADMIN_COOKIE_ROLES, PLATFORM_SHELL_ADMIN_ROLES, platformRoleForAccountOwner, } from './platform-roles.js';
+export { ensurePlatformOperatorEntitlement, isPlatformOperatorUser, PLATFORM_OPERATOR_LIMITS, type PlatformOperatorUserView, rolesFromUserJson, } from './platform-operator.js';
+export { ensureAccountOwnerPlatformAdmin, ensureShellAdminIfAccountOwner, isPlatformShellAdminRole, PLATFORM_SHELL_ADMIN_COOKIE_ROLES, PLATFORM_SHELL_ADMIN_ROLES, platformRoleForAccountOwner, readUsersRole, } from './platform-roles.js';
 export { checkRateLimit, configureRateLimit, getRateLimitStatus, resetRateLimit, resetRateLimitConfig, } from './rate-limit.js';
 export type { RequestContext, SessionBindingConfig, SessionData } from './session.js';
 export { configureSessionBinding, createSession, deleteAllUserSessions, deleteOtherUserSessions, deleteSession, getSession, isRecoverySession, resetSessionBindingConfig, rotateSession, validateSessionBinding, } from './session.js';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,+BAA+B,EAC/B,6BAA6B,EAC7B,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,EACxB,iCAAiC,EACjC,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,EACL,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,aAAa,EACb,eAAe,EACf,UAAU,EACV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EACL,KAAK,8BAA8B,EACnC,KAAK,8BAA8B,EACnC,wBAAwB,EACxB,iCAAiC,EACjC,sBAAsB,EACtB,2BAA2B,EAC3B,oCAAoC,EACpC,kBAAkB,EAClB,8BAA8B,EAC9B,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,eAAe,EACf,2BAA2B,EAC3B,gBAAgB,EAChB,8BAA8B,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,+BAA+B,EAC/B,6BAA6B,EAC7B,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,wBAAwB,EACxB,iCAAiC,EACjC,0BAA0B,EAC1B,2BAA2B,EAC3B,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,EACL,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,aAAa,EACb,eAAe,EACf,UAAU,EACV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -4,8 +4,10 @@
  * Server-side authentication functions for Next.js and TanStack Start.
  * Inspired by Better Auth and Neon Auth patterns.
  */
+// GAP-256 admission waitlist (NOT marketing waitlist)
+export { enqueueAdmissionWaitlist, estimateAdmissionWaitlistPosition, generateAdmissionToken, getAdmissionWaitlistByToken, getAdmissionWaitlistByTokenAnyStatus, hashAdmissionToken, markAdmissionWaitlistConverted, maskAdmissionEmail, } from './admission-waitlist.js';
 // Audit bridge
-export { auditAccountLocked, auditLoginFailure, auditLoginSuccess, auditMfaDisabled, auditMfaEnabled, auditPasswordChange, auditPasswordReset, auditSessionRevoked, } from './audit-bridge.js';
+export { auditAccountLocked, auditLoginFailure, auditLoginSuccess, auditMfaDisabled, auditMfaEnabled, auditPasswordChange, auditPasswordReset, auditSessionRevoked, auditSsoConfigChanged, auditSsoLoginFailure, auditSsoLoginSuccess, } from './audit-bridge.js';
 // NOTE (GAP-338): the audit storage boundary lives at the DEDICATED subpath
 // `@revealui/auth/audit-storage`, deliberately NOT re-exported from this
 // barrel. `@revealui/auth/server` is the fleet's most-mocked module (route
@@ -16,13 +18,16 @@ export { isSignupAllowed, signIn, signUp } from './auth.js';
 export { clearFailedAttempts, configureBruteForce, getFailedAttemptCount, isAccountLocked, recordFailedAttempt, resetBruteForceConfig, } from './brute-force.js';
 export { AuthError, AuthenticationError, DatabaseError, OAuthAccountConflictError, SessionError, TokenError, } from './errors.js';
 export { configureMagicLink, createMagicLink, resetMagicLinkConfig, verifyMagicLink, } from './magic-link.js';
+// GAP-256 margin admit (shared admin + server free-intake)
+export { admitFreeIntake, ensureFreeSignupEntitlement, OPEN_FREE_LIMITS, provisionHostedPersonalAccount, } from './margin-admit.js';
 export { configureMFA, disableMFA, initiateMFASetup, isMFAEnabled, regenerateBackupCodes, resetMFAConfig, verifyBackupCode, verifyMFACode, verifyMFASetup, } from './mfa.js';
 export { checkSessionMfa, requireMfa, toMfaSession } from './mfa-enforcement.js';
 export { buildAuthUrl, exchangeCode, fetchProviderUser, generateOAuthState, getLinkedProviders, linkOAuthAccount, unlinkOAuthAccount, upsertOAuthUser, verifyOAuthState, } from './oauth.js';
 export { configurePasskey, countUserCredentials, deletePasskey, generateAuthenticationChallenge, generateRegistrationChallenge, listPasskeys, renamePasskey, resetPasskeyConfig, storePasskey, verifyAuthentication, verifyRegistration, } from './passkey.js';
 export { changePassword, generatePasswordResetToken, invalidatePasswordResetToken, resetPasswordWithToken, validatePasswordResetToken, } from './password-reset.js';
 export { meetsMinimumPasswordRequirements, validatePasswordStrength, } from './password-validation.js';
-export { ensureAccountOwnerPlatformAdmin, isPlatformShellAdminRole, PLATFORM_SHELL_ADMIN_COOKIE_ROLES, PLATFORM_SHELL_ADMIN_ROLES, platformRoleForAccountOwner, } from './platform-roles.js';
+export { ensurePlatformOperatorEntitlement, isPlatformOperatorUser, PLATFORM_OPERATOR_LIMITS, rolesFromUserJson, } from './platform-operator.js';
+export { ensureAccountOwnerPlatformAdmin, ensureShellAdminIfAccountOwner, isPlatformShellAdminRole, PLATFORM_SHELL_ADMIN_COOKIE_ROLES, PLATFORM_SHELL_ADMIN_ROLES, platformRoleForAccountOwner, readUsersRole, } from './platform-roles.js';
 export { checkRateLimit, configureRateLimit, getRateLimitStatus, resetRateLimit, resetRateLimitConfig, } from './rate-limit.js';
 export { configureSessionBinding, createSession, deleteAllUserSessions, deleteOtherUserSessions, deleteSession, getSession, isRecoverySession, resetSessionBindingConfig, rotateSession, validateSessionBinding, } from './session.js';
 // Signed Cookie

package/dist/server/margin-admit.d.ts

@@ -0,0 +1,55 @@
+/**
+ * GAP-256 free-intake admit + free@t0 entitlement (shared by server + admin).
+ *
+ * Pure decide lives in @revealui/core/margin-governor. This module is the I/O
+ * wrapper: read margin_snapshots, never COUNT(users). Waitlist enqueue is PR-4.
+ */
+import { type AdmissionChannel, type CohortLimits, type GovernorFlags, type PayingIntentSignal, type PureAdmitResult } from '@revealui/core/margin-governor';
+export type AdmitFreeIntakeInput = {
+    channel: AdmissionChannel;
+    email?: string;
+    payingIntent?: PayingIntentSignal;
+    deploymentMode?: 'hosted' | 'forge' | 'unknown';
+    env?: NodeJS.ProcessEnv;
+    now?: Date;
+    /** Waitlist enqueue source tag (default free_signup). */
+    source?: string;
+};
+export type AdmitFreeIntakeResult = PureAdmitResult & {
+    flags: GovernorFlags;
+    /** Present on waitlist decision after successful enqueue (raw once). */
+    waitlistToken?: string;
+    positionEstimate?: number | null;
+};
+/** Hosted free open limits — lockstep with apps/server getHostedLimitsForTier('free'). */
+export declare const OPEN_FREE_LIMITS: CohortLimits;
+export declare function admitFreeIntake(input: AdmitFreeIntakeInput): Promise<AdmitFreeIntakeResult>;
+/**
+ * Provision personal account + owner membership on hosted (same as signUp).
+ * Idempotent-ish: skips if user already has an active owner membership.
+ */
+export declare function provisionHostedPersonalAccount(params: {
+    userId: string;
+    displayName: string;
+}): Promise<{
+    accountId: string;
+} | {
+    skipped: true;
+    reason: string;
+}>;
+/**
+ * Free entitlement@t0 (K15) with source=signup.
+ * Ensures owner membership/account exist first (passkey/oauth paths).
+ */
+export declare function ensureFreeSignupEntitlement(params: {
+    userId: string;
+    cohortLimits: CohortLimits;
+    displayName?: string;
+    now?: Date;
+}): Promise<{
+    accountId: string;
+} | {
+    skipped: true;
+    reason: string;
+}>;
+//# sourceMappingURL=margin-admit.d.ts.map

package/dist/server/margin-admit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"margin-admit.d.ts","sourceRoot":"","sources":["../../src/server/margin-admit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAGjB,KAAK,aAAa,EAGlB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,gCAAgC,CAAC;AAaxC,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,cAAc,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,eAAe,GAAG;IACpD,KAAK,EAAE,aAAa,CAAC;IACrB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,gBAAgB,EAAE,YAI9B,CAAC;AA2DF,wBAAsB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA2FjG;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA2CrE;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAqFrE"}

package/dist/server/margin-admit.js

@@ -0,0 +1,282 @@
+/**
+ * GAP-256 free-intake admit + free@t0 entitlement (shared by server + admin).
+ *
+ * Pure decide lives in @revealui/core/margin-governor. This module is the I/O
+ * wrapper: read margin_snapshots, never COUNT(users). Waitlist enqueue is PR-4.
+ */
+import { getFeaturesForTier } from '@revealui/core/features';
+import { decideFreeIntake, freeCohortLimitsForMode, governorFlagsFromEnv, } from '@revealui/core/margin-governor';
+import { logger } from '@revealui/core/observability/logger';
+import { getClient } from '@revealui/db';
+import { accountEntitlements, accountMemberships, accounts, marginSnapshots, } from '@revealui/db/schema';
+import { and, desc, eq } from 'drizzle-orm';
+import { enqueueAdmissionWaitlist } from './admission-waitlist.js';
+import { ensureAccountOwnerPlatformAdmin } from './platform-roles.js';
+/** Hosted free open limits — lockstep with apps/server getHostedLimitsForTier('free'). */
+export const OPEN_FREE_LIMITS = {
+    maxSites: 1,
+    maxUsers: 3,
+    maxAgentTasks: 0,
+};
+function detectDeploymentMode(env) {
+    const raw = env.REVEALUI_DEPLOYMENT_MODE?.trim().toLowerCase();
+    if (raw === 'hosted')
+        return 'hosted';
+    if (raw === 'forge')
+        return 'forge';
+    if (env.REVEALUI_LICENSE_PRIVATE_KEY)
+        return 'hosted';
+    if (raw)
+        return 'unknown';
+    return 'hosted';
+}
+async function loadLatestSnapshot() {
+    try {
+        const db = getClient();
+        const [row] = await db
+            .select({
+            id: marginSnapshots.id,
+            mode: marginSnapshots.mode,
+            computedAt: marginSnapshots.computedAt,
+            netCents: marginSnapshots.netCents,
+            freeCostRatio: marginSnapshots.freeCostRatio,
+            projected7dCents: marginSnapshots.projected7dCents,
+        })
+            .from(marginSnapshots)
+            .orderBy(desc(marginSnapshots.computedAt))
+            .limit(1);
+        if (!row)
+            return null;
+        const mode = row.mode;
+        if (mode !== 'open' && mode !== 'lean' && mode !== 'waitlist') {
+            return null;
+        }
+        return {
+            id: row.id,
+            mode,
+            computedAt: row.computedAt,
+            netCents: row.netCents,
+            freeCostRatio: row.freeCostRatio,
+            projected7dCents: row.projected7dCents,
+        };
+    }
+    catch (err) {
+        logger.warn('[admit-free-intake] snapshot read failed; fail-open', {
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return null;
+    }
+}
+/**
+ * Pre-check free intake. Call **before** any users insert (K13).
+ * Shadow defaults → always admit (never waitlist response).
+ * Enforce waitlist → enqueue admission_waitlist and attach raw token.
+ */
+function leanMaxAgentTasksFromEnv(env) {
+    const raw = env.LEAN_FREE_MAX_AGENT_TASKS;
+    if (raw === undefined || raw.trim() === '')
+        return 250;
+    const n = Number.parseInt(raw, 10);
+    return Number.isFinite(n) && n > 0 ? n : 250;
+}
+export async function admitFreeIntake(input) {
+    const env = input.env ?? process.env;
+    const flags = governorFlagsFromEnv(env);
+    const snapshot = await loadLatestSnapshot();
+    const result = decideFreeIntake({
+        channel: input.channel,
+        deploymentMode: input.deploymentMode ?? detectDeploymentMode(env),
+        payingIntent: input.payingIntent ?? { kind: 'none' },
+        snapshot,
+        flags,
+        openLimits: OPEN_FREE_LIMITS,
+        leanMaxAgentTasks: leanMaxAgentTasksFromEnv(env),
+        now: input.now,
+    });
+    if (result.decision === 'waitlist') {
+        const email = input.email?.trim();
+        if (!email) {
+            // Cannot enqueue without identity — fail-open admit (not margin 403).
+            logger.warn('[admit-free-intake] waitlist without email; fail-open admit', {
+                channel: input.channel,
+                snapshotId: result.snapshotId,
+            });
+            return {
+                decision: 'admit',
+                mode: 'open',
+                cohortLimits: freeCohortLimitsForMode('open', OPEN_FREE_LIMITS),
+                snapshotId: result.snapshotId,
+                reason: 'waitlist_missing_email',
+                shadow: false,
+                flags,
+            };
+        }
+        try {
+            const enqueued = await enqueueAdmissionWaitlist({
+                email,
+                snapshotId: result.snapshotId,
+                modeAtEnqueue: 'waitlist',
+                source: input.source ?? input.channel,
+                now: input.now,
+            });
+            logger.info('[admit-free-intake]', {
+                channel: input.channel,
+                email: '[redacted]',
+                decision: 'waitlist',
+                mode: result.mode,
+                reason: result.reason,
+                shadow: result.shadow,
+                snapshotId: result.snapshotId,
+                governorEnabled: flags.enabled,
+                waitlistId: enqueued.id,
+                positionEstimate: enqueued.positionEstimate,
+            });
+            return {
+                ...result,
+                flags,
+                waitlistToken: enqueued.waitlistToken,
+                positionEstimate: enqueued.positionEstimate,
+            };
+        }
+        catch (err) {
+            // Enqueue failure must not 403; fail-open admit so signup can proceed.
+            logger.error('[admit-free-intake] waitlist enqueue failed; fail-open admit', err instanceof Error ? err : undefined, { channel: input.channel });
+            return {
+                decision: 'admit',
+                mode: 'open',
+                cohortLimits: freeCohortLimitsForMode('open', OPEN_FREE_LIMITS),
+                snapshotId: result.snapshotId,
+                reason: 'waitlist_enqueue_failed',
+                shadow: false,
+                flags,
+            };
+        }
+    }
+    logger.info('[admit-free-intake]', {
+        channel: input.channel,
+        email: input.email ? '[redacted]' : undefined,
+        decision: result.decision,
+        mode: result.mode,
+        reason: result.reason,
+        shadow: result.shadow,
+        snapshotId: result.snapshotId,
+        governorEnabled: flags.enabled,
+    });
+    return { ...result, flags };
+}
+/**
+ * Provision personal account + owner membership on hosted (same as signUp).
+ * Idempotent-ish: skips if user already has an active owner membership.
+ */
+export async function provisionHostedPersonalAccount(params) {
+    const { isHostedDeployment } = await import('@revealui/core/deployment-mode');
+    if (!isHostedDeployment(process.env)) {
+        return { skipped: true, reason: 'not_hosted' };
+    }
+    const db = getClient();
+    const [existing] = await db
+        .select({ accountId: accountMemberships.accountId })
+        .from(accountMemberships)
+        .where(and(eq(accountMemberships.userId, params.userId), eq(accountMemberships.role, 'owner'), eq(accountMemberships.status, 'active')))
+        .limit(1);
+    if (existing) {
+        return { accountId: existing.accountId };
+    }
+    const accountId = crypto.randomUUID();
+    const now = new Date();
+    await db.insert(accounts).values({
+        id: accountId,
+        name: `${params.displayName || 'RevealUI'} Workspace`,
+        slug: `acct-${accountId}`,
+        status: 'active',
+        createdAt: now,
+        updatedAt: now,
+    });
+    await db.insert(accountMemberships).values({
+        id: crypto.randomUUID(),
+        accountId,
+        userId: params.userId,
+        role: 'owner',
+        status: 'active',
+        createdAt: now,
+        updatedAt: now,
+    });
+    await ensureAccountOwnerPlatformAdmin(db, params.userId);
+    return { accountId };
+}
+/**
+ * Free entitlement@t0 (K15) with source=signup.
+ * Ensures owner membership/account exist first (passkey/oauth paths).
+ */
+export async function ensureFreeSignupEntitlement(params) {
+    const provisioned = await provisionHostedPersonalAccount({
+        userId: params.userId,
+        displayName: params.displayName ?? 'RevealUI',
+    });
+    if ('skipped' in provisioned && provisioned.skipped) {
+        // still try membership lookup on non-hosted? skip
+        if (provisioned.reason === 'not_hosted') {
+            return provisioned;
+        }
+    }
+    const db = getClient();
+    const now = params.now ?? new Date();
+    const [membership] = await db
+        .select({ accountId: accountMemberships.accountId })
+        .from(accountMemberships)
+        .where(and(eq(accountMemberships.userId, params.userId), eq(accountMemberships.role, 'owner'), eq(accountMemberships.status, 'active')))
+        .limit(1);
+    if (!membership) {
+        logger.warn('[free-signup-entitlement] no owner membership; skip', {
+            userId: params.userId,
+        });
+        return { skipped: true, reason: 'no_owner_membership' };
+    }
+    const accountId = membership.accountId;
+    const [existing] = await db
+        .select({ source: accountEntitlements.source })
+        .from(accountEntitlements)
+        .where(eq(accountEntitlements.accountId, accountId))
+        .limit(1);
+    if (existing?.source === 'stripe' || existing?.source === 'grant') {
+        // Do not overwrite paid/gifted rows
+        return { accountId };
+    }
+    const features = getFeaturesForTier('free');
+    const row = {
+        accountId,
+        planId: 'free',
+        tier: 'free',
+        status: 'active',
+        features,
+        limits: {
+            maxSites: params.cohortLimits.maxSites,
+            maxUsers: params.cohortLimits.maxUsers,
+            maxAgentTasks: params.cohortLimits.maxAgentTasks,
+        },
+        meteringStatus: 'active',
+        mode: 'live',
+        source: 'signup',
+        graceUntil: null,
+        lastEventAt: null,
+        updatedAt: now,
+        cogsBreakerTrippedAt: null,
+        cogsBreakerReason: null,
+    };
+    if (existing) {
+        // free_preserve: do not clobber existing free limits mid-cycle
+        await db
+            .update(accountEntitlements)
+            .set({ updatedAt: now })
+            .where(eq(accountEntitlements.accountId, accountId));
+    }
+    else {
+        await db.insert(accountEntitlements).values(row);
+    }
+    logger.info('[free-signup-entitlement] upserted', {
+        accountId,
+        userId: params.userId,
+        maxAgentTasks: params.cohortLimits.maxAgentTasks,
+    });
+    return { accountId };
+}

package/dist/server/platform-operator.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Platform-operator entitlement.
+ *
+ * Super-admin (`_json.roles`) is the instance operator (first signup / bootstrap).
+ * Hosted account owners are shell admins, not super-admin.
+ *
+ * Operators receive a real Enterprise `account_entitlements` row (source=grant).
+ * Gates stay fail-closed. This is not an identity bypass.
+ *
+ * Live on `@revealui/auth/platform-operator`, not the `/server` barrel.
+ * Route tests bare-mock that barrel for getSession (same reason as audit-storage).
+ */
+/** Lockstep with `getHostedLimitsForTier('enterprise')` in apps/server. */
+export declare const PLATFORM_OPERATOR_LIMITS: {
+    readonly maxAgentTasks: number;
+};
+export declare function rolesFromUserJson(json: unknown): string[];
+/** Session/engine user fields this check reads. Extra keys (id, email) are fine. */
+export interface PlatformOperatorUserView {
+    id?: string;
+    _json?: unknown;
+    roles?: unknown;
+}
+/**
+ * True when this user is the instance operator (engine super-admin).
+ * Accepts session `_json.roles` and engine `roles`.
+ */
+export declare function isPlatformOperatorUser(user: PlatformOperatorUserView | null | undefined): boolean;
+export interface EnsurePlatformOperatorEntitlementResult {
+    accountId: string;
+    wrote: boolean;
+}
+export interface EnsurePlatformOperatorSkipped {
+    skipped: true;
+    reason: string;
+}
+/**
+ * Upsert Enterprise (source=grant) for a platform operator's billing account.
+ *
+ * Skips users who are not super-admin. Idempotent when the row is already
+ * a healthy Enterprise grant with `ai`.
+ */
+export declare function ensurePlatformOperatorEntitlement(params: {
+    userId: string;
+    accountId?: string;
+    now?: Date;
+}): Promise<EnsurePlatformOperatorEntitlementResult | EnsurePlatformOperatorSkipped>;
+//# sourceMappingURL=platform-operator.d.ts.map

package/dist/server/platform-operator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-operator.d.ts","sourceRoot":"","sources":["../../src/server/platform-operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB;;CAE3B,CAAC;AAIX,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAiBzD;AAED,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACvC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAQjG;AAED,MAAM,WAAW,uCAAuC;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AA4BD;;;;;GAKG;AACH,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,uCAAuC,GAAG,6BAA6B,CAAC,CA0FnF"}

package/dist/server/platform-operator.js

@@ -0,0 +1,152 @@
+/**
+ * Platform-operator entitlement.
+ *
+ * Super-admin (`_json.roles`) is the instance operator (first signup / bootstrap).
+ * Hosted account owners are shell admins, not super-admin.
+ *
+ * Operators receive a real Enterprise `account_entitlements` row (source=grant).
+ * Gates stay fail-closed. This is not an identity bypass.
+ *
+ * Live on `@revealui/auth/platform-operator`, not the `/server` barrel.
+ * Route tests bare-mock that barrel for getSession (same reason as audit-storage).
+ */
+import { getConfiguredStripeMode } from '@revealui/config/stripe-mode';
+import { getFeaturesForTier } from '@revealui/core/features';
+import { logger } from '@revealui/core/observability/logger';
+import { getClient } from '@revealui/db';
+import { accountEntitlements, accountMemberships, users } from '@revealui/db/schema';
+import { and, eq } from 'drizzle-orm';
+/** Lockstep with `getHostedLimitsForTier('enterprise')` in apps/server. */
+export const PLATFORM_OPERATOR_LIMITS = {
+    maxAgentTasks: Number.MAX_SAFE_INTEGER,
+};
+const SUPER_ADMIN_ROLE = 'super-admin';
+export function rolesFromUserJson(json) {
+    let value = json;
+    if (typeof value === 'string') {
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            return [];
+        }
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return [];
+    }
+    const roles = value.roles;
+    if (!Array.isArray(roles)) {
+        return [];
+    }
+    return roles.filter((role) => typeof role === 'string');
+}
+/**
+ * True when this user is the instance operator (engine super-admin).
+ * Accepts session `_json.roles` and engine `roles`.
+ */
+export function isPlatformOperatorUser(user) {
+    if (!user) {
+        return false;
+    }
+    if (Array.isArray(user.roles) && user.roles.includes(SUPER_ADMIN_ROLE)) {
+        return true;
+    }
+    return rolesFromUserJson(user._json).includes(SUPER_ADMIN_ROLE);
+}
+function featureRecord(features) {
+    return Object.fromEntries(Object.entries(features).filter((entry) => typeof entry[1] === 'boolean'));
+}
+function enterpriseRowComplete(row) {
+    if (row.tier !== 'enterprise') {
+        return false;
+    }
+    if (row.status !== 'active' && row.status !== 'trialing') {
+        return false;
+    }
+    const features = row.features && typeof row.features === 'object' && !Array.isArray(row.features)
+        ? row.features
+        : {};
+    return features.ai === true;
+}
+/**
+ * Upsert Enterprise (source=grant) for a platform operator's billing account.
+ *
+ * Skips users who are not super-admin. Idempotent when the row is already
+ * a healthy Enterprise grant with `ai`.
+ */
+export async function ensurePlatformOperatorEntitlement(params) {
+    const db = getClient();
+    const [user] = await db
+        .select({ id: users.id, json: users._json })
+        .from(users)
+        .where(eq(users.id, params.userId))
+        .limit(1);
+    if (!(user && isPlatformOperatorUser({ _json: user.json }))) {
+        return { skipped: true, reason: 'not_platform_operator' };
+    }
+    const ownerMemberships = await db
+        .select({ accountId: accountMemberships.accountId })
+        .from(accountMemberships)
+        .where(and(eq(accountMemberships.userId, params.userId), eq(accountMemberships.role, 'owner'), eq(accountMemberships.status, 'active')));
+    const ownerIds = ownerMemberships.map((row) => row.accountId);
+    if (params.accountId && !ownerIds.includes(params.accountId)) {
+        logger.warn('[platform-operator-entitlement] refused non-owner workspace', {
+            userId: params.userId,
+            accountId: params.accountId,
+        });
+        return { skipped: true, reason: 'not_owner_workspace' };
+    }
+    const accountId = params.accountId ?? ownerIds[0];
+    if (!accountId) {
+        logger.warn('[platform-operator-entitlement] no owner membership; skip', {
+            userId: params.userId,
+        });
+        return { skipped: true, reason: 'no_owner_membership' };
+    }
+    const mode = getConfiguredStripeMode();
+    const [existing] = await db
+        .select({
+        tier: accountEntitlements.tier,
+        status: accountEntitlements.status,
+        features: accountEntitlements.features,
+        lastEventAt: accountEntitlements.lastEventAt,
+    })
+        .from(accountEntitlements)
+        .where(and(eq(accountEntitlements.accountId, accountId), eq(accountEntitlements.mode, mode)))
+        .limit(1);
+    if (existing && enterpriseRowComplete(existing)) {
+        return { accountId, wrote: false };
+    }
+    const now = params.now ?? new Date();
+    const values = {
+        planId: 'enterprise',
+        tier: 'enterprise',
+        status: 'active',
+        features: featureRecord(getFeaturesForTier('enterprise')),
+        limits: { ...PLATFORM_OPERATOR_LIMITS },
+        meteringStatus: 'active',
+        mode,
+        source: 'grant',
+        graceUntil: null,
+        lastEventAt: existing ? (existing.lastEventAt ?? null) : null,
+        updatedAt: now,
+        cogsBreakerTrippedAt: null,
+        cogsBreakerReason: null,
+    };
+    if (existing) {
+        await db
+            .update(accountEntitlements)
+            .set(values)
+            .where(and(eq(accountEntitlements.accountId, accountId), eq(accountEntitlements.mode, mode)));
+    }
+    else {
+        await db.insert(accountEntitlements).values({ accountId, ...values });
+    }
+    logger.info('[platform-operator-entitlement] granted enterprise', {
+        accountId,
+        userId: params.userId,
+        mode,
+        previousTier: existing?.tier ?? null,
+    });
+    return { accountId, wrote: true };
+}

package/dist/server/platform-roles.d.ts

@@ -39,4 +39,21 @@ export declare function ensureAccountOwnerPlatformAdmin(db: Database, userId: st
     nextRole: string;
     updated: boolean;
 } | null>;
+/**
+ * If the user has an active account_memberships.owner seat, ensure users.role
+ * is shell-admin (admin/owner). No-op for members/admins who are not owners.
+ *
+ * GAP-473 residual: accounts provisioned before ensureAccountOwnerPlatformAdmin
+ * (or any race that left membership owner + users.role=viewer) get shell access
+ * on the next session mint without a manual backfill. Never promotes non-owners.
+ *
+ * Best-effort call sites: createSession (covers password/MFA/passkey/OAuth mint).
+ */
+export declare function ensureShellAdminIfAccountOwner(db: Database, userId: string): Promise<{
+    previousRole: string;
+    nextRole: string;
+    updated: boolean;
+} | null>;
+/** Fresh users.role after session mint / shell repair (for revealui-role cookie). */
+export declare function readUsersRole(db: Database, userId: string): Promise<string | null>;
 //# sourceMappingURL=platform-roles.d.ts.map

package/dist/server/platform-roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-roles.d.ts","sourceRoot":"","sources":["../../src/server/platform-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAC;AAE3F;;;GAGG;AACH,eAAO,MAAM,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAIhE,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKvE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEjF;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAmB9E"}
+{"version":3,"file":"platform-roles.d.ts","sourceRoot":"","sources":["../../src/server/platform-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAC;AAE3F;;;GAGG;AACH,eAAO,MAAM,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAIhE,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKvE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEjF;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAmB9E;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAkB9E;AAED,qFAAqF;AACrF,wBAAsB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOxF"}

package/dist/server/platform-roles.js

@@ -12,8 +12,8 @@
  * via users.role = admin so proxy isAdminRole + /settings (API keys) work.
  * That is NOT super-admin.
  */
-import { users } from '@revealui/db/schema';
-import { eq } from 'drizzle-orm';
+import { accountMemberships, users } from '@revealui/db/schema';
+import { and, eq } from 'drizzle-orm';
 /** DB column values that already pass isAdminRole / shell admin cookie gate. */
 export const PLATFORM_SHELL_ADMIN_ROLES = new Set(['owner', 'admin']);
 /**
@@ -63,3 +63,33 @@ export async function ensureAccountOwnerPlatformAdmin(db, userId) {
     await db.update(users).set({ role: nextRole }).where(eq(users.id, userId));
     return { previousRole, nextRole, updated: true };
 }
+/**
+ * If the user has an active account_memberships.owner seat, ensure users.role
+ * is shell-admin (admin/owner). No-op for members/admins who are not owners.
+ *
+ * GAP-473 residual: accounts provisioned before ensureAccountOwnerPlatformAdmin
+ * (or any race that left membership owner + users.role=viewer) get shell access
+ * on the next session mint without a manual backfill. Never promotes non-owners.
+ *
+ * Best-effort call sites: createSession (covers password/MFA/passkey/OAuth mint).
+ */
+export async function ensureShellAdminIfAccountOwner(db, userId) {
+    const [membership] = await db
+        .select({ id: accountMemberships.id })
+        .from(accountMemberships)
+        .where(and(eq(accountMemberships.userId, userId), eq(accountMemberships.role, 'owner'), eq(accountMemberships.status, 'active')))
+        .limit(1);
+    if (!membership) {
+        return null;
+    }
+    return ensureAccountOwnerPlatformAdmin(db, userId);
+}
+/** Fresh users.role after session mint / shell repair (for revealui-role cookie). */
+export async function readUsersRole(db, userId) {
+    const [row] = await db
+        .select({ role: users.role })
+        .from(users)
+        .where(eq(users.id, userId))
+        .limit(1);
+    return row?.role ?? null;
+}

package/dist/server/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAQjD,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;CACzB;AAaD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAEtF;AAED,qCAAqC;AACrC,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CA0B3F;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAI1E;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAgI7B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAmE9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAqC9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA+BtE;AAED;;;;GAIG;AACH;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBzE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AASjD,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;CACzB;AAaD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAEtF;AAED,qCAAqC;AACrC,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CA0B3F;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAI1E;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAgI7B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAgF9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAqC9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA+BtE;AAED;;;;GAIG;AACH;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBzE"}

package/dist/server/session.js

@@ -10,6 +10,7 @@ import { sessions, users } from '@revealui/db/schema';
 import { and, eq, gt, inArray, isNull, ne } from 'drizzle-orm';
 import { hashToken } from '../utils/token.js';
 import { DatabaseError, TokenError } from './errors.js';
+import { ensureShellAdminIfAccountOwner } from './platform-roles.js';
 const DEFAULT_SESSION_BINDING = {
     enforceUserAgent: true,
     enforceIp: false,
@@ -216,6 +217,18 @@ export async function createSession(userId, options) {
             logger.error('Error getting database client');
             throw new DatabaseError('Database connection failed', error);
         }
+        // GAP-473: membership owner + stale users.role=viewer must not mint a
+        // session that still fails the proxy admin shell gate. Best-effort only —
+        // never fail session mint if role repair fails.
+        try {
+            await ensureShellAdminIfAccountOwner(db, userId);
+        }
+        catch (roleRepairError) {
+            logger.warn('ensureShellAdminIfAccountOwner failed during createSession', {
+                userId,
+                message: roleRepairError instanceof Error ? roleRepairError.message : String(roleRepairError),
+            });
+        }
         // Generate secure session token
         let token;
         let tokenHash;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/auth",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Database-backed session auth for Hono and Next.js — bcrypt, OAuth, brute-force protection, rate limiting, password reset. Ships with RevealUI.",
   "keywords": [
     "auth",
@@ -17,10 +17,10 @@
     "jose": "^5.10.0",
     "zod": "^4.4.3",
     "@revealui/config": "0.6.0",
-    "@revealui/contracts": "0.8.2",
-    "@revealui/core": "0.13.0",
+    "@revealui/contracts": "0.8.3",
+    "@revealui/core": "0.14.0",
     "@revealui/db": "0.10.0",
-    "@revealui/security": "0.6.1"
+    "@revealui/security": "0.8.0"
   },
   "devDependencies": {
     "@simplewebauthn/browser": "^13.3.0",
@@ -31,7 +31,7 @@
     "happy-dom": "^20.10.6",
     "react": "19.2.8",
     "selfsigned": "2.4.1",
-    "typescript": "^6.0.3",
+    "typescript": "6.0.3",
     "vitest": "^4.1.10",
     "xml-crypto": "6.1.2",
     "@revealui/dev": "0.1.0"
@@ -50,11 +50,21 @@
       "import": "./dist/server/index.js",
       "default": "./dist/server/index.js"
     },
+    "./server/storage": {
+      "types": "./dist/server/storage/index.d.ts",
+      "import": "./dist/server/storage/index.js",
+      "default": "./dist/server/storage/index.js"
+    },
     "./audit-storage": {
       "types": "./dist/server/audit-storage.d.ts",
       "import": "./dist/server/audit-storage.js",
       "default": "./dist/server/audit-storage.js"
     },
+    "./platform-operator": {
+      "types": "./dist/server/platform-operator.d.ts",
+      "import": "./dist/server/platform-operator.js",
+      "default": "./dist/server/platform-operator.js"
+    },
     "./react": {
       "types": "./dist/react/index.d.ts",
       "import": "./dist/react/index.js",