@revealui/core 0.12.2 → 0.12.4

package/dist/license.d.ts

@@ -368,6 +368,12 @@ export declare function coversRenewalBound(storedExp: number | null, newBound: n
  * for a perpetual token (no exp claim) or one that cannot be decoded.
  */
 export declare function readLicenseExp(licenseKey: string): Promise<number | null>;
+/**
+ * Reads the `jti` claim from a license JWT WITHOUT verifying its signature.
+ * Used when recording per-token denylist rows after a row-level revoke
+ * (GAP-260 P4-5). Never use as an authentication decision.
+ */
+export declare function readLicenseJti(licenseKey: string): Promise<string | null>;
 /**
  * Generates a signed license key JWT.
  * Server-only in practice (requires the private key) but edge-compatible —

package/dist/license.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/F,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,qBAAqB;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAmBD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAEjF;AAED,qCAAqC;AACrC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;iBAuBxB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAW5E;AASD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAElF;AAkBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAOxC;AAYD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAShC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,iBAAiB,GAAE,MAA4B,GAC9C,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAEhC;AA+GD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA4D9B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CA8C9D;AAaD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAG5C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAGzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAQ5F;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,WAAW,GAAG,OAAO,CA2B7D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,GAAE,WAAmB,GAAG,kBAAkB,CAkEtF;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAE5D;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,QAAqB,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,qBAAqB,QAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,EAClC,KAAK,GAAE,MAAmB,GACzB,MAAM,CAIR;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAE5D;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC,IAAI,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACvE,UAAU,EAAE,MAAM,EAClB,gBAAgB,GAAE,MAAM,GAAG,IAAuC,EAClE,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC"}
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/F,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,qBAAqB;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAmBD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAEjF;AAED,qCAAqC;AACrC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;iBAuBxB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAW5E;AASD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAElF;AAkBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAOxC;AAYD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAShC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,iBAAiB,GAAE,MAA4B,GAC9C,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAEhC;AA+GD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA4D9B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CA8C9D;AAaD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAG5C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAGzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAQ5F;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,WAAW,GAAG,OAAO,CA2B7D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,GAAE,WAAmB,GAAG,kBAAkB,CAkEtF;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAE5D;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,QAAqB,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,qBAAqB,QAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,EAClC,KAAK,GAAE,MAAmB,GACzB,MAAM,CAIR;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAE5D;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC,IAAI,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACvE,UAAU,EAAE,MAAM,EAClB,gBAAgB,GAAE,MAAM,GAAG,IAAuC,EAClE,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC"}

package/dist/license.js

@@ -764,6 +764,21 @@ export async function readLicenseExp(licenseKey) {
         return null;
     }
 }
+/**
+ * Reads the `jti` claim from a license JWT WITHOUT verifying its signature.
+ * Used when recording per-token denylist rows after a row-level revoke
+ * (GAP-260 P4-5). Never use as an authentication decision.
+ */
+export async function readLicenseJti(licenseKey) {
+    try {
+        const jose = await getJose();
+        const payload = jose.decodeJwt(licenseKey);
+        return typeof payload.jti === 'string' && payload.jti.length > 0 ? payload.jti : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Generates a signed license key JWT.
  * Server-only in practice (requires the private key) but edge-compatible —

package/dist/observability/capture.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Framework-agnostic error/event capture (Phase 2.3.3).
+ *
+ * Prefer this over `@sentry/nextjs`. Sink is the structured logger
+ * (`@revealui/core/observability/logger` → console or remote via LoggerConfig).
+ * Browser-safe: no node: builtins. Node handlers are gated on `process`.
+ */
+import type { LogContext } from './logger.js';
+export interface CaptureContext extends LogContext {
+    tags?: Record<string, string>;
+}
+export interface InitNodeObservabilityOptions {
+    /** Service name for log context (default `app`). */
+    service?: string;
+    /**
+     * Install process `unhandledRejection` / `uncaughtException` handlers.
+     * Default true. Idempotent across multiple calls.
+     */
+    installProcessHandlers?: boolean;
+}
+export interface InitBrowserObservabilityOptions {
+    /** Service name for log context (default `app`). */
+    service?: string;
+    /**
+     * Install `window` error + unhandledrejection listeners.
+     * Default true. Idempotent across multiple calls.
+     */
+    installWindowHandlers?: boolean;
+}
+/**
+ * Strip secret-shaped keys from capture context.
+ * Never logs form bodies or credentials.
+ */
+export declare function sanitizeCaptureContext(context?: CaptureContext): LogContext | undefined;
+/**
+ * Capture an exception to the configured sink (console / remote logger).
+ */
+export declare function captureException(error: unknown, context?: CaptureContext): void;
+/**
+ * Capture a non-error event/message.
+ */
+export declare function captureMessage(message: string, context?: CaptureContext): void;
+/**
+ * Capture a failed server action. Pass action id only — never the body.
+ */
+export declare function captureActionFailure(actionId: string, error: unknown, context?: CaptureContext): void;
+/**
+ * Bind a request/correlation id onto the default logger context when present.
+ */
+export declare function bindRequestId(requestId: string | null | undefined): void;
+/**
+ * Node/SSR init: service context + optional process-level handlers.
+ * Call once from the RSC/Hono entry.
+ */
+export declare function initNodeObservability(options?: InitNodeObservabilityOptions): void;
+/**
+ * Browser init: service context + optional window-level handlers.
+ * Call once from the client entry (before hydrate).
+ */
+export declare function initBrowserObservability(options?: InitBrowserObservabilityOptions): void;
+/** Test-only: reset install flags (vitest). */
+export declare function resetObservabilityInstallFlagsForTests(): void;
+//# sourceMappingURL=capture.d.ts.map

package/dist/observability/capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../../src/observability/capture.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqB9C,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,+BAA+B;IAC9C,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAKD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,GAAG,SAAS,CAQvF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAG/E;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAE9E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,cAAc,GACvB,IAAI,CAMN;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAIxE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,4BAAiC,GAAG,IAAI,CAgBtF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,+BAAoC,GAAG,IAAI,CAmB5F;AAED,+CAA+C;AAC/C,wBAAgB,sCAAsC,IAAI,IAAI,CAG7D"}

package/dist/observability/capture.js

@@ -0,0 +1,125 @@
+/**
+ * Framework-agnostic error/event capture (Phase 2.3.3).
+ *
+ * Prefer this over `@sentry/nextjs`. Sink is the structured logger
+ * (`@revealui/core/observability/logger` → console or remote via LoggerConfig).
+ * Browser-safe: no node: builtins. Node handlers are gated on `process`.
+ */
+import { logError, logger } from './logger.js';
+/** Keys that must never ride along on capture context (secrets / bodies). */
+const FORBIDDEN_CONTEXT_KEYS = new Set([
+    'password',
+    'secret',
+    'token',
+    'authorization',
+    'cookie',
+    'cookies',
+    'body',
+    'formdata',
+    'form',
+    'formstate',
+    'credentials',
+    'apikey',
+    'api_key',
+    'sessiontoken',
+]);
+let nodeHandlersInstalled = false;
+let browserHandlersInstalled = false;
+/**
+ * Strip secret-shaped keys from capture context.
+ * Never logs form bodies or credentials.
+ */
+export function sanitizeCaptureContext(context) {
+    if (!context)
+        return undefined;
+    const out = {};
+    for (const [key, value] of Object.entries(context)) {
+        if (FORBIDDEN_CONTEXT_KEYS.has(key.toLowerCase()))
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Capture an exception to the configured sink (console / remote logger).
+ */
+export function captureException(error, context) {
+    const err = error instanceof Error ? error : new Error(String(error));
+    logError(err, sanitizeCaptureContext(context));
+}
+/**
+ * Capture a non-error event/message.
+ */
+export function captureMessage(message, context) {
+    logger.info(message, sanitizeCaptureContext(context));
+}
+/**
+ * Capture a failed server action. Pass action id only — never the body.
+ */
+export function captureActionFailure(actionId, error, context) {
+    captureException(error, {
+        ...context,
+        actionId,
+        kind: 'action_failure',
+    });
+}
+/**
+ * Bind a request/correlation id onto the default logger context when present.
+ */
+export function bindRequestId(requestId) {
+    if (requestId && requestId.length > 0) {
+        logger.setContext({ requestId });
+    }
+}
+/**
+ * Node/SSR init: service context + optional process-level handlers.
+ * Call once from the RSC/Hono entry.
+ */
+export function initNodeObservability(options = {}) {
+    const service = options.service ?? 'app';
+    logger.setContext({ service, runtime: 'node' });
+    logger.info('observability: node init', { service, runtime: 'node' });
+    if (options.installProcessHandlers === false)
+        return;
+    if (nodeHandlersInstalled)
+        return;
+    if (typeof process === 'undefined' || typeof process.on !== 'function')
+        return;
+    nodeHandlersInstalled = true;
+    process.on('unhandledRejection', (reason) => {
+        captureException(reason, { kind: 'unhandledRejection' });
+    });
+    process.on('uncaughtException', (err) => {
+        captureException(err, { kind: 'uncaughtException' });
+    });
+}
+/**
+ * Browser init: service context + optional window-level handlers.
+ * Call once from the client entry (before hydrate).
+ */
+export function initBrowserObservability(options = {}) {
+    const service = options.service ?? 'app';
+    logger.setContext({ service, runtime: 'browser' });
+    logger.info('observability: browser init', { service, runtime: 'browser' });
+    if (options.installWindowHandlers === false)
+        return;
+    if (browserHandlersInstalled)
+        return;
+    if (typeof window === 'undefined')
+        return;
+    browserHandlersInstalled = true;
+    window.addEventListener('error', (event) => {
+        captureException(event.error ?? event.message, {
+            kind: 'window.error',
+            filename: event.filename,
+        });
+    });
+    window.addEventListener('unhandledrejection', (event) => {
+        captureException(event.reason, { kind: 'unhandledrejection' });
+    });
+}
+/** Test-only: reset install flags (vitest). */
+export function resetObservabilityInstallFlagsForTests() {
+    nodeHandlersInstalled = false;
+    browserHandlersInstalled = false;
+}

package/dist/observability/cron-failure-alert.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Shared cron-failure alert path for apps/admin + apps/server.
+ *
+ * Apps inject their Sentry SDK (+ optional email) so this module never depends
+ * on `@sentry/node` or `@sentry/nextjs`. Logger is always the canonical
+ * `@revealui/core/observability/logger` facade.
+ *
+ * Extracted from the intentional admin/server dual (revealui#835 follow-up)
+ * after the 2026-07-31 redundancy audit.
+ */
+export interface CronFailureContext {
+    jobName: string;
+    error: Error;
+    severity?: 'warn' | 'error' | 'fatal';
+    metadata?: Record<string, unknown>;
+}
+/** Minimal Sentry surface both Node and Next SDKs satisfy. */
+export interface CronFailureSentryScope {
+    setTag(key: string, value: string): void;
+    setLevel(level: 'fatal' | 'error' | 'warning' | string): void;
+    setContext(name: string, context: Record<string, unknown>): void;
+}
+export interface CronFailureSentryLike {
+    withScope(callback: (scope: CronFailureSentryScope) => void): void;
+    captureException(error: Error): void;
+}
+export interface CronFailureEmailPayload {
+    to: string;
+    subject: string;
+    html: string;
+    text: string;
+}
+export interface SendCronFailureAlertOptions {
+    /** When omitted, Sentry capture is skipped. */
+    sentry?: CronFailureSentryLike;
+    /**
+     * Destination for the optional email step. When omitted, reads
+     * `REVEALUI_ALERT_EMAIL` from `env`. Empty/undefined skips email.
+     */
+    alertEmail?: string | null;
+    /** Required for email delivery when an alert address is present. */
+    sendEmail?: (payload: CronFailureEmailPayload) => Promise<void>;
+    env?: NodeJS.ProcessEnv;
+}
+export declare function buildCronFailureEmailBody(context: CronFailureContext): {
+    subject: string;
+    html: string;
+    text: string;
+};
+/**
+ * Centralized alert path for cron failures. Always logs at the chosen
+ * severity. Optionally captures to Sentry and/or sends email via injected
+ * adapters.
+ *
+ * Never throws — each step is independent. A failure in one step is logged
+ * and does not prevent the others.
+ */
+export declare function sendCronFailureAlert(context: CronFailureContext, options?: SendCronFailureAlertOptions): Promise<void>;
+//# sourceMappingURL=cron-failure-alert.d.ts.map

package/dist/observability/cron-failure-alert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron-failure-alert.d.ts","sourceRoot":"","sources":["../../src/observability/cron-failure-alert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,8DAA8D;AAC9D,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9D,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAClE;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,IAAI,GAAG,IAAI,CAAC;IACnE,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,2BAA2B;IAC1C,+CAA+C;IAC/C,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oEAAoE;IACpE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,kBAAkB,GAAG;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAqCA;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,IAAI,CAAC,CA0Df"}

package/dist/observability/cron-failure-alert.js

@@ -0,0 +1,109 @@
+/**
+ * Shared cron-failure alert path for apps/admin + apps/server.
+ *
+ * Apps inject their Sentry SDK (+ optional email) so this module never depends
+ * on `@sentry/node` or `@sentry/nextjs`. Logger is always the canonical
+ * `@revealui/core/observability/logger` facade.
+ *
+ * Extracted from the intentional admin/server dual (revealui#835 follow-up)
+ * after the 2026-07-31 redundancy audit.
+ */
+import { logger } from './logger.js';
+export function buildCronFailureEmailBody(context) {
+    const { jobName, error, severity = 'error', metadata } = context;
+    const subject = `[CRON FAILURE] ${jobName}: ${error.message}`;
+    const metaRows = metadata
+        ? Object.entries(metadata)
+            .map(([k, v]) => `<tr><td style="padding:2px 8px;font-weight:bold">${k}</td><td style="padding:2px 8px">${String(v)}</td></tr>`)
+            .join('')
+        : '';
+    const metaSection = metaRows
+        ? `<h3>Metadata</h3><table style="border-collapse:collapse">${metaRows}</table>`
+        : '';
+    const metaText = metadata
+        ? `\nMetadata:\n${Object.entries(metadata)
+            .map(([k, v]) => `  ${k}: ${String(v)}`)
+            .join('\n')}`
+        : '';
+    const html = `<!DOCTYPE html>
+<html>
+<head><meta charset="utf-8"><title>${subject}</title></head>
+<body style="font-family:Arial,sans-serif;line-height:1.6;color:#333;max-width:600px;margin:0 auto;padding:20px">
+  <h1 style="color:#dc2626">Cron Job Failure</h1>
+  <p><strong>Job:</strong> ${jobName}</p>
+  <p><strong>Severity:</strong> ${severity}</p>
+  <p><strong>Error:</strong> ${error.message}</p>
+  ${error.stack ? `<pre style="background:#f5f5f5;padding:12px;overflow:auto;font-size:12px">${error.stack}</pre>` : ''}
+  ${metaSection}
+  <p style="color:#666;font-size:12px">Automated alert from api.revealui.com — ${new Date().toISOString()}</p>
+</body>
+</html>`;
+    const text = `Cron Job Failure\n\nJob: ${jobName}\nSeverity: ${severity}\nError: ${error.message}${metaText}\n\nTimestamp: ${new Date().toISOString()}`;
+    return { subject, html, text };
+}
+/**
+ * Centralized alert path for cron failures. Always logs at the chosen
+ * severity. Optionally captures to Sentry and/or sends email via injected
+ * adapters.
+ *
+ * Never throws — each step is independent. A failure in one step is logged
+ * and does not prevent the others.
+ */
+export async function sendCronFailureAlert(context, options = {}) {
+    const { jobName, error, severity = 'error', metadata } = context;
+    const env = options.env ?? process.env;
+    // Step 1 — always log
+    try {
+        const logPayload = { jobName, ...(metadata ?? {}) };
+        if (severity === 'fatal' || severity === 'error') {
+            logger.error(`[cron-alert] ${jobName} failed: ${error.message}`, error, logPayload);
+        }
+        else {
+            logger.warn(`[cron-alert] ${jobName} failed: ${error.message}`, logPayload);
+        }
+    }
+    catch (logErr) {
+        // Last-resort: if the logger itself is broken, write directly to stderr
+        // so the failure is at least visible in Vercel function logs.
+        process.stderr.write(`[cron-alert] logger failed while reporting ${jobName}: ${logErr instanceof Error ? logErr.message : String(logErr)}\n`);
+    }
+    // Step 2 — Sentry (skipped when no adapter injected)
+    const sentry = options.sentry;
+    if (sentry) {
+        try {
+            sentry.withScope((scope) => {
+                scope.setTag('cron_job', jobName);
+                scope.setTag('alert_severity', severity);
+                if (metadata) {
+                    scope.setContext('metadata', metadata);
+                }
+                if (severity === 'fatal') {
+                    scope.setLevel('fatal');
+                }
+                else if (severity === 'warn') {
+                    scope.setLevel('warning');
+                }
+                sentry.captureException(error);
+            });
+        }
+        catch (sentryErr) {
+            logger.warn(`[cron-alert] Sentry capture failed for ${jobName}`, {
+                detail: sentryErr instanceof Error ? sentryErr.message : String(sentryErr),
+            });
+        }
+    }
+    // Step 3 — optional email
+    const alertEmail = options.alertEmail !== undefined ? options.alertEmail : env.REVEALUI_ALERT_EMAIL;
+    if (!(alertEmail && options.sendEmail)) {
+        return;
+    }
+    try {
+        const { subject, html, text } = buildCronFailureEmailBody(context);
+        await options.sendEmail({ to: alertEmail, subject, html, text });
+    }
+    catch (emailErr) {
+        logger.warn(`[cron-alert] email delivery failed for ${jobName}`, {
+            detail: emailErr instanceof Error ? emailErr.message : String(emailErr),
+        });
+    }
+}

package/dist/observability/index.d.ts

@@ -9,6 +9,8 @@
  * distributed tracing is wired.
  */
 export * from './alerts.js';
+export * from './capture.js';
+export * from './cron-failure-alert.js';
 export * from './health-check.js';
 export * from './logger.js';
 export * from './metrics.js';

package/dist/observability/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/observability/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/observability/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC"}

package/dist/observability/index.js

@@ -9,6 +9,8 @@
  * distributed tracing is wired.
  */
 export * from './alerts.js';
+export * from './capture.js';
+export * from './cron-failure-alert.js';
 export * from './health-check.js';
 export * from './logger.js';
 export * from './metrics.js';

package/dist/revforge-license-boot.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Shared Forge / self-host license boot gate for apps/admin + apps/server.
+ *
+ * Extracted from the intentional admin/server dual after the 2026-08-02 fleet
+ * redundancy audit. Server previously owned the full check (customer id, kid
+ * mismatch, domain binding); admin had a shortened copy. One implementation
+ * so the two cannot drift (instrumentation.ts TODO resolved).
+ *
+ * Throws on failure. Callers that must not throw (Next.js instrumentation)
+ * catch and `process.exit(1)`.
+ */
+export type EnvMap = Record<string, string | undefined>;
+/**
+ * GAP-436 (owner-ruled 2026-07-26): plain OSS/self-host opt-in when no key is
+ * present. Stamped RevForge kits always bake a key, so they never hit this.
+ */
+export declare const ALLOW_UNLICENSED_SELF_HOST_ENV = "REVEALUI_ALLOW_UNLICENSED_SELF_HOST";
+/**
+ * Extracts the `kid` (key id) from a JWT protected header WITHOUT verifying
+ * the signature. Used only to sharpen error messages after cryptographic
+ * verification has already failed.
+ */
+export declare function decodeJwtKid(jwt: string): string | undefined;
+/**
+ * Forge-mode license enforcement at process boot.
+ *
+ * - Hosted mode: no-op.
+ * - Forge mode + no key + ALLOW_UNLICENSED_SELF_HOST: Free (OSS) tier log, return.
+ * - Forge mode otherwise: require key + public key, verify JWT, optional
+ *   customerId + domain binding.
+ *
+ * Honors `SKIP_ENV_VALIDATION=true` for Docker build / tests.
+ */
+export declare function validateForgeLicenseAtStartup(env?: EnvMap): Promise<void>;
+//# sourceMappingURL=revforge-license-boot.d.ts.map

package/dist/revforge-license-boot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revforge-license-boot.d.ts","sourceRoot":"","sources":["../src/revforge-license-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,wCAAwC,CAAC;AAEpF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAa5D;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,GAAE,MAA8B,GAClC,OAAO,CAAC,IAAI,CAAC,CA6Ef"}

package/dist/revforge-license-boot.js

@@ -0,0 +1,115 @@
+/**
+ * Shared Forge / self-host license boot gate for apps/admin + apps/server.
+ *
+ * Extracted from the intentional admin/server dual after the 2026-08-02 fleet
+ * redundancy audit. Server previously owned the full check (customer id, kid
+ * mismatch, domain binding); admin had a shortened copy. One implementation
+ * so the two cannot drift (instrumentation.ts TODO resolved).
+ *
+ * Throws on failure. Callers that must not throw (Next.js instrumentation)
+ * catch and `process.exit(1)`.
+ */
+import { detectDeploymentMode as detectDeploymentModeCore, } from './deployment-mode.js';
+import { computeKeyId, hostMatchesLicensedDomains, validateLicenseKey } from './license.js';
+import { logger } from './observability/logger.js';
+/**
+ * GAP-436 (owner-ruled 2026-07-26): plain OSS/self-host opt-in when no key is
+ * present. Stamped RevForge kits always bake a key, so they never hit this.
+ */
+export const ALLOW_UNLICENSED_SELF_HOST_ENV = 'REVEALUI_ALLOW_UNLICENSED_SELF_HOST';
+/**
+ * Extracts the `kid` (key id) from a JWT protected header WITHOUT verifying
+ * the signature. Used only to sharpen error messages after cryptographic
+ * verification has already failed.
+ */
+export function decodeJwtKid(jwt) {
+    const headerSegment = jwt.split('.')[0];
+    if (!headerSegment)
+        return undefined;
+    try {
+        const header = JSON.parse(Buffer.from(headerSegment, 'base64url').toString('utf8'));
+        if (header && typeof header === 'object' && 'kid' in header) {
+            const { kid } = header;
+            return typeof kid === 'string' ? kid : undefined;
+        }
+    }
+    catch {
+        // Malformed header — caller surfaces generic invalid-license error.
+    }
+    return undefined;
+}
+/**
+ * Forge-mode license enforcement at process boot.
+ *
+ * - Hosted mode: no-op.
+ * - Forge mode + no key + ALLOW_UNLICENSED_SELF_HOST: Free (OSS) tier log, return.
+ * - Forge mode otherwise: require key + public key, verify JWT, optional
+ *   customerId + domain binding.
+ *
+ * Honors `SKIP_ENV_VALIDATION=true` for Docker build / tests.
+ */
+export async function validateForgeLicenseAtStartup(env = process.env) {
+    if (env.SKIP_ENV_VALIDATION === 'true') {
+        return;
+    }
+    const mode = detectDeploymentModeCore(env);
+    if (mode !== 'forge') {
+        return;
+    }
+    if (!env.REVEALUI_LICENSE_KEY) {
+        if (env[ALLOW_UNLICENSED_SELF_HOST_ENV] === 'true') {
+            logger.info('no license key — running Free (OSS) tier');
+            return;
+        }
+        throw new Error('LICENSE VALIDATION FAILED: REVEALUI_LICENSE_KEY is required for RevForge deployments. ' +
+            'Run bin/revvault-bootstrap.sh to materialize docker/.env from revvault, ' +
+            'or contact the operator who stamped this kit. A plain self-host deployment that ' +
+            `intends to run without a license should set ${ALLOW_UNLICENSED_SELF_HOST_ENV}=true to ` +
+            'boot at Free (OSS) tier instead.');
+    }
+    if (!env.REVEALUI_LICENSE_PUBLIC_KEY) {
+        throw new Error('LICENSE VALIDATION FAILED: REVEALUI_LICENSE_PUBLIC_KEY is required for RevForge deployments. ' +
+            'Stamped kits embed this value in docker/.env.example; check that it survived the bootstrap step.');
+    }
+    // Restore real newlines if the public key landed as a single-line PEM
+    // (stamp.sh .env encoding). Split/join, no authored regex — mirrors
+    // @revealui/core/license normalizePem. GAP-259 P0-4.
+    const publicKey = env.REVEALUI_LICENSE_PUBLIC_KEY.split('\\n').join('\n');
+    const expectedCustomerId = env.REVEALUI_LICENSED_CUSTOMER_ID || undefined;
+    const payload = await validateLicenseKey(env.REVEALUI_LICENSE_KEY, publicKey, expectedCustomerId);
+    if (!payload) {
+        const tokenKid = decodeJwtKid(env.REVEALUI_LICENSE_KEY);
+        if (tokenKid !== undefined) {
+            const expectedKid = await computeKeyId(publicKey);
+            if (tokenKid !== expectedKid) {
+                throw new Error('LICENSE VALIDATION FAILED: REVEALUI_LICENSE_PUBLIC_KEY does not match the key that ' +
+                    `signed REVEALUI_LICENSE_KEY (license key id "${tokenKid}", configured public key id ` +
+                    `"${expectedKid}"). The stamped kit baked the wrong public key. Re-issue the license ` +
+                    'with the matching keypair, or bake the public key that pairs with the signing key, ' +
+                    'then re-run bin/revvault-bootstrap.sh. Contact the operator who stamped this kit.');
+            }
+        }
+        throw new Error('LICENSE VALIDATION FAILED: REVEALUI_LICENSE_KEY is invalid, expired beyond grace, ' +
+            'signed with a key that does not match REVEALUI_LICENSE_PUBLIC_KEY, or its ' +
+            'customerId does not match REVEALUI_LICENSED_CUSTOMER_ID (if set). ' +
+            'Contact the operator who stamped this kit to re-issue the license.');
+    }
+    if (payload.domains && payload.domains.length > 0) {
+        const publicUrl = (env.REVEALUI_PUBLIC_SERVER_URL ?? env.NEXT_PUBLIC_SERVER_URL ?? '').trim();
+        if (publicUrl) {
+            let host = '';
+            try {
+                host = new URL(publicUrl).hostname;
+            }
+            catch {
+                host = '';
+            }
+            if (!hostMatchesLicensedDomains(host, payload.domains)) {
+                throw new Error('LICENSE VALIDATION FAILED: this license is restricted to ' +
+                    `[${payload.domains.join(', ')}], but REVEALUI_PUBLIC_SERVER_URL host ` +
+                    `"${host || '(unparseable)'}" is not among them. Set REVEALUI_PUBLIC_SERVER_URL ` +
+                    'to a licensed domain, or contact the operator who stamped this kit.');
+            }
+        }
+    }
+}

package/dist/vite/index.d.ts

@@ -0,0 +1,2 @@
+export { type ViteUserConfig, type WithRevealUIOptions, withRevealUI, } from './withRevealUI.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/vite/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,YAAY,GACb,MAAM,mBAAmB,CAAC"}

package/dist/vite/index.js

@@ -0,0 +1,6 @@
+// RevealUI Vite integration barrel.
+//
+// `withRevealUI` is re-exported here for convenience. Config-time consumers
+// may also import from `@revealui/core/vite/withRevealUI` directly (mirrors
+// the Next.js subpath that stays out of runtime NFT graphs).
+export { withRevealUI, } from './withRevealUI.js';