@revealui/core 0.12.2 → 0.13.0

package/dist/storage/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB,8FAA8F;IAC9F,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,6FAA6F;IAC7F,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE9C,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,UAAU;IACzB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAE9B,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IAEZ,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IAEZ,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IAEb,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAElB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,IAAI,CAAC;CAClB;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF,MAAM,WAAW,QAAQ;IACvB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAElB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IAEpB,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAC;IAExB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB,8FAA8F;IAC9F,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,6FAA6F;IAC7F,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE9C;;;OAGG;IACH,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE1E;;;OAGG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEnD;;;OAGG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEtF,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC;IAEZ,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IAEZ,kCAAkC;IAClC,SAAS,EAAE,IAAI,CAAC;CACjB;AAID,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;CACb;AAID,MAAM,WAAW,UAAU;IACzB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAE9B,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IAEZ,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IAEZ,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IAEb,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAElB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,IAAI,CAAC;CAClB;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF,MAAM,WAAW,QAAQ;IACvB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAElB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IAEpB,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAC;IAExB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}

package/dist/vite/index.d.ts

@@ -0,0 +1,2 @@
+export { type ViteUserConfig, type WithRevealUIOptions, withRevealUI, } from './withRevealUI.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/vite/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,YAAY,GACb,MAAM,mBAAmB,CAAC"}

package/dist/vite/index.js

@@ -0,0 +1,6 @@
+// RevealUI Vite integration barrel.
+//
+// `withRevealUI` is re-exported here for convenience. Config-time consumers
+// may also import from `@revealui/core/vite/withRevealUI` directly (mirrors
+// the Next.js subpath that stays out of runtime NFT graphs).
+export { withRevealUI, } from './withRevealUI.js';

package/dist/vite/withRevealUI.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Vite configuration wrapper for RevealUI dual-mode apps.
+ *
+ * Sibling of `@revealui/core/nextjs/withRevealUI` for the GAP-194 admin port
+ * (Phase 3 Tier 0 step 3.0). Config-time only — import from
+ * `@revealui/core/vite/withRevealUI` in `vite.config.ts`, never from the
+ * package root (keeps Node path helpers out of app runtime graphs).
+ *
+ * MUST NOT alias the `@revealui/config` package specifier: that is a real
+ * workspace package (type-safe env config). Aliasing it to the app's
+ * revealui.config.ts shadows the package in every SSR bundle (prod
+ * passkey/MFA 500s, 2026-06-10). Apps load CMS config via relative imports
+ * or their own `@reveal-config` alias.
+ *
+ * Path-scoped headers (admin-only CSP, CSRF) belong in the request layer
+ * (`packages/router/docs/REQUEST-LAYER.md`), not Vite's global
+ * `server.headers`. When `admin` is true this helper only injects a baseline
+ * pair on dev/preview servers for early dogfood.
+ */
+/**
+ * Minimal Vite config surface used by withRevealUI.
+ * Defined locally so `@revealui/core` does not depend on `vite` types.
+ * Consumers pass their full UserConfig; we only read/merge these fields.
+ */
+export interface ViteUserConfig {
+    define?: Record<string, unknown>;
+    resolve?: {
+        alias?: Record<string, string> | Array<{
+            find: string | RegExp;
+            replacement: string;
+        }>;
+        [key: string]: unknown;
+    };
+    server?: {
+        headers?: Record<string, string>;
+        [key: string]: unknown;
+    };
+    preview?: {
+        headers?: Record<string, string>;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface WithRevealUIOptions {
+    /** Path to the RevealUI config file (relative to the Vite project root) */
+    configPath?: string;
+    /** Whether to enable admin UI env flags + baseline dev/preview headers */
+    admin?: boolean;
+    /** Admin route path (documented for consumers; request-layer owns path gates) */
+    adminRoute?: string;
+    /** API route path */
+    apiRoute?: string;
+}
+/**
+ * Vite configuration wrapper for RevealUI.
+ *
+ * Injects `process.env.REVEALUI_*` via `define`, never aliases
+ * `@revealui/config`, and optionally sets baseline X-Frame-Options /
+ * X-Content-Type-Options on `server` + `preview` when admin is enabled.
+ */
+export declare function withRevealUI(viteConfig?: ViteUserConfig, options?: WithRevealUIOptions): ViteUserConfig;
+//# sourceMappingURL=withRevealUI.d.ts.map

package/dist/vite/withRevealUI.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withRevealUI.d.ts","sourceRoot":"","sources":["../../src/vite/withRevealUI.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACvF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qBAAqB;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA4CD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,UAAU,GAAE,cAAmB,EAC/B,OAAO,GAAE,mBAAwB,GAChC,cAAc,CAuChB"}

package/dist/vite/withRevealUI.js

@@ -0,0 +1,94 @@
+/**
+ * Vite configuration wrapper for RevealUI dual-mode apps.
+ *
+ * Sibling of `@revealui/core/nextjs/withRevealUI` for the GAP-194 admin port
+ * (Phase 3 Tier 0 step 3.0). Config-time only — import from
+ * `@revealui/core/vite/withRevealUI` in `vite.config.ts`, never from the
+ * package root (keeps Node path helpers out of app runtime graphs).
+ *
+ * MUST NOT alias the `@revealui/config` package specifier: that is a real
+ * workspace package (type-safe env config). Aliasing it to the app's
+ * revealui.config.ts shadows the package in every SSR bundle (prod
+ * passkey/MFA 500s, 2026-06-10). Apps load CMS config via relative imports
+ * or their own `@reveal-config` alias.
+ *
+ * Path-scoped headers (admin-only CSP, CSRF) belong in the request layer
+ * (`packages/router/docs/REQUEST-LAYER.md`), not Vite's global
+ * `server.headers`. When `admin` is true this helper only injects a baseline
+ * pair on dev/preview servers for early dogfood.
+ */
+const FORBIDDEN_CONFIG_ALIAS = '@revealui/config';
+function revealUIDefine(options) {
+    return {
+        'process.env.REVEALUI_CONFIG_PATH': JSON.stringify(options.configPath),
+        'process.env.REVEALUI_ADMIN_ENABLED': JSON.stringify(options.admin.toString()),
+        'process.env.REVEALUI_ADMIN_ROUTE': JSON.stringify(options.adminRoute),
+        'process.env.REVEALUI_API_ROUTE': JSON.stringify(options.apiRoute),
+    };
+}
+function assertNoConfigAlias(alias) {
+    if (!alias)
+        return;
+    if (Array.isArray(alias)) {
+        for (const entry of alias) {
+            if (entry.find === FORBIDDEN_CONFIG_ALIAS) {
+                throw new Error('withRevealUI: do not alias @revealui/config to revealui.config.ts — ' +
+                    'that shadows the env-config package (use @reveal-config instead)');
+            }
+        }
+        return;
+    }
+    if (Object.hasOwn(alias, FORBIDDEN_CONFIG_ALIAS)) {
+        throw new Error('withRevealUI: do not alias @revealui/config to revealui.config.ts — ' +
+            'that shadows the env-config package (use @reveal-config instead)');
+    }
+}
+function mergeHeaders(existing, inject) {
+    if (!inject)
+        return existing;
+    return { ...existing, ...inject };
+}
+/**
+ * Vite configuration wrapper for RevealUI.
+ *
+ * Injects `process.env.REVEALUI_*` via `define`, never aliases
+ * `@revealui/config`, and optionally sets baseline X-Frame-Options /
+ * X-Content-Type-Options on `server` + `preview` when admin is enabled.
+ */
+export function withRevealUI(viteConfig = {}, options = {}) {
+    const resolved = {
+        configPath: options.configPath ?? './revealui.config.ts',
+        admin: options.admin ?? true,
+        adminRoute: options.adminRoute ?? '/admin',
+        apiRoute: options.apiRoute ?? '/api',
+    };
+    assertNoConfigAlias(viteConfig.resolve?.alias);
+    const adminHeaders = resolved.admin
+        ? {
+            'X-Frame-Options': 'SAMEORIGIN',
+            'X-Content-Type-Options': 'nosniff',
+        }
+        : undefined;
+    return {
+        ...viteConfig,
+        define: {
+            ...viteConfig.define,
+            ...revealUIDefine(resolved),
+        },
+        resolve: viteConfig.resolve
+            ? {
+                ...viteConfig.resolve,
+                // Passthrough only — never inject @revealui/config (see module doc).
+                alias: viteConfig.resolve.alias,
+            }
+            : viteConfig.resolve,
+        server: {
+            ...viteConfig.server,
+            headers: mergeHeaders(viteConfig.server?.headers, adminHeaders),
+        },
+        preview: {
+            ...viteConfig.preview,
+            headers: mergeHeaders(viteConfig.preview?.headers, adminHeaders),
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/core",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "description": "RevealUI's runtime engine — admin UI, REST API, auth, rich text, plugin system, and access control. The heart of the open-source platform.",
   "license": "MIT",
   "dependencies": {
@@ -23,18 +23,20 @@
     "pg": "^8.22.0",
     "yjs": "^13.6.31",
     "zod": "^4.4.3",
-    "@revealui/contracts": "0.8.1",
+    "@revealui/contracts": "0.8.2",
     "@revealui/resilience": "0.2.4",
-    "@revealui/security": "0.6.0",
+    "@revealui/security": "0.6.1",
     "@revealui/utils": "0.3.6"
   },
   "devDependencies": {
+    "@testing-library/react": "^16.3.2",
     "@types/json-schema": "^7.0.15",
     "@types/pg": "^8.20.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@vitest/coverage-v8": "^4.1.10",
     "expect-type": "^1.4.0",
+    "jsdom": "29.1.1",
     "tsup": "^8.5.1",
     "vitest": "^4.1.10",
     "@revealui/dev": "0.1.0"
@@ -68,6 +70,11 @@
       "import": "./dist/revforge-license.js",
       "default": "./dist/revforge-license.js"
     },
+    "./revforge-license-boot": {
+      "types": "./dist/revforge-license-boot.d.ts",
+      "import": "./dist/revforge-license-boot.js",
+      "default": "./dist/revforge-license-boot.js"
+    },
     "./features": {
       "types": "./dist/features.d.ts",
       "import": "./dist/features.js",
@@ -278,6 +285,16 @@
       "import": "./dist/nextjs/withRevealUI.js",
       "default": "./dist/nextjs/withRevealUI.js"
     },
+    "./vite": {
+      "types": "./dist/vite/index.d.ts",
+      "import": "./dist/vite/index.js",
+      "default": "./dist/vite/index.js"
+    },
+    "./vite/withRevealUI": {
+      "types": "./dist/vite/withRevealUI.d.ts",
+      "import": "./dist/vite/withRevealUI.js",
+      "default": "./dist/vite/withRevealUI.js"
+    },
     "./utils/logger": {
       "types": "./dist/utils/logger.d.ts",
       "import": "./dist/utils/logger.js",
@@ -308,6 +325,11 @@
       "import": "./dist/observability/index.js",
       "default": "./dist/observability/index.js"
     },
+    "./observability/capture": {
+      "types": "./dist/observability/capture.d.ts",
+      "import": "./dist/observability/capture.js",
+      "default": "./dist/observability/capture.js"
+    },
     "./observability/logger": {
       "types": "./dist/observability/logger.d.ts",
       "import": "./dist/observability/logger.js",
@@ -323,6 +345,11 @@
       "import": "./dist/observability/alerts.js",
       "default": "./dist/observability/alerts.js"
     },
+    "./observability/cron-failure-alert": {
+      "types": "./dist/observability/cron-failure-alert.d.ts",
+      "import": "./dist/observability/cron-failure-alert.js",
+      "default": "./dist/observability/cron-failure-alert.js"
+    },
     "./utils/cache": {
       "types": "./dist/utils/cache.d.ts",
       "import": "./dist/utils/cache.js",