@revealui/core 0.14.7 → 0.15.3

package/dist/api/rest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../src/api/rest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,MAAM,EACN,YAAY,EAGZ,cAAc,EAGd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,cAAc;IAC7C,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACX,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AA8aD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,QAAQ,CAAC,CAiGnB;AAGD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB;IACD,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrE,CAaA"}
+{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../src/api/rest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,MAAM,EACN,YAAY,EAGZ,cAAc,EAGd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,cAAc;IAC7C,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACX,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAuaD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,QAAQ,CAAC,CAiGnB;AAGD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB;IACD,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrE,CAaA"}

package/dist/api/rest.js

@@ -153,8 +153,10 @@ function getCorsOriginsFromConfig(config) {
     return [];
 }
 /**
- * Get allowed CORS origin for a request
- * Checks config first, then environment variable, then allows all for development
+ * Get allowed CORS origin for a request.
+ * The allowlist comes from config, then REVEALUI_CORS_ORIGINS.
+ * A request origin on that list is returned. A missing list, an empty list,
+ * or a non-matching origin returns an empty allow-origin so nothing is granted.
  */
 function getAllowedOrigin(request, config) {
     let allowedOrigins = getCorsOriginsFromConfig(config);
@@ -163,18 +165,10 @@ function getAllowedOrigin(request, config) {
         allowedOrigins = process.env.REVEALUI_CORS_ORIGINS.split(',').map((s) => s.trim());
     }
     const origin = request.headers.get('origin');
-    // If config has specific origins and request origin matches, use it
     if (allowedOrigins.length > 0 && origin && allowedOrigins.includes(origin)) {
         return origin;
     }
-    // In development, allow all origins for convenience
-    // In production, this should never be reached if CORS is properly configured
-    if (process.env.NODE_ENV === 'development') {
-        return '*';
-    }
-    // In production, if no allowed origins configured, deny all (secure default)
-    // This prevents accidental exposure in production
-    return origin || '';
+    return '';
 }
 /**
  * Get standard CORS headers for a response

package/dist/license.d.ts

@@ -201,6 +201,8 @@ export declare const REFRESH_ACCEPT_DAYS = 30;
  * the bind succeeds. It never mints and never grants entitlement on its own.
  */
 export declare function validateLicenseKeyForRefresh(licenseKey: string, publicKey: string | readonly string[], expectedCustomerId: string, refreshAcceptDays?: number): Promise<LicensePayload | null>;
+/** Authenticated operator containment: validates issuer/signature/customer, not entitlement expiry. */
+export declare function validateLicenseKeyForOperator(licenseKey: string, publicKey: string | readonly string[], expectedCustomerId: string): Promise<LicensePayload | null>;
 /**
  * Outcome of a signing-keypair self-test. See {@link selfVerifyLicenseKeypair}.
  */

package/dist/license.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/F,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,qBAAqB;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW/F;AAeD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAOjF;AAED,qCAAqC;AACrC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;iBAuBxB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAW5E;AAWD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAElF;AAkBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAOxC;AAYD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAShC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,EAAE,MAAM,EAC1B,iBAAiB,GAAE,MAA4B,GAC9C,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAIhC;AA+GD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA4D9B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CA8C9D;AAyCD;;;GAGG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,WAAW,CAAC,CAKlE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAG5C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAGzD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAaT;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,WAAW,GAAG,OAAO,CA2B7D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,GAAE,WAAmB,GAAG,kBAAkB,CAkEtF;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAE5D;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,QAAqB,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,qBAAqB,QAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,EAClC,KAAK,GAAE,MAAmB,GACzB,MAAM,CAIR;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAE5D;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC,IAAI,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACvE,UAAU,EAAE,MAAM,EAClB,gBAAgB,GAAE,MAAM,GAAG,IAAuC,EAClE,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAKxC"}
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/F,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,qBAAqB;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW/F;AAeD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAOjF;AAED,qCAAqC;AACrC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;iBAuBxB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAW5E;AAWD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAElF;AAkBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAOxC;AAYD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAShC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,EAAE,MAAM,EAC1B,iBAAiB,GAAE,MAA4B,GAC9C,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAIhC;AAED,uGAAuG;AACvG,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAGhC;AAqID;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA4D9B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CA8C9D;AAyCD;;;GAGG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,WAAW,CAAC,CAKlE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAG5C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAGzD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAaT;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,WAAW,GAAG,OAAO,CA2B7D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,GAAE,WAAmB,GAAG,kBAAkB,CAkEtF;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAE5D;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,QAAqB,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,qBAAqB,QAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,EAClC,KAAK,GAAE,MAAmB,GACzB,MAAM,CAIR;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAE5D;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC,IAAI,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACvE,UAAU,EAAE,MAAM,EAClB,gBAAgB,GAAE,MAAM,GAAG,IAAuC,EAClE,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAKxC"}

package/dist/license.js

@@ -281,6 +281,12 @@ export async function validateLicenseKeyForRefresh(licenseKey, publicKey, expect
         return null;
     return verifyAndParseLicenseJwt(licenseKey, publicKey, refreshAcceptDays * 86_400, bound);
 }
+/** Authenticated operator containment: validates issuer/signature/customer, not entitlement expiry. */
+export async function validateLicenseKeyForOperator(licenseKey, publicKey, expectedCustomerId) {
+    if (!expectedCustomerId.trim())
+        return null;
+    return verifyAndParseLicenseJwt(licenseKey, publicKey, 0, expectedCustomerId, true);
+}
 /**
  * Shared verify + parse path for {@link validateLicenseKey} and
  * {@link validateLicenseKeyForRefresh}. The ONLY behavioral difference between
@@ -288,7 +294,7 @@ export async function validateLicenseKeyForRefresh(licenseKey, publicKey, expect
  * still accepted — so the rotation-aware multi-key loop and the payload schema
  * live in exactly one place.
  */
-async function verifyAndParseLicenseJwt(licenseKey, publicKey, clockToleranceSeconds, expectedCustomerId) {
+async function verifyAndParseLicenseJwt(licenseKey, publicKey, clockToleranceSeconds, expectedCustomerId, operator = false) {
     const candidates = typeof publicKey === 'string' ? [publicKey] : [...publicKey];
     if (candidates.length === 0)
         return null;
@@ -303,12 +309,27 @@ async function verifyAndParseLicenseJwt(licenseKey, publicKey, clockToleranceSec
         for (const candidate of ordered) {
             try {
                 const key = await jose.importSPKI(candidate, 'EdDSA');
-                const { payload } = await jose.jwtVerify(licenseKey, key, {
-                    algorithms: ['EdDSA'],
-                    clockTolerance: clockToleranceSeconds,
-                    issuer: LICENSE_ISSUER,
-                    audience: LICENSE_AUDIENCE,
-                });
+                let payload;
+                if (operator) {
+                    const verified = await jose.compactVerify(licenseKey, key, { algorithms: ['EdDSA'] });
+                    const claims = JSON.parse(new TextDecoder().decode(verified.payload));
+                    if (claims.iss !== LICENSE_ISSUER ||
+                        !(claims.aud === LICENSE_AUDIENCE ||
+                            (Array.isArray(claims.aud) && claims.aud.includes(LICENSE_AUDIENCE))) ||
+                        (claims.nbf !== undefined &&
+                            (typeof claims.nbf !== 'number' || claims.nbf > Date.now() / 1000))) {
+                        continue;
+                    }
+                    payload = claims;
+                }
+                else {
+                    ({ payload } = await jose.jwtVerify(licenseKey, key, {
+                        algorithms: ['EdDSA'],
+                        clockTolerance: clockToleranceSeconds,
+                        issuer: LICENSE_ISSUER,
+                        audience: LICENSE_AUDIENCE,
+                    }));
+                }
                 verifiedPayload = payload;
                 verified = true;
                 break;
@@ -882,17 +903,18 @@ export async function generateLicenseKey(payload, privateKey, expiresInSeconds =
     // Strip the optional jti from the spread so jose.setJti() is the single
     // source of the claim (avoids a duplicate field in the payload).
     const { jti: _ignoredJti, ...rest } = payload;
+    const issuedAt = Math.floor(Date.now() / 1000);
     const builder = new jose.SignJWT({ ...rest })
         .setProtectedHeader(header)
-        .setIssuedAt()
+        .setIssuedAt(issuedAt)
         // Phase 1 audit B-2: enforce nbf so tokens cannot be replayed pre-issue
         // by a clock-skewed client.
-        .setNotBefore('0s')
+        .setNotBefore(issuedAt)
         .setJti(jti)
         .setIssuer(LICENSE_ISSUER)
         .setAudience(LICENSE_AUDIENCE);
     if (expiresInSeconds !== null) {
-        builder.setExpirationTime(`${expiresInSeconds}s`);
+        builder.setExpirationTime(issuedAt + expiresInSeconds);
     }
     return builder.sign(key);
 }

package/dist/sentry-environment.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Sentry `environment` for a deploy.
+ *
+ * `NODE_ENV=production` is set on staging as well as production, so it is not
+ * a safe Sentry label. Prefer `SENTRY_ENVIRONMENT` (then `REVEALUI_DEPLOY_ENV`,
+ * then `NEXT_PUBLIC_SENTRY_ENVIRONMENT`). When those are unset, derive the
+ * label from public hosts. A `*.staging.revealui.com` host is never reported
+ * as production. Vercel preview stays `preview`.
+ */
+export type SentryEnvironmentName = 'production' | 'staging' | 'preview' | 'development' | 'test';
+/** Non-secret label. Set `SENTRY_ENVIRONMENT=staging` on staging Vercel and Fly. */
+export declare const SENTRY_ENVIRONMENT_VAR = "SENTRY_ENVIRONMENT";
+export interface SentryEnvironmentSource {
+    SENTRY_ENVIRONMENT?: string | undefined;
+    REVEALUI_DEPLOY_ENV?: string | undefined;
+    NEXT_PUBLIC_SENTRY_ENVIRONMENT?: string | undefined;
+    NODE_ENV?: string | undefined;
+    VERCEL_ENV?: string | undefined;
+    REVEALUI_API_URL?: string | undefined;
+    NEXT_PUBLIC_API_URL?: string | undefined;
+    API_URL?: string | undefined;
+    REVEALUI_PUBLIC_SERVER_URL?: string | undefined;
+    NEXT_PUBLIC_SERVER_URL?: string | undefined;
+    VERCEL_PROJECT_PRODUCTION_URL?: string | undefined;
+    VERCEL_URL?: string | undefined;
+    SESSION_COOKIE_DOMAIN?: string | undefined;
+    PASSKEY_RP_ID?: string | undefined;
+    PASSKEY_ORIGIN?: string | undefined;
+    CORS_ORIGIN?: string | undefined;
+}
+/**
+ * Resolve the Sentry environment label.
+ * Staging hosts report `staging`, or `preview` when that explicit label is set.
+ * They do not report `production`.
+ */
+export declare function resolveSentryEnvironment(env: SentryEnvironmentSource): SentryEnvironmentName;
+//# sourceMappingURL=sentry-environment.d.ts.map

package/dist/sentry-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry-environment.d.ts","sourceRoot":"","sources":["../src/sentry-environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,8BAA8B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,6BAA6B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAyED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,uBAAuB,GAAG,qBAAqB,CAoD5F"}

package/dist/sentry-environment.js

@@ -0,0 +1,129 @@
+/**
+ * Sentry `environment` for a deploy.
+ *
+ * `NODE_ENV=production` is set on staging as well as production, so it is not
+ * a safe Sentry label. Prefer `SENTRY_ENVIRONMENT` (then `REVEALUI_DEPLOY_ENV`,
+ * then `NEXT_PUBLIC_SENTRY_ENVIRONMENT`). When those are unset, derive the
+ * label from public hosts. A `*.staging.revealui.com` host is never reported
+ * as production. Vercel preview stays `preview`.
+ */
+import { isStagingRevealHost, normalizeRequestHost } from './session-cookie-domain.js';
+/** Non-secret label. Set `SENTRY_ENVIRONMENT=staging` on staging Vercel and Fly. */
+export const SENTRY_ENVIRONMENT_VAR = 'SENTRY_ENVIRONMENT';
+const HOST_KEYS = [
+    'REVEALUI_API_URL',
+    'NEXT_PUBLIC_API_URL',
+    'API_URL',
+    'REVEALUI_PUBLIC_SERVER_URL',
+    'NEXT_PUBLIC_SERVER_URL',
+    'VERCEL_PROJECT_PRODUCTION_URL',
+    'VERCEL_URL',
+    'SESSION_COOKIE_DOMAIN',
+    'PASSKEY_RP_ID',
+    'PASSKEY_ORIGIN',
+    'CORS_ORIGIN',
+];
+const PRODUCTION_HOSTS = new Set([
+    'revealui.com',
+    'www.revealui.com',
+    'api.revealui.com',
+    'admin.revealui.com',
+    'docs.revealui.com',
+]);
+function lockedEnvironment(raw) {
+    if (raw == null)
+        return null;
+    const value = raw.trim().toLowerCase();
+    switch (value) {
+        case 'production':
+        case 'staging':
+        case 'preview':
+        case 'development':
+        case 'test':
+            return value;
+        default:
+            return null;
+    }
+}
+function firstLocked(...values) {
+    for (const value of values) {
+        const locked = lockedEnvironment(value);
+        if (locked)
+            return locked;
+    }
+    return null;
+}
+function splitComma(raw) {
+    const parts = [];
+    let start = 0;
+    for (let index = 0; index <= raw.length; index += 1) {
+        if (index === raw.length || raw.charCodeAt(index) === 44) {
+            const part = raw.slice(start, index).trim();
+            if (part.length > 0)
+                parts.push(part);
+            start = index + 1;
+        }
+    }
+    return parts;
+}
+function collectHosts(env) {
+    const hosts = [];
+    for (const key of HOST_KEYS) {
+        const raw = env[key];
+        if (typeof raw !== 'string' || raw.trim().length === 0)
+            continue;
+        for (const part of splitComma(raw)) {
+            const host = normalizeRequestHost(part);
+            if (host)
+                hosts.push(host);
+        }
+    }
+    return hosts;
+}
+/**
+ * Resolve the Sentry environment label.
+ * Staging hosts report `staging`, or `preview` when that explicit label is set.
+ * They do not report `production`.
+ */
+export function resolveSentryEnvironment(env) {
+    const hosts = collectHosts(env);
+    let stagingHost = false;
+    let productionHost = false;
+    for (const host of hosts) {
+        if (isStagingRevealHost(host))
+            stagingHost = true;
+        if (PRODUCTION_HOSTS.has(host))
+            productionHost = true;
+    }
+    const explicit = firstLocked(env.SENTRY_ENVIRONMENT, env.REVEALUI_DEPLOY_ENV, env.NEXT_PUBLIC_SENTRY_ENVIRONMENT);
+    if (stagingHost) {
+        if (explicit === 'staging' ||
+            explicit === 'preview' ||
+            explicit === 'development' ||
+            explicit === 'test') {
+            return explicit;
+        }
+        return 'staging';
+    }
+    if (explicit)
+        return explicit;
+    if (productionHost)
+        return 'production';
+    const vercel = lockedEnvironment(env.VERCEL_ENV);
+    if (vercel === 'preview' ||
+        vercel === 'development' ||
+        vercel === 'test' ||
+        vercel === 'staging') {
+        return vercel;
+    }
+    const nodeEnv = lockedEnvironment(env.NODE_ENV);
+    if (nodeEnv === 'development' ||
+        nodeEnv === 'test' ||
+        nodeEnv === 'staging' ||
+        nodeEnv === 'preview') {
+        return nodeEnv;
+    }
+    if (nodeEnv === 'production' || vercel === 'production')
+        return 'production';
+    return 'development';
+}

package/dist/session-cookie-domain.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Session cookie domain for a request host (GAP-343).
+ *
+ * Staging hosts always resolve to `staging.revealui.com` so a production
+ * `SESSION_COOKIE_DOMAIN` (for example `.revealui.com`) is not attached to
+ * the staging subtree. Every other host returns `configuredDomain` unchanged.
+ * This function does not read the environment and does not apply the
+ * production-only gate. Callers keep that gate.
+ */
+/** Cookie Domain attribute for the staging.revealui.com subtree. No leading dot. */
+export declare const STAGING_SESSION_COOKIE_DOMAIN = "staging.revealui.com";
+/**
+ * Hostname from a Host or X-Forwarded-Host value.
+ * Strips a scheme, path, trailing dot, and numeric port. Uses the first
+ * comma-separated entry. Returns null when nothing usable remains.
+ * String methods only (no regular expressions).
+ */
+export declare function normalizeRequestHost(raw: string | null | undefined): string | null;
+/**
+ * True for `staging.revealui.com` and any host under `*.staging.revealui.com`.
+ * Label-boundary match: `evilstaging.revealui.com` and
+ * `staging.revealui.com.evil.com` are not staging hosts.
+ */
+export declare function isStagingRevealHost(requestHost: string | null | undefined): boolean;
+/**
+ * Cookie Domain for this request.
+ *
+ * Staging hosts return `staging.revealui.com` even when `configuredDomain`
+ * is the production domain or unset. Every other host, including a missing
+ * host, returns `configuredDomain` exactly (including `undefined`).
+ */
+export declare function sessionCookieDomainForHost(requestHost: string | null | undefined, configuredDomain: string | undefined): string | undefined;
+/**
+ * Public request host. Prefer `Host` so a client-supplied `X-Forwarded-Host`
+ * cannot override the host the platform already set. Fall back to
+ * `X-Forwarded-Host` only when `Host` is absent.
+ */
+export declare function requestHostFromHeaders(getHeader: (name: string) => string | null | undefined): string | null;
+//# sourceMappingURL=session-cookie-domain.d.ts.map

package/dist/session-cookie-domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cookie-domain.d.ts","sourceRoot":"","sources":["../src/session-cookie-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,oFAAoF;AACpF,eAAO,MAAM,6BAA6B,yBAAyB,CAAC;AAEpE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CA0ClF;AAUD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAKnF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,MAAM,GAAG,SAAS,CAKpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,GACrD,MAAM,GAAG,IAAI,CAMf"}

package/dist/session-cookie-domain.js

@@ -0,0 +1,106 @@
+/**
+ * Session cookie domain for a request host (GAP-343).
+ *
+ * Staging hosts always resolve to `staging.revealui.com` so a production
+ * `SESSION_COOKIE_DOMAIN` (for example `.revealui.com`) is not attached to
+ * the staging subtree. Every other host returns `configuredDomain` unchanged.
+ * This function does not read the environment and does not apply the
+ * production-only gate. Callers keep that gate.
+ */
+/** Cookie Domain attribute for the staging.revealui.com subtree. No leading dot. */
+export const STAGING_SESSION_COOKIE_DOMAIN = 'staging.revealui.com';
+/**
+ * Hostname from a Host or X-Forwarded-Host value.
+ * Strips a scheme, path, trailing dot, and numeric port. Uses the first
+ * comma-separated entry. Returns null when nothing usable remains.
+ * String methods only (no regular expressions).
+ */
+export function normalizeRequestHost(raw) {
+    if (raw == null)
+        return null;
+    let value = raw.trim().toLowerCase();
+    if (value.length === 0)
+        return null;
+    const comma = value.indexOf(',');
+    if (comma !== -1) {
+        value = value.slice(0, comma).trim();
+    }
+    if (value.length === 0)
+        return null;
+    const scheme = value.indexOf('://');
+    if (scheme !== -1) {
+        value = value.slice(scheme + 3);
+    }
+    const slash = value.indexOf('/');
+    if (slash !== -1) {
+        value = value.slice(0, slash);
+    }
+    if (value.startsWith('[')) {
+        const end = value.indexOf(']');
+        if (end === -1)
+            return null;
+        const bracketed = value.slice(0, end + 1);
+        return bracketed.length > 2 ? bracketed : null;
+    }
+    const colon = value.lastIndexOf(':');
+    if (colon !== -1) {
+        const port = value.slice(colon + 1);
+        if (port.length > 0 && isAllDigits(port)) {
+            value = value.slice(0, colon);
+        }
+    }
+    if (value.endsWith('.')) {
+        value = value.slice(0, -1);
+    }
+    if (value.length === 0)
+        return null;
+    return value;
+}
+function isAllDigits(value) {
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code < 48 || code > 57)
+            return false;
+    }
+    return true;
+}
+/**
+ * True for `staging.revealui.com` and any host under `*.staging.revealui.com`.
+ * Label-boundary match: `evilstaging.revealui.com` and
+ * `staging.revealui.com.evil.com` are not staging hosts.
+ */
+export function isStagingRevealHost(requestHost) {
+    const host = normalizeRequestHost(requestHost);
+    if (!host)
+        return false;
+    if (host === STAGING_SESSION_COOKIE_DOMAIN)
+        return true;
+    return host.endsWith(`.${STAGING_SESSION_COOKIE_DOMAIN}`);
+}
+/**
+ * Cookie Domain for this request.
+ *
+ * Staging hosts return `staging.revealui.com` even when `configuredDomain`
+ * is the production domain or unset. Every other host, including a missing
+ * host, returns `configuredDomain` exactly (including `undefined`).
+ */
+export function sessionCookieDomainForHost(requestHost, configuredDomain) {
+    if (isStagingRevealHost(requestHost)) {
+        return STAGING_SESSION_COOKIE_DOMAIN;
+    }
+    return configuredDomain;
+}
+/**
+ * Public request host. Prefer `Host` so a client-supplied `X-Forwarded-Host`
+ * cannot override the host the platform already set. Fall back to
+ * `X-Forwarded-Host` only when `Host` is absent.
+ */
+export function requestHostFromHeaders(getHeader) {
+    const host = getHeader('host');
+    if (typeof host === 'string' && host.trim().length > 0)
+        return host;
+    const forwarded = getHeader('x-forwarded-host');
+    if (typeof forwarded === 'string' && forwarded.trim().length > 0)
+        return forwarded;
+    return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/core",
-  "version": "0.14.7",
+  "version": "0.15.3",
   "description": "RevealUI's runtime engine — admin UI, REST API, auth, rich text, plugin system, and access control. The heart of the open-source platform.",
   "license": "MIT",
   "dependencies": {
@@ -23,10 +23,10 @@
     "pg": "^8.22.0",
     "yjs": "^13.6.31",
     "zod": "^4.4.3",
-    "@revealui/contracts": "0.11.0",
-    "@revealui/presentation": "0.14.7",
+    "@revealui/contracts": "0.13.2",
+    "@revealui/presentation": "0.15.2",
     "@revealui/resilience": "0.2.4",
-    "@revealui/security": "0.8.2",
+    "@revealui/security": "0.10.1",
     "@revealui/utils": "0.3.6"
   },
   "devDependencies": {
@@ -66,6 +66,16 @@
       "import": "./dist/deployment-mode.js",
       "default": "./dist/deployment-mode.js"
     },
+    "./session-cookie-domain": {
+      "types": "./dist/session-cookie-domain.d.ts",
+      "import": "./dist/session-cookie-domain.js",
+      "default": "./dist/session-cookie-domain.js"
+    },
+    "./sentry-environment": {
+      "types": "./dist/sentry-environment.d.ts",
+      "import": "./dist/sentry-environment.js",
+      "default": "./dist/sentry-environment.js"
+    },
     "./margin-governor": {
       "types": "./dist/margin-governor.d.ts",
       "import": "./dist/margin-governor.js",