@revealui/core 0.15.0 → 0.15.4

package/dist/api/rest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../src/api/rest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,MAAM,EACN,YAAY,EAGZ,cAAc,EAGd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,cAAc;IAC7C,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACX,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AA8aD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,QAAQ,CAAC,CAiGnB;AAGD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB;IACD,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrE,CAaA"}
+{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../src/api/rest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,MAAM,EACN,YAAY,EAGZ,cAAc,EAGd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,cAAc;IAC7C,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACX,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAuaD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,QAAQ,CAAC,CAiGnB;AAGD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,GACzB;IACD,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrE,CAaA"}

package/dist/api/rest.js

@@ -153,8 +153,10 @@ function getCorsOriginsFromConfig(config) {
     return [];
 }
 /**
- * Get allowed CORS origin for a request
- * Checks config first, then environment variable, then allows all for development
+ * Get allowed CORS origin for a request.
+ * The allowlist comes from config, then REVEALUI_CORS_ORIGINS.
+ * A request origin on that list is returned. A missing list, an empty list,
+ * or a non-matching origin returns an empty allow-origin so nothing is granted.
  */
 function getAllowedOrigin(request, config) {
     let allowedOrigins = getCorsOriginsFromConfig(config);
@@ -163,18 +165,10 @@ function getAllowedOrigin(request, config) {
         allowedOrigins = process.env.REVEALUI_CORS_ORIGINS.split(',').map((s) => s.trim());
     }
     const origin = request.headers.get('origin');
-    // If config has specific origins and request origin matches, use it
     if (allowedOrigins.length > 0 && origin && allowedOrigins.includes(origin)) {
         return origin;
     }
-    // In development, allow all origins for convenience
-    // In production, this should never be reached if CORS is properly configured
-    if (process.env.NODE_ENV === 'development') {
-        return '*';
-    }
-    // In production, if no allowed origins configured, deny all (secure default)
-    // This prevents accidental exposure in production
-    return origin || '';
+    return '';
 }
 /**
  * Get standard CORS headers for a response

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export type { UniversalPostgresAdapterConfig } from './database/universal-postgr
 export { universalPostgresAdapter } from './database/universal-postgres.js';
 export { createRevealUI, createRevealUIAccessRule, createRevealUIBlock, createRevealUICollection, createRevealUIField, } from './factories/index.js';
 export { type FeatureFlags, getFeatures, getFeaturesForTier, getRequiredTier, isFeatureEnabled, } from './features.js';
-export { computeKeyId, configureGracePeriods, configureLicenseCache, type GracePeriodConfig, generateLicenseKey, getCurrentTier, getGraceConfig, getLicensePayload, getLicenseStatus, getMaxSites, getMaxUsers, initializeLicense, isLicensed, type LicenseCacheConfig, type LicenseCheckResult, type LicenseMode, type LicensePayload, type LicenseTier, readLicenseExp, readLicenseJti, resetLicenseState, validateLicenseKey, } from './license.js';
+export { computeKeyId, configureGracePeriods, configureLicenseCache, type GracePeriodConfig, generateLicenseKey, getCurrentTier, getGraceConfig, getLicensePayload, getLicensePublicKeyTrustManifest, getLicenseStatus, getMaxSites, getMaxUsers, initializeLicense, isLicensed, type LicenseCacheConfig, type LicenseCheckResult, type LicenseMode, type LicensePayload, type LicensePublicKeyTrustManifest, type LicenseTier, readLicenseExp, readLicenseJti, resetLicenseState, validateLicenseKey, } from './license.js';
 export { getRevealUI as getRevealUINext } from './nextjs/index.js';
 export { formBuilderPlugin } from './plugins/form-builder.js';
 export { nestedDocsPlugin } from './plugins/nested-docs.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzD,YAAY,EACV,0BAA0B,EAC1B,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,gBAAgB,EAChB,YAAY,EAEZ,cAAc,EACd,QAAQ,EACR,YAAY,EAEZ,SAAS,EACT,cAAc,EACd,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,SAAS,EACT,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,yBAAyB,EACzB,UAAU,EACV,QAAQ,EAER,oBAAoB,EACpB,eAAe,EAEf,aAAa,EAEb,WAAW,EACX,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,YAAY,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,YAAY,EACjB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAInE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAEL,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,4BAA4B,EAE5B,gBAAgB,EAEhB,iBAAiB,EAEjB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,aAAa,EAEb,qBAAqB,EAErB,MAAM,EAEN,kBAAkB,EAClB,cAAc,EACd,KAAK,cAAc,EAEnB,KAAK,eAAe,EACpB,6BAA6B,EAC7B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAI5D,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,yBAAyB,EACzB,iCAAiC,EACjC,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,MAAM,GACP,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAQlF,OAAO,EACL,KAAK,UAAU,EAEf,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAE3B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,MAAM,EAEX,qBAAqB,EAErB,gBAAgB,EAChB,WAAW,EACX,YAAY,EAEZ,KAAK,KAAK,EACV,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAGtB,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,qBAAqB,EAErB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,WAAW,EAEX,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,YAAY,EAEZ,uBAAuB,EACvB,mBAAmB,EACnB,MAAM,EACN,kBAAkB,EAClB,KAAK,KAAK,GACX,MAAM,2BAA2B,CAAC;AAOnC,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAElB,KAAK,EACL,WAAW,EACX,aAAa,EACb,eAAe,EAEf,cAAc,EACd,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,UAAU,EAEV,MAAM,EACN,aAAa,EACb,YAAY,EACZ,cAAc,EAEd,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAEhB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EAEnB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EAEjB,cAAc,EACd,qBAAqB,EAErB,aAAa,EACb,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EAExB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EAExB,mBAAmB,EAEnB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EAEnB,UAAU,EACV,WAAW,EACX,WAAW,EACX,cAAc,EAEd,eAAe,EACf,UAAU,EACV,cAAc,EACd,UAAU,EACV,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAEV,MAAM,EAEN,UAAU,EACV,UAAU,EACV,sBAAsB,EAEtB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAEhB,eAAe,EAEf,qBAAqB,EACrB,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,iBAAiB,IAAI,uBAAuB,EAC5C,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EAEX,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EAEpB,aAAa,EACb,kBAAkB,EAElB,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,UAAU,EACV,aAAa,EACb,SAAS,EAET,mBAAmB,EACnB,YAAY,EAEZ,gBAAgB,EAChB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAK1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzD,YAAY,EACV,0BAA0B,EAC1B,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,gBAAgB,EAChB,YAAY,EAEZ,cAAc,EACd,QAAQ,EACR,YAAY,EAEZ,SAAS,EACT,cAAc,EACd,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,SAAS,EACT,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,yBAAyB,EACzB,UAAU,EACV,QAAQ,EAER,oBAAoB,EACpB,eAAe,EAEf,aAAa,EAEb,WAAW,EACX,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,YAAY,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,YAAY,EACjB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,gCAAgC,EAChC,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,6BAA6B,EAClC,KAAK,WAAW,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAInE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAEL,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,4BAA4B,EAE5B,gBAAgB,EAEhB,iBAAiB,EAEjB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,aAAa,EAEb,qBAAqB,EAErB,MAAM,EAEN,kBAAkB,EAClB,cAAc,EACd,KAAK,cAAc,EAEnB,KAAK,eAAe,EACpB,6BAA6B,EAC7B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAI5D,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,yBAAyB,EACzB,iCAAiC,EACjC,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,MAAM,GACP,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAQlF,OAAO,EACL,KAAK,UAAU,EAEf,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAE3B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,MAAM,EAEX,qBAAqB,EAErB,gBAAgB,EAChB,WAAW,EACX,YAAY,EAEZ,KAAK,KAAK,EACV,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAGtB,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,qBAAqB,EAErB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,WAAW,EAEX,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,YAAY,EAEZ,uBAAuB,EACvB,mBAAmB,EACnB,MAAM,EACN,kBAAkB,EAClB,KAAK,KAAK,GACX,MAAM,2BAA2B,CAAC;AAOnC,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAElB,KAAK,EACL,WAAW,EACX,aAAa,EACb,eAAe,EAEf,cAAc,EACd,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,UAAU,EAEV,MAAM,EACN,aAAa,EACb,YAAY,EACZ,cAAc,EAEd,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAEhB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EAEnB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EAEjB,cAAc,EACd,qBAAqB,EAErB,aAAa,EACb,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EAExB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EAExB,mBAAmB,EAEnB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EAEnB,UAAU,EACV,WAAW,EACX,WAAW,EACX,cAAc,EAEd,eAAe,EACf,UAAU,EACV,cAAc,EACd,UAAU,EACV,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAEV,MAAM,EAEN,UAAU,EACV,UAAU,EACV,sBAAsB,EAEtB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAEhB,eAAe,EAEf,qBAAqB,EACrB,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,iBAAiB,IAAI,uBAAuB,EAC5C,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EAEX,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EAEpB,aAAa,EACb,kBAAkB,EAElB,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,UAAU,EACV,aAAa,EACb,SAAS,EAET,mBAAmB,EACnB,YAAY,EAEZ,gBAAgB,EAChB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAK1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG"}

package/dist/index.js

@@ -36,7 +36,7 @@ export { universalPostgresAdapter } from './database/universal-postgres.js';
 export { createRevealUI, createRevealUIAccessRule, createRevealUIBlock, createRevealUICollection, createRevealUIField, } from './factories/index.js';
 export { getFeatures, getFeaturesForTier, getRequiredTier, isFeatureEnabled, } from './features.js';
 // License and feature flags
-export { computeKeyId, configureGracePeriods, configureLicenseCache, generateLicenseKey, getCurrentTier, getGraceConfig, getLicensePayload, getLicenseStatus, getMaxSites, getMaxUsers, initializeLicense, isLicensed, readLicenseExp, readLicenseJti, resetLicenseState, validateLicenseKey, } from './license.js';
+export { computeKeyId, configureGracePeriods, configureLicenseCache, generateLicenseKey, getCurrentTier, getGraceConfig, getLicensePayload, getLicensePublicKeyTrustManifest, getLicenseStatus, getMaxSites, getMaxUsers, initializeLicense, isLicensed, readLicenseExp, readLicenseJti, resetLicenseState, validateLicenseKey, } from './license.js';
 // Next.js integration
 // Note: `withRevealUI` is intentionally NOT re-exported here — it pulls in
 // `node:fs` at module load, which causes Next's NFT tracer to pull the whole

package/dist/license.d.ts

@@ -18,7 +18,7 @@ export type LicenseTier = 'free' | 'pro' | 'max' | 'enterprise';
  *
  * - active: License is valid and current
  * - grace: License has an issue but is within a grace period (still allowed)
- * - read-only: Perpetual support lapsed past grace — reads allowed, writes blocked
+ * - read-only: Reserved compatibility state; support lapse does not block perpetual writes
  * - expired: Grace period exhausted — degraded to free tier
  * - invalid: Signature invalid or tampered — hard fail
  * - missing: No license configured — free tier
@@ -36,14 +36,14 @@ export interface LicenseCheckResult {
     reason?: string;
     /** Milliseconds remaining in grace period (undefined if not in grace) */
     graceRemainingMs?: number;
-    /** Whether writes should be blocked (read-only mode for lapsed perpetual) */
+    /** Whether writes should be blocked; perpetual support lapse does not set this flag */
     readOnly: boolean;
 }
 /** Grace period configuration (in days). Overridable via env for testing. */
 export interface GracePeriodConfig {
     /** Days after subscription expiry before degrading to free (default: 3) */
     subscriptionDays: number;
-    /** Days after perpetual support lapse before read-only mode (default: 30) */
+    /** Deprecated compatibility setting; does not limit acquired perpetual runtime access */
     perpetualDays: number;
     /** Days of cached-license grace when infra is unreachable (default: 7) */
     infraDays: number;
@@ -140,6 +140,35 @@ export declare function readPemEnv(name: string, env?: Record<string, string | u
  * live request.
  */
 export declare function getPublicKeys(): string[];
+type LicensePublicKeyRole = 'current' | 'next';
+declare const LICENSE_TRUST_ISSUER = "https://revealui.com";
+declare const LICENSE_TRUST_AUDIENCE = "revealui-license";
+export type LicensePublicKeyTrustManifest = {
+    version: 1;
+    issuer: typeof LICENSE_TRUST_ISSUER;
+    audience: typeof LICENSE_TRUST_AUDIENCE;
+    keys: Array<{
+        role: LicensePublicKeyRole;
+        algorithm: 'EdDSA';
+        publicKey: string;
+        jwtKid: string;
+        keyId: string;
+    }>;
+    digest: string;
+    /** Compatibility field for clients of the original current-key response. */
+    publicKey: string;
+};
+export type LicenseTrustVerification = {
+    payload: LicensePayload;
+    verifiedKeyId: string;
+    trustSetDigest: string;
+};
+/**
+ * Build the public, versioned trust manifest from the same ordered key snapshot
+ * consumed by license verification. Any malformed configured key makes the
+ * endpoint fail closed; a malformed NEXT entry is never silently discarded.
+ */
+export declare function getLicensePublicKeyTrustManifest(): Promise<LicensePublicKeyTrustManifest>;
 /**
  * Computes a deterministic Key ID (kid) from a public key PEM string.
  * Returns the first 8 characters of the SHA-256 hex digest of the PEM.
@@ -173,6 +202,12 @@ export declare function computeKeyId(publicKeyPem: string): Promise<string>;
  * options below. Signature is enforced via the public key.
  */
 export declare function validateLicenseKey(licenseKey: string, publicKey: string | readonly string[], expectedCustomerId?: string): Promise<LicensePayload | null>;
+/**
+ * Verify against one already-built trust manifest and identify the exact
+ * configured key that accepted the token. The returned digest and key ID let
+ * a strict online verifier bind its result to the same set the caller fetched.
+ */
+export declare function validateLicenseKeyAgainstTrustManifest(licenseKey: string, manifest: LicensePublicKeyTrustManifest, expectedCustomerId?: string): Promise<LicenseTrustVerification | null>;
 /**
  * How far past `exp` a license JWT is still accepted by the refresh endpoint
  * (GAP-287 PR-1). Ratified by the owner 2026-07-18 at 30 days.
@@ -201,6 +236,8 @@ export declare const REFRESH_ACCEPT_DAYS = 30;
  * the bind succeeds. It never mints and never grants entitlement on its own.
  */
 export declare function validateLicenseKeyForRefresh(licenseKey: string, publicKey: string | readonly string[], expectedCustomerId: string, refreshAcceptDays?: number): Promise<LicensePayload | null>;
+/** Authenticated operator containment: validates issuer/signature/customer, not entitlement expiry. */
+export declare function validateLicenseKeyForOperator(licenseKey: string, publicKey: string | readonly string[], expectedCustomerId: string): Promise<LicensePayload | null>;
 /**
  * Outcome of a signing-keypair self-test. See {@link selfVerifyLicenseKeypair}.
  */

package/dist/license.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/F,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,qBAAqB;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW/F;AAeD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAOjF;AAED,qCAAqC;AACrC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;iBAuBxB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAW5E;AAWD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAElF;AAkBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAOxC;AAYD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAShC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,EAAE,MAAM,EAC1B,iBAAiB,GAAE,MAA4B,GAC9C,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAIhC;AA+GD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA4D9B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CA8C9D;AAyCD;;;GAGG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,WAAW,CAAC,CAKlE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAG5C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAGzD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAaT;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,WAAW,GAAG,OAAO,CA2B7D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,GAAE,WAAmB,GAAG,kBAAkB,CAkEtF;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAE5D;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,QAAqB,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,qBAAqB,QAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,EAClC,KAAK,GAAE,MAAmB,GACzB,MAAM,CAIR;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAE5D;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC,IAAI,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACvE,UAAU,EAAE,MAAM,EAClB,gBAAgB,GAAE,MAAM,GAAG,IAAuC,EAClE,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAKxC"}
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/F,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,qBAAqB;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,yFAAyF;IACzF,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW/F;AAeD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAOjF;AAED,qCAAqC;AACrC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;iBAuBxB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAW5E;AAWD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAElF;AAkBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAExC;AAED,KAAK,oBAAoB,GAAG,SAAS,GAAG,MAAM,CAAC;AAO/C,QAAA,MAAM,oBAAoB,yBAAyB,CAAC;AACpD,QAAA,MAAM,sBAAsB,qBAAqB,CAAC;AAMlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,OAAO,oBAAoB,CAAC;IACpC,QAAQ,EAAE,OAAO,sBAAsB,CAAC;IACxC,IAAI,EAAE,KAAK,CAAC;QACV,IAAI,EAAE,oBAAoB,CAAC;QAC3B,SAAS,EAAE,OAAO,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;IACH,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAsFF;;;;GAIG;AACH,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,6BAA6B,CAAC,CA+C/F;AAYD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAShC;AAED;;;;GAIG;AACH,wBAAsB,sCAAsC,CAC1D,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,6BAA6B,EACvC,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CA8E1C;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,EAAE,MAAM,EAC1B,iBAAiB,GAAE,MAA4B,GAC9C,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAIhC;AAED,uGAAuG;AACvG,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAGhC;AAqID;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA4D9B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CA8C9D;AAyCD;;;GAGG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,WAAW,CAAC,CAKlE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAG5C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAGzD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAaT;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,WAAW,GAAG,OAAO,CA2B7D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,GAAE,WAAmB,GAAG,kBAAkB,CAkEtF;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAE5D;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,QAAqB,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,qBAAqB,QAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,EAClC,KAAK,GAAE,MAAmB,GACzB,MAAM,CAIR;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAE5D;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC,IAAI,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACvE,UAAU,EAAE,MAAM,EAClB,gBAAgB,GAAE,MAAM,GAAG,IAAuC,EAClE,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAKxC"}

package/dist/license.js

@@ -162,10 +162,10 @@ export function readPemEnv(name, env = process.env) {
     const raw = env[name];
     if (raw === undefined)
         return undefined;
-    const trimmed = raw.trim();
+    const trimmed = normalizePem(raw).trim();
     if (trimmed.length === 0)
         return undefined;
-    return normalizePem(trimmed);
+    return trimmed;
 }
 /**
  * The ordered public-key candidates used to verify license JWTs.
@@ -183,14 +183,133 @@ export function readPemEnv(name, env = process.env) {
  * live request.
  */
 export function getPublicKeys() {
-    const keys = [];
-    const current = process.env.REVEALUI_LICENSE_PUBLIC_KEY;
+    return getPublicKeySnapshot().map(({ publicKey }) => publicKey);
+}
+const LICENSE_TRUST_ISSUER = 'https://revealui.com';
+const LICENSE_TRUST_AUDIENCE = 'revealui-license';
+const LICENSE_TRUST_MANIFEST_MAX_BYTES = 16 * 1024;
+const LICENSE_TRUST_PEM_MAX_BYTES = 2 * 1024;
+const LICENSE_TRUST_SPKI_BEGIN = '-----BEGIN PUBLIC KEY-----';
+const LICENSE_TRUST_SPKI_END = '-----END PUBLIC KEY-----';
+function getPublicKeySnapshot() {
+    const current = readPemEnv('REVEALUI_LICENSE_PUBLIC_KEY');
+    const next = readPemEnv('REVEALUI_LICENSE_PUBLIC_KEY_NEXT');
+    const candidates = [];
     if (current)
-        keys.push(normalizePem(current));
-    const next = process.env.REVEALUI_LICENSE_PUBLIC_KEY_NEXT;
+        candidates.push({ role: 'current', publicKey: current });
     if (next)
-        keys.push(normalizePem(next));
-    return keys;
+        candidates.push({ role: 'next', publicKey: next });
+    return candidates;
+}
+function toHex(bytes) {
+    let hex = '';
+    for (const byte of bytes)
+        hex += byte.toString(16).padStart(2, '0');
+    return hex;
+}
+function decodePublicKeySpki(publicKeyPem) {
+    if (new TextEncoder().encode(publicKeyPem).byteLength > LICENSE_TRUST_PEM_MAX_BYTES) {
+        throw new Error('License public key exceeds the supported size');
+    }
+    if (!(publicKeyPem.startsWith(LICENSE_TRUST_SPKI_BEGIN) &&
+        publicKeyPem.endsWith(LICENSE_TRUST_SPKI_END))) {
+        throw new Error('License trust entries must contain a public SPKI PEM');
+    }
+    const body = publicKeyPem
+        .slice(LICENSE_TRUST_SPKI_BEGIN.length, -LICENSE_TRUST_SPKI_END.length)
+        .split('\n')
+        .join('')
+        .split('\r')
+        .join('');
+    if (body.length === 0 || body.includes('-')) {
+        throw new Error('License public key PEM body is invalid');
+    }
+    let binary;
+    try {
+        binary = atob(body);
+    }
+    catch {
+        throw new Error('License public key PEM body is invalid');
+    }
+    if (btoa(binary) !== body)
+        throw new Error('License public key PEM body is not canonical base64');
+    const der = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1) {
+        der[index] = binary.charCodeAt(index);
+    }
+    return der;
+}
+async function describeLicensePublicKey(candidate) {
+    const spki = decodePublicKeySpki(candidate.publicKey);
+    const spkiBuffer = new ArrayBuffer(spki.byteLength);
+    new Uint8Array(spkiBuffer).set(spki);
+    const key = await crypto.subtle.importKey('spki', spkiBuffer, { name: 'Ed25519' }, true, [
+        'verify',
+    ]);
+    if (key.algorithm.name !== 'Ed25519') {
+        throw new Error('License trust entries must use Ed25519');
+    }
+    const canonicalSpki = new Uint8Array(await crypto.subtle.exportKey('spki', key));
+    if (canonicalSpki.length !== spki.length ||
+        canonicalSpki.some((byte, index) => byte !== spki[index])) {
+        throw new Error('License public key SPKI is not canonical');
+    }
+    const keyId = toHex(new Uint8Array(await crypto.subtle.digest('SHA-256', canonicalSpki)));
+    const jwtKid = await computeKeyId(candidate.publicKey);
+    return {
+        role: candidate.role,
+        algorithm: 'EdDSA',
+        publicKey: candidate.publicKey,
+        jwtKid,
+        keyId,
+    };
+}
+/**
+ * Build the public, versioned trust manifest from the same ordered key snapshot
+ * consumed by license verification. Any malformed configured key makes the
+ * endpoint fail closed; a malformed NEXT entry is never silently discarded.
+ */
+export async function getLicensePublicKeyTrustManifest() {
+    if (LICENSE_ISSUER !== LICENSE_TRUST_ISSUER || LICENSE_AUDIENCE !== LICENSE_TRUST_AUDIENCE) {
+        throw new Error('License issuer configuration does not match the hosted trust contract');
+    }
+    const snapshot = getPublicKeySnapshot();
+    if (snapshot.length === 0 || snapshot[0]?.role !== 'current' || snapshot.length > 2) {
+        throw new Error('License current public key is not configured');
+    }
+    const keys = await Promise.all(snapshot.map(describeLicensePublicKey));
+    const keyIds = new Set();
+    const jwtKids = new Set();
+    for (const key of keys) {
+        if (keyIds.has(key.keyId) || jwtKids.has(key.jwtKid)) {
+            throw new Error('License trust set contains duplicate key identities');
+        }
+        keyIds.add(key.keyId);
+        jwtKids.add(key.jwtKid);
+    }
+    const version = 1;
+    const digestInput = JSON.stringify({
+        version,
+        issuer: LICENSE_TRUST_ISSUER,
+        audience: LICENSE_TRUST_AUDIENCE,
+        keys: keys.map(({ role, algorithm, keyId }) => ({ role, algorithm, keyId })),
+    });
+    const digest = toHex(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(digestInput))));
+    const current = keys[0];
+    if (!current)
+        throw new Error('License current public key is not configured');
+    const manifest = {
+        version,
+        issuer: LICENSE_TRUST_ISSUER,
+        audience: LICENSE_TRUST_AUDIENCE,
+        keys,
+        digest,
+        publicKey: current.publicKey,
+    };
+    if (new TextEncoder().encode(JSON.stringify(manifest)).byteLength > LICENSE_TRUST_MANIFEST_MAX_BYTES) {
+        throw new Error('License trust manifest exceeds the supported size');
+    }
+    return manifest;
 }
 /**
  * Reads the license key from environment.
@@ -248,6 +367,79 @@ export async function validateLicenseKey(licenseKey, publicKey, expectedCustomer
     // is available for grace-period calculations in isLicensed().
     return verifyAndParseLicenseJwt(licenseKey, publicKey, graceConfig.subscriptionDays * 86_400, expectedCustomerId);
 }
+/**
+ * Verify against one already-built trust manifest and identify the exact
+ * configured key that accepted the token. The returned digest and key ID let
+ * a strict online verifier bind its result to the same set the caller fetched.
+ */
+export async function validateLicenseKeyAgainstTrustManifest(licenseKey, manifest, expectedCustomerId) {
+    try {
+        // Detach from the caller before the first await. Callers may retain and
+        // mutate their input object while signature verification is in flight.
+        const snapshot = Object.freeze({
+            version: manifest.version,
+            issuer: manifest.issuer,
+            audience: manifest.audience,
+            digest: manifest.digest,
+            publicKey: manifest.publicKey,
+            keys: Array.isArray(manifest.keys)
+                ? Object.freeze(manifest.keys.map((key) => Object.freeze({ ...key })))
+                : manifest.keys,
+        });
+        if (snapshot.version !== 1 ||
+            snapshot.issuer !== LICENSE_TRUST_ISSUER ||
+            snapshot.audience !== LICENSE_TRUST_AUDIENCE ||
+            !/^[0-9a-f]{64}$/.test(snapshot.digest) ||
+            !Array.isArray(snapshot.keys) ||
+            snapshot.keys.length === 0 ||
+            snapshot.keys.length > 2 ||
+            snapshot.keys[0]?.role !== 'current' ||
+            snapshot.keys.some((key, index) => key.role !== (index === 0 ? 'current' : 'next'))) {
+            return null;
+        }
+        const described = await Promise.all(snapshot.keys.map((key) => describeLicensePublicKey({ role: key.role, publicKey: key.publicKey })));
+        const keyIds = new Set();
+        const jwtKids = new Set();
+        for (let index = 0; index < described.length; index += 1) {
+            const actual = described[index];
+            const supplied = snapshot.keys[index];
+            if (!(actual && supplied) ||
+                actual.algorithm !== supplied.algorithm ||
+                actual.keyId !== supplied.keyId ||
+                actual.jwtKid !== supplied.jwtKid ||
+                keyIds.has(actual.keyId) ||
+                jwtKids.has(actual.jwtKid)) {
+                return null;
+            }
+            keyIds.add(actual.keyId);
+            jwtKids.add(actual.jwtKid);
+        }
+        const digestInput = JSON.stringify({
+            version: snapshot.version,
+            issuer: snapshot.issuer,
+            audience: snapshot.audience,
+            keys: described.map(({ role, algorithm, keyId }) => ({ role, algorithm, keyId })),
+        });
+        const expectedDigest = toHex(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(digestInput))));
+        if (snapshot.digest !== expectedDigest || snapshot.publicKey !== described[0]?.publicKey) {
+            return null;
+        }
+        for (const key of described) {
+            const payload = await validateLicenseKey(licenseKey, key.publicKey, expectedCustomerId);
+            if (payload) {
+                return {
+                    payload,
+                    verifiedKeyId: key.keyId,
+                    trustSetDigest: snapshot.digest,
+                };
+            }
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
 /**
  * How far past `exp` a license JWT is still accepted by the refresh endpoint
  * (GAP-287 PR-1). Ratified by the owner 2026-07-18 at 30 days.
@@ -281,6 +473,12 @@ export async function validateLicenseKeyForRefresh(licenseKey, publicKey, expect
         return null;
     return verifyAndParseLicenseJwt(licenseKey, publicKey, refreshAcceptDays * 86_400, bound);
 }
+/** Authenticated operator containment: validates issuer/signature/customer, not entitlement expiry. */
+export async function validateLicenseKeyForOperator(licenseKey, publicKey, expectedCustomerId) {
+    if (!expectedCustomerId.trim())
+        return null;
+    return verifyAndParseLicenseJwt(licenseKey, publicKey, 0, expectedCustomerId, true);
+}
 /**
  * Shared verify + parse path for {@link validateLicenseKey} and
  * {@link validateLicenseKeyForRefresh}. The ONLY behavioral difference between
@@ -288,7 +486,7 @@ export async function validateLicenseKeyForRefresh(licenseKey, publicKey, expect
  * still accepted — so the rotation-aware multi-key loop and the payload schema
  * live in exactly one place.
  */
-async function verifyAndParseLicenseJwt(licenseKey, publicKey, clockToleranceSeconds, expectedCustomerId) {
+async function verifyAndParseLicenseJwt(licenseKey, publicKey, clockToleranceSeconds, expectedCustomerId, operator = false) {
     const candidates = typeof publicKey === 'string' ? [publicKey] : [...publicKey];
     if (candidates.length === 0)
         return null;
@@ -303,12 +501,27 @@ async function verifyAndParseLicenseJwt(licenseKey, publicKey, clockToleranceSec
         for (const candidate of ordered) {
             try {
                 const key = await jose.importSPKI(candidate, 'EdDSA');
-                const { payload } = await jose.jwtVerify(licenseKey, key, {
-                    algorithms: ['EdDSA'],
-                    clockTolerance: clockToleranceSeconds,
-                    issuer: LICENSE_ISSUER,
-                    audience: LICENSE_AUDIENCE,
-                });
+                let payload;
+                if (operator) {
+                    const verified = await jose.compactVerify(licenseKey, key, { algorithms: ['EdDSA'] });
+                    const claims = JSON.parse(new TextDecoder().decode(verified.payload));
+                    if (claims.iss !== LICENSE_ISSUER ||
+                        !(claims.aud === LICENSE_AUDIENCE ||
+                            (Array.isArray(claims.aud) && claims.aud.includes(LICENSE_AUDIENCE))) ||
+                        (claims.nbf !== undefined &&
+                            (typeof claims.nbf !== 'number' || claims.nbf > Date.now() / 1000))) {
+                        continue;
+                    }
+                    payload = claims;
+                }
+                else {
+                    ({ payload } = await jose.jwtVerify(licenseKey, key, {
+                        algorithms: ['EdDSA'],
+                        clockTolerance: clockToleranceSeconds,
+                        issuer: LICENSE_ISSUER,
+                        audience: LICENSE_AUDIENCE,
+                    }));
+                }
                 verifiedPayload = payload;
                 verified = true;
                 break;
@@ -882,17 +1095,18 @@ export async function generateLicenseKey(payload, privateKey, expiresInSeconds =
     // Strip the optional jti from the spread so jose.setJti() is the single
     // source of the claim (avoids a duplicate field in the payload).
     const { jti: _ignoredJti, ...rest } = payload;
+    const issuedAt = Math.floor(Date.now() / 1000);
     const builder = new jose.SignJWT({ ...rest })
         .setProtectedHeader(header)
-        .setIssuedAt()
+        .setIssuedAt(issuedAt)
         // Phase 1 audit B-2: enforce nbf so tokens cannot be replayed pre-issue
         // by a clock-skewed client.
-        .setNotBefore('0s')
+        .setNotBefore(issuedAt)
         .setJti(jti)
         .setIssuer(LICENSE_ISSUER)
         .setAudience(LICENSE_AUDIENCE);
     if (expiresInSeconds !== null) {
-        builder.setExpirationTime(`${expiresInSeconds}s`);
+        builder.setExpirationTime(issuedAt + expiresInSeconds);
     }
     return builder.sign(key);
 }

package/dist/sentry-environment.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Sentry `environment` for a deploy.
+ *
+ * `NODE_ENV=production` is set on staging as well as production, so it is not
+ * a safe Sentry label. Prefer `SENTRY_ENVIRONMENT` (then `REVEALUI_DEPLOY_ENV`,
+ * then `NEXT_PUBLIC_SENTRY_ENVIRONMENT`). When those are unset, derive the
+ * label from public hosts. A `*.staging.revealui.com` host is never reported
+ * as production. Vercel preview stays `preview`.
+ */
+export type SentryEnvironmentName = 'production' | 'staging' | 'preview' | 'development' | 'test';
+/** Non-secret label. Set `SENTRY_ENVIRONMENT=staging` on staging Vercel and Fly. */
+export declare const SENTRY_ENVIRONMENT_VAR = "SENTRY_ENVIRONMENT";
+export interface SentryEnvironmentSource {
+    SENTRY_ENVIRONMENT?: string | undefined;
+    REVEALUI_DEPLOY_ENV?: string | undefined;
+    NEXT_PUBLIC_SENTRY_ENVIRONMENT?: string | undefined;
+    NODE_ENV?: string | undefined;
+    VERCEL_ENV?: string | undefined;
+    REVEALUI_API_URL?: string | undefined;
+    NEXT_PUBLIC_API_URL?: string | undefined;
+    API_URL?: string | undefined;
+    REVEALUI_PUBLIC_SERVER_URL?: string | undefined;
+    NEXT_PUBLIC_SERVER_URL?: string | undefined;
+    VERCEL_PROJECT_PRODUCTION_URL?: string | undefined;
+    VERCEL_URL?: string | undefined;
+    SESSION_COOKIE_DOMAIN?: string | undefined;
+    PASSKEY_RP_ID?: string | undefined;
+    PASSKEY_ORIGIN?: string | undefined;
+    CORS_ORIGIN?: string | undefined;
+}
+/**
+ * Resolve the Sentry environment label.
+ * Staging hosts report `staging`, or `preview` when that explicit label is set.
+ * They do not report `production`.
+ */
+export declare function resolveSentryEnvironment(env: SentryEnvironmentSource): SentryEnvironmentName;
+//# sourceMappingURL=sentry-environment.d.ts.map

package/dist/sentry-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry-environment.d.ts","sourceRoot":"","sources":["../src/sentry-environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,8BAA8B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,6BAA6B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAyED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,uBAAuB,GAAG,qBAAqB,CAoD5F"}

package/dist/sentry-environment.js

@@ -0,0 +1,129 @@
+/**
+ * Sentry `environment` for a deploy.
+ *
+ * `NODE_ENV=production` is set on staging as well as production, so it is not
+ * a safe Sentry label. Prefer `SENTRY_ENVIRONMENT` (then `REVEALUI_DEPLOY_ENV`,
+ * then `NEXT_PUBLIC_SENTRY_ENVIRONMENT`). When those are unset, derive the
+ * label from public hosts. A `*.staging.revealui.com` host is never reported
+ * as production. Vercel preview stays `preview`.
+ */
+import { isStagingRevealHost, normalizeRequestHost } from './session-cookie-domain.js';
+/** Non-secret label. Set `SENTRY_ENVIRONMENT=staging` on staging Vercel and Fly. */
+export const SENTRY_ENVIRONMENT_VAR = 'SENTRY_ENVIRONMENT';
+const HOST_KEYS = [
+    'REVEALUI_API_URL',
+    'NEXT_PUBLIC_API_URL',
+    'API_URL',
+    'REVEALUI_PUBLIC_SERVER_URL',
+    'NEXT_PUBLIC_SERVER_URL',
+    'VERCEL_PROJECT_PRODUCTION_URL',
+    'VERCEL_URL',
+    'SESSION_COOKIE_DOMAIN',
+    'PASSKEY_RP_ID',
+    'PASSKEY_ORIGIN',
+    'CORS_ORIGIN',
+];
+const PRODUCTION_HOSTS = new Set([
+    'revealui.com',
+    'www.revealui.com',
+    'api.revealui.com',
+    'admin.revealui.com',
+    'docs.revealui.com',
+]);
+function lockedEnvironment(raw) {
+    if (raw == null)
+        return null;
+    const value = raw.trim().toLowerCase();
+    switch (value) {
+        case 'production':
+        case 'staging':
+        case 'preview':
+        case 'development':
+        case 'test':
+            return value;
+        default:
+            return null;
+    }
+}
+function firstLocked(...values) {
+    for (const value of values) {
+        const locked = lockedEnvironment(value);
+        if (locked)
+            return locked;
+    }
+    return null;
+}
+function splitComma(raw) {
+    const parts = [];
+    let start = 0;
+    for (let index = 0; index <= raw.length; index += 1) {
+        if (index === raw.length || raw.charCodeAt(index) === 44) {
+            const part = raw.slice(start, index).trim();
+            if (part.length > 0)
+                parts.push(part);
+            start = index + 1;
+        }
+    }
+    return parts;
+}
+function collectHosts(env) {
+    const hosts = [];
+    for (const key of HOST_KEYS) {
+        const raw = env[key];
+        if (typeof raw !== 'string' || raw.trim().length === 0)
+            continue;
+        for (const part of splitComma(raw)) {
+            const host = normalizeRequestHost(part);
+            if (host)
+                hosts.push(host);
+        }
+    }
+    return hosts;
+}
+/**
+ * Resolve the Sentry environment label.
+ * Staging hosts report `staging`, or `preview` when that explicit label is set.
+ * They do not report `production`.
+ */
+export function resolveSentryEnvironment(env) {
+    const hosts = collectHosts(env);
+    let stagingHost = false;
+    let productionHost = false;
+    for (const host of hosts) {
+        if (isStagingRevealHost(host))
+            stagingHost = true;
+        if (PRODUCTION_HOSTS.has(host))
+            productionHost = true;
+    }
+    const explicit = firstLocked(env.SENTRY_ENVIRONMENT, env.REVEALUI_DEPLOY_ENV, env.NEXT_PUBLIC_SENTRY_ENVIRONMENT);
+    if (stagingHost) {
+        if (explicit === 'staging' ||
+            explicit === 'preview' ||
+            explicit === 'development' ||
+            explicit === 'test') {
+            return explicit;
+        }
+        return 'staging';
+    }
+    if (explicit)
+        return explicit;
+    if (productionHost)
+        return 'production';
+    const vercel = lockedEnvironment(env.VERCEL_ENV);
+    if (vercel === 'preview' ||
+        vercel === 'development' ||
+        vercel === 'test' ||
+        vercel === 'staging') {
+        return vercel;
+    }
+    const nodeEnv = lockedEnvironment(env.NODE_ENV);
+    if (nodeEnv === 'development' ||
+        nodeEnv === 'test' ||
+        nodeEnv === 'staging' ||
+        nodeEnv === 'preview') {
+        return nodeEnv;
+    }
+    if (nodeEnv === 'production' || vercel === 'production')
+        return 'production';
+    return 'development';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/core",
-  "version": "0.15.0",
+  "version": "0.15.4",
   "description": "RevealUI's runtime engine — admin UI, REST API, auth, rich text, plugin system, and access control. The heart of the open-source platform.",
   "license": "MIT",
   "dependencies": {
@@ -23,10 +23,10 @@
     "pg": "^8.22.0",
     "yjs": "^13.6.31",
     "zod": "^4.4.3",
-    "@revealui/contracts": "0.12.0",
-    "@revealui/presentation": "0.14.8",
+    "@revealui/contracts": "0.13.2",
+    "@revealui/presentation": "0.15.2",
     "@revealui/resilience": "0.2.4",
-    "@revealui/security": "0.8.2",
+    "@revealui/security": "0.10.1",
     "@revealui/utils": "0.3.6"
   },
   "devDependencies": {
@@ -71,6 +71,11 @@
       "import": "./dist/session-cookie-domain.js",
       "default": "./dist/session-cookie-domain.js"
     },
+    "./sentry-environment": {
+      "types": "./dist/sentry-environment.d.ts",
+      "import": "./dist/sentry-environment.js",
+      "default": "./dist/sentry-environment.js"
+    },
     "./margin-governor": {
       "types": "./dist/margin-governor.d.ts",
       "import": "./dist/margin-governor.js",