@revealui/presentation@0.12.1

Patch Changes

• 86780ad: Fix RenderBlocks emitting data-rvui-field paths one segment short of the real draft structure (e.g. blocks.0.title instead of blocks.0.data.title). Every block component reads its fields from block.data.*, so a path stopping at the block index landed an edit-session patch as a sibling of data instead of inside it — silently corrupting the block's data on write, both in the session draft and (on publish) the live page. Attributes only appear in edit mode (editable + docId), so this does not affect any non-edit-mode rendering or visual output.
• Updated dependencies [86780ad]
  • @revealui/contracts@0.8.1

@revealui/mcp@0.8.3

Patch Changes

• Updated dependencies [641ff50]
• Updated dependencies [fb3315c]
• Updated dependencies [94d1714]
  • @revealui/security@0.6.0
  • @revealui/db@0.10.0
  • @revealui/core@0.12.2
  • @revealui/setup@0.7.2
  • @revealui/knowledge-graph@0.1.5
  • @revealui/contracts@0.8.1

@revealui/knowledge-graph@0.1.5

Patch Changes

• Updated dependencies [fb3315c]
• Updated dependencies [94d1714]
  • @revealui/db@0.10.0

@revealui/harnesses@0.11.0

Minor Changes

• b65c739: Delete the zero-consumer coordination-daemon twin per GAP-421's DELETE train
  (audit step 8, daemon-ownership ADR 2026-07-25): goals/, server/rpc-server.ts,
  server/spawner-service.ts, server/shared-memory-client.ts, coordinator.ts,
  and coordination/ (3,002 source LOC + 1,211 test LOC), plus the start and
  coordinate --init CLI subcommands that were the only thing constructing the
  now-deleted HarnessCoordinator. The RevDev daemon owns the coordination
  runtime and the harness socket; this package keeps the CLI, content
  definitions, and ./gates. The published ./goals subpath export is removed
  — a breaking change for any external importer, hence the minor bump inside 0.x.

  server/http-gateway.ts stays (it is ported into the RevDev daemon separately);
  its RpcServer type import is replaced with a minimal local RpcDispatch
  structural interface covering its one real usage (dispatchHttp), plus
  GatewayStore and SpawnerLike structural interfaces covering its DaemonStore
  and SpawnerService couplings the same way, so the module keeps compiling
  without those two also-deleted types.

  storage/ and config/ were in the ADR's DELETE list but are NOT deleted here:
  storage/ backs server/__tests__/http-gateway.test.ts's real (non-mocked)
  security test suite (GAP-353 auth flow), and config/ is a real production
  dependency of adapters/cursor-adapter.ts and adapters/opencode-adapter.ts
  (both staying, INCUBATE). Both are consumers the ADR's routing did not account
  for; deleting either would have required rewriting or gutting working code/tests
  outside this train's scope, so they were left in place and reported instead.

• ec8b2dc: Remove the ./protocol subpath export. It was mapped in package.json but never listed in tsup.config.ts, so dist/protocol/ never existed and the export 404'd (ERR_MODULE_NOT_FOUND) for anyone who tried it. GAP-421's routing audit found zero consumers of the subpath fleet-wide; protocol types, schemas, and factories remain available via the root @revealui/harnesses export, which already re-exports them.

Patch Changes

• @revealui/core@0.12.2

@revealui/editor@0.2.1

Patch Changes

• 86780ad: Land canvas defaults for a fresh edit session: resolve a published page (home then products then first) when no dirty docs exist, so the preview iframe is not stuck on bare /. Export pickDefaultPreviewPageId for the preference order.
• 86780ad: VES P2 slice: gate fleet-marketing session patches with marketing-voice Tier-1 validation, extend prose slots for contracts block shapes, and add blocks.insert/remove/move ops on the session API plus canvas block chrome.
• Updated dependencies [86780ad]
• Updated dependencies [86780ad]
  • @revealui/presentation@0.12.1
  • @revealui/contracts@0.8.1

@revealui/db@0.10.0

Minor Changes

• fb3315c: Close the audit env-parity fail-open (GAP-417 item 5): @revealui/db now exports hasDatabaseConnectionEnv(), a boot-time predicate that matches getClient()'s connection resolution exactly (config url, then POSTGRES_URL / DATABASE_URL), and assertAuditStorageEnv consumes it instead of a local triple that also accepted DATABASE_HOST — an env shape getClient() never consults, which let the assert pass, the install throw, and production silently keep the in-memory audit sink.
• 94d1714: GAP-417 both rails (owner-countersigned): the audit path has no escape hatch into unsigned production rows. assertAuditStorageEnv refuses a production boot without the signing key regardless of SKIP_ENV_VALIDATION; DrizzleAuditStore.append/appendBatch refuse to land an unsigned row when NODE_ENV=production; and the signer composition normalizes single-line \n-escaped PEMs so env_file transports (RevForge kits) can carry the key.

@revealui/core@0.12.2

Patch Changes

• Updated dependencies [641ff50]
• Updated dependencies [94d1714]
  • @revealui/security@0.6.0
  • @revealui/contracts@0.8.1

@revealui/contracts@0.8.1

Patch Changes

• 86780ad: VES P2 slice: gate fleet-marketing session patches with marketing-voice Tier-1 validation, extend prose slots for contracts block shapes, and add blocks.insert/remove/move ops on the session API plus canvas block chrome.

@revealui/cli@0.9.4

Patch Changes

• @revealui/setup@0.7.2

@revealui/auth@0.5.0

Minor Changes

• 50b9b4b: Add the shared audit storage boundary (DrizzleBackedAuditStorage, installAuditStorage, assertAuditStorageEnv, auditStorageSelfTest, createAuditStore, getAuditRowSigner, mapSeverityToDb) at the dedicated subpath @revealui/auth/audit-storage, moved from apps/server so the admin process can install persistent, signed audit storage at boot. The boundary is deliberately not re-exported from the @revealui/auth/server barrel: route tests bare-mock that barrel for getSession, and a bare mock must never swallow the audit write path. Fixes the defect where every admin-process audit emit (including login receipts) landed in the default in-memory store and evaporated on restart (GAP-338).
• fb3315c: Close the audit env-parity fail-open (GAP-417 item 5): @revealui/db now exports hasDatabaseConnectionEnv(), a boot-time predicate that matches getClient()'s connection resolution exactly (config url, then POSTGRES_URL / DATABASE_URL), and assertAuditStorageEnv consumes it instead of a local triple that also accepted DATABASE_HOST — an env shape getClient() never consults, which let the assert pass, the install throw, and production silently keep the in-memory audit sink.
• 94d1714: GAP-417 both rails (owner-countersigned): the audit path has no escape hatch into unsigned production rows. assertAuditStorageEnv refuses a production boot without the signing key regardless of SKIP_ENV_VALIDATION; DrizzleAuditStore.append/appendBatch refuse to land an unsigned row when NODE_ENV=production; and the signer composition normalizes single-line \n-escaped PEMs so env_file transports (RevForge kits) can carry the key.

Patch Changes

• Updated dependencies [641ff50]
• Updated dependencies [fb3315c]
• Updated dependencies [94d1714]
  • @revealui/security@0.6.0
  • @revealui/db@0.10.0
  • @revealui/core@0.12.2
  • @revealui/contracts@0.8.1