@revealui/core 0.10.1 → 0.11.0

package/dist/license.js

@@ -120,14 +120,37 @@ let cachedState = {
     keyPresentButInvalid: false,
 };
 /**
- * The public key used to verify license JWTs.
- * In production, this is fetched from the license server.
- * For local development, it reads from REVEALUI_LICENSE_PUBLIC_KEY env var.
+ * Restore real newlines in a PEM stored single-line with literal `\n`
+ * (Docker / .env files commonly do this). Fixed-string split/join — no
+ * authored regex, per the fleet no-regex rule.
  */
-function getPublicKey() {
-    const raw = process.env.REVEALUI_LICENSE_PUBLIC_KEY ?? null;
-    // Docker/env files store PEM as single-line with literal \n  -  restore real newlines
-    return raw ? raw.replace(/\\n/g, '\n') : null;
+export function normalizePem(raw) {
+    return raw.split('\\n').join('\n');
+}
+/**
+ * The ordered public-key candidates used to verify license JWTs.
+ *
+ * Index 0 is the current key (`REVEALUI_LICENSE_PUBLIC_KEY`); index 1, when
+ * present, is the incoming rotation key (`REVEALUI_LICENSE_PUBLIC_KEY_NEXT`).
+ * During a zero-downtime key rotation BOTH are configured at once, so a token
+ * signed by EITHER key verifies GREEN and no customer is interrupted while
+ * re-minted tokens propagate. In production the current key is provisioned
+ * from the license server; both read from env here.
+ *
+ * Exported so the hosted boot canary (`apps/server` validate path) builds the
+ * SAME ordered, newline-normalized list the request path uses — a NEXT-signed
+ * token must pass the canary during a rotation window exactly as it passes a
+ * live request.
+ */
+export function getPublicKeys() {
+    const keys = [];
+    const current = process.env.REVEALUI_LICENSE_PUBLIC_KEY;
+    if (current)
+        keys.push(normalizePem(current));
+    const next = process.env.REVEALUI_LICENSE_PUBLIC_KEY_NEXT;
+    if (next)
+        keys.push(normalizePem(next));
+    return keys;
 }
 /**
  * Reads the license key from environment.
@@ -159,6 +182,16 @@ export async function computeKeyId(publicKeyPem) {
  * Validates a license key JWT and returns the decoded payload.
  * Returns null if the key is invalid, expired, or missing.
  *
+ * Multi-key rotation (GAP-259 P0-3): `publicKey` accepts either a single PEM
+ * or an ORDERED list of candidate PEMs (current first, then the incoming
+ * rotation key). The token is verified against each candidate in turn and is
+ * accepted on the FIRST success; it is rejected only when EVERY candidate
+ * fails. The JWT `kid` header (a SHA-256 fingerprint via `computeKeyId`) is a
+ * perf hint used to try the matching key first — it is NOT authoritative, so a
+ * token with no `kid` (or a stale one) still verifies against whichever key
+ * actually signed it. This lets a deployment run both keys at once during a
+ * zero-downtime rotation. A single string keeps the legacy behavior unchanged.
+ *
  * Phase 1 audit B-2: when `expectedCustomerId` is supplied, the JWT's
  * `customerId` claim must match exactly — otherwise the token is rejected
  * even when the signature + iss + aud + exp are all valid. This binds a
@@ -171,25 +204,49 @@ export async function computeKeyId(publicKeyPem) {
  * options below. Signature is enforced via the public key.
  */
 export async function validateLicenseKey(licenseKey, publicKey, expectedCustomerId) {
+    const candidates = typeof publicKey === 'string' ? [publicKey] : [...publicKey];
+    if (candidates.length === 0)
+        return null;
     try {
         const jose = await getJose();
-        // Extract kid from JWT header for forward-compatible key rotation
+        // The kid header is a rotation hint: try the key whose fingerprint matches
+        // first, then still fall through to the rest (a token may carry no kid).
         const header = jose.decodeProtectedHeader(licenseKey);
-        const expectedKid = await computeKeyId(publicKey);
-        if (header.kid && header.kid !== expectedKid) {
-            logger.warn(`JWT kid mismatch: token has "${header.kid}", current key is "${expectedKid}". ` +
-                'Token may have been signed with a rotated key.');
+        const ordered = await orderCandidatesByKid(candidates, header.kid);
+        let verifiedPayload = null;
+        let verified = false;
+        for (const candidate of ordered) {
+            try {
+                const key = await jose.importSPKI(candidate, 'EdDSA');
+                // Accept tokens expired within the subscription grace window so the
+                // payload is available for grace-period calculations in isLicensed().
+                const { payload } = await jose.jwtVerify(licenseKey, key, {
+                    algorithms: ['EdDSA'],
+                    clockTolerance: graceConfig.subscriptionDays * 86_400,
+                    issuer: LICENSE_ISSUER,
+                    audience: LICENSE_AUDIENCE,
+                });
+                verifiedPayload = payload;
+                verified = true;
+                break;
+            }
+            catch {
+                // This candidate did not verify (wrong key, malformed PEM, bad
+                // iss/aud, or expired beyond grace) — try the next before giving up.
+            }
         }
-        const key = await jose.importSPKI(publicKey, 'EdDSA');
-        // Accept tokens expired within the subscription grace window so the
-        // payload is available for grace-period calculations in isLicensed().
-        const { payload } = await jose.jwtVerify(licenseKey, key, {
-            algorithms: ['EdDSA'],
-            clockTolerance: graceConfig.subscriptionDays * 86_400,
-            issuer: LICENSE_ISSUER,
-            audience: LICENSE_AUDIENCE,
-        });
-        const result = licensePayloadSchema.safeParse(payload);
+        if (!verified) {
+            // Rejected by every configured key. Warn once (no key material leaked)
+            // to aid diagnosing a rotation where the token's signer is not yet — or
+            // no longer — in REVEALUI_LICENSE_PUBLIC_KEY[_NEXT].
+            if (header.kid) {
+                logger.warn(`License JWT rejected: token kid "${header.kid}" did not verify against ` +
+                    `any of the ${candidates.length} configured public key(s). ` +
+                    'The signing key may not be in REVEALUI_LICENSE_PUBLIC_KEY / _NEXT.');
+            }
+            return null;
+        }
+        const result = licensePayloadSchema.safeParse(verifiedPayload);
         if (!result.success) {
             return null;
         }
@@ -209,6 +266,108 @@ export async function validateLicenseKey(licenseKey, publicKey, expectedCustomer
         return null;
     }
 }
+/**
+ * Order candidate PEMs so the one whose `computeKeyId` fingerprint matches the
+ * token's `kid` header is tried first. A perf hint only — when `kid` is absent
+ * or matches nothing, the original order is preserved and the caller still
+ * tries every candidate. Never throws (a malformed candidate simply does not
+ * match and is left in place).
+ */
+async function orderCandidatesByKid(candidates, kid) {
+    if (!kid || candidates.length < 2)
+        return candidates;
+    for (let i = 0; i < candidates.length; i++) {
+        const candidate = candidates[i];
+        if (!candidate)
+            continue;
+        let fingerprint = null;
+        try {
+            fingerprint = await computeKeyId(candidate);
+        }
+        catch {
+            fingerprint = null;
+        }
+        if (fingerprint === kid) {
+            if (i === 0)
+                return candidates;
+            return [candidate, ...candidates.slice(0, i), ...candidates.slice(i + 1)];
+        }
+    }
+    return candidates;
+}
+/**
+ * Self-test a signing keypair by signing a throwaway token with `privateKey`
+ * and verifying it against the ordered `publicKeys` list — the SAME multi-key
+ * path real tokens take. Used by the hosted boot canary (GAP-259 P0-4).
+ *
+ * Distinguishes three outcomes so the caller can react correctly:
+ *  - `ok`       — a token the private key signed verifies against a configured
+ *                 public key, and its kid resolves to a configured key.
+ *  - `mismatch` — imports all succeeded but NO public key verifies the token:
+ *                 the private key does not pair with any verification key. A
+ *                 definitive fault the caller should fail loud on.
+ *  - `degraded` — a jose/parse exception (malformed PEM), no public key to
+ *                 verify against, or a kid outside the configured allowlist.
+ *                 Ambiguous / possibly environmental; the caller should alert,
+ *                 not crash.
+ *
+ * Never throws — every jose exception collapses to `degraded`. The parse of the
+ * public PEMs happens up front precisely so a malformed public key is reported
+ * as `degraded` rather than masquerading as a `mismatch` (validateLicenseKey
+ * collapses import failures and signature failures alike to null). Edge-compatible.
+ */
+export async function selfVerifyLicenseKeypair(privateKey, publicKeys) {
+    if (publicKeys.length === 0) {
+        return { status: 'degraded', reason: 'no public key configured to verify against' };
+    }
+    const jose = await getJose();
+    // Pre-parse every public PEM so a MALFORMED public key surfaces as `degraded`
+    // (a jose import exception) instead of an indistinguishable `mismatch`.
+    for (const pk of publicKeys) {
+        try {
+            await jose.importSPKI(pk, 'EdDSA');
+        }
+        catch (err) {
+            return {
+                status: 'degraded',
+                reason: `public key import failed: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+    }
+    // Sign a throwaway token with the deployment's own private key. A malformed
+    // private PEM throws inside generateLicenseKey (importPKCS8) → degraded.
+    const firstKey = publicKeys[0];
+    let token;
+    try {
+        token = await generateLicenseKey({ tier: 'pro', customerId: 'canary' }, privateKey, 60, firstKey);
+    }
+    catch (err) {
+        return {
+            status: 'degraded',
+            reason: `canary token signing failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    // Verify against the ordered public-key list. A null result AFTER imports
+    // succeeded means no configured key verifies a token our own private key
+    // signed: a definitive keypair mismatch.
+    const payload = await validateLicenseKey(token, publicKeys);
+    if (payload === null) {
+        return { status: 'mismatch' };
+    }
+    // kid allowlist: the token's kid must resolve to a configured public key.
+    const header = jose.decodeProtectedHeader(token);
+    const kid = typeof header.kid === 'string' ? header.kid : undefined;
+    if (kid !== undefined) {
+        const allowed = await Promise.all(publicKeys.map((pk) => computeKeyId(pk)));
+        if (!allowed.includes(kid)) {
+            return {
+                status: 'degraded',
+                reason: `signed token kid "${kid}" is not among the configured public-key ids [${allowed.join(', ')}]`,
+            };
+        }
+    }
+    return { status: 'ok', kid };
+}
 /**
  * Initialize the license system. Call once at application startup.
  * Reads REVEALUI_LICENSE_KEY and REVEALUI_LICENSE_PUBLIC_KEY from environment.
@@ -217,8 +376,8 @@ export async function validateLicenseKey(licenseKey, publicKey, expectedCustomer
  */
 export async function initializeLicense() {
     const licenseKey = await getLicenseKey();
-    const publicKey = getPublicKey();
-    if (!(licenseKey && publicKey)) {
+    const publicKeys = getPublicKeys();
+    if (!(licenseKey && publicKeys.length > 0)) {
         cachedState = {
             tier: 'free',
             payload: null,
@@ -228,7 +387,7 @@ export async function initializeLicense() {
         cachedAt = Date.now();
         return 'free';
     }
-    const payload = await validateLicenseKey(licenseKey, publicKey);
+    const payload = await validateLicenseKey(licenseKey, publicKeys);
     if (!payload) {
         // Key was present but failed validation (expired beyond grace, invalid signature, etc.)
         cachedState = {

package/dist/richtext/exports/client/rcc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rcc.d.ts","sourceRoot":"","sources":["../../../../src/richtext/exports/client/rcc.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAA0B,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIhF,OAAO,EAQL,KAAK,qBAAqB,EAE1B,KAAK,qBAAqB,EAE3B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,OAAO,CAAC;AA2B3C,UAAU,mBAAoB,SAAQ,qBAAqB;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AA0PD;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,CAAC,EAAE,sBAAsB,GAC/B,GAAG,CAAC,OAAO,GAAG,IAAI,CAMpB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,SAAS,EACT,GAAG,OAAO,EACX,EAAE;IACD,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,sBAAsB,GAAG,GAAG,CAAC,OAAO,GAAG,IAAI,CAO9C"}
+{"version":3,"file":"rcc.d.ts","sourceRoot":"","sources":["../../../../src/richtext/exports/client/rcc.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAA0B,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIhF,OAAO,EAQL,KAAK,qBAAqB,EAE1B,KAAK,qBAAqB,EAE3B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,OAAO,CAAC;AA2B3C,UAAU,mBAAoB,SAAQ,qBAAqB;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AA+PD;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,CAAC,EAAE,sBAAsB,GAC/B,GAAG,CAAC,OAAO,GAAG,IAAI,CAMpB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,SAAS,EACT,GAAG,OAAO,EACX,EAAE;IACD,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,sBAAsB,GAAG,GAAG,CAAC,OAAO,GAAG,IAAI,CAO9C"}

package/dist/richtext/exports/client/rcc.js

@@ -114,7 +114,12 @@ function serializeNode(node, index, options) {
         if (options?.renderImage) {
             return options.renderImage({ src, alt, width, height, caption }, index);
         }
-        return (_jsxs("figure", { style: { margin: '16px 0', textAlign: 'center' }, children: [_jsx("img", { src: src, alt: alt, width: width, height: height, style: { maxWidth: '100%', height: 'auto', display: 'block' } }), caption && (_jsx("figcaption", { style: { marginTop: '8px', fontSize: '14px', color: '#64748b', fontStyle: 'italic' }, children: caption }))] }, index));
+        return (_jsxs("figure", { style: { margin: '16px 0', textAlign: 'center' }, children: [_jsx("img", { src: src, alt: alt, width: width, height: height, style: { maxWidth: '100%', height: 'auto', display: 'block' } }), caption && (_jsx("figcaption", { style: {
+                        marginTop: '8px',
+                        fontSize: '14px',
+                        color: 'var(--rvui-text-2, #64748b)',
+                        fontStyle: 'italic',
+                    }, children: caption }))] }, index));
     }
     // Horizontal rule
     if (node.type === 'horizontalrule') {

package/dist/richtext/exports/server/rsc.d.ts

@@ -66,7 +66,7 @@ interface SerializeOptions {
     renderBlock?: (node: SerializedBlockNode, index: number) => JSX.Element | null;
     /** Custom link renderer */
     renderLink?: (node: SerializedLinkNode, children: JSX.Element | null, index: number) => JSX.Element;
-    /** Custom image renderer */
+    /** Custom image renderer. `data.src` arrives already sanitized. */
     renderImage?: (data: {
         src?: string;
         alt?: string;
@@ -74,6 +74,13 @@ interface SerializeOptions {
         height?: number;
         caption?: string;
     }, index: number) => JSX.Element | null;
+    /** Custom upload-node renderer. `data.url` arrives already sanitized. */
+    renderUpload?: (data: {
+        url?: string;
+        alt?: string;
+        width?: number;
+        height?: number;
+    }, index: number) => JSX.Element | null;
 }
 /**
  * Serialize a Lexical editor state to React elements
@@ -113,7 +120,13 @@ export interface RichTextContentProps {
         height?: number;
         caption?: string;
     }, index: number) => JSX.Element | null;
+    renderUpload?: (data: {
+        url?: string;
+        alt?: string;
+        width?: number;
+        height?: number;
+    }, index: number) => JSX.Element | null;
 }
-export declare function RichTextContent({ data, className, renderBlock, renderLink, renderImage, }: RichTextContentProps): JSX.Element | null;
+export declare function RichTextContent({ data, className, renderBlock, renderLink, renderImage, renderUpload, }: RichTextContentProps): JSX.Element | null;
 export default RichTextContent;
 //# sourceMappingURL=rsc.d.ts.map

package/dist/richtext/exports/server/rsc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsc.d.ts","sourceRoot":"","sources":["../../../../src/richtext/exports/server/rsc.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,OAAO,CAAC;AAG3C,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAKtC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAyBlC,UAAU,qBAAsB,SAAQ,qBAAqB;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,kBAAmB,SAAQ,qBAAqB;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;QACjC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,GAAG,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KAC7C,CAAC;CACH;AAmBD,UAAU,mBAAoB,SAAQ,qBAAqB;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACrE,SAAQ,qBAAqB;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAMD,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,UAAU,gBAAgB;IACxB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,2BAA2B;IAC3B,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AAqSD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,CAAC,EAAE,gBAAgB,GACzB,GAAG,CAAC,OAAO,GAAG,IAAI,CAMpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,MAAM,CAAC,CA2CjB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,wBAAwB,sBAYhF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,yBAAyB,sBAYlF;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AAED,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,SAAS,EACT,WAAW,EACX,UAAU,EACV,WAAW,GACZ,EAAE,oBAAoB,sBAgBtB;AAED,eAAe,eAAe,CAAC"}
+{"version":3,"file":"rsc.d.ts","sourceRoot":"","sources":["../../../../src/richtext/exports/server/rsc.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,OAAO,CAAC;AAG3C,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAKtC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AA+BlC,UAAU,qBAAsB,SAAQ,qBAAqB;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,kBAAmB,SAAQ,qBAAqB;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;QACjC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,GAAG,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KAC7C,CAAC;CACH;AAmBD,UAAU,mBAAoB,SAAQ,qBAAqB;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACrE,SAAQ,qBAAqB;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAMD,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,UAAU,gBAAgB;IACxB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,2BAA2B;IAC3B,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,mEAAmE;IACnE,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IACxB,yEAAyE;IACzE,YAAY,CAAC,EAAE,CACb,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AAwVD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,CAAC,EAAE,gBAAgB,GACzB,GAAG,CAAC,OAAO,GAAG,IAAI,CAMpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,MAAM,CAAC,CA2CjB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,wBAAwB,sBAYhF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,yBAAyB,sBAYlF;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,CACb,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AAED,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,SAAS,EACT,WAAW,EACX,UAAU,EACV,WAAW,EACX,YAAY,GACb,EAAE,oBAAoB,sBAiBtB;AAED,eAAe,eAAe,CAAC"}

package/dist/richtext/exports/server/rsc.js

@@ -26,6 +26,11 @@ const IS_UNDERLINE = 8;
 const IS_CODE = 16;
 const IS_SUBSCRIPT = 32;
 const IS_SUPERSCRIPT = 64;
+// Heading `tag` values come from stored, author-controlled Lexical JSON and
+// are rendered as JSX element names — allow-list them (a forged tag like
+// "script" would otherwise render a live <script> element, whose text
+// children React does not escape).
+const HEADING_TAGS = new Set(['h1', 'h2', 'h3', 'h4', 'h5', 'h6']);
 /**
  * Serialize a text node with formatting
  */
@@ -87,9 +92,9 @@ function serializeNode(node, index, options) {
     if (node.type === 'paragraph') {
         return _jsx("p", { children: serializeChildren(n.children, options) }, index);
     }
-    // Heading
+    // Heading — the stored tag is author-controlled; render only allow-listed h1-h6
     if (node.type === 'heading') {
-        const Tag = (n.tag || 'h1');
+        const Tag = (n.tag && HEADING_TAGS.has(n.tag) ? n.tag : 'h1');
         return _jsx(Tag, { children: serializeChildren(n.children, options) }, index);
     }
     // Quote
@@ -141,9 +146,9 @@ function serializeNode(node, index, options) {
         const width = imageNode.fields?.width;
         const height = imageNode.fields?.height;
         const caption = imageNode.fields?.caption;
-        // Allow custom image renderer
+        // Allow custom image renderer — hand it the sanitized src, never the raw one
         if (options?.renderImage) {
-            return options.renderImage(imageNode.fields || {}, index);
+            return options.renderImage({ ...(imageNode.fields || {}), src }, index);
         }
         // Default image rendering
         return (_jsxs("figure", { style: { margin: '16px 0', textAlign: 'center' }, children: [_jsx("img", { src: src, alt: alt, width: width, height: height, style: {
@@ -153,10 +158,34 @@ function serializeNode(node, index, options) {
                     } }), caption && (_jsx("figcaption", { style: {
                         marginTop: '8px',
                         fontSize: '14px',
-                        color: '#64748b',
+                        color: 'var(--rvui-text-2, #64748b)',
                         fontStyle: 'italic',
                     }, children: caption }))] }, index));
     }
+    // Upload (media-collection reference from the rich-text upload feature).
+    // The stored value.url is author-controlled; sanitize before any renderer
+    // sees it.
+    if (node.type === 'upload') {
+        const uploadNode = node;
+        const value = uploadNode.value;
+        if (!value || typeof value === 'string' || !value.url) {
+            return null;
+        }
+        const url = sanitizeUrl(value.url, 'image');
+        if (options?.renderUpload) {
+            return options.renderUpload({ url, alt: value.alt, width: value.width, height: value.height }, index);
+        }
+        return (_jsxs("figure", { style: { margin: '16px 0' }, children: [_jsx("img", { src: url, alt: value.alt || '', width: value.width, height: value.height, style: {
+                        maxWidth: '100%',
+                        height: 'auto',
+                        display: 'block',
+                    } }), value.alt && (_jsx("figcaption", { style: {
+                        marginTop: '8px',
+                        fontSize: '14px',
+                        color: 'var(--rvui-text-2, #64748b)',
+                        fontStyle: 'italic',
+                    }, children: value.alt }))] }, index));
+    }
     // Horizontal rule
     if (node.type === 'horizontalrule') {
         return _jsx("hr", {}, index);
@@ -287,7 +316,7 @@ export function RscEntryLexicalField({ data, className }) {
     }
     return _jsx("div", { className: className, children: content });
 }
-export function RichTextContent({ data, className, renderBlock, renderLink, renderImage, }) {
+export function RichTextContent({ data, className, renderBlock, renderLink, renderImage, renderUpload, }) {
     if (!data) {
         return null;
     }
@@ -295,6 +324,7 @@ export function RichTextContent({ data, className, renderBlock, renderLink, rend
         renderBlock: renderBlock || undefined,
         renderLink: renderLink || undefined,
         renderImage: renderImage || undefined,
+        renderUpload: renderUpload || undefined,
     });
     if (!content) {
         return null;

package/dist/storage/index.d.ts

@@ -3,17 +3,16 @@ export { createMockProvider } from './mock.js';
 export type { ObjectStorageConfig } from './object-storage.js';
 export { objectStorage } from './object-storage.js';
 export { createR2Provider } from './r2.js';
-export type { ListItem, ListOptions, ListResult, PutOptions, PutResult, R2Config, StorageConfig, StorageProvider, VercelBlobConfig, } from './types.js';
-export { createVercelBlobProvider } from './vercel-blob-provider.js';
+export type { ListItem, ListOptions, ListResult, PutOptions, PutResult, R2Config, StorageConfig, StorageProvider, } from './types.js';
 /**
  * Construct a StorageProvider from a tagged config.
  *
  * Per `feedback_pluggable_provider_pattern`: explicit "no-X" opt-in — unknown
  * tags throw with a clear message; no silent fallback.
  *
- * Supported tags: 'r2' (canonical), 'vercel-blob' (legacy migration-window
- * fallback), and 'mock' (tests). The provider-agnostic `objectStorage` Payload
- * plugin (object-storage.ts) adapts any of these to apps/admin's upload path.
+ * Supported tags: 'r2' (canonical) and 'mock' (tests). The provider-agnostic
+ * `objectStorage` Payload plugin (object-storage.ts) adapts either to apps/admin's
+ * upload path.
  */
 export declare function createStorage(config: StorageConfig): StorageProvider;
 //# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAK/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAgBpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAK/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,aAAa,EACb,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAcpE"}

package/dist/storage/index.js

@@ -3,44 +3,41 @@
 //
 // Phase 1 (#959): types.ts + index.ts type re-exports.
 // Phase 2a (#959 follow-up): r2 + mock providers + createStorage factory.
-// Phase 2b (this PR): vercel-blob StorageProvider + apps/server media-route
-//   cutover. R2 is canonical; Vercel Blob is the migration-window fallback.
+// Phase 2b (#959 follow-up): apps/server media-route cutover onto R2.
+// #1644: legacy Vercel Blob StorageProvider removed once R2 was confirmed in
+//   every production environment — R2 is now the sole non-mock backend.
 import { createMockProvider } from './mock.js';
 import { createR2Provider } from './r2.js';
-import { createVercelBlobProvider } from './vercel-blob-provider.js';
 export { createMockProvider } from './mock.js';
 // Provider-agnostic Payload-style upload plugin — adapts any StorageProvider
-// (R2 canonical, Vercel Blob fallback, mock) to the engine's collection upload
-// adapter. Used by apps/admin/revealui.config.ts. GAP-208 Phase 4 replaced the
-// provider-specific `vercelBlobStorage` plugin with this.
+// (R2 canonical, mock) to the engine's collection upload adapter. Used by
+// apps/admin/revealui.config.ts. GAP-208 Phase 4 replaced the provider-specific
+// `vercelBlobStorage` plugin with this.
 export { objectStorage } from './object-storage.js';
 // Provider factories — exported so callers can construct a provider directly
 // when they already know which one they want (skipping the discriminated-union
 // factory below).
 export { createR2Provider } from './r2.js';
-export { createVercelBlobProvider } from './vercel-blob-provider.js';
 /**
  * Construct a StorageProvider from a tagged config.
  *
  * Per `feedback_pluggable_provider_pattern`: explicit "no-X" opt-in — unknown
  * tags throw with a clear message; no silent fallback.
  *
- * Supported tags: 'r2' (canonical), 'vercel-blob' (legacy migration-window
- * fallback), and 'mock' (tests). The provider-agnostic `objectStorage` Payload
- * plugin (object-storage.ts) adapts any of these to apps/admin's upload path.
+ * Supported tags: 'r2' (canonical) and 'mock' (tests). The provider-agnostic
+ * `objectStorage` Payload plugin (object-storage.ts) adapts either to apps/admin's
+ * upload path.
  */
 export function createStorage(config) {
     switch (config.provider) {
         case 'r2':
             return createR2Provider(config.r2);
-        case 'vercel-blob':
-            return createVercelBlobProvider(config.vercelBlob);
         case 'mock':
             return createMockProvider();
         default: {
             const _exhaustive = config;
             throw new Error(`createStorage: unknown provider tag. Got ${JSON.stringify(_exhaustive)}. ` +
-                "Valid tags: 'r2', 'vercel-blob', 'mock'.");
+                "Valid tags: 'r2', 'mock'.");
         }
     }
 }

package/dist/storage/object-storage.d.ts

@@ -1,11 +1,11 @@
 /**
  * Object-storage upload plugin (provider-agnostic).
  *
- * Adapts any `StorageProvider` (Cloudflare R2 — canonical — Vercel Blob, mock,
- * or a future backend) to the RevealUI engine's collection upload-adapter
- * interface, so `apps/admin/revealui.config.ts` stores media through the
- * configured object-storage backend. Replaces the provider-specific
- * `vercelBlobStorage` Payload plugin retired in GAP-208 Phase 4.
+ * Adapts any `StorageProvider` (Cloudflare R2 — canonical — mock, or a future
+ * backend) to the RevealUI engine's collection upload-adapter interface, so
+ * `apps/admin/revealui.config.ts` stores media through the configured
+ * object-storage backend. Replaces the provider-specific `vercelBlobStorage`
+ * Payload plugin retired in GAP-208 Phase 4.
  *
  * The backend is resolved through a lazy `resolveProvider` thunk — invoked
  * (and memoized) on the first upload/delete, never at config-build time — so a

package/dist/storage/object-storage.js

@@ -1,11 +1,11 @@
 /**
  * Object-storage upload plugin (provider-agnostic).
  *
- * Adapts any `StorageProvider` (Cloudflare R2 — canonical — Vercel Blob, mock,
- * or a future backend) to the RevealUI engine's collection upload-adapter
- * interface, so `apps/admin/revealui.config.ts` stores media through the
- * configured object-storage backend. Replaces the provider-specific
- * `vercelBlobStorage` Payload plugin retired in GAP-208 Phase 4.
+ * Adapts any `StorageProvider` (Cloudflare R2 — canonical — mock, or a future
+ * backend) to the RevealUI engine's collection upload-adapter interface, so
+ * `apps/admin/revealui.config.ts` stores media through the configured
+ * object-storage backend. Replaces the provider-specific `vercelBlobStorage`
+ * Payload plugin retired in GAP-208 Phase 4.
  *
  * The backend is resolved through a lazy `resolveProvider` thunk — invoked
  * (and memoized) on the first upload/delete, never at config-build time — so a

package/dist/storage/types.d.ts

@@ -8,10 +8,10 @@
  * apps/admin health probes, packages/core Payload-style plugin shims) depend
  * only on this contract. Switching providers becomes a config change.
  *
- * GAP-208 introduces this abstraction during the Vercel Blob → Cloudflare R2
- * swap (2026-05-18). The vercel-blob Payload-style plugin (vercel-blob.ts)
- * stays in place during migration for backward compat; once consumers migrate
- * to the interface, the legacy plugin is dropped.
+ * GAP-208 introduced this abstraction during the Vercel Blob → Cloudflare R2
+ * swap (2026-05-18). #1644 removed the Vercel Blob StorageProvider once R2 was
+ * confirmed in every production environment; Cloudflare R2 is now the sole
+ * non-mock backend.
  */
 export interface StorageProvider {
     /** Upload binary data. Returns a fully-qualified URL the value is reachable at. */
@@ -20,7 +20,7 @@ export interface StorageProvider {
     del(keyOrUrl: string): Promise<void>;
     /** List items, optionally filtered by key prefix. Used by health probes + admin browsing. */
     list(opts?: ListOptions): Promise<ListResult>;
-    /** Provider tag (e.g. "r2", "vercel-blob", "mock") — exposed so consumers can adapt URL handling. */
+    /** Provider tag (e.g. "r2", "mock") — exposed so consumers can adapt URL handling. */
     readonly provider: string;
 }
 export interface PutOptions {
@@ -80,9 +80,6 @@ export interface ListItem {
 export type StorageConfig = {
     provider: 'r2';
     r2: R2Config;
-} | {
-    provider: 'vercel-blob';
-    vercelBlob: VercelBlobConfig;
 } | {
     provider: 'mock';
 };
@@ -103,8 +100,4 @@ export interface R2Config {
      */
     publicBaseUrl?: string;
 }
-export interface VercelBlobConfig {
-    /** vercel_blob_rw_* token from the Vercel Blob dashboard. */
-    token: string;
-}
 //# sourceMappingURL=types.d.ts.map

package/dist/storage/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB,8FAA8F;IAC9F,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,6FAA6F;IAC7F,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE9C,qGAAqG;IACrG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,UAAU;IACzB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAE9B,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IAEZ,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IAEZ,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IAEb,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAElB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,IAAI,CAAC;CAClB;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAA;CAAE,GAChC;IAAE,QAAQ,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GACzD;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzB,MAAM,WAAW,QAAQ;IACvB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAElB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IAEpB,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAC;IAExB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB,8FAA8F;IAC9F,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,6FAA6F;IAC7F,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE9C,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,UAAU;IACzB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAE9B,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IAEZ,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IAEZ,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IAEb,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAElB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,IAAI,CAAC;CAClB;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF,MAAM,WAAW,QAAQ;IACvB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAElB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IAEpB,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAC;IAExB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}

package/dist/storage/types.js

@@ -8,9 +8,9 @@
  * apps/admin health probes, packages/core Payload-style plugin shims) depend
  * only on this contract. Switching providers becomes a config change.
  *
- * GAP-208 introduces this abstraction during the Vercel Blob → Cloudflare R2
- * swap (2026-05-18). The vercel-blob Payload-style plugin (vercel-blob.ts)
- * stays in place during migration for backward compat; once consumers migrate
- * to the interface, the legacy plugin is dropped.
+ * GAP-208 introduced this abstraction during the Vercel Blob → Cloudflare R2
+ * swap (2026-05-18). #1644 removed the Vercel Blob StorageProvider once R2 was
+ * confirmed in every production environment; Cloudflare R2 is now the sole
+ * non-mock backend.
  */
 export {};