@revealui/core 0.12.4 → 0.13.1

package/dist/client/admin/utils/csrf.d.ts

@@ -1,9 +1,10 @@
 /**
- * CSRF helpers for browser clients (admin, auth hooks, agent stream).
+ * CSRF helpers for browser clients (admin, auth hooks, agent stream, sync).
  *
  * Single source of truth for reading the JS-readable `revealui-csrf` cookie
- * (fleet-redundancy P2-C). Consumers: this package's admin APIClient,
- * `@revealui/auth/react` (re-export), `@revealui/ai` useAgentStream.
+ * (fleet-redundancy P2-C; C12 residual 2026-08-07). Consumers: this package's
+ * admin APIClient, `@revealui/auth/react` (re-export), `@revealui/ai`
+ * useAgentStream, `@revealui/sync` csrfHeaders, and apps/admin `apiFetch`.
  *
  * The admin proxy and the api server's csrfMiddleware require any unsafe
  * request carrying a `revealui-session` cookie to echo this cookie as an

package/dist/client/admin/utils/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../../../src/client/admin/utils/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAgBlD;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,CAOrD"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../../../src/client/admin/utils/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAgBlD;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,CAOrD"}

package/dist/client/admin/utils/csrf.js

@@ -1,9 +1,10 @@
 /**
- * CSRF helpers for browser clients (admin, auth hooks, agent stream).
+ * CSRF helpers for browser clients (admin, auth hooks, agent stream, sync).
  *
  * Single source of truth for reading the JS-readable `revealui-csrf` cookie
- * (fleet-redundancy P2-C). Consumers: this package's admin APIClient,
- * `@revealui/auth/react` (re-export), `@revealui/ai` useAgentStream.
+ * (fleet-redundancy P2-C; C12 residual 2026-08-07). Consumers: this package's
+ * admin APIClient, `@revealui/auth/react` (re-export), `@revealui/ai`
+ * useAgentStream, `@revealui/sync` csrfHeaders, and apps/admin `apiFetch`.
  *
  * The admin proxy and the api server's csrfMiddleware require any unsafe
  * request carrying a `revealui-session` cookie to echo this cookie as an

package/dist/monitoring/alerts.d.ts

@@ -1,8 +1,13 @@
 /**
- * Alert System
+ * Alert System (monitoring / process-health plane)
  *
  * Manages alert channels (logger, Sentry, console) and alert delivery.
  * Provides configurable thresholds and aggregation for production.
+ *
+ * Ownership (ADR 2026-08-07-core-alert-planes): this is the **monitoring**
+ * plane (`sendAlert`). Rule/threshold lifecycle lives in
+ * `observability/alerts` (`AlertingSystem`). Cron failures use only
+ * `observability/cron-failure-alert`. Do not reimplement a fourth path.
  */
 import type { Alert } from './types.js';
 /**

package/dist/monitoring/alerts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/monitoring/alerts.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;GAEG;AACH,UAAU,YAAY;IACpB,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7D,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CAClC;AAsCD;;GAEG;AACH,KAAK,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpD;;GAEG;AACH,UAAU,WAAW;IACnB,uBAAuB;IACvB,QAAQ,EAAE,YAAY,EAAE,CAAC;IAEzB,kFAAkF;IAClF,qBAAqB,EAAE,OAAO,CAAC;IAE/B,2CAA2C;IAC3C,mBAAmB,EAAE,MAAM,CAAC;IAE5B,uCAAuC;IACvC,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAYD;;GAEG;AACH,cAAM,YAAY;IAChB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,gBAAgB,CAA+B;IACvD,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,YAAY,CAA6B;gBAErC,MAAM,GAAE,OAAO,CAAC,WAAW,CAAM,EAAE,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI;IAUjF;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI;IAU7B;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI;IAMjC;;OAEG;IACH,OAAO,CAAC,YAAY;IAoBpB;;OAEG;IACH,OAAO,CAAC,YAAY;IAuBpB;;OAEG;IACH,OAAO,CAAC,aAAa;IAYrB;;OAEG;IACH,OAAO,CAAC,YAAY;IAmEpB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;OAEG;IACH,OAAO,CAAC,WAAW;IAwCnB;;OAEG;IACH,eAAe,IAAI,IAAI;IAOvB;;OAEG;IACH,OAAO,CAAC,YAAY;IAIpB;;OAEG;IACH,QAAQ,IAAI;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,kBAAkB,EAAE,OAAO,CAAC;KAC7B;IAQD;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI;IAI3C;;OAEG;IACH,OAAO,IAAI,IAAI;CAIhB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,cAAqB,CAAC;AAE/C;;GAEG;AACH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AAC3C;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB;;GAEG;AAEH,wBAAgB,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAE5C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAEhD;AAED,wBAAgB,aAAa,IAAI,UAAU,CAAC,OAAO,YAAY,CAAC,QAAQ,CAAC,CAExE;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAE/D"}
+{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/monitoring/alerts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;GAEG;AACH,UAAU,YAAY;IACpB,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7D,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CAClC;AAsCD;;GAEG;AACH,KAAK,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpD;;GAEG;AACH,UAAU,WAAW;IACnB,uBAAuB;IACvB,QAAQ,EAAE,YAAY,EAAE,CAAC;IAEzB,kFAAkF;IAClF,qBAAqB,EAAE,OAAO,CAAC;IAE/B,2CAA2C;IAC3C,mBAAmB,EAAE,MAAM,CAAC;IAE5B,uCAAuC;IACvC,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAYD;;GAEG;AACH,cAAM,YAAY;IAChB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,gBAAgB,CAA+B;IACvD,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,YAAY,CAA6B;gBAErC,MAAM,GAAE,OAAO,CAAC,WAAW,CAAM,EAAE,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI;IAUjF;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI;IAU7B;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI;IAMjC;;OAEG;IACH,OAAO,CAAC,YAAY;IAoBpB;;OAEG;IACH,OAAO,CAAC,YAAY;IAuBpB;;OAEG;IACH,OAAO,CAAC,aAAa;IAYrB;;OAEG;IACH,OAAO,CAAC,YAAY;IAmEpB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;OAEG;IACH,OAAO,CAAC,WAAW;IAwCnB;;OAEG;IACH,eAAe,IAAI,IAAI;IAOvB;;OAEG;IACH,OAAO,CAAC,YAAY;IAIpB;;OAEG;IACH,QAAQ,IAAI;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,kBAAkB,EAAE,OAAO,CAAC;KAC7B;IAQD;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI;IAI3C;;OAEG;IACH,OAAO,IAAI,IAAI;CAIhB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,cAAqB,CAAC;AAE/C;;GAEG;AACH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AAC3C;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB;;GAEG;AAEH,wBAAgB,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAE5C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAEhD;AAED,wBAAgB,aAAa,IAAI,UAAU,CAAC,OAAO,YAAY,CAAC,QAAQ,CAAC,CAExE;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAE/D"}

package/dist/monitoring/alerts.js

@@ -1,8 +1,13 @@
 /**
- * Alert System
+ * Alert System (monitoring / process-health plane)
  *
  * Manages alert channels (logger, Sentry, console) and alert delivery.
  * Provides configurable thresholds and aggregation for production.
+ *
+ * Ownership (ADR 2026-08-07-core-alert-planes): this is the **monitoring**
+ * plane (`sendAlert`). Rule/threshold lifecycle lives in
+ * `observability/alerts` (`AlertingSystem`). Cron failures use only
+ * `observability/cron-failure-alert`. Do not reimplement a fourth path.
  */
 import { logger } from '../utils/logger-server.js';
 import { getRequestContext } from '../utils/request-context.js';

package/dist/observability/alerts.d.ts

@@ -1,7 +1,12 @@
 /**
- * Alert System
+ * Alert System (observability rule plane)
  *
- * Configure and trigger alerts based on metrics and thresholds
+ * Configure and trigger alerts based on metrics and thresholds.
+ *
+ * Ownership (ADR 2026-08-07-core-alert-planes): this is the **observability**
+ * plane (`AlertingSystem`). Process/health ops delivery is
+ * `monitoring/alerts` (`sendAlert`). Cron failures use only
+ * `cron-failure-alert`. Do not reimplement a fourth path.
  */
 export type AlertSeverity = 'info' | 'warning' | 'error' | 'critical';
 export type AlertStatus = 'firing' | 'resolved';

package/dist/observability/alerts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/observability/alerts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AACtE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEhD,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;CAC9B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,YAAY,CAAiC;IACrD,OAAO,CAAC,SAAS,CAAkC;IAEnD;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;IAInC;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIlC;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAIvC;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAsBpC;;OAEG;YACW,SAAS;IAkCvB;;OAEG;YACW,YAAY;IAc1B;;OAEG;YACW,SAAS;IAmBvB;;OAEG;IACH,eAAe,IAAI,KAAK,EAAE;IAI1B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS;IAIzC;;OAEG;IACH,eAAe,CAAC,UAAU,GAAE,MAAc,GAAG,MAAM,CAAC,OAAO;CAK5D;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ,gBAAuB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,YA8B5B,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,aAAa,EAAE,GAAG,YAAY,CAc5F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,EACzE,UAAU,EAAE,MAAM,EAAE,EACpB,UAAU,CAAC,EAAE,aAAa,EAAE,GAC3B,YAAY,CAsBd;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,aAAa,EAAE,GAAG,YAAY,CAoDjG;AAED;;GAEG;AAEH;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,MAAM,EAAE,SAAS,GAAE,MAAU,GAAG,SAAS,CAQjG;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,MAAM,EAAE,SAAS,GAAE,MAAa,GAAG,SAAS,CAQjG;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,MAAM,MAAM,EAC7B,SAAS,GAAE,MAAW,GACrB,SAAS,CAQX;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,MAAM,MAAM,EAC5B,SAAS,GAAE,MAAW,GACrB,SAAS,CAQX;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAQtF;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAClC,SAAS,CAQX;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,MAAM,EAC1B,SAAS,GAAE,MAAW,GACrB,SAAS,CAQX;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,MAAM,EAC1B,SAAS,GAAE,MAAa,GACvB,SAAS,CAQX;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,MAAM,EACvB,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,GAAG,GAAG,GAAG,GAAG,GAAS,EAC/B,QAAQ,GAAE,aAAyB,GAClC,SAAS,CA0BX"}
+{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/observability/alerts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AACtE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEhD,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;CAC9B;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,YAAY,CAAiC;IACrD,OAAO,CAAC,SAAS,CAAkC;IAEnD;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;IAInC;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIlC;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAIvC;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAsBpC;;OAEG;YACW,SAAS;IAkCvB;;OAEG;YACW,YAAY;IAc1B;;OAEG;YACW,SAAS;IAmBvB;;OAEG;IACH,eAAe,IAAI,KAAK,EAAE;IAI1B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS;IAIzC;;OAEG;IACH,eAAe,CAAC,UAAU,GAAE,MAAc,GAAG,MAAM,CAAC,OAAO;CAK5D;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ,gBAAuB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,YA8B5B,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,aAAa,EAAE,GAAG,YAAY,CAc5F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,EACzE,UAAU,EAAE,MAAM,EAAE,EACpB,UAAU,CAAC,EAAE,aAAa,EAAE,GAC3B,YAAY,CAsBd;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,aAAa,EAAE,GAAG,YAAY,CAoDjG;AAED;;GAEG;AAEH;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,MAAM,EAAE,SAAS,GAAE,MAAU,GAAG,SAAS,CAQjG;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,MAAM,EAAE,SAAS,GAAE,MAAa,GAAG,SAAS,CAQjG;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,MAAM,MAAM,EAC7B,SAAS,GAAE,MAAW,GACrB,SAAS,CAQX;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,MAAM,MAAM,EAC5B,SAAS,GAAE,MAAW,GACrB,SAAS,CAQX;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAQtF;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAClC,SAAS,CAQX;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,MAAM,EAC1B,SAAS,GAAE,MAAW,GACrB,SAAS,CAQX;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,MAAM,EAC1B,SAAS,GAAE,MAAa,GACvB,SAAS,CAQX;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,MAAM,EACvB,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,GAAG,GAAG,GAAG,GAAG,GAAS,EAC/B,QAAQ,GAAE,aAAyB,GAClC,SAAS,CA0BX"}

package/dist/observability/alerts.js

@@ -1,7 +1,12 @@
 /**
- * Alert System
+ * Alert System (observability rule plane)
  *
- * Configure and trigger alerts based on metrics and thresholds
+ * Configure and trigger alerts based on metrics and thresholds.
+ *
+ * Ownership (ADR 2026-08-07-core-alert-planes): this is the **observability**
+ * plane (`AlertingSystem`). Process/health ops delivery is
+ * `monitoring/alerts` (`sendAlert`). Cron failures use only
+ * `cron-failure-alert`. Do not reimplement a fourth path.
  */
 import { logger } from './logger.js';
 export class AlertingSystem {

package/dist/storage/_sigv4.d.ts

@@ -45,9 +45,11 @@ export interface SigV4Result {
  * key → signature. Verified against AWS's official `get-vanilla` test vector.
  */
 export declare function computeSigV4(input: CanonicalInput): SigV4Result;
+/** Payload hash token for presigned URLs (body hash unknown at sign time). */
+export declare const UNSIGNED_PAYLOAD = "UNSIGNED-PAYLOAD";
 /** Inputs for an R2/S3 request signature. */
 export interface SignS3Input {
-    method: 'GET' | 'PUT' | 'DELETE';
+    method: 'GET' | 'PUT' | 'DELETE' | 'HEAD';
     accountId: string;
     bucket: string;
     /** Object key; omit for bucket-level operations (e.g. ListObjectsV2). */
@@ -73,4 +75,36 @@ export interface SignedS3Request {
  * from the URL (same value), and `Host` is a forbidden header to set manually.
  */
 export declare function signS3Request(input: SignS3Input): SignedS3Request;
+/** Inputs for a query-string presigned S3/R2 URL (no Authorization header). */
+export interface SignS3PresignedInput {
+    method: 'GET' | 'PUT' | 'DELETE' | 'HEAD';
+    accountId: string;
+    bucket: string;
+    key: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** Lifetime of the URL in seconds. */
+    expiresInSeconds: number;
+    /**
+     * Headers the client must send and that are included in the signature
+     * (content-type, content-length, …). Host is always signed and omitted
+     * from the returned headers (fetch sets it from the URL).
+     */
+    signedHeaders?: Record<string, string>;
+    now: Date;
+}
+export interface PresignedS3Url {
+    url: string;
+    /** Headers the client must include (signed set minus host). */
+    headers: Record<string, string>;
+}
+/**
+ * Build a query-string SigV4 presigned URL for R2/S3.
+ *
+ * Uses UNSIGNED-PAYLOAD so the client does not need to pre-hash the body.
+ * Credential and signature ride in the query string; the client sends only
+ * the signed non-host headers (e.g. content-type) with the request.
+ */
+export declare function signS3PresignedUrl(input: SignS3PresignedInput): PresignedS3Url;
 //# sourceMappingURL=_sigv4.d.ts.map

package/dist/storage/_sigv4.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_sigv4.d.ts","sourceRoot":"","sources":["../../src/storage/_sigv4.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,iFAAiF;AACjF,eAAO,MAAM,YAAY,qEAAqE,CAAC;AAE/F,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAE3D;AAQD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAaxE;AAQD,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,CAkC/D;AAED,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,CAmDjE"}
+{"version":3,"file":"_sigv4.d.ts","sourceRoot":"","sources":["../../src/storage/_sigv4.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,iFAAiF;AACjF,eAAO,MAAM,YAAY,qEAAqE,CAAC;AAE/F,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAE3D;AAQD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAaxE;AAQD,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,CAkC/D;AAED,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,CAmDjE;AAED,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,sCAAsC;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,GAAG,cAAc,CAgD9E"}

package/dist/storage/_sigv4.js

@@ -81,6 +81,8 @@ export function computeSigV4(input) {
     const signature = createHmac('sha256', kSigning).update(stringToSign, 'utf8').digest('hex');
     return { signature, signedHeaders, scope, canonicalQuery };
 }
+/** Payload hash token for presigned URLs (body hash unknown at sign time). */
+export const UNSIGNED_PAYLOAD = 'UNSIGNED-PAYLOAD';
 /**
  * Build a signed R2 request: a path-style URL + AWS4-HMAC-SHA256 Authorization
  * header. The `host` header is signed but not returned — fetch/undici sets it
@@ -132,3 +134,54 @@ export function signS3Request(input) {
     const url = `https://${host}${canonicalPath}${canonicalQuery ? `?${canonicalQuery}` : ''}`;
     return { url, headers };
 }
+/**
+ * Build a query-string SigV4 presigned URL for R2/S3.
+ *
+ * Uses UNSIGNED-PAYLOAD so the client does not need to pre-hash the body.
+ * Credential and signature ride in the query string; the client sends only
+ * the signed non-host headers (e.g. content-type) with the request.
+ */
+export function signS3PresignedUrl(input) {
+    const host = `${input.accountId}.r2.cloudflarestorage.com`;
+    const { amzDate, dateStamp } = toAmzDate(input.now);
+    const scope = `${dateStamp}/${input.region}/${S3_SERVICE}/aws4_request`;
+    const encodedKey = input.key
+        .split('/')
+        .map((segment) => awsUriEncode(segment, false))
+        .join('/');
+    const canonicalPath = `/${awsUriEncode(input.bucket, false)}/${encodedKey}`;
+    const clientHeaders = {};
+    const headersToSign = { host };
+    for (const [name, value] of Object.entries(input.signedHeaders ?? {})) {
+        const lower = name.toLowerCase();
+        if (lower === 'host')
+            continue;
+        headersToSign[lower] = value;
+        clientHeaders[lower] = value;
+    }
+    const signedHeaderNames = Object.keys(headersToSign).sort().join(';');
+    const query = [
+        ['X-Amz-Algorithm', ALGORITHM],
+        ['X-Amz-Credential', `${input.accessKeyId}/${scope}`],
+        ['X-Amz-Date', amzDate],
+        ['X-Amz-Expires', String(input.expiresInSeconds)],
+        ['X-Amz-SignedHeaders', signedHeaderNames],
+    ];
+    const { signature, canonicalQuery } = computeSigV4({
+        method: input.method,
+        canonicalPath,
+        query,
+        headersToSign,
+        payloadHash: UNSIGNED_PAYLOAD,
+        amzDate,
+        region: input.region,
+        service: S3_SERVICE,
+        accessKeyId: input.accessKeyId,
+        secretAccessKey: input.secretAccessKey,
+    });
+    const fullQuery = `${canonicalQuery}&${awsUriEncode('X-Amz-Signature', true)}=${awsUriEncode(signature, true)}`;
+    return {
+        url: `https://${host}${canonicalPath}?${fullQuery}`,
+        headers: clientHeaders,
+    };
+}

package/dist/storage/index.d.ts

@@ -3,7 +3,7 @@ export { createMockProvider } from './mock.js';
 export type { ObjectStorageConfig } from './object-storage.js';
 export { objectStorage } from './object-storage.js';
 export { createR2Provider } from './r2.js';
-export type { ListItem, ListOptions, ListResult, PutOptions, PutResult, R2Config, StorageConfig, StorageProvider, } from './types.js';
+export type { HeadObjectResult, ListItem, ListOptions, ListResult, PresignPutOptions, PresignPutResult, PutOptions, PutResult, R2Config, StorageConfig, StorageProvider, } from './types.js';
 /**
  * Construct a StorageProvider from a tagged config.
  *

package/dist/storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAK/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,aAAa,EACb,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAcpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAK/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EACV,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,QAAQ,EACR,aAAa,EACb,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAcpE"}

package/dist/storage/index.js

@@ -3,9 +3,8 @@
 //
 // Phase 1 (#959): types.ts + index.ts type re-exports.
 // Phase 2a (#959 follow-up): r2 + mock providers + createStorage factory.
-// Phase 2b (#959 follow-up): apps/server media-route cutover onto R2.
-// #1644: legacy Vercel Blob StorageProvider removed once R2 was confirmed in
-//   every production environment — R2 is now the sole non-mock backend.
+// Phase 2b media-route cutover onto R2 (server) + #1644 Vercel Blob removal.
+// Phase 2b presign (GAP-215): createPresignedPutUrl + headObject + getObjectRange.
 import { createMockProvider } from './mock.js';
 import { createR2Provider } from './r2.js';
 export { createMockProvider } from './mock.js';

package/dist/storage/mock.d.ts

@@ -8,9 +8,9 @@
  * `mock://` scheme so callers can distinguish mock results from real ones
  * without parsing host names.
  *
- * GAP-208 Phase 2a (2026-05-18).
+ * GAP-208 Phase 2a (2026-05-18). Phase 2b (GAP-215): presigned PUT + head + range.
  */
-import type { ListOptions, ListResult, PutOptions, PutResult, StorageProvider } from './types.js';
+import type { HeadObjectResult, ListOptions, ListResult, PresignPutOptions, PresignPutResult, PutOptions, PutResult, StorageProvider } from './types.js';
 interface MockEntry {
     body: Uint8Array;
     contentType: string;
@@ -22,6 +22,9 @@ declare class MockProvider implements StorageProvider {
     readonly provider = "mock";
     private readonly store;
     put(key: string, data: Blob | ArrayBuffer | Uint8Array | ReadableStream<Uint8Array>, opts?: PutOptions): Promise<PutResult>;
+    createPresignedPutUrl(opts: PresignPutOptions): Promise<PresignPutResult>;
+    headObject(key: string): Promise<HeadObjectResult>;
+    getObjectRange(key: string, start: number, endInclusive: number): Promise<Uint8Array>;
     del(keyOrUrl: string): Promise<void>;
     list(opts?: ListOptions): Promise<ListResult>;
     /** Test helper — read the raw bytes back. Not part of StorageProvider. */

package/dist/storage/mock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock.d.ts","sourceRoot":"","sources":["../../src/storage/mock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAEV,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,eAAe,EAChB,MAAM,YAAY,CAAC;AAMpB,UAAU,SAAS;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,cAAM,YAAa,YAAW,eAAe;IAC3C,QAAQ,CAAC,QAAQ,UAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IAEhD,GAAG,CACP,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC;IAiBf,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAgCnD,0EAA0E;IAC1E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIzC,wEAAwE;IACxE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI3C,0EAA0E;IAC1E,IAAI,IAAI,MAAM;IAId,0EAA0E;IAC1E,KAAK,IAAI,IAAI;IAIb,OAAO,CAAC,UAAU;CAMnB;AAED,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD;AAED,YAAY,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"mock.d.ts","sourceRoot":"","sources":["../../src/storage/mock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EACV,gBAAgB,EAEhB,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,eAAe,EAChB,MAAM,YAAY,CAAC;AAOpB,UAAU,SAAS;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,cAAM,YAAa,YAAW,eAAe;IAC3C,QAAQ,CAAC,QAAQ,UAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IAEhD,GAAG,CACP,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC;IAiBf,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6BzE,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAYlD,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkBrF,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAgCnD,0EAA0E;IAC1E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIzC,wEAAwE;IACxE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI3C,0EAA0E;IAC1E,IAAI,IAAI,MAAM;IAId,0EAA0E;IAC1E,KAAK,IAAI,IAAI;IAIb,OAAO,CAAC,UAAU;CAMnB;AAED,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD;AAED,YAAY,EAAE,YAAY,EAAE,CAAC"}

package/dist/storage/mock.js

@@ -8,12 +8,13 @@
  * `mock://` scheme so callers can distinguish mock results from real ones
  * without parsing host names.
  *
- * GAP-208 Phase 2a (2026-05-18).
+ * GAP-208 Phase 2a (2026-05-18). Phase 2b (GAP-215): presigned PUT + head + range.
  */
 import { toUint8Array } from './_helpers.js';
 const PROVIDER_TAG = 'mock';
 const MOCK_URL_SCHEME = 'mock://storage';
 const DEFAULT_LIST_LIMIT = 1000;
+const DEFAULT_PRESIGN_EXPIRES_SECONDS = 900;
 class MockProvider {
     provider = PROVIDER_TAG;
     store = new Map();
@@ -33,6 +34,58 @@ class MockProvider {
             provider: PROVIDER_TAG,
         };
     }
+    async createPresignedPutUrl(opts) {
+        const expiresInSeconds = opts.expiresInSeconds ?? DEFAULT_PRESIGN_EXPIRES_SECONDS;
+        if (expiresInSeconds <= 0) {
+            throw new Error('createPresignedPutUrl: expiresInSeconds must be positive');
+        }
+        const now = new Date();
+        const expiresAt = new Date(now.getTime() + expiresInSeconds * 1000);
+        const headers = {
+            'content-type': opts.contentType,
+        };
+        if (opts.contentLength !== undefined) {
+            headers['content-length'] = String(opts.contentLength);
+        }
+        // Synthetic presigned URL. Tests that exercise the full client flow call
+        // put() with the same key after "uploading"; route tests mock this method.
+        const params = new URLSearchParams({
+            expires: String(Math.floor(expiresAt.getTime() / 1000)),
+            'content-type': opts.contentType,
+        });
+        return {
+            url: `${MOCK_URL_SCHEME}/presign/${opts.key}?${params.toString()}`,
+            headers,
+            key: opts.key,
+            expiresAt,
+        };
+    }
+    async headObject(key) {
+        const entry = this.store.get(key);
+        if (!entry) {
+            throw new Error(`mock HEAD failed for "${key}": NoSuchKey object not found`);
+        }
+        return {
+            size: entry.body.byteLength,
+            contentType: entry.contentType,
+            url: `${MOCK_URL_SCHEME}/${key}`,
+        };
+    }
+    async getObjectRange(key, start, endInclusive) {
+        if (start < 0 || endInclusive < start) {
+            throw new Error(`getObjectRange: invalid range ${start}-${endInclusive} (start must be >= 0 and endInclusive >= start)`);
+        }
+        const entry = this.store.get(key);
+        if (!entry) {
+            throw new Error(`mock GET range failed for "${key}": NoSuchKey object not found`);
+        }
+        // Inclusive end, clamped to body length (mirrors S3 range semantics).
+        const end = Math.min(endInclusive, entry.body.byteLength - 1);
+        if (start >= entry.body.byteLength) {
+            return new Uint8Array(0);
+        }
+        return entry.body.slice(start, end + 1);
+    }
     async del(keyOrUrl) {
         const key = this.extractKey(keyOrUrl);
         this.store.delete(key);

package/dist/storage/r2.d.ts

@@ -12,13 +12,15 @@
  *
  * GAP-208 Phase 2a (2026-05-18). Phase 1 (interface + types) shipped in #959.
  * Native client (dropping @aws-sdk/client-s3) landed 2026-06-09.
+ * Phase 2b (GAP-215): createPresignedPutUrl + headObject + getObjectRange for
+ * direct-to-R2 media uploads.
  *
  * Server-only. Do NOT import from client-side code or edge runtime.
  *
- * Known limitation (unchanged from the SDK version): request bodies are
- * buffered fully in memory (see toUint8Array) so the payload can be hashed for
- * SigV4. Streaming uploads (STREAMING-AWS4-HMAC-SHA256-PAYLOAD) are a future
- * enhancement; presigned/private URLs remain Phase 2b.
+ * Known limitation: request bodies for server-side put() are buffered fully in
+ * memory (see toUint8Array) so the payload can be hashed for SigV4. Streaming
+ * uploads (STREAMING-AWS4-HMAC-SHA256-PAYLOAD) are a future enhancement.
+ * Direct client uploads use createPresignedPutUrl and never buffer in the API.
  */
 import type { R2Config, StorageProvider } from './types.js';
 export declare function createR2Provider(config: R2Config): StorageProvider;

package/dist/storage/r2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/storage/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAMV,QAAQ,EACR,eAAe,EAChB,MAAM,YAAY,CAAC;AAkKpB,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAElE"}
+{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/storage/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EASV,QAAQ,EACR,eAAe,EAChB,MAAM,YAAY,CAAC;AA6QpB,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAElE"}

package/dist/storage/r2.js

@@ -12,20 +12,23 @@
  *
  * GAP-208 Phase 2a (2026-05-18). Phase 1 (interface + types) shipped in #959.
  * Native client (dropping @aws-sdk/client-s3) landed 2026-06-09.
+ * Phase 2b (GAP-215): createPresignedPutUrl + headObject + getObjectRange for
+ * direct-to-R2 media uploads.
  *
  * Server-only. Do NOT import from client-side code or edge runtime.
  *
- * Known limitation (unchanged from the SDK version): request bodies are
- * buffered fully in memory (see toUint8Array) so the payload can be hashed for
- * SigV4. Streaming uploads (STREAMING-AWS4-HMAC-SHA256-PAYLOAD) are a future
- * enhancement; presigned/private URLs remain Phase 2b.
+ * Known limitation: request bodies for server-side put() are buffered fully in
+ * memory (see toUint8Array) so the payload can be hashed for SigV4. Streaming
+ * uploads (STREAMING-AWS4-HMAC-SHA256-PAYLOAD) are a future enhancement.
+ * Direct client uploads use createPresignedPutUrl and never buffer in the API.
  */
 import { toUint8Array } from './_helpers.js';
-import { EMPTY_SHA256, sha256Hex, signS3Request } from './_sigv4.js';
+import { EMPTY_SHA256, sha256Hex, signS3PresignedUrl, signS3Request } from './_sigv4.js';
 import { parseListObjectsV2, s3ErrorFields } from './_xml.js';
 const PROVIDER_TAG = 'r2';
 const DEFAULT_CONTENT_TYPE = 'application/octet-stream';
 const DEFAULT_LIST_LIMIT = 1000;
+const DEFAULT_PRESIGN_EXPIRES_SECONDS = 900;
 const REGION = 'auto';
 class R2Provider {
     provider = PROVIDER_TAG;
@@ -36,9 +39,9 @@ class R2Provider {
     publicBaseUrl;
     constructor(config) {
         if (!config.publicBaseUrl) {
-            throw new Error('R2 provider requires R2Config.publicBaseUrl. Presigned/private URLs ' +
-                'are not supported in Phase 2a. Set publicBaseUrl to either a bound ' +
-                "custom domain (e.g. 'https://media.revealui.com') or the R2 dev URL " +
+            throw new Error('R2 provider requires R2Config.publicBaseUrl for public media URLs after ' +
+                'upload. Set publicBaseUrl to either a bound custom domain ' +
+                "(e.g. 'https://media.revealui.com') or the R2 dev URL " +
                 "('https://<account-id>.r2.cloudflarestorage.com/<bucket>').");
         }
         this.accountId = config.accountId;
@@ -49,9 +52,9 @@ class R2Provider {
     }
     async put(key, data, opts) {
         if (opts?.access === 'private') {
-            throw new Error("R2 provider Phase 2a does not support access: 'private'. All objects " +
-                'are written under the publicBaseUrl. Presigned/private-URL support ' +
-                'lands in Phase 2b.');
+            throw new Error("R2 provider does not support access: 'private' for put(). Use " +
+                'createPresignedPutUrl for client direct uploads; public object URLs ' +
+                'still use publicBaseUrl after confirm.');
         }
         const body = await toUint8Array(data);
         const extraHeaders = {
@@ -90,11 +93,99 @@ class R2Provider {
         }
         return {
             key,
-            url: `${this.publicBaseUrl}/${key}`,
+            url: this.objectPublicUrl(key),
             size: body.byteLength,
             provider: PROVIDER_TAG,
         };
     }
+    async createPresignedPutUrl(opts) {
+        const expiresInSeconds = opts.expiresInSeconds ?? DEFAULT_PRESIGN_EXPIRES_SECONDS;
+        if (expiresInSeconds <= 0) {
+            throw new Error('createPresignedPutUrl: expiresInSeconds must be positive');
+        }
+        const signedHeaders = {
+            'content-type': opts.contentType,
+        };
+        if (opts.contentLength !== undefined) {
+            signedHeaders['content-length'] = String(opts.contentLength);
+        }
+        const now = new Date();
+        const { url, headers } = signS3PresignedUrl({
+            method: 'PUT',
+            accountId: this.accountId,
+            bucket: this.bucket,
+            key: opts.key,
+            region: REGION,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            expiresInSeconds,
+            signedHeaders,
+            now,
+        });
+        return {
+            url,
+            headers,
+            key: opts.key,
+            expiresAt: new Date(now.getTime() + expiresInSeconds * 1000),
+        };
+    }
+    async headObject(key) {
+        const { url, headers } = signS3Request({
+            method: 'HEAD',
+            accountId: this.accountId,
+            bucket: this.bucket,
+            key,
+            region: REGION,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            payloadHash: EMPTY_SHA256,
+            now: new Date(),
+        });
+        const response = await fetch(url, { method: 'HEAD', headers });
+        if (response.status === 404) {
+            throw new Error(`R2 HEAD failed for "${key}": NoSuchKey object not found`);
+        }
+        if (!response.ok) {
+            throw await storageError('HEAD', key, response);
+        }
+        const lengthHeader = response.headers.get('content-length');
+        const size = lengthHeader === null ? 0 : Number(lengthHeader);
+        if (!Number.isFinite(size) || size < 0) {
+            throw new Error(`R2 HEAD failed for "${key}": invalid content-length`);
+        }
+        return {
+            size,
+            contentType: response.headers.get('content-type') ?? DEFAULT_CONTENT_TYPE,
+            url: this.objectPublicUrl(key),
+        };
+    }
+    async getObjectRange(key, start, endInclusive) {
+        if (start < 0 || endInclusive < start) {
+            throw new Error(`getObjectRange: invalid range ${start}-${endInclusive} (start must be >= 0 and endInclusive >= start)`);
+        }
+        const { url, headers } = signS3Request({
+            method: 'GET',
+            accountId: this.accountId,
+            bucket: this.bucket,
+            key,
+            region: REGION,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            payloadHash: EMPTY_SHA256,
+            extraHeaders: { range: `bytes=${start}-${endInclusive}` },
+            now: new Date(),
+        });
+        const response = await fetch(url, { method: 'GET', headers });
+        if (response.status === 404) {
+            throw new Error(`R2 GET range failed for "${key}": NoSuchKey object not found`);
+        }
+        // 206 Partial Content is the expected success; some backends return 200
+        // with the full object when range is unsupported — still accept it.
+        if (!response.ok && response.status !== 206) {
+            throw await storageError('GET range', key, response);
+        }
+        return new Uint8Array(await response.arrayBuffer());
+    }
     async del(keyOrUrl) {
         const key = this.extractKey(keyOrUrl);
         const { url, headers } = signS3Request({
@@ -139,7 +230,7 @@ class R2Provider {
         const parsed = parseListObjectsV2(await response.text());
         const items = parsed.objects.map((entry) => ({
             key: entry.key,
-            url: `${this.publicBaseUrl}/${entry.key}`,
+            url: this.objectPublicUrl(entry.key),
             size: entry.size,
             uploadedAt: entry.lastModified,
         }));
@@ -149,6 +240,9 @@ class R2Provider {
             hasMore: parsed.isTruncated,
         };
     }
+    objectPublicUrl(key) {
+        return `${this.publicBaseUrl}/${key}`;
+    }
     extractKey(keyOrUrl) {
         const parsed = tryParseUrl(keyOrUrl);
         if (!parsed) {

package/dist/storage/types.d.ts

@@ -20,9 +20,58 @@ export interface StorageProvider {
     del(keyOrUrl: string): Promise<void>;
     /** List items, optionally filtered by key prefix. Used by health probes + admin browsing. */
     list(opts?: ListOptions): Promise<ListResult>;
+    /**
+     * Issue a short-lived presigned PUT URL so clients upload bytes direct to the
+     * backend (GAP-215 / Phase 2b). File bytes never buffer in the API function.
+     */
+    createPresignedPutUrl(opts: PresignPutOptions): Promise<PresignPutResult>;
+    /**
+     * HEAD an object. Used by the media confirm endpoint to re-check size and
+     * content-type after a direct-to-storage upload.
+     */
+    headObject(key: string): Promise<HeadObjectResult>;
+    /**
+     * GET a byte range of an object (inclusive end). Used to re-check magic
+     * bytes on confirm without downloading the whole file.
+     */
+    getObjectRange(key: string, start: number, endInclusive: number): Promise<Uint8Array>;
     /** Provider tag (e.g. "r2", "mock") — exposed so consumers can adapt URL handling. */
     readonly provider: string;
 }
+export interface PresignPutOptions {
+    /** Storage key the client will write (provider-relative, e.g. "media/uuid.jpg"). */
+    key: string;
+    /** MIME type the client must send as Content-Type (signed into the URL). */
+    contentType: string;
+    /**
+     * Optional declared Content-Length. When set, signed into the request so the
+     * client cannot upload a larger body. Browser fetch cannot set Content-Length
+     * manually, so media direct-upload leaves this unset and re-checks size via
+     * headObject on confirm.
+     */
+    contentLength?: number;
+    /** URL lifetime in seconds. Defaults to provider-specific value (typically 900). */
+    expiresInSeconds?: number;
+}
+export interface PresignPutResult {
+    /** Fully-qualified presigned PUT URL (query-string SigV4). */
+    url: string;
+    /**
+     * Headers the client MUST send with the PUT (at least content-type). Values
+     * are already signed into the URL's X-Amz-SignedHeaders set.
+     */
+    headers: Record<string, string>;
+    /** Storage key the URL writes to (echo of PresignPutOptions.key). */
+    key: string;
+    /** Absolute expiry of the URL. */
+    expiresAt: Date;
+}
+export interface HeadObjectResult {
+    size: number;
+    contentType: string;
+    /** Public (or mock) URL the object is reachable at for GET. */
+    url: string;
+}
 export interface PutOptions {
     /** MIME type — written to the object's Content-Type header. Defaults to "application/octet-stream". */
     contentType?: string;
@@ -93,10 +142,11 @@ export interface R2Config {
     /** Bucket name (per-account-globally-unique within R2). */
     bucket: string;
     /**
-     * Optional public base URL for objects (e.g. "https://media.revealui.com" if a
-     * custom domain is bound, or "https://<account-id>.r2.cloudflarestorage.com/<bucket>"
-     * for the dev URL). When set, PutResult.url uses this base. When omitted, PutResult.url
-     * falls back to a presigned URL (private bucket pattern).
+     * Public base URL for objects (e.g. "https://media.revealui.com" if a custom
+     * domain is bound, or the R2 dev URL). Required: PutResult.url, HeadObjectResult.url,
+     * and media rows after confirm use this base. Presigned PUT URLs themselves
+     * target the S3 API endpoint and do not need this, but the final public media
+     * URL still does.
      */
     publicBaseUrl?: string;
 }

package/dist/storage/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB,8FAA8F;IAC9F,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,6FAA6F;IAC7F,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE9C,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,UAAU;IACzB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAE9B,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IAEZ,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IAEZ,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IAEb,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAElB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,IAAI,CAAC;CAClB;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF,MAAM,WAAW,QAAQ;IACvB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAElB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IAEpB,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAC;IAExB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB,8FAA8F;IAC9F,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,6FAA6F;IAC7F,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE9C;;;OAGG;IACH,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE1E;;;OAGG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEnD;;;OAGG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEtF,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC;IAEZ,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IAEZ,kCAAkC;IAClC,SAAS,EAAE,IAAI,CAAC;CACjB;AAID,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;CACb;AAID,MAAM,WAAW,UAAU;IACzB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAE9B,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IAEZ,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IAEZ,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IAEb,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAElB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,IAAI,CAAC;CAClB;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF,MAAM,WAAW,QAAQ;IACvB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAElB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IAEpB,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAC;IAExB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/core",
-  "version": "0.12.4",
+  "version": "0.13.1",
   "description": "RevealUI's runtime engine — admin UI, REST API, auth, rich text, plugin system, and access control. The heart of the open-source platform.",
   "license": "MIT",
   "dependencies": {
@@ -25,7 +25,7 @@
     "zod": "^4.4.3",
     "@revealui/contracts": "0.8.2",
     "@revealui/resilience": "0.2.4",
-    "@revealui/security": "0.6.1",
+    "@revealui/security": "0.7.0",
     "@revealui/utils": "0.3.6"
   },
   "devDependencies": {