@revealui/core 0.7.0 → 0.8.0

package/README.md

@@ -159,7 +159,7 @@ pnpm dev
 - **Not** for standalone UI components  -  use `@revealui/presentation`
 - **Not** for raw database queries  -  use `@revealui/db` directly
 
-## JOSHUA Alignment
+## Design Principles
 
 - **Sovereign**: Self-hosted runtime engine  -  no vendor dependency for content management, auth, or storage
 - **Unified**: One `buildConfig()` call wires collections, globals, plugins, security, and feature gates into a single configuration

package/dist/collections/operations/delete.d.ts

@@ -3,8 +3,6 @@
  *
  * Deletes a document by ID with access control enforcement.
  */
-import type { DatabaseResult, RevealCollectionConfig, RevealDeleteOptions, RevealDocument } from '../../types/index.js';
-export declare function deleteDocument(config: RevealCollectionConfig, db: {
-    query: (query: string, values?: unknown[]) => Promise<DatabaseResult>;
-} | null, options: RevealDeleteOptions): Promise<RevealDocument>;
+import type { QueryableDatabaseAdapter, RevealCollectionConfig, RevealDeleteOptions, RevealDocument } from '../../types/index.js';
+export declare function deleteDocument(config: RevealCollectionConfig, db: QueryableDatabaseAdapter | null, options: RevealDeleteOptions): Promise<RevealDocument>;
 //# sourceMappingURL=delete.d.ts.map

package/dist/collections/operations/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/delete.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAoC9B,wBAAsB,cAAc,CAClC,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE;IACF,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACvE,GAAG,IAAI,EACR,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAoBzB"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/delete.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAsC9B,wBAAsB,cAAc,CAClC,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAkCzB"}

package/dist/collections/operations/delete.js

@@ -3,6 +3,7 @@
  *
  * Deletes a document by ID with access control enforcement.
  */
+import { find } from './find.js';
 import { deleteByIdQuery } from './sqlAdapter.js';
 /**
  * Evaluate a collection's access.delete function.
@@ -22,16 +23,32 @@ async function evaluateDeleteAccess(config, options) {
     const result = await deleteAccess({ req, id: options.id });
     if (result === false)
         return false;
-    // Any truthy result (true, WhereClause) = allowed for single-document operations
-    return !!result;
+    if (result === true)
+        return true;
+    // A WhereClause = row-level access: allowed only for rows matching the filter.
+    return result;
 }
 export async function deleteDocument(config, db, options) {
     const { id } = options;
     // --- Access control enforcement ---
-    const allowed = await evaluateDeleteAccess(config, options);
-    if (!allowed) {
+    const access = await evaluateDeleteAccess(config, options);
+    if (access === false) {
         throw new Error('Access denied: insufficient permissions to delete this document');
     }
+    if (access !== true) {
+        // Row-level access: confirm the target row matches the ownership filter
+        // before deleting, so delete() cannot remove a row outside the caller's
+        // scope. Reuse find()'s AND-merge; overrideAccess skips re-evaluation.
+        const scoped = await find(config, db, {
+            where: { and: [{ id: { equals: id } }, access] },
+            limit: 1,
+            req: options.req,
+            overrideAccess: true,
+        });
+        if (scoped.docs.length === 0) {
+            throw new Error('Access denied: insufficient permissions to delete this document');
+        }
+    }
     if (db?.query) {
         // Dynamic collection storage is quarantined in sqlAdapter.ts until this
         // layer is redesigned around typed tables that Drizzle can model directly.

package/dist/collections/operations/findById.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"findById.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/findById.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EACd,aAAa,EAEd,MAAM,sBAAsB,CAAC;AAI9B,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE;IACP,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GACA,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAwHhC"}
+{"version":3,"file":"findById.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/findById.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EACd,aAAa,EAGd,MAAM,sBAAsB,CAAC;AAK9B,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE;IACP,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GACA,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAsIhC"}

package/dist/collections/operations/findById.js

@@ -5,6 +5,7 @@
  */
 import { afterRead } from '../../fields/hooks/afterRead/index.js';
 import { deserializeJsonFields } from '../../utils/json-parsing.js';
+import { find } from './find.js';
 import { selectByIdQuery } from './sqlAdapter.js';
 export async function findByID(config, db, options) {
     const { id, depth = 0, req, populate: populateOption } = options;
@@ -22,9 +23,23 @@ export async function findByID(config, db, options) {
             const result = await readAccess({ req, id });
             if (result === false)
                 return null;
-            // If result is a WhereClause (row-level filter), we fetch the doc first then verify.
-            // For findByID, we check after fetch whether the doc matches the access filter.
-            // Boolean true = allow, WhereClause = post-fetch filter (handled below after query).
+            if (result !== true) {
+                // Row-level access: a WhereClause means "allowed only for rows matching
+                // this filter". Confirm THIS row matches before returning it — otherwise
+                // findByID hands back rows the ownership rule was meant to scope out
+                // (cross-tenant / unpublished-draft leakage). Reuse find()'s AND-merge so
+                // the filter runs through the same proven path the list view uses (both
+                // storage adapters); overrideAccess skips re-evaluating the rule.
+                const scoped = await find(config, db, {
+                    where: { and: [{ id: { equals: id } }, result] },
+                    limit: 1,
+                    depth,
+                    req,
+                    ...(populateOption !== undefined ? { populate: populateOption } : {}),
+                    overrideAccess: true,
+                });
+                return scoped.docs[0] ?? null;
+            }
         }
     }
     if (db?.collectionStorage?.findByID) {

package/dist/collections/operations/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/update.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EACV,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EAGd,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAiF9B,wBAAsB,MAAM,CAC1B,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAkMzB"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/update.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EACV,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EAGd,mBAAmB,EAEpB,MAAM,sBAAsB,CAAC;AAmF9B,wBAAsB,MAAM,CAC1B,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAgNzB"}

package/dist/collections/operations/update.js

@@ -8,6 +8,7 @@ import { defaultLogger } from '../../instance/logger.js';
 import { collectJsonFields, serializeValueForDatabase } from '../../utils/json-parsing.js';
 import { flattenFields, isJsonFieldType } from '../../utils/type-guards.js';
 import { runBeforeFieldHooks } from './fieldHooks.js';
+import { find } from './find.js';
 import { findByID } from './findById.js';
 import { checkExistsByIdQuery, selectJsonByIdQuery, updateByIdQuery, updateByIdWithVersionQuery, } from './sqlAdapter.js';
 /**
@@ -52,16 +53,32 @@ async function evaluateUpdateAccess(config, options) {
     const result = await updateAccess({ req, id: options.id, data: options.data });
     if (result === false)
         return false;
-    // Any truthy result (true, WhereClause) = allowed for single-document operations
-    return !!result;
+    if (result === true)
+        return true;
+    // A WhereClause = row-level access: allowed only for rows matching the filter.
+    return result;
 }
 export async function update(config, db, options) {
     const { id, data } = options;
     // --- Access control enforcement ---
-    const allowed = await evaluateUpdateAccess(config, options);
-    if (!allowed) {
+    const access = await evaluateUpdateAccess(config, options);
+    if (access === false) {
         throw new Error('Access denied: insufficient permissions to update this document');
     }
+    if (access !== true) {
+        // Row-level access: confirm the target row matches the ownership filter
+        // before mutating, so update() cannot modify a row outside the caller's
+        // scope. Reuse find()'s AND-merge; overrideAccess skips re-evaluation.
+        const scoped = await find(config, db, {
+            where: { and: [{ id: { equals: options.id } }, access] },
+            limit: 1,
+            req: options.req,
+            overrideAccess: true,
+        });
+        if (scoped.docs.length === 0) {
+            throw new Error('Access denied: insufficient permissions to update this document');
+        }
+    }
     // Run beforeValidate field hooks before validation so they can transform values.
     await runBeforeFieldHooks(config, data, 'update', 'beforeValidate', undefined, options.req);
     // Validate email format if email field is being updated

package/dist/observability/metrics.d.ts

@@ -165,7 +165,6 @@ export declare const appMetrics: {
     x402PaymentRequiredTotal: Counter;
     x402PaymentVerifyTotal: Counter;
     x402PaymentVerifyDuration: Histogram;
-    x402SafeguardRejectionTotal: Counter;
 };
 /**
  * Track HTTP request
@@ -189,25 +188,16 @@ export declare function trackError(type: string, severity?: 'low' | 'medium' | '
 export declare function updateActiveConnections(type: string, delta: number): void;
 /**
  * Track an x402 HTTP 402 emission at a route. Call when the route returns
- * 402 with `X-PAYMENT-REQUIRED`. `currency` is `'usdc-rvui'` when both are
- * advertised (RVUI_PAYMENTS_ENABLED + receiving wallet set) and `'usdc-only'`
- * otherwise.
+ * 402 with `X-PAYMENT-REQUIRED`. `currency` is always `'usdc-only'` — USDC on
+ * Base is the sole settlement currency.
  */
-export declare function trackX402PaymentRequired(route: string, currency: 'usdc-only' | 'usdc-rvui'): void;
+export declare function trackX402PaymentRequired(route: string, currency: 'usdc-only'): void;
 /**
  * Track an x402 payment verification. Increments the result counter and
- * observes the duration histogram (latency includes Coinbase facilitator
- * round-trip for USDC OR Solana RPC + safeguards pipeline for RVUI).
+ * observes the duration histogram (latency = Coinbase facilitator round-trip
+ * for USDC).
  */
-export declare function trackX402PaymentVerify(route: string, scheme: 'exact' | 'solana-spl', result: 'valid' | 'invalid', durationMs: number): void;
-/**
- * Track an RVUI safeguards pipeline rejection. Called from
- * `verifyRvuiPayment` when `validatePayment` returns disallowed. Reasons
- * are mapped from the safeguard's free-text reason at the call site to
- * keep wording coupling low.
- */
-export type X402SafeguardRejectionReason = 'duplicate-tx' | 'circuit-breaker' | 'single-payment-cap' | 'wallet-rate-limit' | 'discount-cap' | 'unknown';
-export declare function trackX402SafeguardRejection(reason: X402SafeguardRejectionReason): void;
+export declare function trackX402PaymentVerify(route: string, scheme: 'exact', result: 'valid' | 'invalid', durationMs: number): void;
 /**
  * Update memory usage
  */

package/dist/observability/metrics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/observability/metrics.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,YAAY;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAgB,SAAQ,MAAM;IAC7C,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAkC;IAEjD;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO;IAc/D;;OAEG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK;IAc3D;;OAEG;IACH,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,EAA8D,EAC7E,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,SAAS;IAiBZ;;OAEG;IACH,UAAU,IAAI,MAAM,EAAE;IAItB;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI3C;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,gBAAgB,IAAI,MAAM;IA0C1B;;OAEG;IACH,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAsBtC;AAED;;GAEG;AACH,qBAAa,OAAO;IACN,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAElC;;OAEG;IACH,GAAG,CAAC,KAAK,GAAE,MAAU,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI;IAenD;;OAEG;IACH,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM;IAKlC;;OAEG;IACH,OAAO,CAAC,SAAS;IAIjB;;OAEG;IACH,OAAO,CAAC,WAAW;CAWpB;AAED;;GAEG;AACH,qBAAa,KAAK;IACJ,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAElC;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI;IAe/C;;OAEG;IACH,GAAG,CAAC,KAAK,GAAE,MAAU,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI;IAenD;;OAEG;IACH,GAAG,CAAC,KAAK,GAAE,MAAU,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI;IAInD;;OAEG;IACH,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM;IAKlC;;OAEG;IACH,OAAO,CAAC,SAAS;IAIjB;;OAEG;IACH,OAAO,CAAC,WAAW;CAWpB;AAED;;GAEG;AACH,qBAAa,SAAS;IACR,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,eAAe;IAE3C;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI;IAoBnD;;OAEG;IACH,UAAU,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM,IAAI;IAS7C;;OAEG;IACH,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM;IAS7B;;OAEG;IACH,OAAO,IAAI,MAAM;CAIlB;AAED;;GAEG;AACH,eAAO,MAAM,OAAO,kBAAyB,CAAC;AAE9C;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;CA8FtB,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,IAAI,CAGN;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAGrF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,EAC5C,MAAM,GAAE,SAAS,GAAG,OAAmB,GACtC,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAqB,GAC1D,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,WAAW,GAAG,IAAI,CAEjG;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,OAAO,GAAG,YAAY,EAC9B,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,UAAU,EAAE,MAAM,GACjB,IAAI,CAGN;AAED;;;;;GAKG;AACH,MAAM,MAAM,4BAA4B,GACpC,cAAc,GACd,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,GACnB,cAAc,GACd,SAAS,CAAC;AAEd,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,4BAA4B,GAAG,IAAI,CAEtF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAQxC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,GAAE,MAAc,GAAG,MAAM,CAAC,OAAO,CAEhF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,GAAG,OAAO,EAAE,SAAS,GAAG,OAAO,MAE3E,SAAS,QAAQ,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACnD,MAAM,MAAM,OAAO,CAAC,SAAS,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,KACnD,OAAO,CAAC,SAAS,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB5C"}
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/observability/metrics.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,YAAY;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAgB,SAAQ,MAAM;IAC7C,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAkC;IAEjD;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO;IAc/D;;OAEG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK;IAc3D;;OAEG;IACH,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,EAA8D,EAC7E,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,SAAS;IAiBZ;;OAEG;IACH,UAAU,IAAI,MAAM,EAAE;IAItB;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI3C;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,gBAAgB,IAAI,MAAM;IA0C1B;;OAEG;IACH,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAsBtC;AAED;;GAEG;AACH,qBAAa,OAAO;IACN,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAElC;;OAEG;IACH,GAAG,CAAC,KAAK,GAAE,MAAU,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI;IAenD;;OAEG;IACH,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM;IAKlC;;OAEG;IACH,OAAO,CAAC,SAAS;IAIjB;;OAEG;IACH,OAAO,CAAC,WAAW;CAWpB;AAED;;GAEG;AACH,qBAAa,KAAK;IACJ,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAElC;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI;IAe/C;;OAEG;IACH,GAAG,CAAC,KAAK,GAAE,MAAU,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI;IAenD;;OAEG;IACH,GAAG,CAAC,KAAK,GAAE,MAAU,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI;IAInD;;OAEG;IACH,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM;IAKlC;;OAEG;IACH,OAAO,CAAC,SAAS;IAIjB;;OAEG;IACH,OAAO,CAAC,WAAW;CAWpB;AAED;;GAEG;AACH,qBAAa,SAAS;IACR,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,eAAe;IAE3C;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI;IAoBnD;;OAEG;IACH,UAAU,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM,IAAI;IAS7C;;OAEG;IACH,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM;IAS7B;;OAEG;IACH,OAAO,IAAI,MAAM;CAIlB;AAED;;GAEG;AACH,eAAO,MAAM,OAAO,kBAAyB,CAAC;AAE9C;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;CAwFtB,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,IAAI,CAGN;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAGrF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,EAC5C,MAAM,GAAE,SAAS,GAAG,OAAmB,GACtC,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAqB,GAC1D,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,IAAI,CAEnF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,UAAU,EAAE,MAAM,GACjB,IAAI,CAGN;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAQxC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,GAAE,MAAc,GAAG,MAAM,CAAC,OAAO,CAEhF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,GAAG,OAAO,EAAE,SAAS,GAAG,OAAO,MAE3E,SAAS,QAAQ,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACnD,MAAM,MAAM,OAAO,CAAC,SAAS,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,KACnD,OAAO,CAAC,SAAS,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB5C"}

package/dist/observability/metrics.js

@@ -358,8 +358,7 @@ export const appMetrics = {
     // x402 micropayments (GAP-149 PR 5)
     x402PaymentRequiredTotal: metrics.counter('x402_payment_required_total', 'HTTP 402 Payment Required responses emitted by route + currency advertised', ['route', 'currency']),
     x402PaymentVerifyTotal: metrics.counter('x402_payment_verify_total', 'x402 payment verification attempts by route, scheme, and result', ['route', 'scheme', 'result']),
-    x402PaymentVerifyDuration: metrics.histogram('x402_payment_verify_duration_seconds', 'x402 payment verification latency (Coinbase facilitator round-trip for USDC; Solana RPC + safeguards for RVUI)', [0.05, 0.1, 0.5, 1, 5, 10, 30], ['scheme']),
-    x402SafeguardRejectionTotal: metrics.counter('x402_safeguard_rejection_total', 'RVUI safeguards pipeline rejections by reason (replay / cap / rate-limit / discount-cap / circuit-breaker)', ['reason']),
+    x402PaymentVerifyDuration: metrics.histogram('x402_payment_verify_duration_seconds', 'x402 payment verification latency (Coinbase facilitator round-trip for USDC)', [0.05, 0.1, 0.5, 1, 5, 10, 30], ['scheme']),
 };
 /**
  * Track HTTP request
@@ -395,25 +394,21 @@ export function updateActiveConnections(type, delta) {
 }
 /**
  * Track an x402 HTTP 402 emission at a route. Call when the route returns
- * 402 with `X-PAYMENT-REQUIRED`. `currency` is `'usdc-rvui'` when both are
- * advertised (RVUI_PAYMENTS_ENABLED + receiving wallet set) and `'usdc-only'`
- * otherwise.
+ * 402 with `X-PAYMENT-REQUIRED`. `currency` is always `'usdc-only'` — USDC on
+ * Base is the sole settlement currency.
  */
 export function trackX402PaymentRequired(route, currency) {
     appMetrics.x402PaymentRequiredTotal.inc(1, { route, currency });
 }
 /**
  * Track an x402 payment verification. Increments the result counter and
- * observes the duration histogram (latency includes Coinbase facilitator
- * round-trip for USDC OR Solana RPC + safeguards pipeline for RVUI).
+ * observes the duration histogram (latency = Coinbase facilitator round-trip
+ * for USDC).
  */
 export function trackX402PaymentVerify(route, scheme, result, durationMs) {
     appMetrics.x402PaymentVerifyTotal.inc(1, { route, scheme, result });
     appMetrics.x402PaymentVerifyDuration.observe(durationMs / 1000, { scheme });
 }
-export function trackX402SafeguardRejection(reason) {
-    appMetrics.x402SafeguardRejectionTotal.inc(1, { reason });
-}
 /**
  * Update memory usage
  */

package/dist/richtext/exports/server/rsc.d.ts

@@ -4,7 +4,7 @@
  * Provides server-side rendering components for Lexical content.
  * Converts Lexical JSON state to React elements without requiring a browser.
  */
-import { isSafeUrl, sanitizeUrl } from '@revealui/security';
+import { isSafeUrl, sanitizeUrl } from '@revealui/security/sanitize';
 import type { SerializedEditorState, SerializedLexicalNode } from 'lexical';
 import { type JSX } from 'react';
 export type { SerializedEditorState };

package/dist/richtext/exports/server/rsc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsc.d.ts","sourceRoot":"","sources":["../../../../src/richtext/exports/server/rsc.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,OAAO,CAAC;AAG3C,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAKtC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAyBlC,UAAU,qBAAsB,SAAQ,qBAAqB;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,kBAAmB,SAAQ,qBAAqB;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;QACjC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,GAAG,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KAC7C,CAAC;CACH;AAmBD,UAAU,mBAAoB,SAAQ,qBAAqB;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACrE,SAAQ,qBAAqB;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAMD,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,UAAU,gBAAgB;IACxB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,2BAA2B;IAC3B,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AAqSD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,CAAC,EAAE,gBAAgB,GACzB,GAAG,CAAC,OAAO,GAAG,IAAI,CAMpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,MAAM,CAAC,CA2CjB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,wBAAwB,kDAYhF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,yBAAyB,kDAYlF;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AAED,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,SAAS,EACT,WAAW,EACX,UAAU,EACV,WAAW,GACZ,EAAE,oBAAoB,kDAgBtB;AAED,eAAe,eAAe,CAAC"}
+{"version":3,"file":"rsc.d.ts","sourceRoot":"","sources":["../../../../src/richtext/exports/server/rsc.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,OAAO,CAAC;AAG3C,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAKtC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAyBlC,UAAU,qBAAsB,SAAQ,qBAAqB;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,kBAAmB,SAAQ,qBAAqB;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;QACjC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,GAAG,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KAC7C,CAAC;CACH;AAmBD,UAAU,mBAAoB,SAAQ,qBAAqB;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACrE,SAAQ,qBAAqB;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAMD,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,UAAU,gBAAgB;IACxB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,2BAA2B;IAC3B,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AAqSD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,CAAC,EAAE,gBAAgB,GACzB,GAAG,CAAC,OAAO,GAAG,IAAI,CAMpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,MAAM,CAAC,CA2CjB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,wBAAwB,kDAYhF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,yBAAyB,kDAYlF;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AAED,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,SAAS,EACT,WAAW,EACX,UAAU,EACV,WAAW,GACZ,EAAE,oBAAoB,kDAgBtB;AAED,eAAe,eAAe,CAAC"}

package/dist/richtext/exports/server/rsc.js

@@ -5,7 +5,12 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * Provides server-side rendering components for Lexical content.
  * Converts Lexical JSON state to React elements without requiring a browser.
  */
-import { isSafeUrl, sanitizeUrl } from '@revealui/security';
+// Import from the client-safe ./sanitize subpath, NOT the @revealui/security
+// barrel: the barrel statically re-exports auth.ts/gdpr.ts, whose top-level
+// `import 'node:crypto'` crashes this module's client/RSC bundle (blank render
+// on routes that load rich text, e.g. marketing /blog). ./sanitize imports only
+// parse5 and is browser-safe.
+import { isSafeUrl, sanitizeUrl } from '@revealui/security/sanitize';
 import { Fragment } from 'react';
 // URL sanitization is owned by @revealui/security (single source of truth
 // for every untrusted-string sink across RevFleet). Re-exported here so

package/dist/security/index.d.ts

@@ -1,6 +1,13 @@
 /**
- * Security & Compliance  -  re-exported from @revealui/security
- * New code should import directly from '@revealui/security'.
+ * Security & Compliance  -  full server-side surface.
+ *
+ * Re-exports the client-safe `@revealui/security` barrel AND the server-only
+ * `@revealui/security/server` entry (auth/gdpr/audit/ssrf — node: built-ins),
+ * so server code can pull any security symbol from one place. Because it
+ * re-exports `./server`, THIS entry is server-only: do not import
+ * `@revealui/core/security` from client/RSC code (use `@revealui/security` or
+ * `@revealui/security/sanitize` there).
  */
 export * from '@revealui/security';
+export * from '@revealui/security/server';
 //# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC"}

package/dist/security/index.js

@@ -1,5 +1,12 @@
 /**
- * Security & Compliance  -  re-exported from @revealui/security
- * New code should import directly from '@revealui/security'.
+ * Security & Compliance  -  full server-side surface.
+ *
+ * Re-exports the client-safe `@revealui/security` barrel AND the server-only
+ * `@revealui/security/server` entry (auth/gdpr/audit/ssrf — node: built-ins),
+ * so server code can pull any security symbol from one place. Because it
+ * re-exports `./server`, THIS entry is server-only: do not import
+ * `@revealui/core/security` from client/RSC code (use `@revealui/security` or
+ * `@revealui/security/sanitize` there).
  */
 export * from '@revealui/security';
+export * from '@revealui/security/server';

package/dist/storage/_helpers.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Internal helpers shared across storage providers.
+ *
+ * Underscore prefix denotes private-to-storage/; not re-exported from
+ * packages/core/src/storage/index.ts.
+ *
+ * GAP-208 Phase 2a (2026-05-18).
+ */
+/**
+ * Normalize the four accepted body types into a Uint8Array so providers
+ * can compute size + hand a known buffer to their underlying SDKs.
+ */
+export declare function toUint8Array(data: Blob | ArrayBuffer | Uint8Array | ReadableStream<Uint8Array>): Promise<Uint8Array>;
+//# sourceMappingURL=_helpers.d.ts.map

package/dist/storage/_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_helpers.d.ts","sourceRoot":"","sources":["../../src/storage/_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,GACjE,OAAO,CAAC,UAAU,CAAC,CA0BrB"}

package/dist/storage/_helpers.js

@@ -0,0 +1,40 @@
+/**
+ * Internal helpers shared across storage providers.
+ *
+ * Underscore prefix denotes private-to-storage/; not re-exported from
+ * packages/core/src/storage/index.ts.
+ *
+ * GAP-208 Phase 2a (2026-05-18).
+ */
+/**
+ * Normalize the four accepted body types into a Uint8Array so providers
+ * can compute size + hand a known buffer to their underlying SDKs.
+ */
+export async function toUint8Array(data) {
+    if (data instanceof Uint8Array) {
+        return data;
+    }
+    if (data instanceof ArrayBuffer) {
+        return new Uint8Array(data);
+    }
+    if (data instanceof Blob) {
+        return new Uint8Array(await data.arrayBuffer());
+    }
+    const reader = data.getReader();
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        chunks.push(value);
+        total += value.byteLength;
+    }
+    const merged = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        merged.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return merged;
+}

package/dist/storage/index.d.ts

@@ -1,2 +1,18 @@
+import type { StorageConfig, StorageProvider } from './types.js';
+export { createMockProvider } from './mock.js';
+export { createR2Provider } from './r2.js';
+export type { ListItem, ListOptions, ListResult, PutOptions, PutResult, R2Config, StorageConfig, StorageProvider, VercelBlobConfig, } from './types.js';
 export { vercelBlobStorage } from './vercel-blob.js';
+/**
+ * Construct a StorageProvider from a tagged config.
+ *
+ * Per `feedback_pluggable_provider_pattern`: explicit "no-X" opt-in — unknown
+ * or unsupported tags throw with a clear message; no silent fallback.
+ *
+ * Supported tags in Phase 2a: 'r2', 'mock'. The 'vercel-blob' tag is reserved
+ * for Phase 2b (StorageProvider impl over @vercel/blob); during the migration
+ * window, consumers needing Vercel Blob should use the legacy `vercelBlobStorage`
+ * Payload plugin via `revealui.config.ts`.
+ */
+export declare function createStorage(config: StorageConfig): StorageProvider;
 //# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAK/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAqBpE"}

package/dist/storage/index.js

@@ -1,2 +1,44 @@
-// Re-export storage adapters
+// Storage abstraction (StorageProvider interface + per-provider configs + factory).
+// GAP-208 — introduced 2026-05-18 alongside Vercel Blob → Cloudflare R2 swap.
+//
+// Phase 1 (#959): types.ts + index.ts type re-exports.
+// Phase 2a (this PR): r2 + mock providers + createStorage factory.
+import { createMockProvider } from './mock.js';
+import { createR2Provider } from './r2.js';
+export { createMockProvider } from './mock.js';
+// Provider factories — exported so callers can construct a provider directly
+// when they already know which one they want (skipping the discriminated-union
+// factory below).
+export { createR2Provider } from './r2.js';
+// Legacy Payload-style plugin — kept during GAP-208 migration so existing
+// `apps/admin/revealui.config.ts` keeps working. Dropped in Phase 4 cleanup.
 export { vercelBlobStorage } from './vercel-blob.js';
+/**
+ * Construct a StorageProvider from a tagged config.
+ *
+ * Per `feedback_pluggable_provider_pattern`: explicit "no-X" opt-in — unknown
+ * or unsupported tags throw with a clear message; no silent fallback.
+ *
+ * Supported tags in Phase 2a: 'r2', 'mock'. The 'vercel-blob' tag is reserved
+ * for Phase 2b (StorageProvider impl over @vercel/blob); during the migration
+ * window, consumers needing Vercel Blob should use the legacy `vercelBlobStorage`
+ * Payload plugin via `revealui.config.ts`.
+ */
+export function createStorage(config) {
+    switch (config.provider) {
+        case 'r2':
+            return createR2Provider(config.r2);
+        case 'mock':
+            return createMockProvider();
+        case 'vercel-blob':
+            throw new Error("createStorage: provider 'vercel-blob' is not yet implemented as a " +
+                'StorageProvider (lands in GAP-208 Phase 2b). For the migration ' +
+                'window, use the legacy `vercelBlobStorage` Payload plugin in ' +
+                "revealui.config.ts, or switch to provider: 'r2'.");
+        default: {
+            const _exhaustive = config;
+            throw new Error(`createStorage: unknown provider tag. Got ${JSON.stringify(_exhaustive)}. ` +
+                "Valid tags: 'r2', 'mock', 'vercel-blob' (Phase 2b).");
+        }
+    }
+}

package/dist/storage/mock.d.ts

@@ -0,0 +1,39 @@
+/**
+ * In-memory mock implementation of StorageProvider for tests.
+ *
+ * Per `feedback_pluggable_provider_pattern`: every provider abstraction ships
+ * a mock so consumer tests don't need network access or real cloud creds.
+ *
+ * Stores objects in a Map keyed by storage key. URLs use a synthetic
+ * `mock://` scheme so callers can distinguish mock results from real ones
+ * without parsing host names.
+ *
+ * GAP-208 Phase 2a (2026-05-18).
+ */
+import type { ListOptions, ListResult, PutOptions, PutResult, StorageProvider } from './types.js';
+interface MockEntry {
+    body: Uint8Array;
+    contentType: string;
+    cacheControl?: string;
+    metadata?: Record<string, string>;
+    uploadedAt: Date;
+}
+declare class MockProvider implements StorageProvider {
+    readonly provider = "mock";
+    private readonly store;
+    put(key: string, data: Blob | ArrayBuffer | Uint8Array | ReadableStream<Uint8Array>, opts?: PutOptions): Promise<PutResult>;
+    del(keyOrUrl: string): Promise<void>;
+    list(opts?: ListOptions): Promise<ListResult>;
+    /** Test helper — read the raw bytes back. Not part of StorageProvider. */
+    read(key: string): Uint8Array | undefined;
+    /** Test helper — full entry inspection. Not part of StorageProvider. */
+    inspect(key: string): MockEntry | undefined;
+    /** Test helper — count of stored objects. Not part of StorageProvider. */
+    size(): number;
+    /** Test helper — wipe all stored objects. Not part of StorageProvider. */
+    clear(): void;
+    private extractKey;
+}
+export declare function createMockProvider(): MockProvider;
+export type { MockProvider };
+//# sourceMappingURL=mock.d.ts.map

package/dist/storage/mock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.d.ts","sourceRoot":"","sources":["../../src/storage/mock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAEV,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,eAAe,EAChB,MAAM,YAAY,CAAC;AAMpB,UAAU,SAAS;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,cAAM,YAAa,YAAW,eAAe;IAC3C,QAAQ,CAAC,QAAQ,UAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IAEhD,GAAG,CACP,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC;IAiBf,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAgCnD,0EAA0E;IAC1E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIzC,wEAAwE;IACxE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI3C,0EAA0E;IAC1E,IAAI,IAAI,MAAM;IAId,0EAA0E;IAC1E,KAAK,IAAI,IAAI;IAIb,OAAO,CAAC,UAAU;CAMnB;AAED,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD;AAED,YAAY,EAAE,YAAY,EAAE,CAAC"}

package/dist/storage/mock.js

@@ -0,0 +1,91 @@
+/**
+ * In-memory mock implementation of StorageProvider for tests.
+ *
+ * Per `feedback_pluggable_provider_pattern`: every provider abstraction ships
+ * a mock so consumer tests don't need network access or real cloud creds.
+ *
+ * Stores objects in a Map keyed by storage key. URLs use a synthetic
+ * `mock://` scheme so callers can distinguish mock results from real ones
+ * without parsing host names.
+ *
+ * GAP-208 Phase 2a (2026-05-18).
+ */
+import { toUint8Array } from './_helpers.js';
+const PROVIDER_TAG = 'mock';
+const MOCK_URL_SCHEME = 'mock://storage';
+const DEFAULT_LIST_LIMIT = 1000;
+class MockProvider {
+    provider = PROVIDER_TAG;
+    store = new Map();
+    async put(key, data, opts) {
+        const body = await toUint8Array(data);
+        this.store.set(key, {
+            body,
+            contentType: opts?.contentType ?? 'application/octet-stream',
+            cacheControl: opts?.cacheControl,
+            metadata: opts?.metadata,
+            uploadedAt: new Date(),
+        });
+        return {
+            key,
+            url: `${MOCK_URL_SCHEME}/${key}`,
+            size: body.byteLength,
+            provider: PROVIDER_TAG,
+        };
+    }
+    async del(keyOrUrl) {
+        const key = this.extractKey(keyOrUrl);
+        this.store.delete(key);
+    }
+    async list(opts) {
+        const prefix = opts?.prefix ?? '';
+        const limit = opts?.limit ?? DEFAULT_LIST_LIMIT;
+        const startAfter = opts?.cursor;
+        const allKeys = Array.from(this.store.keys())
+            .filter((key) => key.startsWith(prefix))
+            .sort();
+        const startIndex = startAfter ? allKeys.findIndex((k) => k > startAfter) : 0;
+        const effectiveStart = startIndex < 0 ? allKeys.length : startIndex;
+        const page = allKeys.slice(effectiveStart, effectiveStart + limit);
+        const items = page.map((key) => {
+            const entry = this.store.get(key);
+            if (!entry) {
+                throw new Error(`mock: store mutated during list iteration (${key})`);
+            }
+            return {
+                key,
+                url: `${MOCK_URL_SCHEME}/${key}`,
+                size: entry.body.byteLength,
+                uploadedAt: entry.uploadedAt,
+            };
+        });
+        const hasMore = effectiveStart + limit < allKeys.length;
+        const nextCursor = hasMore ? page[page.length - 1] : undefined;
+        return { items, cursor: nextCursor, hasMore };
+    }
+    /** Test helper — read the raw bytes back. Not part of StorageProvider. */
+    read(key) {
+        return this.store.get(key)?.body;
+    }
+    /** Test helper — full entry inspection. Not part of StorageProvider. */
+    inspect(key) {
+        return this.store.get(key);
+    }
+    /** Test helper — count of stored objects. Not part of StorageProvider. */
+    size() {
+        return this.store.size;
+    }
+    /** Test helper — wipe all stored objects. Not part of StorageProvider. */
+    clear() {
+        this.store.clear();
+    }
+    extractKey(keyOrUrl) {
+        if (keyOrUrl.startsWith(`${MOCK_URL_SCHEME}/`)) {
+            return keyOrUrl.slice(MOCK_URL_SCHEME.length + 1);
+        }
+        return keyOrUrl;
+    }
+}
+export function createMockProvider() {
+    return new MockProvider();
+}

package/dist/storage/r2.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Cloudflare R2 implementation of StorageProvider.
+ *
+ * R2 is S3-compatible — uses @aws-sdk/client-s3 with a custom endpoint and
+ * region='auto'. See https://developers.cloudflare.com/r2/api/s3/api/.
+ *
+ * GAP-208 Phase 2a (2026-05-18). Phase 1 (interface + types) shipped in #959.
+ *
+ * Server-only. Do NOT import from client-side code or edge runtime.
+ */
+import type { R2Config, StorageProvider } from './types.js';
+export declare function createR2Provider(config: R2Config): StorageProvider;
+//# sourceMappingURL=r2.d.ts.map

package/dist/storage/r2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/storage/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EAMV,QAAQ,EACR,eAAe,EAChB,MAAM,YAAY,CAAC;AAsHpB,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAElE"}

package/dist/storage/r2.js

@@ -0,0 +1,117 @@
+/**
+ * Cloudflare R2 implementation of StorageProvider.
+ *
+ * R2 is S3-compatible — uses @aws-sdk/client-s3 with a custom endpoint and
+ * region='auto'. See https://developers.cloudflare.com/r2/api/s3/api/.
+ *
+ * GAP-208 Phase 2a (2026-05-18). Phase 1 (interface + types) shipped in #959.
+ *
+ * Server-only. Do NOT import from client-side code or edge runtime.
+ */
+import { DeleteObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
+import { toUint8Array } from './_helpers.js';
+const PROVIDER_TAG = 'r2';
+const DEFAULT_CONTENT_TYPE = 'application/octet-stream';
+const DEFAULT_LIST_LIMIT = 1000;
+class R2Provider {
+    provider = PROVIDER_TAG;
+    client;
+    bucket;
+    publicBaseUrl;
+    constructor(config) {
+        if (!config.publicBaseUrl) {
+            throw new Error('R2 provider requires R2Config.publicBaseUrl. Presigned/private URLs ' +
+                'are not supported in Phase 2a. Set publicBaseUrl to either a bound ' +
+                "custom domain (e.g. 'https://media.revealui.com') or the R2 dev URL " +
+                "('https://<account-id>.r2.cloudflarestorage.com/<bucket>').");
+        }
+        this.bucket = config.bucket;
+        this.publicBaseUrl = stripTrailingSlash(config.publicBaseUrl);
+        this.client = new S3Client({
+            region: 'auto',
+            endpoint: `https://${config.accountId}.r2.cloudflarestorage.com`,
+            credentials: {
+                accessKeyId: config.accessKeyId,
+                secretAccessKey: config.secretAccessKey,
+            },
+        });
+    }
+    async put(key, data, opts) {
+        if (opts?.access === 'private') {
+            throw new Error("R2 provider Phase 2a does not support access: 'private'. All objects " +
+                'are written under the publicBaseUrl. Presigned/private-URL support ' +
+                'lands in Phase 2b.');
+        }
+        const body = await toUint8Array(data);
+        await this.client.send(new PutObjectCommand({
+            Bucket: this.bucket,
+            Key: key,
+            Body: body,
+            ContentType: opts?.contentType ?? DEFAULT_CONTENT_TYPE,
+            ContentLength: body.byteLength,
+            CacheControl: opts?.cacheControl,
+            Metadata: opts?.metadata,
+        }));
+        return {
+            key,
+            url: `${this.publicBaseUrl}/${key}`,
+            size: body.byteLength,
+            provider: PROVIDER_TAG,
+        };
+    }
+    async del(keyOrUrl) {
+        const key = this.extractKey(keyOrUrl);
+        await this.client.send(new DeleteObjectCommand({
+            Bucket: this.bucket,
+            Key: key,
+        }));
+    }
+    async list(opts) {
+        const response = await this.client.send(new ListObjectsV2Command({
+            Bucket: this.bucket,
+            Prefix: opts?.prefix,
+            MaxKeys: opts?.limit ?? DEFAULT_LIST_LIMIT,
+            ContinuationToken: opts?.cursor,
+        }));
+        const items = (response.Contents ?? []).flatMap((entry) => {
+            if (!entry.Key)
+                return [];
+            return [
+                {
+                    key: entry.Key,
+                    url: `${this.publicBaseUrl}/${entry.Key}`,
+                    size: entry.Size ?? 0,
+                    uploadedAt: entry.LastModified ?? new Date(0),
+                },
+            ];
+        });
+        return {
+            items,
+            cursor: response.NextContinuationToken,
+            hasMore: response.IsTruncated === true,
+        };
+    }
+    extractKey(keyOrUrl) {
+        const parsed = tryParseUrl(keyOrUrl);
+        if (!parsed) {
+            return keyOrUrl;
+        }
+        // URL form — strip the leading slash from the pathname.
+        return parsed.pathname.startsWith('/') ? parsed.pathname.slice(1) : parsed.pathname;
+    }
+}
+export function createR2Provider(config) {
+    return new R2Provider(config);
+}
+// ── helpers ────────────────────────────────────────────────────────────────
+function tryParseUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return null;
+    }
+}
+function stripTrailingSlash(value) {
+    return value.endsWith('/') ? value.slice(0, -1) : value;
+}

package/dist/storage/types.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Provider-agnostic storage interface for the RevealUI fleet.
+ *
+ * Per `feedback_revealui_agnosticism_principle` + `feedback_pluggable_provider_pattern`:
+ * slim interface, tag + factory, explicit "no-X" opt-in, mock provider for tests.
+ *
+ * Providers implement this interface; consumers (apps/server media routes,
+ * apps/admin health probes, packages/core Payload-style plugin shims) depend
+ * only on this contract. Switching providers becomes a config change.
+ *
+ * GAP-208 introduces this abstraction during the Vercel Blob → Cloudflare R2
+ * swap (2026-05-18). The vercel-blob Payload-style plugin (vercel-blob.ts)
+ * stays in place during migration for backward compat; once consumers migrate
+ * to the interface, the legacy plugin is dropped.
+ */
+export interface StorageProvider {
+    /** Upload binary data. Returns a fully-qualified URL the value is reachable at. */
+    put(key: string, data: Blob | ArrayBuffer | Uint8Array | ReadableStream<Uint8Array>, opts?: PutOptions): Promise<PutResult>;
+    /** Delete by either provider URL or storage key. Best-effort; missing keys are not errors. */
+    del(keyOrUrl: string): Promise<void>;
+    /** List items, optionally filtered by key prefix. Used by health probes + admin browsing. */
+    list(opts?: ListOptions): Promise<ListResult>;
+    /** Provider tag (e.g. "r2", "vercel-blob", "mock") — exposed so consumers can adapt URL handling. */
+    readonly provider: string;
+}
+export interface PutOptions {
+    /** MIME type — written to the object's Content-Type header. Defaults to "application/octet-stream". */
+    contentType?: string;
+    /**
+     * Public read access (no auth required for GET on the returned URL).
+     * Defaults to "public" because the current media-upload flow needs public CDN URLs.
+     * Providers that don't support public access (e.g. private-bucket-only configs)
+     * MUST throw when access: "public" is requested.
+     */
+    access?: 'public' | 'private';
+    /** Cache-Control header value. Provider may apply a sensible default if omitted. */
+    cacheControl?: string;
+    /** Custom user-metadata. Keys are lowercased; values are strings. Limits vary by provider. */
+    metadata?: Record<string, string>;
+}
+export interface PutResult {
+    /** The storage key the object was written to (provider-relative, e.g. "media/uuid.jpg"). */
+    key: string;
+    /** Fully-qualified URL the object is reachable at for GET. */
+    url: string;
+    /** Storage size in bytes. Always populated by every provider. */
+    size: number;
+    /** Provider tag that wrote this object (matches StorageProvider.provider). */
+    provider: string;
+}
+export interface ListOptions {
+    /** Filter to keys starting with this prefix. */
+    prefix?: string;
+    /** Maximum items per page. Providers cap this internally (typically 1000). */
+    limit?: number;
+    /** Opaque pagination cursor from a previous ListResult. */
+    cursor?: string;
+}
+export interface ListResult {
+    items: ListItem[];
+    /** Next-page cursor if hasMore is true; undefined when listing is exhausted. */
+    cursor?: string;
+    hasMore: boolean;
+}
+export interface ListItem {
+    key: string;
+    url: string;
+    size: number;
+    uploadedAt: Date;
+}
+/**
+ * Discriminated union over `provider`. Adding a new provider means:
+ *   1. add a tag here + the per-provider config shape
+ *   2. add a case in the createStorage factory
+ *   3. implement the StorageProvider interface in a new file
+ *
+ * No silent fallback per `feedback_pluggable_provider_pattern`: unknown tags
+ * throw with a clear "valid tags: ..." message.
+ */
+export type StorageConfig = {
+    provider: 'r2';
+    r2: R2Config;
+} | {
+    provider: 'vercel-blob';
+    vercelBlob: VercelBlobConfig;
+} | {
+    provider: 'mock';
+};
+export interface R2Config {
+    /** Cloudflare account ID (visible at top of the R2 dashboard). */
+    accountId: string;
+    /** R2 API token Access Key ID (NOT the global account API token). */
+    accessKeyId: string;
+    /** R2 API token Secret Access Key (paired with accessKeyId). */
+    secretAccessKey: string;
+    /** Bucket name (per-account-globally-unique within R2). */
+    bucket: string;
+    /**
+     * Optional public base URL for objects (e.g. "https://media.revealui.com" if a
+     * custom domain is bound, or "https://<account-id>.r2.cloudflarestorage.com/<bucket>"
+     * for the dev URL). When set, PutResult.url uses this base. When omitted, PutResult.url
+     * falls back to a presigned URL (private bucket pattern).
+     */
+    publicBaseUrl?: string;
+}
+export interface VercelBlobConfig {
+    /** vercel_blob_rw_* token from the Vercel Blob dashboard. */
+    token: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/storage/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/storage/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtB,8FAA8F;IAC9F,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,6FAA6F;IAC7F,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE9C,qGAAqG;IACrG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,UAAU;IACzB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAE9B,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IAEZ,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IAEZ,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IAEb,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAElB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,IAAI,CAAC;CAClB;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAA;CAAE,GAChC;IAAE,QAAQ,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GACzD;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzB,MAAM,WAAW,QAAQ;IACvB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAElB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IAEpB,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAC;IAExB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;CACf"}

package/dist/storage/types.js

@@ -0,0 +1,16 @@
+/**
+ * Provider-agnostic storage interface for the RevealUI fleet.
+ *
+ * Per `feedback_revealui_agnosticism_principle` + `feedback_pluggable_provider_pattern`:
+ * slim interface, tag + factory, explicit "no-X" opt-in, mock provider for tests.
+ *
+ * Providers implement this interface; consumers (apps/server media routes,
+ * apps/admin health probes, packages/core Payload-style plugin shims) depend
+ * only on this contract. Switching providers becomes a config change.
+ *
+ * GAP-208 introduces this abstraction during the Vercel Blob → Cloudflare R2
+ * swap (2026-05-18). The vercel-blob Payload-style plugin (vercel-blob.ts)
+ * stays in place during migration for backward compat; once consumers migrate
+ * to the interface, the legacy plugin is dropped.
+ */
+export {};

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@revealui/core",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "RevealUI's runtime engine — admin UI, REST API, auth, rich text, plugin system, and access control. The heart of the open-source platform.",
   "license": "MIT",
   "dependencies": {
-    "@electric-sql/pglite": "^0.4.4",
+    "@aws-sdk/client-s3": "^3.1049.0",
+    "@electric-sql/pglite": "^0.4.5",
     "@lexical/clipboard": "^0.44.0",
     "@lexical/code": "^0.44.0",
     "@lexical/html": "^0.44.0",
@@ -21,13 +22,13 @@
     "dataloader": "^2.2.3",
     "jose": "^6.2.3",
     "lexical": "^0.44.0",
-    "pg": "^8.20.0",
+    "pg": "^8.21.0",
     "yjs": "^13.6.30",
     "zod": "^4.4.3",
-    "@revealui/cache": "0.1.5",
-    "@revealui/contracts": "0.5.0",
+    "@revealui/cache": "0.2.1",
+    "@revealui/contracts": "0.6.0",
     "@revealui/resilience": "0.2.4",
-    "@revealui/security": "0.3.1",
+    "@revealui/security": "0.4.0",
     "@revealui/utils": "0.3.5"
   },
   "devDependencies": {