@revealui/core 0.7.0 → 0.9.0

package/dist/security/index.js

@@ -1,5 +1,12 @@
 /**
- * Security & Compliance  -  re-exported from @revealui/security
- * New code should import directly from '@revealui/security'.
+ * Security & Compliance  -  full server-side surface.
+ *
+ * Re-exports the client-safe `@revealui/security` barrel AND the server-only
+ * `@revealui/security/server` entry (auth/gdpr/audit/ssrf — node: built-ins),
+ * so server code can pull any security symbol from one place. Because it
+ * re-exports `./server`, THIS entry is server-only: do not import
+ * `@revealui/core/security` from client/RSC code (use `@revealui/security` or
+ * `@revealui/security/sanitize` there).
  */
 export * from '@revealui/security';
+export * from '@revealui/security/server';

package/dist/server/index.d.ts

@@ -13,7 +13,7 @@
  */
 export { createRESTHandlers, handleRESTRequest } from '../api/rest.js';
 export { universalPostgresAdapter } from '../database/universal-postgres.js';
-export { vercelBlobStorage } from '../storage/vercel-blob.js';
+export { objectStorage } from '../storage/object-storage.js';
 export type { LogContext, Logger, LogLevel } from '../utils/logger-server.js';
 export { createLogger, logger } from '../utils/logger-server.js';
 export * from '../utils/request-context.js';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAEjE,cAAc,6BAA6B,CAAC;AAQ5C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAEjE,cAAc,6BAA6B,CAAC;AAQ5C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/server/index.js

@@ -15,7 +15,7 @@
 export { createRESTHandlers, handleRESTRequest } from '../api/rest.js';
 // Server-only database/storage
 export { universalPostgresAdapter } from '../database/universal-postgres.js';
-export { vercelBlobStorage } from '../storage/vercel-blob.js';
+export { objectStorage } from '../storage/object-storage.js';
 // Server-only logger with request context
 export { createLogger, logger } from '../utils/logger-server.js';
 // Request context utilities (server-only - uses async_hooks)

package/dist/storage/_helpers.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Internal helpers shared across storage providers.
+ *
+ * Underscore prefix denotes private-to-storage/; not re-exported from
+ * packages/core/src/storage/index.ts.
+ *
+ * GAP-208 Phase 2a (2026-05-18).
+ */
+/**
+ * Normalize the four accepted body types into a Uint8Array so providers
+ * can compute size + hand a known buffer to their underlying SDKs.
+ */
+export declare function toUint8Array(data: Blob | ArrayBuffer | Uint8Array | ReadableStream<Uint8Array>): Promise<Uint8Array>;
+//# sourceMappingURL=_helpers.d.ts.map

package/dist/storage/_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_helpers.d.ts","sourceRoot":"","sources":["../../src/storage/_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,GACjE,OAAO,CAAC,UAAU,CAAC,CA0BrB"}

package/dist/storage/_helpers.js

@@ -0,0 +1,40 @@
+/**
+ * Internal helpers shared across storage providers.
+ *
+ * Underscore prefix denotes private-to-storage/; not re-exported from
+ * packages/core/src/storage/index.ts.
+ *
+ * GAP-208 Phase 2a (2026-05-18).
+ */
+/**
+ * Normalize the four accepted body types into a Uint8Array so providers
+ * can compute size + hand a known buffer to their underlying SDKs.
+ */
+export async function toUint8Array(data) {
+    if (data instanceof Uint8Array) {
+        return data;
+    }
+    if (data instanceof ArrayBuffer) {
+        return new Uint8Array(data);
+    }
+    if (data instanceof Blob) {
+        return new Uint8Array(await data.arrayBuffer());
+    }
+    const reader = data.getReader();
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        chunks.push(value);
+        total += value.byteLength;
+    }
+    const merged = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        merged.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return merged;
+}

package/dist/storage/index.d.ts

@@ -1,2 +1,19 @@
-export { vercelBlobStorage } from './vercel-blob.js';
+import type { StorageConfig, StorageProvider } from './types.js';
+export { createMockProvider } from './mock.js';
+export type { ObjectStorageConfig } from './object-storage.js';
+export { objectStorage } from './object-storage.js';
+export { createR2Provider } from './r2.js';
+export type { ListItem, ListOptions, ListResult, PutOptions, PutResult, R2Config, StorageConfig, StorageProvider, VercelBlobConfig, } from './types.js';
+export { createVercelBlobProvider } from './vercel-blob-provider.js';
+/**
+ * Construct a StorageProvider from a tagged config.
+ *
+ * Per `feedback_pluggable_provider_pattern`: explicit "no-X" opt-in — unknown
+ * tags throw with a clear message; no silent fallback.
+ *
+ * Supported tags: 'r2' (canonical), 'vercel-blob' (legacy migration-window
+ * fallback), and 'mock' (tests). The provider-agnostic `objectStorage` Payload
+ * plugin (object-storage.ts) adapts any of these to apps/admin's upload path.
+ */
+export declare function createStorage(config: StorageConfig): StorageProvider;
 //# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAK/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAgBpE"}

package/dist/storage/index.js

@@ -1,2 +1,46 @@
-// Re-export storage adapters
-export { vercelBlobStorage } from './vercel-blob.js';
+// Storage abstraction (StorageProvider interface + per-provider configs + factory).
+// GAP-208 — introduced 2026-05-18 alongside Vercel Blob → Cloudflare R2 swap.
+//
+// Phase 1 (#959): types.ts + index.ts type re-exports.
+// Phase 2a (#959 follow-up): r2 + mock providers + createStorage factory.
+// Phase 2b (this PR): vercel-blob StorageProvider + apps/server media-route
+//   cutover. R2 is canonical; Vercel Blob is the migration-window fallback.
+import { createMockProvider } from './mock.js';
+import { createR2Provider } from './r2.js';
+import { createVercelBlobProvider } from './vercel-blob-provider.js';
+export { createMockProvider } from './mock.js';
+// Provider-agnostic Payload-style upload plugin — adapts any StorageProvider
+// (R2 canonical, Vercel Blob fallback, mock) to the engine's collection upload
+// adapter. Used by apps/admin/revealui.config.ts. GAP-208 Phase 4 replaced the
+// provider-specific `vercelBlobStorage` plugin with this.
+export { objectStorage } from './object-storage.js';
+// Provider factories — exported so callers can construct a provider directly
+// when they already know which one they want (skipping the discriminated-union
+// factory below).
+export { createR2Provider } from './r2.js';
+export { createVercelBlobProvider } from './vercel-blob-provider.js';
+/**
+ * Construct a StorageProvider from a tagged config.
+ *
+ * Per `feedback_pluggable_provider_pattern`: explicit "no-X" opt-in — unknown
+ * tags throw with a clear message; no silent fallback.
+ *
+ * Supported tags: 'r2' (canonical), 'vercel-blob' (legacy migration-window
+ * fallback), and 'mock' (tests). The provider-agnostic `objectStorage` Payload
+ * plugin (object-storage.ts) adapts any of these to apps/admin's upload path.
+ */
+export function createStorage(config) {
+    switch (config.provider) {
+        case 'r2':
+            return createR2Provider(config.r2);
+        case 'vercel-blob':
+            return createVercelBlobProvider(config.vercelBlob);
+        case 'mock':
+            return createMockProvider();
+        default: {
+            const _exhaustive = config;
+            throw new Error(`createStorage: unknown provider tag. Got ${JSON.stringify(_exhaustive)}. ` +
+                "Valid tags: 'r2', 'vercel-blob', 'mock'.");
+        }
+    }
+}

package/dist/storage/mock.d.ts

@@ -0,0 +1,39 @@
+/**
+ * In-memory mock implementation of StorageProvider for tests.
+ *
+ * Per `feedback_pluggable_provider_pattern`: every provider abstraction ships
+ * a mock so consumer tests don't need network access or real cloud creds.
+ *
+ * Stores objects in a Map keyed by storage key. URLs use a synthetic
+ * `mock://` scheme so callers can distinguish mock results from real ones
+ * without parsing host names.
+ *
+ * GAP-208 Phase 2a (2026-05-18).
+ */
+import type { ListOptions, ListResult, PutOptions, PutResult, StorageProvider } from './types.js';
+interface MockEntry {
+    body: Uint8Array;
+    contentType: string;
+    cacheControl?: string;
+    metadata?: Record<string, string>;
+    uploadedAt: Date;
+}
+declare class MockProvider implements StorageProvider {
+    readonly provider = "mock";
+    private readonly store;
+    put(key: string, data: Blob | ArrayBuffer | Uint8Array | ReadableStream<Uint8Array>, opts?: PutOptions): Promise<PutResult>;
+    del(keyOrUrl: string): Promise<void>;
+    list(opts?: ListOptions): Promise<ListResult>;
+    /** Test helper — read the raw bytes back. Not part of StorageProvider. */
+    read(key: string): Uint8Array | undefined;
+    /** Test helper — full entry inspection. Not part of StorageProvider. */
+    inspect(key: string): MockEntry | undefined;
+    /** Test helper — count of stored objects. Not part of StorageProvider. */
+    size(): number;
+    /** Test helper — wipe all stored objects. Not part of StorageProvider. */
+    clear(): void;
+    private extractKey;
+}
+export declare function createMockProvider(): MockProvider;
+export type { MockProvider };
+//# sourceMappingURL=mock.d.ts.map

package/dist/storage/mock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.d.ts","sourceRoot":"","sources":["../../src/storage/mock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAEV,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,eAAe,EAChB,MAAM,YAAY,CAAC;AAMpB,UAAU,SAAS;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,cAAM,YAAa,YAAW,eAAe;IAC3C,QAAQ,CAAC,QAAQ,UAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IAEhD,GAAG,CACP,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC;IAiBf,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAgCnD,0EAA0E;IAC1E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIzC,wEAAwE;IACxE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI3C,0EAA0E;IAC1E,IAAI,IAAI,MAAM;IAId,0EAA0E;IAC1E,KAAK,IAAI,IAAI;IAIb,OAAO,CAAC,UAAU;CAMnB;AAED,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD;AAED,YAAY,EAAE,YAAY,EAAE,CAAC"}

package/dist/storage/mock.js

@@ -0,0 +1,91 @@
+/**
+ * In-memory mock implementation of StorageProvider for tests.
+ *
+ * Per `feedback_pluggable_provider_pattern`: every provider abstraction ships
+ * a mock so consumer tests don't need network access or real cloud creds.
+ *
+ * Stores objects in a Map keyed by storage key. URLs use a synthetic
+ * `mock://` scheme so callers can distinguish mock results from real ones
+ * without parsing host names.
+ *
+ * GAP-208 Phase 2a (2026-05-18).
+ */
+import { toUint8Array } from './_helpers.js';
+const PROVIDER_TAG = 'mock';
+const MOCK_URL_SCHEME = 'mock://storage';
+const DEFAULT_LIST_LIMIT = 1000;
+class MockProvider {
+    provider = PROVIDER_TAG;
+    store = new Map();
+    async put(key, data, opts) {
+        const body = await toUint8Array(data);
+        this.store.set(key, {
+            body,
+            contentType: opts?.contentType ?? 'application/octet-stream',
+            cacheControl: opts?.cacheControl,
+            metadata: opts?.metadata,
+            uploadedAt: new Date(),
+        });
+        return {
+            key,
+            url: `${MOCK_URL_SCHEME}/${key}`,
+            size: body.byteLength,
+            provider: PROVIDER_TAG,
+        };
+    }
+    async del(keyOrUrl) {
+        const key = this.extractKey(keyOrUrl);
+        this.store.delete(key);
+    }
+    async list(opts) {
+        const prefix = opts?.prefix ?? '';
+        const limit = opts?.limit ?? DEFAULT_LIST_LIMIT;
+        const startAfter = opts?.cursor;
+        const allKeys = Array.from(this.store.keys())
+            .filter((key) => key.startsWith(prefix))
+            .sort();
+        const startIndex = startAfter ? allKeys.findIndex((k) => k > startAfter) : 0;
+        const effectiveStart = startIndex < 0 ? allKeys.length : startIndex;
+        const page = allKeys.slice(effectiveStart, effectiveStart + limit);
+        const items = page.map((key) => {
+            const entry = this.store.get(key);
+            if (!entry) {
+                throw new Error(`mock: store mutated during list iteration (${key})`);
+            }
+            return {
+                key,
+                url: `${MOCK_URL_SCHEME}/${key}`,
+                size: entry.body.byteLength,
+                uploadedAt: entry.uploadedAt,
+            };
+        });
+        const hasMore = effectiveStart + limit < allKeys.length;
+        const nextCursor = hasMore ? page[page.length - 1] : undefined;
+        return { items, cursor: nextCursor, hasMore };
+    }
+    /** Test helper — read the raw bytes back. Not part of StorageProvider. */
+    read(key) {
+        return this.store.get(key)?.body;
+    }
+    /** Test helper — full entry inspection. Not part of StorageProvider. */
+    inspect(key) {
+        return this.store.get(key);
+    }
+    /** Test helper — count of stored objects. Not part of StorageProvider. */
+    size() {
+        return this.store.size;
+    }
+    /** Test helper — wipe all stored objects. Not part of StorageProvider. */
+    clear() {
+        this.store.clear();
+    }
+    extractKey(keyOrUrl) {
+        if (keyOrUrl.startsWith(`${MOCK_URL_SCHEME}/`)) {
+            return keyOrUrl.slice(MOCK_URL_SCHEME.length + 1);
+        }
+        return keyOrUrl;
+    }
+}
+export function createMockProvider() {
+    return new MockProvider();
+}

package/dist/storage/object-storage.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Object-storage upload plugin (provider-agnostic).
+ *
+ * Adapts any `StorageProvider` (Cloudflare R2 — canonical — Vercel Blob, mock,
+ * or a future backend) to the RevealUI engine's collection upload-adapter
+ * interface, so `apps/admin/revealui.config.ts` stores media through the
+ * configured object-storage backend. Replaces the provider-specific
+ * `vercelBlobStorage` Payload plugin retired in GAP-208 Phase 4.
+ *
+ * The backend is resolved through a lazy `resolveProvider` thunk — invoked
+ * (and memoized) on the first upload/delete, never at config-build time — so a
+ * consumer reading validated config (e.g. `@revealui/config`'s `config.storage`)
+ * does NOT force env validation when the admin config module is imported during
+ * `next build`, tests, or boot. This mirrors `apps/server` `getMediaStorage()`,
+ * which reads `config.storage` lazily per request.
+ *
+ * WARNING: This module is server-only.
+ * Do NOT import in client-side code or edge runtime.
+ */
+import type { Plugin } from '../types/index.js';
+import type { StorageProvider } from './types.js';
+export interface ObjectStorageConfig {
+    /** When `false`, the plugin is a no-op (no upload config applied). Defaults to enabled. */
+    enabled?: boolean;
+    /** Map of collection slug → whether to attach upload handling. */
+    collections?: {
+        [key: string]: boolean;
+    };
+    /**
+     * Lazily resolves the backend the upload adapter writes through. Called once
+     * (memoized) on the first upload/delete — never at config build — so reading
+     * validated config (e.g. `@revealui/config`'s `config.storage`) does not force
+     * env validation at module load. Should throw a clear, actionable error when
+     * no backend is configured (fail-fast; never silently no-op an upload).
+     */
+    resolveProvider: () => StorageProvider;
+    /** Key prefix for stored objects. Defaults to `'uploads'`. */
+    prefix?: string;
+}
+export declare function objectStorage(config: ObjectStorageConfig): Plugin;
+//# sourceMappingURL=object-storage.d.ts.map

package/dist/storage/object-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-storage.d.ts","sourceRoot":"","sources":["../../src/storage/object-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kEAAkE;IAClE,WAAW,CAAC,EAAE;QACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,eAAe,CAAC;IACvC,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAiGjE"}

package/dist/storage/{vercel-blob.js → object-storage.js}

@@ -1,13 +1,35 @@
 /**
- * Vercel Blob Storage Plugin
+ * Object-storage upload plugin (provider-agnostic).
+ *
+ * Adapts any `StorageProvider` (Cloudflare R2 — canonical — Vercel Blob, mock,
+ * or a future backend) to the RevealUI engine's collection upload-adapter
+ * interface, so `apps/admin/revealui.config.ts` stores media through the
+ * configured object-storage backend. Replaces the provider-specific
+ * `vercelBlobStorage` Payload plugin retired in GAP-208 Phase 4.
+ *
+ * The backend is resolved through a lazy `resolveProvider` thunk — invoked
+ * (and memoized) on the first upload/delete, never at config-build time — so a
+ * consumer reading validated config (e.g. `@revealui/config`'s `config.storage`)
+ * does NOT force env validation when the admin config module is imported during
+ * `next build`, tests, or boot. This mirrors `apps/server` `getMediaStorage()`,
+ * which reads `config.storage` lazily per request.
  *
  * WARNING: This module is server-only.
  * Do NOT import in client-side code or edge runtime.
  */
-import { del, put } from '@vercel/blob';
 import { defaultLogger } from '../instance/logger.js';
-export function vercelBlobStorage(config) {
+export function objectStorage(config) {
     const prefix = config.prefix || 'uploads';
+    // Memoize the provider so the underlying client (S3 / Blob) is constructed
+    // once per process, not per upload — and so config is read lazily, on first
+    // use, rather than at config-build time.
+    let cachedProvider;
+    const getProvider = () => {
+        if (!cachedProvider) {
+            cachedProvider = config.resolveProvider();
+        }
+        return cachedProvider;
+    };
     return (incomingConfig) => {
         if (config.enabled === false) {
             return incomingConfig;
@@ -26,25 +48,21 @@ export function vercelBlobStorage(config) {
                         crop: true,
                         adapters: [
                             {
-                                name: 'vercel-blob',
+                                name: 'object-storage',
                                 adapter: {
-                                    name: 'vercel-blob',
+                                    name: 'object-storage',
                                     generateURL: (file) => {
                                         return `${prefix}/${file.filename}`;
                                     },
                                     upload: async (file) => {
                                         try {
-                                            const filePath = `${prefix}/${collection.slug}/${Date.now()}-${file.name}`;
-                                            if (!config.token) {
-                                                throw new Error('Vercel blob token is required but not configured');
-                                            }
-                                            const blob = await put(filePath, file.data, {
+                                            const key = `${prefix}/${collection.slug}/${Date.now()}-${file.name}`;
+                                            const result = await getProvider().put(key, file.data, {
                                                 access: 'public',
-                                                token: config.token,
-                                                addRandomSuffix: false,
+                                                contentType: file.mimetype,
                                             });
                                             return {
-                                                url: blob.url,
+                                                url: result.url,
                                                 filename: file.name,
                                                 filesize: file.size,
                                                 mimeType: file.mimetype,
@@ -53,20 +71,22 @@ export function vercelBlobStorage(config) {
                                             };
                                         }
                                         catch (error) {
-                                            defaultLogger.error('Vercel Blob upload error:', error);
+                                            defaultLogger.error('Object storage upload error:', error);
                                             throw error;
                                         }
                                     },
                                     delete: async (filename) => {
                                         try {
-                                            // Extract the blob URL from filename or construct it
-                                            const blobUrl = filename.startsWith('http')
+                                            // Payload may pass a full URL (preferred — providers extract
+                                            // the storage key from it) or a bare filename; mirror the
+                                            // legacy plugin's prefix-prepend for the bare-filename case.
+                                            const keyOrUrl = filename.startsWith('http')
                                                 ? filename
                                                 : `${prefix}/${filename}`;
-                                            await del(blobUrl);
+                                            await getProvider().del(keyOrUrl);
                                         }
                                         catch (error) {
-                                            defaultLogger.error('Vercel Blob delete error:', error);
+                                            defaultLogger.error('Object storage delete error:', error);
                                             throw error;
                                         }
                                     },

package/dist/storage/r2.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Cloudflare R2 implementation of StorageProvider.
+ *
+ * R2 is S3-compatible — uses @aws-sdk/client-s3 with a custom endpoint and
+ * region='auto'. See https://developers.cloudflare.com/r2/api/s3/api/.
+ *
+ * GAP-208 Phase 2a (2026-05-18). Phase 1 (interface + types) shipped in #959.
+ *
+ * Server-only. Do NOT import from client-side code or edge runtime.
+ */
+import type { R2Config, StorageProvider } from './types.js';
+export declare function createR2Provider(config: R2Config): StorageProvider;
+//# sourceMappingURL=r2.d.ts.map

package/dist/storage/r2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/storage/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EAMV,QAAQ,EACR,eAAe,EAChB,MAAM,YAAY,CAAC;AAsHpB,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAElE"}

package/dist/storage/r2.js

@@ -0,0 +1,117 @@
+/**
+ * Cloudflare R2 implementation of StorageProvider.
+ *
+ * R2 is S3-compatible — uses @aws-sdk/client-s3 with a custom endpoint and
+ * region='auto'. See https://developers.cloudflare.com/r2/api/s3/api/.
+ *
+ * GAP-208 Phase 2a (2026-05-18). Phase 1 (interface + types) shipped in #959.
+ *
+ * Server-only. Do NOT import from client-side code or edge runtime.
+ */
+import { DeleteObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
+import { toUint8Array } from './_helpers.js';
+const PROVIDER_TAG = 'r2';
+const DEFAULT_CONTENT_TYPE = 'application/octet-stream';
+const DEFAULT_LIST_LIMIT = 1000;
+class R2Provider {
+    provider = PROVIDER_TAG;
+    client;
+    bucket;
+    publicBaseUrl;
+    constructor(config) {
+        if (!config.publicBaseUrl) {
+            throw new Error('R2 provider requires R2Config.publicBaseUrl. Presigned/private URLs ' +
+                'are not supported in Phase 2a. Set publicBaseUrl to either a bound ' +
+                "custom domain (e.g. 'https://media.revealui.com') or the R2 dev URL " +
+                "('https://<account-id>.r2.cloudflarestorage.com/<bucket>').");
+        }
+        this.bucket = config.bucket;
+        this.publicBaseUrl = stripTrailingSlash(config.publicBaseUrl);
+        this.client = new S3Client({
+            region: 'auto',
+            endpoint: `https://${config.accountId}.r2.cloudflarestorage.com`,
+            credentials: {
+                accessKeyId: config.accessKeyId,
+                secretAccessKey: config.secretAccessKey,
+            },
+        });
+    }
+    async put(key, data, opts) {
+        if (opts?.access === 'private') {
+            throw new Error("R2 provider Phase 2a does not support access: 'private'. All objects " +
+                'are written under the publicBaseUrl. Presigned/private-URL support ' +
+                'lands in Phase 2b.');
+        }
+        const body = await toUint8Array(data);
+        await this.client.send(new PutObjectCommand({
+            Bucket: this.bucket,
+            Key: key,
+            Body: body,
+            ContentType: opts?.contentType ?? DEFAULT_CONTENT_TYPE,
+            ContentLength: body.byteLength,
+            CacheControl: opts?.cacheControl,
+            Metadata: opts?.metadata,
+        }));
+        return {
+            key,
+            url: `${this.publicBaseUrl}/${key}`,
+            size: body.byteLength,
+            provider: PROVIDER_TAG,
+        };
+    }
+    async del(keyOrUrl) {
+        const key = this.extractKey(keyOrUrl);
+        await this.client.send(new DeleteObjectCommand({
+            Bucket: this.bucket,
+            Key: key,
+        }));
+    }
+    async list(opts) {
+        const response = await this.client.send(new ListObjectsV2Command({
+            Bucket: this.bucket,
+            Prefix: opts?.prefix,
+            MaxKeys: opts?.limit ?? DEFAULT_LIST_LIMIT,
+            ContinuationToken: opts?.cursor,
+        }));
+        const items = (response.Contents ?? []).flatMap((entry) => {
+            if (!entry.Key)
+                return [];
+            return [
+                {
+                    key: entry.Key,
+                    url: `${this.publicBaseUrl}/${entry.Key}`,
+                    size: entry.Size ?? 0,
+                    uploadedAt: entry.LastModified ?? new Date(0),
+                },
+            ];
+        });
+        return {
+            items,
+            cursor: response.NextContinuationToken,
+            hasMore: response.IsTruncated === true,
+        };
+    }
+    extractKey(keyOrUrl) {
+        const parsed = tryParseUrl(keyOrUrl);
+        if (!parsed) {
+            return keyOrUrl;
+        }
+        // URL form — strip the leading slash from the pathname.
+        return parsed.pathname.startsWith('/') ? parsed.pathname.slice(1) : parsed.pathname;
+    }
+}
+export function createR2Provider(config) {
+    return new R2Provider(config);
+}
+// ── helpers ────────────────────────────────────────────────────────────────
+function tryParseUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return null;
+    }
+}
+function stripTrailingSlash(value) {
+    return value.endsWith('/') ? value.slice(0, -1) : value;
+}