@revealui/core 0.8.0 → 0.10.0

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAEjE,cAAc,6BAA6B,CAAC;AAQ5C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAEjE,cAAc,6BAA6B,CAAC;AAQ5C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/server/index.js

@@ -15,7 +15,7 @@
 export { createRESTHandlers, handleRESTRequest } from '../api/rest.js';
 // Server-only database/storage
 export { universalPostgresAdapter } from '../database/universal-postgres.js';
-export { vercelBlobStorage } from '../storage/vercel-blob.js';
+export { objectStorage } from '../storage/object-storage.js';
 // Server-only logger with request context
 export { createLogger, logger } from '../utils/logger-server.js';
 // Request context utilities (server-only - uses async_hooks)

package/dist/storage/_sigv4.d.ts

@@ -0,0 +1,76 @@
+/**
+ * AWS Signature Version 4 signer for the Cloudflare R2 (S3-compatible) API.
+ *
+ * Replaces the request signing that @aws-sdk/client-s3 used to do for us.
+ * Uses only node:crypto — no external dependencies, no regex.
+ *
+ * The core (`computeSigV4`) is verified byte-for-byte against the official AWS
+ * SigV4 test-suite `get-vanilla` vector in __tests__/_sigv4.test.ts.
+ *
+ * Server-only. Do NOT import from client-side code or edge runtime.
+ */
+/** Hex SHA-256 of the empty string — the payload hash for body-less requests. */
+export declare const EMPTY_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+/** Hex SHA-256 of arbitrary bytes (request payload hashing). */
+export declare function sha256Hex(data: string | Uint8Array): string;
+/**
+ * RFC 3986 percent-encoding per the AWS SigV4 spec. `encodeSlash` is false for
+ * path segments (slashes are separators) and true for query keys/values.
+ */
+export declare function awsUriEncode(input: string, encodeSlash: boolean): string;
+/** Inputs to the verified SigV4 core. All path/header values must be final. */
+export interface CanonicalInput {
+    method: string;
+    /** Already AWS-URI-encoded path (slashes preserved). */
+    canonicalPath: string;
+    /** Raw (unencoded) query pairs; encoded + sorted by the signer. */
+    query: [string, string][];
+    /** Exact header set to sign (any case; lowercased + trimmed internally). */
+    headersToSign: Record<string, string>;
+    payloadHash: string;
+    amzDate: string;
+    region: string;
+    service: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+}
+export interface SigV4Result {
+    signature: string;
+    signedHeaders: string;
+    scope: string;
+    canonicalQuery: string;
+}
+/**
+ * The verified SigV4 computation: canonical request → string-to-sign → signing
+ * key → signature. Verified against AWS's official `get-vanilla` test vector.
+ */
+export declare function computeSigV4(input: CanonicalInput): SigV4Result;
+/** Inputs for an R2/S3 request signature. */
+export interface SignS3Input {
+    method: 'GET' | 'PUT' | 'DELETE';
+    accountId: string;
+    bucket: string;
+    /** Object key; omit for bucket-level operations (e.g. ListObjectsV2). */
+    key?: string;
+    /** Query params; `undefined` values are dropped before signing. */
+    query?: Record<string, string | undefined>;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** Hex SHA-256 of the body, or EMPTY_SHA256 for body-less requests. */
+    payloadHash: string;
+    /** Extra headers to send + sign (content-type, cache-control, x-amz-meta-*). */
+    extraHeaders?: Record<string, string>;
+    now: Date;
+}
+export interface SignedS3Request {
+    url: string;
+    headers: Record<string, string>;
+}
+/**
+ * Build a signed R2 request: a path-style URL + AWS4-HMAC-SHA256 Authorization
+ * header. The `host` header is signed but not returned — fetch/undici sets it
+ * from the URL (same value), and `Host` is a forbidden header to set manually.
+ */
+export declare function signS3Request(input: SignS3Input): SignedS3Request;
+//# sourceMappingURL=_sigv4.d.ts.map

package/dist/storage/_sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_sigv4.d.ts","sourceRoot":"","sources":["../../src/storage/_sigv4.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,iFAAiF;AACjF,eAAO,MAAM,YAAY,qEAAqE,CAAC;AAE/F,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAE3D;AAQD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAaxE;AAQD,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,CAkC/D;AAED,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,CAmDjE"}

package/dist/storage/_sigv4.js

@@ -0,0 +1,134 @@
+/**
+ * AWS Signature Version 4 signer for the Cloudflare R2 (S3-compatible) API.
+ *
+ * Replaces the request signing that @aws-sdk/client-s3 used to do for us.
+ * Uses only node:crypto — no external dependencies, no regex.
+ *
+ * The core (`computeSigV4`) is verified byte-for-byte against the official AWS
+ * SigV4 test-suite `get-vanilla` vector in __tests__/_sigv4.test.ts.
+ *
+ * Server-only. Do NOT import from client-side code or edge runtime.
+ */
+import { createHash, createHmac } from 'node:crypto';
+const ALGORITHM = 'AWS4-HMAC-SHA256';
+const S3_SERVICE = 's3';
+/** Hex SHA-256 of the empty string — the payload hash for body-less requests. */
+export const EMPTY_SHA256 = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855';
+/** Hex SHA-256 of arbitrary bytes (request payload hashing). */
+export function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+function hmac(key, data) {
+    return createHmac('sha256', key).update(data, 'utf8').digest();
+}
+const UNRESERVED = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~';
+/**
+ * RFC 3986 percent-encoding per the AWS SigV4 spec. `encodeSlash` is false for
+ * path segments (slashes are separators) and true for query keys/values.
+ */
+export function awsUriEncode(input, encodeSlash) {
+    let out = '';
+    for (const byte of new TextEncoder().encode(input)) {
+        const ch = String.fromCharCode(byte);
+        if (UNRESERVED.includes(ch)) {
+            out += ch;
+        }
+        else if (ch === '/' && !encodeSlash) {
+            out += '/';
+        }
+        else {
+            out += `%${byte.toString(16).toUpperCase().padStart(2, '0')}`;
+        }
+    }
+    return out;
+}
+function toAmzDate(now) {
+    const iso = now.toISOString(); // e.g. 2026-05-18T10:00:00.000Z
+    const amzDate = `${iso.slice(0, 4)}${iso.slice(5, 7)}${iso.slice(8, 10)}T${iso.slice(11, 13)}${iso.slice(14, 16)}${iso.slice(17, 19)}Z`;
+    return { amzDate, dateStamp: amzDate.slice(0, 8) };
+}
+/**
+ * The verified SigV4 computation: canonical request → string-to-sign → signing
+ * key → signature. Verified against AWS's official `get-vanilla` test vector.
+ */
+export function computeSigV4(input) {
+    const lowered = new Map();
+    for (const [name, value] of Object.entries(input.headersToSign)) {
+        lowered.set(name.toLowerCase(), value.trim());
+    }
+    const names = [...lowered.keys()].sort();
+    const canonicalHeaders = names.map((n) => `${n}:${lowered.get(n)}\n`).join('');
+    const signedHeaders = names.join(';');
+    const canonicalQuery = [...input.query]
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .map(([k, v]) => `${awsUriEncode(k, true)}=${awsUriEncode(v, true)}`)
+        .join('&');
+    const canonicalRequest = [
+        input.method,
+        input.canonicalPath,
+        canonicalQuery,
+        canonicalHeaders,
+        signedHeaders,
+        input.payloadHash,
+    ].join('\n');
+    const dateStamp = input.amzDate.slice(0, 8);
+    const scope = `${dateStamp}/${input.region}/${input.service}/aws4_request`;
+    const stringToSign = [ALGORITHM, input.amzDate, scope, sha256Hex(canonicalRequest)].join('\n');
+    const kDate = hmac(`AWS4${input.secretAccessKey}`, dateStamp);
+    const kRegion = hmac(kDate, input.region);
+    const kService = hmac(kRegion, input.service);
+    const kSigning = hmac(kService, 'aws4_request');
+    const signature = createHmac('sha256', kSigning).update(stringToSign, 'utf8').digest('hex');
+    return { signature, signedHeaders, scope, canonicalQuery };
+}
+/**
+ * Build a signed R2 request: a path-style URL + AWS4-HMAC-SHA256 Authorization
+ * header. The `host` header is signed but not returned — fetch/undici sets it
+ * from the URL (same value), and `Host` is a forbidden header to set manually.
+ */
+export function signS3Request(input) {
+    const host = `${input.accountId}.r2.cloudflarestorage.com`;
+    const { amzDate } = toAmzDate(input.now);
+    const encodedKey = (input.key ?? '')
+        .split('/')
+        .map((segment) => awsUriEncode(segment, false))
+        .join('/');
+    const canonicalPath = input.key !== undefined
+        ? `/${awsUriEncode(input.bucket, false)}/${encodedKey}`
+        : `/${awsUriEncode(input.bucket, false)}`;
+    const query = [];
+    for (const [k, v] of Object.entries(input.query ?? {})) {
+        if (v !== undefined)
+            query.push([k, v]);
+    }
+    const headersToSign = {
+        host,
+        'x-amz-date': amzDate,
+        'x-amz-content-sha256': input.payloadHash,
+    };
+    for (const [k, v] of Object.entries(input.extraHeaders ?? {})) {
+        headersToSign[k.toLowerCase()] = v;
+    }
+    const { signature, signedHeaders, scope, canonicalQuery } = computeSigV4({
+        method: input.method,
+        canonicalPath,
+        query,
+        headersToSign,
+        payloadHash: input.payloadHash,
+        amzDate,
+        region: input.region,
+        service: S3_SERVICE,
+        accessKeyId: input.accessKeyId,
+        secretAccessKey: input.secretAccessKey,
+    });
+    const headers = {
+        'x-amz-date': amzDate,
+        'x-amz-content-sha256': input.payloadHash,
+        authorization: `${ALGORITHM} Credential=${input.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
+    };
+    for (const [k, v] of Object.entries(input.extraHeaders ?? {})) {
+        headers[k.toLowerCase()] = v;
+    }
+    const url = `https://${host}${canonicalPath}${canonicalQuery ? `?${canonicalQuery}` : ''}`;
+    return { url, headers };
+}

package/dist/storage/_xml.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Minimal, dependency-free readers for the two S3/R2 XML responses we consume:
+ * ListObjectsV2 results and `<Error>` bodies. Replaces the XML codec that
+ * @aws-sdk/client-s3 used to run for us.
+ *
+ * No regex (M2): a tag's text can never contain a raw `<` (XML escapes it to
+ * `&lt;`), so `indexOf`-based tag scanning is unambiguous.
+ */
+export interface ListedObject {
+    key: string;
+    size: number;
+    lastModified: Date;
+}
+export interface ParsedList {
+    objects: ListedObject[];
+    isTruncated: boolean;
+    nextContinuationToken?: string;
+}
+/** Parse an S3 ListObjectsV2 XML response into the fields the R2 provider needs. */
+export declare function parseListObjectsV2(xml: string): ParsedList;
+/** Extract `<Code>`/`<Message>` from an S3 `<Error>` response for diagnostics. */
+export declare function s3ErrorFields(xml: string): {
+    code?: string;
+    message?: string;
+};
+//# sourceMappingURL=_xml.d.ts.map

package/dist/storage/_xml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_xml.d.ts","sourceRoot":"","sources":["../../src/storage/_xml.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA6BH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CA6B1D;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAK9E"}

package/dist/storage/_xml.js

@@ -0,0 +1,75 @@
+/**
+ * Minimal, dependency-free readers for the two S3/R2 XML responses we consume:
+ * ListObjectsV2 results and `<Error>` bodies. Replaces the XML codec that
+ * @aws-sdk/client-s3 used to run for us.
+ *
+ * No regex (M2): a tag's text can never contain a raw `<` (XML escapes it to
+ * `&lt;`), so `indexOf`-based tag scanning is unambiguous.
+ */
+/** First `<tag>…</tag>` text content at or after `from`, or undefined. */
+function firstTagValue(xml, tag, from = 0) {
+    const open = `<${tag}>`;
+    const start = xml.indexOf(open, from);
+    if (start === -1)
+        return undefined;
+    const contentStart = start + open.length;
+    const end = xml.indexOf(`</${tag}>`, contentStart);
+    if (end === -1)
+        return undefined;
+    return xml.slice(contentStart, end);
+}
+/** Decode the five predefined XML entities (no regex). `&amp;` is decoded last. */
+function decodeXmlEntities(value) {
+    if (!value.includes('&'))
+        return value;
+    return value
+        .split('&lt;')
+        .join('<')
+        .split('&gt;')
+        .join('>')
+        .split('&quot;')
+        .join('"')
+        .split('&apos;')
+        .join("'")
+        .split('&amp;')
+        .join('&');
+}
+/** Parse an S3 ListObjectsV2 XML response into the fields the R2 provider needs. */
+export function parseListObjectsV2(xml) {
+    const objects = [];
+    const contentsOpen = '<Contents>';
+    const contentsClose = '</Contents>';
+    let cursor = 0;
+    for (;;) {
+        const start = xml.indexOf(contentsOpen, cursor);
+        if (start === -1)
+            break;
+        const end = xml.indexOf(contentsClose, start);
+        if (end === -1)
+            break;
+        const block = xml.slice(start + contentsOpen.length, end);
+        const key = firstTagValue(block, 'Key');
+        if (key !== undefined) {
+            const lastModified = firstTagValue(block, 'LastModified');
+            objects.push({
+                key: decodeXmlEntities(key),
+                size: Number(firstTagValue(block, 'Size') ?? '0') || 0,
+                lastModified: lastModified ? new Date(lastModified) : new Date(0),
+            });
+        }
+        cursor = end + contentsClose.length;
+    }
+    const token = firstTagValue(xml, 'NextContinuationToken');
+    return {
+        objects,
+        isTruncated: firstTagValue(xml, 'IsTruncated') === 'true',
+        nextContinuationToken: token !== undefined ? decodeXmlEntities(token) : undefined,
+    };
+}
+/** Extract `<Code>`/`<Message>` from an S3 `<Error>` response for diagnostics. */
+export function s3ErrorFields(xml) {
+    return {
+        code: firstTagValue(xml, 'Code'),
+        message: firstTagValue(xml, 'Message'),
+    };
+}

package/dist/storage/index.d.ts

@@ -1,18 +1,19 @@
 import type { StorageConfig, StorageProvider } from './types.js';
 export { createMockProvider } from './mock.js';
+export type { ObjectStorageConfig } from './object-storage.js';
+export { objectStorage } from './object-storage.js';
 export { createR2Provider } from './r2.js';
 export type { ListItem, ListOptions, ListResult, PutOptions, PutResult, R2Config, StorageConfig, StorageProvider, VercelBlobConfig, } from './types.js';
-export { vercelBlobStorage } from './vercel-blob.js';
+export { createVercelBlobProvider } from './vercel-blob-provider.js';
 /**
  * Construct a StorageProvider from a tagged config.
  *
  * Per `feedback_pluggable_provider_pattern`: explicit "no-X" opt-in — unknown
- * or unsupported tags throw with a clear message; no silent fallback.
+ * tags throw with a clear message; no silent fallback.
  *
- * Supported tags in Phase 2a: 'r2', 'mock'. The 'vercel-blob' tag is reserved
- * for Phase 2b (StorageProvider impl over @vercel/blob); during the migration
- * window, consumers needing Vercel Blob should use the legacy `vercelBlobStorage`
- * Payload plugin via `revealui.config.ts`.
+ * Supported tags: 'r2' (canonical), 'vercel-blob' (legacy migration-window
+ * fallback), and 'mock' (tests). The provider-agnostic `objectStorage` Payload
+ * plugin (object-storage.ts) adapts any of these to apps/admin's upload path.
  */
 export declare function createStorage(config: StorageConfig): StorageProvider;
 //# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAK/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAqBpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAK/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAgBpE"}

package/dist/storage/index.js

@@ -2,43 +2,45 @@
 // GAP-208 — introduced 2026-05-18 alongside Vercel Blob → Cloudflare R2 swap.
 //
 // Phase 1 (#959): types.ts + index.ts type re-exports.
-// Phase 2a (this PR): r2 + mock providers + createStorage factory.
+// Phase 2a (#959 follow-up): r2 + mock providers + createStorage factory.
+// Phase 2b (this PR): vercel-blob StorageProvider + apps/server media-route
+//   cutover. R2 is canonical; Vercel Blob is the migration-window fallback.
 import { createMockProvider } from './mock.js';
 import { createR2Provider } from './r2.js';
+import { createVercelBlobProvider } from './vercel-blob-provider.js';
 export { createMockProvider } from './mock.js';
+// Provider-agnostic Payload-style upload plugin — adapts any StorageProvider
+// (R2 canonical, Vercel Blob fallback, mock) to the engine's collection upload
+// adapter. Used by apps/admin/revealui.config.ts. GAP-208 Phase 4 replaced the
+// provider-specific `vercelBlobStorage` plugin with this.
+export { objectStorage } from './object-storage.js';
 // Provider factories — exported so callers can construct a provider directly
 // when they already know which one they want (skipping the discriminated-union
 // factory below).
 export { createR2Provider } from './r2.js';
-// Legacy Payload-style plugin — kept during GAP-208 migration so existing
-// `apps/admin/revealui.config.ts` keeps working. Dropped in Phase 4 cleanup.
-export { vercelBlobStorage } from './vercel-blob.js';
+export { createVercelBlobProvider } from './vercel-blob-provider.js';
 /**
  * Construct a StorageProvider from a tagged config.
  *
  * Per `feedback_pluggable_provider_pattern`: explicit "no-X" opt-in — unknown
- * or unsupported tags throw with a clear message; no silent fallback.
+ * tags throw with a clear message; no silent fallback.
  *
- * Supported tags in Phase 2a: 'r2', 'mock'. The 'vercel-blob' tag is reserved
- * for Phase 2b (StorageProvider impl over @vercel/blob); during the migration
- * window, consumers needing Vercel Blob should use the legacy `vercelBlobStorage`
- * Payload plugin via `revealui.config.ts`.
+ * Supported tags: 'r2' (canonical), 'vercel-blob' (legacy migration-window
+ * fallback), and 'mock' (tests). The provider-agnostic `objectStorage` Payload
+ * plugin (object-storage.ts) adapts any of these to apps/admin's upload path.
  */
 export function createStorage(config) {
     switch (config.provider) {
         case 'r2':
             return createR2Provider(config.r2);
+        case 'vercel-blob':
+            return createVercelBlobProvider(config.vercelBlob);
         case 'mock':
             return createMockProvider();
-        case 'vercel-blob':
-            throw new Error("createStorage: provider 'vercel-blob' is not yet implemented as a " +
-                'StorageProvider (lands in GAP-208 Phase 2b). For the migration ' +
-                'window, use the legacy `vercelBlobStorage` Payload plugin in ' +
-                "revealui.config.ts, or switch to provider: 'r2'.");
         default: {
             const _exhaustive = config;
             throw new Error(`createStorage: unknown provider tag. Got ${JSON.stringify(_exhaustive)}. ` +
-                "Valid tags: 'r2', 'mock', 'vercel-blob' (Phase 2b).");
+                "Valid tags: 'r2', 'vercel-blob', 'mock'.");
         }
     }
 }

package/dist/storage/object-storage.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Object-storage upload plugin (provider-agnostic).
+ *
+ * Adapts any `StorageProvider` (Cloudflare R2 — canonical — Vercel Blob, mock,
+ * or a future backend) to the RevealUI engine's collection upload-adapter
+ * interface, so `apps/admin/revealui.config.ts` stores media through the
+ * configured object-storage backend. Replaces the provider-specific
+ * `vercelBlobStorage` Payload plugin retired in GAP-208 Phase 4.
+ *
+ * The backend is resolved through a lazy `resolveProvider` thunk — invoked
+ * (and memoized) on the first upload/delete, never at config-build time — so a
+ * consumer reading validated config (e.g. `@revealui/config`'s `config.storage`)
+ * does NOT force env validation when the admin config module is imported during
+ * `next build`, tests, or boot. This mirrors `apps/server` `getMediaStorage()`,
+ * which reads `config.storage` lazily per request.
+ *
+ * WARNING: This module is server-only.
+ * Do NOT import in client-side code or edge runtime.
+ */
+import type { Plugin } from '../types/index.js';
+import type { StorageProvider } from './types.js';
+export interface ObjectStorageConfig {
+    /** When `false`, the plugin is a no-op (no upload config applied). Defaults to enabled. */
+    enabled?: boolean;
+    /** Map of collection slug → whether to attach upload handling. */
+    collections?: {
+        [key: string]: boolean;
+    };
+    /**
+     * Lazily resolves the backend the upload adapter writes through. Called once
+     * (memoized) on the first upload/delete — never at config build — so reading
+     * validated config (e.g. `@revealui/config`'s `config.storage`) does not force
+     * env validation at module load. Should throw a clear, actionable error when
+     * no backend is configured (fail-fast; never silently no-op an upload).
+     */
+    resolveProvider: () => StorageProvider;
+    /** Key prefix for stored objects. Defaults to `'uploads'`. */
+    prefix?: string;
+}
+export declare function objectStorage(config: ObjectStorageConfig): Plugin;
+//# sourceMappingURL=object-storage.d.ts.map

package/dist/storage/object-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-storage.d.ts","sourceRoot":"","sources":["../../src/storage/object-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kEAAkE;IAClE,WAAW,CAAC,EAAE;QACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,eAAe,CAAC;IACvC,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAiGjE"}

package/dist/storage/{vercel-blob.js → object-storage.js}

@@ -1,13 +1,35 @@
 /**
- * Vercel Blob Storage Plugin
+ * Object-storage upload plugin (provider-agnostic).
+ *
+ * Adapts any `StorageProvider` (Cloudflare R2 — canonical — Vercel Blob, mock,
+ * or a future backend) to the RevealUI engine's collection upload-adapter
+ * interface, so `apps/admin/revealui.config.ts` stores media through the
+ * configured object-storage backend. Replaces the provider-specific
+ * `vercelBlobStorage` Payload plugin retired in GAP-208 Phase 4.
+ *
+ * The backend is resolved through a lazy `resolveProvider` thunk — invoked
+ * (and memoized) on the first upload/delete, never at config-build time — so a
+ * consumer reading validated config (e.g. `@revealui/config`'s `config.storage`)
+ * does NOT force env validation when the admin config module is imported during
+ * `next build`, tests, or boot. This mirrors `apps/server` `getMediaStorage()`,
+ * which reads `config.storage` lazily per request.
  *
  * WARNING: This module is server-only.
  * Do NOT import in client-side code or edge runtime.
  */
-import { del, put } from '@vercel/blob';
 import { defaultLogger } from '../instance/logger.js';
-export function vercelBlobStorage(config) {
+export function objectStorage(config) {
     const prefix = config.prefix || 'uploads';
+    // Memoize the provider so the underlying client (S3 / Blob) is constructed
+    // once per process, not per upload — and so config is read lazily, on first
+    // use, rather than at config-build time.
+    let cachedProvider;
+    const getProvider = () => {
+        if (!cachedProvider) {
+            cachedProvider = config.resolveProvider();
+        }
+        return cachedProvider;
+    };
     return (incomingConfig) => {
         if (config.enabled === false) {
             return incomingConfig;
@@ -26,25 +48,21 @@ export function vercelBlobStorage(config) {
                         crop: true,
                         adapters: [
                             {
-                                name: 'vercel-blob',
+                                name: 'object-storage',
                                 adapter: {
-                                    name: 'vercel-blob',
+                                    name: 'object-storage',
                                     generateURL: (file) => {
                                         return `${prefix}/${file.filename}`;
                                     },
                                     upload: async (file) => {
                                         try {
-                                            const filePath = `${prefix}/${collection.slug}/${Date.now()}-${file.name}`;
-                                            if (!config.token) {
-                                                throw new Error('Vercel blob token is required but not configured');
-                                            }
-                                            const blob = await put(filePath, file.data, {
+                                            const key = `${prefix}/${collection.slug}/${Date.now()}-${file.name}`;
+                                            const result = await getProvider().put(key, file.data, {
                                                 access: 'public',
-                                                token: config.token,
-                                                addRandomSuffix: false,
+                                                contentType: file.mimetype,
                                             });
                                             return {
-                                                url: blob.url,
+                                                url: result.url,
                                                 filename: file.name,
                                                 filesize: file.size,
                                                 mimeType: file.mimetype,
@@ -53,20 +71,22 @@ export function vercelBlobStorage(config) {
                                             };
                                         }
                                         catch (error) {
-                                            defaultLogger.error('Vercel Blob upload error:', error);
+                                            defaultLogger.error('Object storage upload error:', error);
                                             throw error;
                                         }
                                     },
                                     delete: async (filename) => {
                                         try {
-                                            // Extract the blob URL from filename or construct it
-                                            const blobUrl = filename.startsWith('http')
+                                            // Payload may pass a full URL (preferred — providers extract
+                                            // the storage key from it) or a bare filename; mirror the
+                                            // legacy plugin's prefix-prepend for the bare-filename case.
+                                            const keyOrUrl = filename.startsWith('http')
                                                 ? filename
                                                 : `${prefix}/${filename}`;
-                                            await del(blobUrl);
+                                            await getProvider().del(keyOrUrl);
                                         }
                                         catch (error) {
-                                            defaultLogger.error('Vercel Blob delete error:', error);
+                                            defaultLogger.error('Object storage delete error:', error);
                                             throw error;
                                         }
                                     },

package/dist/storage/r2.d.ts

@@ -1,12 +1,24 @@
 /**
  * Cloudflare R2 implementation of StorageProvider.
  *
- * R2 is S3-compatible — uses @aws-sdk/client-s3 with a custom endpoint and
- * region='auto'. See https://developers.cloudflare.com/r2/api/s3/api/.
+ * R2 is S3-compatible. This is a native client: AWS SigV4 request signing
+ * (./_sigv4.ts, verified against AWS's official test vector) over global
+ * `fetch`, plus a small XML reader for ListObjectsV2 (./_xml.ts). No SDK
+ * dependency — only node:crypto + fetch.
+ *
+ * Path-style addressing is used for the S3 API calls
+ * (https://<account>.r2.cloudflarestorage.com/<bucket>/<key>); this has no
+ * effect on the public object URLs, which are built from `publicBaseUrl`.
  *
  * GAP-208 Phase 2a (2026-05-18). Phase 1 (interface + types) shipped in #959.
+ * Native client (dropping @aws-sdk/client-s3) landed 2026-06-09.
  *
  * Server-only. Do NOT import from client-side code or edge runtime.
+ *
+ * Known limitation (unchanged from the SDK version): request bodies are
+ * buffered fully in memory (see toUint8Array) so the payload can be hashed for
+ * SigV4. Streaming uploads (STREAMING-AWS4-HMAC-SHA256-PAYLOAD) are a future
+ * enhancement; presigned/private URLs remain Phase 2b.
  */
 import type { R2Config, StorageProvider } from './types.js';
 export declare function createR2Provider(config: R2Config): StorageProvider;

package/dist/storage/r2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/storage/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EAMV,QAAQ,EACR,eAAe,EAChB,MAAM,YAAY,CAAC;AAsHpB,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAElE"}
+{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/storage/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAMV,QAAQ,EACR,eAAe,EAChB,MAAM,YAAY,CAAC;AAkKpB,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAElE"}