@revealui/core 0.8.0 → 0.10.0

package/dist/storage/r2.js

@@ -1,21 +1,37 @@
 /**
  * Cloudflare R2 implementation of StorageProvider.
  *
- * R2 is S3-compatible — uses @aws-sdk/client-s3 with a custom endpoint and
- * region='auto'. See https://developers.cloudflare.com/r2/api/s3/api/.
+ * R2 is S3-compatible. This is a native client: AWS SigV4 request signing
+ * (./_sigv4.ts, verified against AWS's official test vector) over global
+ * `fetch`, plus a small XML reader for ListObjectsV2 (./_xml.ts). No SDK
+ * dependency — only node:crypto + fetch.
+ *
+ * Path-style addressing is used for the S3 API calls
+ * (https://<account>.r2.cloudflarestorage.com/<bucket>/<key>); this has no
+ * effect on the public object URLs, which are built from `publicBaseUrl`.
  *
  * GAP-208 Phase 2a (2026-05-18). Phase 1 (interface + types) shipped in #959.
+ * Native client (dropping @aws-sdk/client-s3) landed 2026-06-09.
  *
  * Server-only. Do NOT import from client-side code or edge runtime.
+ *
+ * Known limitation (unchanged from the SDK version): request bodies are
+ * buffered fully in memory (see toUint8Array) so the payload can be hashed for
+ * SigV4. Streaming uploads (STREAMING-AWS4-HMAC-SHA256-PAYLOAD) are a future
+ * enhancement; presigned/private URLs remain Phase 2b.
  */
-import { DeleteObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
 import { toUint8Array } from './_helpers.js';
+import { EMPTY_SHA256, sha256Hex, signS3Request } from './_sigv4.js';
+import { parseListObjectsV2, s3ErrorFields } from './_xml.js';
 const PROVIDER_TAG = 'r2';
 const DEFAULT_CONTENT_TYPE = 'application/octet-stream';
 const DEFAULT_LIST_LIMIT = 1000;
+const REGION = 'auto';
 class R2Provider {
     provider = PROVIDER_TAG;
-    client;
+    accountId;
+    accessKeyId;
+    secretAccessKey;
     bucket;
     publicBaseUrl;
     constructor(config) {
@@ -25,16 +41,11 @@ class R2Provider {
                 "custom domain (e.g. 'https://media.revealui.com') or the R2 dev URL " +
                 "('https://<account-id>.r2.cloudflarestorage.com/<bucket>').");
         }
+        this.accountId = config.accountId;
+        this.accessKeyId = config.accessKeyId;
+        this.secretAccessKey = config.secretAccessKey;
         this.bucket = config.bucket;
         this.publicBaseUrl = stripTrailingSlash(config.publicBaseUrl);
-        this.client = new S3Client({
-            region: 'auto',
-            endpoint: `https://${config.accountId}.r2.cloudflarestorage.com`,
-            credentials: {
-                accessKeyId: config.accessKeyId,
-                secretAccessKey: config.secretAccessKey,
-            },
-        });
     }
     async put(key, data, opts) {
         if (opts?.access === 'private') {
@@ -43,15 +54,40 @@ class R2Provider {
                 'lands in Phase 2b.');
         }
         const body = await toUint8Array(data);
-        await this.client.send(new PutObjectCommand({
-            Bucket: this.bucket,
-            Key: key,
-            Body: body,
-            ContentType: opts?.contentType ?? DEFAULT_CONTENT_TYPE,
-            ContentLength: body.byteLength,
-            CacheControl: opts?.cacheControl,
-            Metadata: opts?.metadata,
-        }));
+        const extraHeaders = {
+            'content-type': opts?.contentType ?? DEFAULT_CONTENT_TYPE,
+        };
+        if (opts?.cacheControl) {
+            extraHeaders['cache-control'] = opts.cacheControl;
+        }
+        for (const [name, value] of Object.entries(opts?.metadata ?? {})) {
+            extraHeaders[`x-amz-meta-${name.toLowerCase()}`] = value;
+        }
+        const { url, headers } = signS3Request({
+            method: 'PUT',
+            accountId: this.accountId,
+            bucket: this.bucket,
+            key,
+            region: REGION,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            payloadHash: sha256Hex(body),
+            extraHeaders,
+            now: new Date(),
+        });
+        // No manual content-length: it is a forbidden fetch header that undici
+        // computes from the body itself, and setting it throws UND_ERR_INVALID_ARG
+        // ("invalid content-length header") on the R2 PUT. `headers` already carries
+        // the signed set. `as BodyInit` bridges the TS lib's ArrayBufferLike vs
+        // ArrayBuffer typed-array variance for fetch bodies (cf. src/api/compression.ts).
+        const response = await fetch(url, {
+            method: 'PUT',
+            headers,
+            body: body,
+        });
+        if (!response.ok) {
+            throw await storageError('PUT', key, response);
+        }
         return {
             key,
             url: `${this.publicBaseUrl}/${key}`,
@@ -61,34 +97,56 @@ class R2Provider {
     }
     async del(keyOrUrl) {
         const key = this.extractKey(keyOrUrl);
-        await this.client.send(new DeleteObjectCommand({
-            Bucket: this.bucket,
-            Key: key,
-        }));
+        const { url, headers } = signS3Request({
+            method: 'DELETE',
+            accountId: this.accountId,
+            bucket: this.bucket,
+            key,
+            region: REGION,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            payloadHash: EMPTY_SHA256,
+            now: new Date(),
+        });
+        // Best-effort: a missing key is not an error. S3/R2 returns 204 regardless;
+        // tolerate 404 defensively.
+        const response = await fetch(url, { method: 'DELETE', headers });
+        if (!response.ok && response.status !== 404) {
+            throw await storageError('DELETE', key, response);
+        }
     }
     async list(opts) {
-        const response = await this.client.send(new ListObjectsV2Command({
-            Bucket: this.bucket,
-            Prefix: opts?.prefix,
-            MaxKeys: opts?.limit ?? DEFAULT_LIST_LIMIT,
-            ContinuationToken: opts?.cursor,
-        }));
-        const items = (response.Contents ?? []).flatMap((entry) => {
-            if (!entry.Key)
-                return [];
-            return [
-                {
-                    key: entry.Key,
-                    url: `${this.publicBaseUrl}/${entry.Key}`,
-                    size: entry.Size ?? 0,
-                    uploadedAt: entry.LastModified ?? new Date(0),
-                },
-            ];
+        const { url, headers } = signS3Request({
+            method: 'GET',
+            accountId: this.accountId,
+            bucket: this.bucket,
+            region: REGION,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            payloadHash: EMPTY_SHA256,
+            query: {
+                'list-type': '2',
+                prefix: opts?.prefix,
+                'max-keys': String(opts?.limit ?? DEFAULT_LIST_LIMIT),
+                'continuation-token': opts?.cursor,
+            },
+            now: new Date(),
         });
+        const response = await fetch(url, { method: 'GET', headers });
+        if (!response.ok) {
+            throw await storageError('LIST', this.bucket, response);
+        }
+        const parsed = parseListObjectsV2(await response.text());
+        const items = parsed.objects.map((entry) => ({
+            key: entry.key,
+            url: `${this.publicBaseUrl}/${entry.key}`,
+            size: entry.size,
+            uploadedAt: entry.lastModified,
+        }));
         return {
             items,
-            cursor: response.NextContinuationToken,
-            hasMore: response.IsTruncated === true,
+            cursor: parsed.nextContinuationToken,
+            hasMore: parsed.isTruncated,
         };
     }
     extractKey(keyOrUrl) {
@@ -104,6 +162,11 @@ export function createR2Provider(config) {
     return new R2Provider(config);
 }
 // ── helpers ────────────────────────────────────────────────────────────────
+async function storageError(operation, key, response) {
+    const body = await response.text().catch(() => '');
+    const { code, message } = s3ErrorFields(body);
+    return new Error(`R2 ${operation} failed for "${key}": ${code ?? response.status} ${message ?? response.statusText}`);
+}
 function tryParseUrl(value) {
     try {
         return new URL(value);

package/dist/storage/vercel-blob-provider.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Vercel Blob implementation of StorageProvider.
+ *
+ * Legacy backend retained during the GAP-208 Cloudflare R2 cutover so the
+ * media-upload path can fall back to Vercel Blob when R2 is not configured.
+ * Wraps @vercel/blob's put/del/list behind the provider-agnostic
+ * StorageProvider interface. Cloudflare R2 (r2.ts) is the canonical backend;
+ * this provider is removed once the Blob store is decommissioned.
+ *
+ * NOTE: distinct from vercel-blob.ts in this directory, which is the legacy
+ * Payload-style upload *plugin* still wired into apps/admin's
+ * revealui.config.ts. This file is the StorageProvider the createStorage
+ * factory returns for the 'vercel-blob' tag.
+ *
+ * Server-only. Do NOT import from client-side code or edge runtime.
+ */
+import type { ListOptions, ListResult, PutOptions, PutResult, StorageProvider, VercelBlobConfig } from './types.js';
+declare class VercelBlobProvider implements StorageProvider {
+    readonly provider = "vercel-blob";
+    private readonly token;
+    constructor(config: VercelBlobConfig);
+    put(key: string, data: Blob | ArrayBuffer | Uint8Array | ReadableStream<Uint8Array>, opts?: PutOptions): Promise<PutResult>;
+    del(keyOrUrl: string): Promise<void>;
+    list(opts?: ListOptions): Promise<ListResult>;
+}
+export declare function createVercelBlobProvider(config: VercelBlobConfig): StorageProvider;
+export type { VercelBlobProvider };
+//# sourceMappingURL=vercel-blob-provider.d.ts.map

package/dist/storage/vercel-blob-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-blob-provider.d.ts","sourceRoot":"","sources":["../../src/storage/vercel-blob-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAEV,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAKpB,cAAM,kBAAmB,YAAW,eAAe;IACjD,QAAQ,CAAC,QAAQ,iBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,MAAM,EAAE,gBAAgB;IAW9B,GAAG,CACP,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC;IAmCf,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;CAqBpD;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,GAAG,eAAe,CAElF;AAED,YAAY,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/storage/vercel-blob-provider.js

@@ -0,0 +1,88 @@
+/**
+ * Vercel Blob implementation of StorageProvider.
+ *
+ * Legacy backend retained during the GAP-208 Cloudflare R2 cutover so the
+ * media-upload path can fall back to Vercel Blob when R2 is not configured.
+ * Wraps @vercel/blob's put/del/list behind the provider-agnostic
+ * StorageProvider interface. Cloudflare R2 (r2.ts) is the canonical backend;
+ * this provider is removed once the Blob store is decommissioned.
+ *
+ * NOTE: distinct from vercel-blob.ts in this directory, which is the legacy
+ * Payload-style upload *plugin* still wired into apps/admin's
+ * revealui.config.ts. This file is the StorageProvider the createStorage
+ * factory returns for the 'vercel-blob' tag.
+ *
+ * Server-only. Do NOT import from client-side code or edge runtime.
+ */
+import { del, list, put } from '@vercel/blob';
+import { toUint8Array } from './_helpers.js';
+const PROVIDER_TAG = 'vercel-blob';
+const DEFAULT_LIST_LIMIT = 1000;
+class VercelBlobProvider {
+    provider = PROVIDER_TAG;
+    token;
+    constructor(config) {
+        if (!config.token) {
+            throw new Error('Vercel Blob provider requires VercelBlobConfig.token (the ' +
+                'BLOB_READ_WRITE_TOKEN value). For new deployments prefer Cloudflare ' +
+                'R2 (provider: "r2").');
+        }
+        this.token = config.token;
+    }
+    async put(key, data, opts) {
+        if (opts?.access === 'private') {
+            throw new Error("Vercel Blob provider does not support access: 'private' — every blob " +
+                'is publicly readable. Use Cloudflare R2 for private-access patterns.');
+        }
+        // Normalize to bytes so the result carries an accurate size regardless of
+        // input shape (ReadableStream has no length until consumed). Re-wrap in a
+        // fresh Uint8Array so the Blob part is backed by a non-shared ArrayBuffer,
+        // satisfying the DOM BlobPart type under TS strict typed-array generics.
+        const body = await toUint8Array(data);
+        const result = await put(key, new Blob([new Uint8Array(body)]), {
+            access: 'public',
+            token: this.token,
+            contentType: opts?.contentType,
+            // Keys are caller-controlled (callers pre-randomize, e.g. media/<uuid>.ext);
+            // never append a second random suffix or the returned URL won't match `key`.
+            addRandomSuffix: false,
+        });
+        // Vercel Blob has no per-object user-metadata or Cache-Control-header API
+        // (only cacheControlMaxAge); opts.metadata / opts.cacheControl are ignored
+        // by this legacy provider. R2 honors both.
+        return {
+            key,
+            url: result.url,
+            size: body.byteLength,
+            provider: PROVIDER_TAG,
+        };
+    }
+    async del(keyOrUrl) {
+        // Vercel's del is idempotent (deleting an absent blob is a no-op), so this
+        // satisfies the best-effort contract. It requires the full blob URL, which
+        // is what media records persist.
+        await del(keyOrUrl, { token: this.token });
+    }
+    async list(opts) {
+        const response = await list({
+            token: this.token,
+            prefix: opts?.prefix,
+            limit: opts?.limit ?? DEFAULT_LIST_LIMIT,
+            cursor: opts?.cursor,
+        });
+        const items = response.blobs.map((blob) => ({
+            key: blob.pathname,
+            url: blob.url,
+            size: blob.size,
+            uploadedAt: blob.uploadedAt,
+        }));
+        return {
+            items,
+            cursor: response.cursor,
+            hasMore: response.hasMore,
+        };
+    }
+}
+export function createVercelBlobProvider(config) {
+    return new VercelBlobProvider(config);
+}

package/package.json

@@ -1,45 +1,44 @@
 {
   "name": "@revealui/core",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "RevealUI's runtime engine — admin UI, REST API, auth, rich text, plugin system, and access control. The heart of the open-source platform.",
   "license": "MIT",
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1049.0",
-    "@electric-sql/pglite": "^0.4.5",
-    "@lexical/clipboard": "^0.44.0",
-    "@lexical/code": "^0.44.0",
-    "@lexical/html": "^0.44.0",
-    "@lexical/link": "^0.44.0",
-    "@lexical/list": "^0.44.0",
-    "@lexical/react": "^0.44.0",
-    "@lexical/rich-text": "^0.44.0",
-    "@lexical/selection": "^0.44.0",
-    "@lexical/table": "^0.44.0",
-    "@lexical/utils": "^0.44.0",
-    "@lexical/yjs": "^0.44.0",
+    "@electric-sql/pglite": "^0.5.1",
+    "@lexical/clipboard": "^0.45.0",
+    "@lexical/code": "^0.45.0",
+    "@lexical/html": "^0.45.0",
+    "@lexical/link": "^0.45.0",
+    "@lexical/list": "^0.45.0",
+    "@lexical/react": "^0.45.0",
+    "@lexical/rich-text": "^0.45.0",
+    "@lexical/selection": "^0.45.0",
+    "@lexical/table": "^0.45.0",
+    "@lexical/utils": "^0.45.0",
+    "@lexical/yjs": "^0.45.0",
     "@vercel/blob": "^2.3.3",
     "bcryptjs": "^3.0.3",
     "dataloader": "^2.2.3",
-    "jose": "^6.2.3",
-    "lexical": "^0.44.0",
+    "jose": "^5.10.0",
+    "lexical": "^0.45.0",
     "pg": "^8.21.0",
-    "yjs": "^13.6.30",
+    "yjs": "^13.6.31",
     "zod": "^4.4.3",
-    "@revealui/cache": "0.2.1",
-    "@revealui/contracts": "0.6.0",
+    "@revealui/cache": "0.2.2",
+    "@revealui/contracts": "0.6.1",
     "@revealui/resilience": "0.2.4",
-    "@revealui/security": "0.4.0",
+    "@revealui/security": "0.4.1",
     "@revealui/utils": "0.3.5"
   },
   "devDependencies": {
     "@types/json-schema": "^7.0.15",
     "@types/pg": "^8.20.0",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@vitest/coverage-v8": "^4.1.5",
+    "@vitest/coverage-v8": "^4.1.8",
     "expect-type": "^1.3.0",
     "tsup": "^8.5.1",
-    "vitest": "^4.1.5",
+    "vitest": "^4.1.8",
     "@revealui/dev": "0.1.0"
   },
   "engines": {

package/dist/storage/vercel-blob.d.ts

@@ -1,17 +0,0 @@
-/**
- * Vercel Blob Storage Plugin
- *
- * WARNING: This module is server-only.
- * Do NOT import in client-side code or edge runtime.
- */
-import type { Plugin } from '../types/index.js';
-export interface VercelBlobStorageConfig {
-    enabled?: boolean;
-    collections?: {
-        [key: string]: boolean;
-    };
-    token?: string;
-    prefix?: string;
-}
-export declare function vercelBlobStorage(config: VercelBlobStorageConfig): Plugin;
-//# sourceMappingURL=vercel-blob.d.ts.map

package/dist/storage/vercel-blob.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"vercel-blob.d.ts","sourceRoot":"","sources":["../../src/storage/vercel-blob.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE;QACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAyFzE"}