@revealui/core 0.8.0 → 0.9.0

package/README.md

@@ -19,7 +19,7 @@ Part of the [RevealUI monorepo](https://github.com/RevealUIStudio/revealui)  -
 - **Plugins**  -  Extensible plugin system (form builder, nested docs, redirects)
 - **Feature Gating**  -  Tier-based licensing (free, pro, max, enterprise) with JWT license keys
 - **Database**  -  PostgreSQL adapters (NeonDB + PGlite for testing), connection pooling, SSL/TLS
-- **Storage**  -  Pluggable storage interface (Vercel Blob adapter included)
+- **Storage**  -  Pluggable storage interface (Cloudflare R2 primary; Vercel Blob legacy adapter retained during migration)
 
 ## Installation
 
@@ -113,27 +113,71 @@ if (isFeatureEnabled('ai')) {
 
 | Subpath | Purpose |
 |---------|---------|
-| `@revealui/core` | Main entry (RevealUI instance) |
+| `@revealui/core` | Main entry |
 | `@revealui/core/server` | Server-side CRUD API |
 | `@revealui/core/client` | Client-side React hooks and utilities |
-| `@revealui/core/config` | Configuration builder |
+| `@revealui/core/client/ui` | Client UI components |
+| `@revealui/core/client/admin` | Client admin components |
+| `@revealui/core/client/richtext` | Client rich text editor |
+| `@revealui/core/config` | Configuration builder (`buildConfig`) |
 | `@revealui/core/admin` | Admin dashboard components |
+| `@revealui/core/admin/utils/serializeConfig` | Config serialization util |
+| `@revealui/core/admin/utils/apiClient` | Admin API client |
+| `@revealui/core/admin/i18n/en` | English i18n strings |
 | `@revealui/core/richtext` | Rich text server utilities |
 | `@revealui/core/richtext/client` | Lexical editor React components |
+| `@revealui/core/richtext/react` | Rich text React exports |
 | `@revealui/core/richtext/html` | HTML serialization |
 | `@revealui/core/richtext/rsc` | React Server Component support |
+| `@revealui/core/richtext/lexical` | Raw Lexical exports |
 | `@revealui/core/security` | Security infrastructure |
 | `@revealui/core/auth` | Auth utilities |
 | `@revealui/core/database` | Database adapters |
-| `@revealui/core/storage` | Storage adapters |
+| `@revealui/core/database/ssl-config` | SSL/TLS config |
+| `@revealui/core/database/type-adapter` | Type adapter utilities |
+| `@revealui/core/storage` | Storage adapters (R2 + legacy Vercel Blob) |
 | `@revealui/core/plugins` | Plugin system |
 | `@revealui/core/features` | Feature flags |
 | `@revealui/core/license` | License validation |
+| `@revealui/core/license-encryption` | License encryption |
+| `@revealui/core/revforge-license` | RevForge license validation |
 | `@revealui/core/monitoring` | Health monitoring |
+| `@revealui/core/monitoring/process-registry` | Process registry |
+| `@revealui/core/monitoring/query-monitor` | Query monitor |
+| `@revealui/core/observability` | Observability root |
 | `@revealui/core/observability/logger` | Structured logging |
+| `@revealui/core/observability/metrics` | Metrics |
+| `@revealui/core/observability/alerts` | Alerts |
+| `@revealui/core/error-handling` | Error boundaries, retry, circuit breaker, fallback UI |
+| `@revealui/core/error-handling/error-reporter` | Error reporting |
+| `@revealui/core/caching` | Caching utilities |
+| `@revealui/core/cache/query-cache` | Query cache |
+| `@revealui/core/jobs` | Background jobs |
+| `@revealui/core/translations` | i18n translations |
+| `@revealui/core/ui` | UI component exports |
 | `@revealui/core/types` | TypeScript type definitions |
+| `@revealui/core/types/core` | Core types |
+| `@revealui/core/types/schema` | Schema types |
+| `@revealui/core/types/generated` | Generated types |
+| `@revealui/core/types/admin` | Admin types |
+| `@revealui/core/types/frontend` | Frontend types |
+| `@revealui/core/generated` | Generated code |
 | `@revealui/core/nextjs` | Next.js integration middleware |
-| `@revealui/core/utils/*` | Utilities (cache, deep-clone, errors) |
+| `@revealui/core/nextjs/withRevealUI` | Next.js config wrapper |
+| `@revealui/core/api/rest` | REST API handler |
+| `@revealui/core/api/compression` | Response compression |
+| `@revealui/core/api/payload-optimization` | Payload optimization |
+| `@revealui/core/api/rate-limit` | API rate limiting |
+| `@revealui/core/api/response-cache` | Response cache |
+| `@revealui/core/optimization/code-splitting` | Code splitting helpers |
+| `@revealui/core/utils/logger` | Logger utility |
+| `@revealui/core/utils/logger/client` | Client-side logger |
+| `@revealui/core/utils/logger/server` | Server-side logger |
+| `@revealui/core/utils/cache` | Cache utility |
+| `@revealui/core/utils/deep-clone` | Deep clone utility |
+| `@revealui/core/utils/errors` | Error utilities |
+| `@revealui/core/utils/error-responses` | Error response helpers |
+| `@revealui/core/utils/request-context` | Request context |
 
 ## Development
 

package/dist/collections/operations/sqlAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlAdapter.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/sqlAdapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACvE,CAAC;AA6BF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAM/C;AAkBD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAMvD;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAIpF;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,MAAM,CAER;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAKjF;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAI1E;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAKrF"}
+{"version":3,"file":"sqlAdapter.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/sqlAdapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACvE,CAAC;AA6BF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAM/C;AAkBD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAMvD;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAIpF;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,MAAM,CAER;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAKjF;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAI1E;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAKrF"}

package/dist/collections/operations/sqlAdapter.js

@@ -83,7 +83,13 @@ export function insertDocumentQuery(configSlug, columns) {
     return `INSERT INTO ${collectionTable(configSlug)} (id, ${escapedColumns}) VALUES ($1, ${placeholders})`;
 }
 export function selectJsonByIdQuery(configSlug) {
-    return `SELECT _json FROM ${collectionTable(configSlug)} WHERE id = $1 LIMIT 1`;
+    // `id` MUST be in the projection. Query results pass through
+    // safeParseRevealDocuments, which drops any row lacking an `id`. A bare
+    // `SELECT _json` row has no `id`, so it gets filtered to empty — making
+    // update() wrongly throw "Document not found" for every JSON-field
+    // collection. Keep `_json` first so existing `sql.includes('SELECT _json')`
+    // matchers still recognize this query.
+    return `SELECT _json, id FROM ${collectionTable(configSlug)} WHERE id = $1 LIMIT 1`;
 }
 export function checkExistsByIdQuery(configSlug) {
     return `SELECT id FROM ${collectionTable(configSlug)} WHERE id = $1 LIMIT 1`;

package/dist/index.d.ts

@@ -27,7 +27,7 @@ export { nestedDocsPlugin } from './plugins/nested-docs.js';
 export { redirectsPlugin } from './plugins/redirects.js';
 export { afterChangeTraverseFields, afterReadTraverseFields, beforeChangeTraverseFields, beforeValidateTraverseFields, buildWhereClause, checkDependencies, createRevealUIInstance, defaultLogger, extractWhereValues, flattenResult, getRelationshipFields, Logger, RevealUICollection, RevealUIGlobal, type RevealUILogger, type RichTextAdapter, relationshipPopulationPromise, validateRelationshipMetadata, withNullableJSONSchemaType, } from './revealui.js';
 export { BoldFeature, FixedToolbarFeature, HeadingFeature, ItalicFeature, LinkFeature, lexicalEditor, TreeViewFeature, UnderlineFeature, } from './richtext/index.js';
-export { vercelBlobStorage } from './storage/vercel-blob.js';
+export { objectStorage } from './storage/object-storage.js';
 export { LRUCache, type LRUCacheOptions } from './utils/cache.js';
 export { deepClone } from './utils/deep-clone.js';
 export { createApplicationErrorResponseData, createErrorResponseData, createSuccessResponseData, createValidationErrorResponseData, type ErrorResponseData, } from './utils/error-responses.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzD,YAAY,EACV,0BAA0B,EAC1B,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,gBAAgB,EAChB,YAAY,EAEZ,cAAc,EACd,QAAQ,EACR,YAAY,EAEZ,SAAS,EACT,cAAc,EACd,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,SAAS,EACT,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,yBAAyB,EACzB,UAAU,EACV,QAAQ,EAER,oBAAoB,EACpB,eAAe,EAEf,aAAa,EAEb,WAAW,EACX,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,YAAY,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,YAAY,EACjB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAEL,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,4BAA4B,EAE5B,gBAAgB,EAEhB,iBAAiB,EAEjB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,aAAa,EAEb,qBAAqB,EAErB,MAAM,EAEN,kBAAkB,EAClB,cAAc,EACd,KAAK,cAAc,EAEnB,KAAK,eAAe,EACpB,6BAA6B,EAC7B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,yBAAyB,EACzB,iCAAiC,EACjC,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,MAAM,GACP,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAQlF,OAAO,EACL,KAAK,UAAU,EAEf,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAE3B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,MAAM,EAEX,qBAAqB,EAErB,gBAAgB,EAChB,WAAW,EACX,YAAY,EAEZ,KAAK,KAAK,EACV,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAGtB,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,qBAAqB,EAErB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,WAAW,EAEX,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,YAAY,EAEZ,uBAAuB,EACvB,mBAAmB,EACnB,MAAM,EACN,kBAAkB,EAClB,KAAK,KAAK,GACX,MAAM,2BAA2B,CAAC;AAOnC,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAElB,KAAK,EACL,WAAW,EACX,aAAa,EACb,eAAe,EAEf,cAAc,EACd,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,UAAU,EAEV,MAAM,EACN,aAAa,EACb,YAAY,EACZ,cAAc,EAEd,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAEhB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EAEnB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EAEjB,cAAc,EACd,qBAAqB,EAErB,aAAa,EACb,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EAExB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EAExB,mBAAmB,EAEnB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EAEnB,UAAU,EACV,WAAW,EACX,WAAW,EACX,cAAc,EAEd,eAAe,EACf,UAAU,EACV,cAAc,EACd,UAAU,EACV,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAEV,MAAM,EAEN,UAAU,EACV,UAAU,EACV,sBAAsB,EAEtB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAEhB,eAAe,EAEf,qBAAqB,EACrB,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,iBAAiB,IAAI,uBAAuB,EAC5C,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EAEX,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EAEpB,aAAa,EACb,kBAAkB,EAElB,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,UAAU,EACV,aAAa,EACb,SAAS,EAET,mBAAmB,EACnB,YAAY,EAEZ,gBAAgB,EAChB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAK1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACzD,YAAY,EACV,0BAA0B,EAC1B,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,gBAAgB,EAChB,YAAY,EAEZ,cAAc,EACd,QAAQ,EACR,YAAY,EAEZ,SAAS,EACT,cAAc,EACd,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,SAAS,EACT,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,yBAAyB,EACzB,UAAU,EACV,QAAQ,EAER,oBAAoB,EACpB,eAAe,EAEf,aAAa,EAEb,WAAW,EACX,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,YAAY,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,YAAY,EACjB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAEL,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,4BAA4B,EAE5B,gBAAgB,EAEhB,iBAAiB,EAEjB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,aAAa,EAEb,qBAAqB,EAErB,MAAM,EAEN,kBAAkB,EAClB,cAAc,EACd,KAAK,cAAc,EAEnB,KAAK,eAAe,EACpB,6BAA6B,EAC7B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,yBAAyB,EACzB,iCAAiC,EACjC,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,MAAM,GACP,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAQlF,OAAO,EACL,KAAK,UAAU,EAEf,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAE3B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,MAAM,EAEX,qBAAqB,EAErB,gBAAgB,EAChB,WAAW,EACX,YAAY,EAEZ,KAAK,KAAK,EACV,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAGtB,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,qBAAqB,EAErB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,WAAW,EAEX,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,YAAY,EAEZ,uBAAuB,EACvB,mBAAmB,EACnB,MAAM,EACN,kBAAkB,EAClB,KAAK,KAAK,GACX,MAAM,2BAA2B,CAAC;AAOnC,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAElB,KAAK,EACL,WAAW,EACX,aAAa,EACb,eAAe,EAEf,cAAc,EACd,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,UAAU,EAEV,MAAM,EACN,aAAa,EACb,YAAY,EACZ,cAAc,EAEd,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAEhB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EAEnB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EAEjB,cAAc,EACd,qBAAqB,EAErB,aAAa,EACb,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EAExB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EAExB,mBAAmB,EAEnB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EAEnB,UAAU,EACV,WAAW,EACX,WAAW,EACX,cAAc,EAEd,eAAe,EACf,UAAU,EACV,cAAc,EACd,UAAU,EACV,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAEV,MAAM,EAEN,UAAU,EACV,UAAU,EACV,sBAAsB,EAEtB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAEhB,eAAe,EAEf,qBAAqB,EACrB,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,iBAAiB,IAAI,uBAAuB,EAC5C,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EAEX,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EAEpB,aAAa,EACb,kBAAkB,EAElB,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,UAAU,EACV,aAAa,EACb,SAAS,EAET,mBAAmB,EACnB,YAAY,EAEZ,gBAAgB,EAChB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAK1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG"}

package/dist/index.js

@@ -66,7 +66,7 @@ RevealUICollection, RevealUIGlobal, relationshipPopulationPromise, validateRelat
 // Rich text editor
 export { BoldFeature, FixedToolbarFeature, HeadingFeature, ItalicFeature, LinkFeature, lexicalEditor, TreeViewFeature, UnderlineFeature, } from './richtext/index.js';
 // Storage adapters
-export { vercelBlobStorage } from './storage/vercel-blob.js';
+export { objectStorage } from './storage/object-storage.js';
 // Note: Logger class is exported from ./revealui.ts (instance/logger.js), not from utils/logger.js
 export { LRUCache } from './utils/cache.js';
 // Deep clone utility

package/dist/license.d.ts

@@ -139,6 +139,26 @@ export declare function getCurrentTier(): LicenseTier;
  * Returns the full license payload, or null if no valid license or cache expired.
  */
 export declare function getLicensePayload(): LicensePayload | null;
+/**
+ * Returns true when `host` is covered by the license's `domains` claim.
+ *
+ * The single matching primitive for RevForge/Fleet domain-lock — consumed by
+ * the API's `requireDomain` middleware, the admin boot check, and
+ * `validateLicenseAtStartup`. Because the allowed domains come from the signed
+ * JWT `domains` claim (not a separate env var), the lock is cryptographically
+ * bound: it cannot be spoofed by editing an env file.
+ *
+ * Matching rules (no authored regex, per the fleet no-regex rule):
+ * - `host` is lower-cased and stripped of any `:port` suffix
+ * - `localhost` / `127.0.0.1` are always allowed, so a trial kit boots and
+ *   serves on its default `http://localhost` regardless of the licensed domain
+ * - otherwise `host` must equal a licensed domain OR be a subdomain of one
+ *   (`app.example.com` matches `example.com`)
+ *
+ * @param host    raw Host header value or URL hostname (a `:port` suffix is tolerated)
+ * @param domains the license payload's `domains` claim
+ */
+export declare function hostMatchesLicensedDomains(host: string, domains: readonly string[]): boolean;
 /**
  * Checks whether the current license is at least the given tier.
  * Also validates that the license has not expired (checks JWT exp claim).

package/dist/license.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/F,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,qBAAqB;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAmBD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAEjF;AAED,qCAAqC;AACrC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;iBAuBxB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAW5E;AASD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAElF;AAuCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA6ChC;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CA8C9D;AAaD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAG5C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAGzD;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,WAAW,GAAG,OAAO,CA2B7D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,GAAE,WAAmB,GAAG,kBAAkB,CAkEtF;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAE5D;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACvE,UAAU,EAAE,MAAM,EAClB,gBAAgB,GAAE,MAAM,GAAG,IAAyB,EACpD,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC"}
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/F,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,qBAAqB;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAmBD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAEjF;AAED,qCAAqC;AACrC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;iBAuBxB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAW5E;AASD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAElF;AAuCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA6ChC;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CA8C9D;AAaD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAG5C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAGzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAQ5F;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,WAAW,GAAG,OAAO,CA2B7D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,GAAE,WAAmB,GAAG,kBAAkB,CAkEtF;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAE5D;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACvE,UAAU,EAAE,MAAM,EAClB,gBAAgB,GAAE,MAAM,GAAG,IAAyB,EACpD,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC"}

package/dist/license.js

@@ -281,6 +281,36 @@ export function getLicensePayload() {
     evictStaleCache();
     return cachedState.payload;
 }
+/**
+ * Returns true when `host` is covered by the license's `domains` claim.
+ *
+ * The single matching primitive for RevForge/Fleet domain-lock — consumed by
+ * the API's `requireDomain` middleware, the admin boot check, and
+ * `validateLicenseAtStartup`. Because the allowed domains come from the signed
+ * JWT `domains` claim (not a separate env var), the lock is cryptographically
+ * bound: it cannot be spoofed by editing an env file.
+ *
+ * Matching rules (no authored regex, per the fleet no-regex rule):
+ * - `host` is lower-cased and stripped of any `:port` suffix
+ * - `localhost` / `127.0.0.1` are always allowed, so a trial kit boots and
+ *   serves on its default `http://localhost` regardless of the licensed domain
+ * - otherwise `host` must equal a licensed domain OR be a subdomain of one
+ *   (`app.example.com` matches `example.com`)
+ *
+ * @param host    raw Host header value or URL hostname (a `:port` suffix is tolerated)
+ * @param domains the license payload's `domains` claim
+ */
+export function hostMatchesLicensedDomains(host, domains) {
+    const normalized = (host.trim().toLowerCase().split(':')[0] ?? '').trim();
+    if (!normalized)
+        return false;
+    if (normalized === 'localhost' || normalized === '127.0.0.1')
+        return true;
+    return domains.some((domain) => {
+        const d = domain.trim().toLowerCase();
+        return d.length > 0 && (normalized === d || normalized.endsWith(`.${d}`));
+    });
+}
 /**
  * Checks whether the current license is at least the given tier.
  * Also validates that the license has not expired (checks JWT exp claim).

package/dist/observability/health-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health-check.d.ts","sourceRoot":"","sources":["../../src/observability/health-check.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,SAAS,CAAsB;IAEvC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAIlC;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI9B;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,YAAY,CAAC;IAoD1C;;OAEG;YACW,cAAc;IAS5B;;OAEG;IACH,SAAS,IAAI,MAAM;CAGpB;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,mBAA0B,CAAC;AAEnD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAmCnF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,gBAAgB,GAAE,MAAW,GAAG,WAAW,CAwClF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,gBAAgB,GAAE,MAAW,GAAG,WAAW,CA4ChF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,GAAE,MAAY,GAAG,WAAW,CAuC3F;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,EACzC,QAAQ,GAAE,OAAe,GACxB,WAAW,CAMb;AAED;;GAEG;AACH,wBAAgB,oBAAoB,UACjB,OAAO,CAAC,QAAQ,CAAC,CAanC;AAED;;GAEG;AACH,wBAAgB,uBAAuB,UACpB,OAAO,CAAC,QAAQ,CAAC,CA2BnC;AAED;;GAEG;AACH,wBAAgB,sBAAsB,UACzB,QAAQ,CAqBpB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,UAAU,GAAE,MAAc,EAC1B,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,GAC9C,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAsBzB"}
+{"version":3,"file":"health-check.d.ts","sourceRoot":"","sources":["../../src/observability/health-check.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,SAAS,CAAsB;IAEvC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAIlC;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI9B;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,YAAY,CAAC;IAoD1C;;OAEG;YACW,cAAc;IAS5B;;OAEG;IACH,SAAS,IAAI,MAAM;CAGpB;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,mBAA0B,CAAC;AAEnD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAmCnF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,gBAAgB,GAAE,MAAW,GAAG,WAAW,CA8ClF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,gBAAgB,GAAE,MAAW,GAAG,WAAW,CA4ChF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,GAAE,MAAY,GAAG,WAAW,CAuC3F;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,EACzC,QAAQ,GAAE,OAAe,GACxB,WAAW,CAMb;AAED;;GAEG;AACH,wBAAgB,oBAAoB,UACjB,OAAO,CAAC,QAAQ,CAAC,CAanC;AAED;;GAEG;AACH,wBAAgB,uBAAuB,UACpB,OAAO,CAAC,QAAQ,CAAC,CA2BnC;AAED;;GAEG;AACH,wBAAgB,sBAAsB,UACzB,QAAQ,CAqBpB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,UAAU,GAAE,MAAc,EAC1B,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,GAC9C,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAsBzB"}

package/dist/observability/health-check.js

@@ -5,6 +5,7 @@
  */
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { getHeapStatistics } from 'node:v8';
 import { logger } from './logger.js';
 const execFileAsync = promisify(execFile);
 export class HealthCheckSystem {
@@ -145,7 +146,12 @@ export function createMemoryHealthCheck(thresholdPercent = 90) {
                 };
             }
             const usage = process.memoryUsage();
-            const usedPercent = (usage.heapUsed / usage.heapTotal) * 100;
+            // heapTotal is V8's currently-committed heap, not the ceiling — it sits
+            // just above heapUsed and grows on demand toward heap_size_limit
+            // (--max-old-space-size), so heapUsed/heapTotal reads ~90%+ during normal
+            // operation. heap_size_limit is the real OOM-proximity denominator.
+            const heapLimit = getHeapStatistics().heap_size_limit;
+            const usedPercent = (usage.heapUsed / heapLimit) * 100;
             let status = 'healthy';
             let message = 'Memory usage normal';
             if (usedPercent > thresholdPercent) {
@@ -162,6 +168,7 @@ export function createMemoryHealthCheck(thresholdPercent = 90) {
                 details: {
                     heapUsed: usage.heapUsed,
                     heapTotal: usage.heapTotal,
+                    heapLimit,
                     usedPercent: usedPercent.toFixed(2),
                     external: usage.external,
                     rss: usage.rss,

package/dist/server/index.d.ts

@@ -13,7 +13,7 @@
  */
 export { createRESTHandlers, handleRESTRequest } from '../api/rest.js';
 export { universalPostgresAdapter } from '../database/universal-postgres.js';
-export { vercelBlobStorage } from '../storage/vercel-blob.js';
+export { objectStorage } from '../storage/object-storage.js';
 export type { LogContext, Logger, LogLevel } from '../utils/logger-server.js';
 export { createLogger, logger } from '../utils/logger-server.js';
 export * from '../utils/request-context.js';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAEjE,cAAc,6BAA6B,CAAC;AAQ5C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAEjE,cAAc,6BAA6B,CAAC;AAQ5C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/server/index.js

@@ -15,7 +15,7 @@
 export { createRESTHandlers, handleRESTRequest } from '../api/rest.js';
 // Server-only database/storage
 export { universalPostgresAdapter } from '../database/universal-postgres.js';
-export { vercelBlobStorage } from '../storage/vercel-blob.js';
+export { objectStorage } from '../storage/object-storage.js';
 // Server-only logger with request context
 export { createLogger, logger } from '../utils/logger-server.js';
 // Request context utilities (server-only - uses async_hooks)

package/dist/storage/index.d.ts

@@ -1,18 +1,19 @@
 import type { StorageConfig, StorageProvider } from './types.js';
 export { createMockProvider } from './mock.js';
+export type { ObjectStorageConfig } from './object-storage.js';
+export { objectStorage } from './object-storage.js';
 export { createR2Provider } from './r2.js';
 export type { ListItem, ListOptions, ListResult, PutOptions, PutResult, R2Config, StorageConfig, StorageProvider, VercelBlobConfig, } from './types.js';
-export { vercelBlobStorage } from './vercel-blob.js';
+export { createVercelBlobProvider } from './vercel-blob-provider.js';
 /**
  * Construct a StorageProvider from a tagged config.
  *
  * Per `feedback_pluggable_provider_pattern`: explicit "no-X" opt-in — unknown
- * or unsupported tags throw with a clear message; no silent fallback.
+ * tags throw with a clear message; no silent fallback.
  *
- * Supported tags in Phase 2a: 'r2', 'mock'. The 'vercel-blob' tag is reserved
- * for Phase 2b (StorageProvider impl over @vercel/blob); during the migration
- * window, consumers needing Vercel Blob should use the legacy `vercelBlobStorage`
- * Payload plugin via `revealui.config.ts`.
+ * Supported tags: 'r2' (canonical), 'vercel-blob' (legacy migration-window
+ * fallback), and 'mock' (tests). The provider-agnostic `objectStorage` Payload
+ * plugin (object-storage.ts) adapts any of these to apps/admin's upload path.
  */
 export declare function createStorage(config: StorageConfig): StorageProvider;
 //# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAK/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAqBpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAK/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,QAAQ,EACR,aAAa,EACb,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAgBpE"}

package/dist/storage/index.js

@@ -2,43 +2,45 @@
 // GAP-208 — introduced 2026-05-18 alongside Vercel Blob → Cloudflare R2 swap.
 //
 // Phase 1 (#959): types.ts + index.ts type re-exports.
-// Phase 2a (this PR): r2 + mock providers + createStorage factory.
+// Phase 2a (#959 follow-up): r2 + mock providers + createStorage factory.
+// Phase 2b (this PR): vercel-blob StorageProvider + apps/server media-route
+//   cutover. R2 is canonical; Vercel Blob is the migration-window fallback.
 import { createMockProvider } from './mock.js';
 import { createR2Provider } from './r2.js';
+import { createVercelBlobProvider } from './vercel-blob-provider.js';
 export { createMockProvider } from './mock.js';
+// Provider-agnostic Payload-style upload plugin — adapts any StorageProvider
+// (R2 canonical, Vercel Blob fallback, mock) to the engine's collection upload
+// adapter. Used by apps/admin/revealui.config.ts. GAP-208 Phase 4 replaced the
+// provider-specific `vercelBlobStorage` plugin with this.
+export { objectStorage } from './object-storage.js';
 // Provider factories — exported so callers can construct a provider directly
 // when they already know which one they want (skipping the discriminated-union
 // factory below).
 export { createR2Provider } from './r2.js';
-// Legacy Payload-style plugin — kept during GAP-208 migration so existing
-// `apps/admin/revealui.config.ts` keeps working. Dropped in Phase 4 cleanup.
-export { vercelBlobStorage } from './vercel-blob.js';
+export { createVercelBlobProvider } from './vercel-blob-provider.js';
 /**
  * Construct a StorageProvider from a tagged config.
  *
  * Per `feedback_pluggable_provider_pattern`: explicit "no-X" opt-in — unknown
- * or unsupported tags throw with a clear message; no silent fallback.
+ * tags throw with a clear message; no silent fallback.
  *
- * Supported tags in Phase 2a: 'r2', 'mock'. The 'vercel-blob' tag is reserved
- * for Phase 2b (StorageProvider impl over @vercel/blob); during the migration
- * window, consumers needing Vercel Blob should use the legacy `vercelBlobStorage`
- * Payload plugin via `revealui.config.ts`.
+ * Supported tags: 'r2' (canonical), 'vercel-blob' (legacy migration-window
+ * fallback), and 'mock' (tests). The provider-agnostic `objectStorage` Payload
+ * plugin (object-storage.ts) adapts any of these to apps/admin's upload path.
  */
 export function createStorage(config) {
     switch (config.provider) {
         case 'r2':
             return createR2Provider(config.r2);
+        case 'vercel-blob':
+            return createVercelBlobProvider(config.vercelBlob);
         case 'mock':
             return createMockProvider();
-        case 'vercel-blob':
-            throw new Error("createStorage: provider 'vercel-blob' is not yet implemented as a " +
-                'StorageProvider (lands in GAP-208 Phase 2b). For the migration ' +
-                'window, use the legacy `vercelBlobStorage` Payload plugin in ' +
-                "revealui.config.ts, or switch to provider: 'r2'.");
         default: {
             const _exhaustive = config;
             throw new Error(`createStorage: unknown provider tag. Got ${JSON.stringify(_exhaustive)}. ` +
-                "Valid tags: 'r2', 'mock', 'vercel-blob' (Phase 2b).");
+                "Valid tags: 'r2', 'vercel-blob', 'mock'.");
         }
     }
 }

package/dist/storage/object-storage.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Object-storage upload plugin (provider-agnostic).
+ *
+ * Adapts any `StorageProvider` (Cloudflare R2 — canonical — Vercel Blob, mock,
+ * or a future backend) to the RevealUI engine's collection upload-adapter
+ * interface, so `apps/admin/revealui.config.ts` stores media through the
+ * configured object-storage backend. Replaces the provider-specific
+ * `vercelBlobStorage` Payload plugin retired in GAP-208 Phase 4.
+ *
+ * The backend is resolved through a lazy `resolveProvider` thunk — invoked
+ * (and memoized) on the first upload/delete, never at config-build time — so a
+ * consumer reading validated config (e.g. `@revealui/config`'s `config.storage`)
+ * does NOT force env validation when the admin config module is imported during
+ * `next build`, tests, or boot. This mirrors `apps/server` `getMediaStorage()`,
+ * which reads `config.storage` lazily per request.
+ *
+ * WARNING: This module is server-only.
+ * Do NOT import in client-side code or edge runtime.
+ */
+import type { Plugin } from '../types/index.js';
+import type { StorageProvider } from './types.js';
+export interface ObjectStorageConfig {
+    /** When `false`, the plugin is a no-op (no upload config applied). Defaults to enabled. */
+    enabled?: boolean;
+    /** Map of collection slug → whether to attach upload handling. */
+    collections?: {
+        [key: string]: boolean;
+    };
+    /**
+     * Lazily resolves the backend the upload adapter writes through. Called once
+     * (memoized) on the first upload/delete — never at config build — so reading
+     * validated config (e.g. `@revealui/config`'s `config.storage`) does not force
+     * env validation at module load. Should throw a clear, actionable error when
+     * no backend is configured (fail-fast; never silently no-op an upload).
+     */
+    resolveProvider: () => StorageProvider;
+    /** Key prefix for stored objects. Defaults to `'uploads'`. */
+    prefix?: string;
+}
+export declare function objectStorage(config: ObjectStorageConfig): Plugin;
+//# sourceMappingURL=object-storage.d.ts.map

package/dist/storage/object-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-storage.d.ts","sourceRoot":"","sources":["../../src/storage/object-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kEAAkE;IAClE,WAAW,CAAC,EAAE;QACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,eAAe,CAAC;IACvC,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAiGjE"}

package/dist/storage/{vercel-blob.js → object-storage.js}

@@ -1,13 +1,35 @@
 /**
- * Vercel Blob Storage Plugin
+ * Object-storage upload plugin (provider-agnostic).
+ *
+ * Adapts any `StorageProvider` (Cloudflare R2 — canonical — Vercel Blob, mock,
+ * or a future backend) to the RevealUI engine's collection upload-adapter
+ * interface, so `apps/admin/revealui.config.ts` stores media through the
+ * configured object-storage backend. Replaces the provider-specific
+ * `vercelBlobStorage` Payload plugin retired in GAP-208 Phase 4.
+ *
+ * The backend is resolved through a lazy `resolveProvider` thunk — invoked
+ * (and memoized) on the first upload/delete, never at config-build time — so a
+ * consumer reading validated config (e.g. `@revealui/config`'s `config.storage`)
+ * does NOT force env validation when the admin config module is imported during
+ * `next build`, tests, or boot. This mirrors `apps/server` `getMediaStorage()`,
+ * which reads `config.storage` lazily per request.
  *
  * WARNING: This module is server-only.
  * Do NOT import in client-side code or edge runtime.
  */
-import { del, put } from '@vercel/blob';
 import { defaultLogger } from '../instance/logger.js';
-export function vercelBlobStorage(config) {
+export function objectStorage(config) {
     const prefix = config.prefix || 'uploads';
+    // Memoize the provider so the underlying client (S3 / Blob) is constructed
+    // once per process, not per upload — and so config is read lazily, on first
+    // use, rather than at config-build time.
+    let cachedProvider;
+    const getProvider = () => {
+        if (!cachedProvider) {
+            cachedProvider = config.resolveProvider();
+        }
+        return cachedProvider;
+    };
     return (incomingConfig) => {
         if (config.enabled === false) {
             return incomingConfig;
@@ -26,25 +48,21 @@ export function vercelBlobStorage(config) {
                         crop: true,
                         adapters: [
                             {
-                                name: 'vercel-blob',
+                                name: 'object-storage',
                                 adapter: {
-                                    name: 'vercel-blob',
+                                    name: 'object-storage',
                                     generateURL: (file) => {
                                         return `${prefix}/${file.filename}`;
                                     },
                                     upload: async (file) => {
                                         try {
-                                            const filePath = `${prefix}/${collection.slug}/${Date.now()}-${file.name}`;
-                                            if (!config.token) {
-                                                throw new Error('Vercel blob token is required but not configured');
-                                            }
-                                            const blob = await put(filePath, file.data, {
+                                            const key = `${prefix}/${collection.slug}/${Date.now()}-${file.name}`;
+                                            const result = await getProvider().put(key, file.data, {
                                                 access: 'public',
-                                                token: config.token,
-                                                addRandomSuffix: false,
+                                                contentType: file.mimetype,
                                             });
                                             return {
-                                                url: blob.url,
+                                                url: result.url,
                                                 filename: file.name,
                                                 filesize: file.size,
                                                 mimeType: file.mimetype,
@@ -53,20 +71,22 @@ export function vercelBlobStorage(config) {
                                             };
                                         }
                                         catch (error) {
-                                            defaultLogger.error('Vercel Blob upload error:', error);
+                                            defaultLogger.error('Object storage upload error:', error);
                                             throw error;
                                         }
                                     },
                                     delete: async (filename) => {
                                         try {
-                                            // Extract the blob URL from filename or construct it
-                                            const blobUrl = filename.startsWith('http')
+                                            // Payload may pass a full URL (preferred — providers extract
+                                            // the storage key from it) or a bare filename; mirror the
+                                            // legacy plugin's prefix-prepend for the bare-filename case.
+                                            const keyOrUrl = filename.startsWith('http')
                                                 ? filename
                                                 : `${prefix}/${filename}`;
-                                            await del(blobUrl);
+                                            await getProvider().del(keyOrUrl);
                                         }
                                         catch (error) {
-                                            defaultLogger.error('Vercel Blob delete error:', error);
+                                            defaultLogger.error('Object storage delete error:', error);
                                             throw error;
                                         }
                                     },

package/dist/storage/vercel-blob-provider.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Vercel Blob implementation of StorageProvider.
+ *
+ * Legacy backend retained during the GAP-208 Cloudflare R2 cutover so the
+ * media-upload path can fall back to Vercel Blob when R2 is not configured.
+ * Wraps @vercel/blob's put/del/list behind the provider-agnostic
+ * StorageProvider interface. Cloudflare R2 (r2.ts) is the canonical backend;
+ * this provider is removed once the Blob store is decommissioned.
+ *
+ * NOTE: distinct from vercel-blob.ts in this directory, which is the legacy
+ * Payload-style upload *plugin* still wired into apps/admin's
+ * revealui.config.ts. This file is the StorageProvider the createStorage
+ * factory returns for the 'vercel-blob' tag.
+ *
+ * Server-only. Do NOT import from client-side code or edge runtime.
+ */
+import type { ListOptions, ListResult, PutOptions, PutResult, StorageProvider, VercelBlobConfig } from './types.js';
+declare class VercelBlobProvider implements StorageProvider {
+    readonly provider = "vercel-blob";
+    private readonly token;
+    constructor(config: VercelBlobConfig);
+    put(key: string, data: Blob | ArrayBuffer | Uint8Array | ReadableStream<Uint8Array>, opts?: PutOptions): Promise<PutResult>;
+    del(keyOrUrl: string): Promise<void>;
+    list(opts?: ListOptions): Promise<ListResult>;
+}
+export declare function createVercelBlobProvider(config: VercelBlobConfig): StorageProvider;
+export type { VercelBlobProvider };
+//# sourceMappingURL=vercel-blob-provider.d.ts.map

package/dist/storage/vercel-blob-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-blob-provider.d.ts","sourceRoot":"","sources":["../../src/storage/vercel-blob-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAEV,WAAW,EACX,UAAU,EACV,UAAU,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAKpB,cAAM,kBAAmB,YAAW,eAAe;IACjD,QAAQ,CAAC,QAAQ,iBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,MAAM,EAAE,gBAAgB;IAW9B,GAAG,CACP,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,EAClE,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC;IAmCf,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;CAqBpD;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,GAAG,eAAe,CAElF;AAED,YAAY,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/storage/vercel-blob-provider.js

@@ -0,0 +1,88 @@
+/**
+ * Vercel Blob implementation of StorageProvider.
+ *
+ * Legacy backend retained during the GAP-208 Cloudflare R2 cutover so the
+ * media-upload path can fall back to Vercel Blob when R2 is not configured.
+ * Wraps @vercel/blob's put/del/list behind the provider-agnostic
+ * StorageProvider interface. Cloudflare R2 (r2.ts) is the canonical backend;
+ * this provider is removed once the Blob store is decommissioned.
+ *
+ * NOTE: distinct from vercel-blob.ts in this directory, which is the legacy
+ * Payload-style upload *plugin* still wired into apps/admin's
+ * revealui.config.ts. This file is the StorageProvider the createStorage
+ * factory returns for the 'vercel-blob' tag.
+ *
+ * Server-only. Do NOT import from client-side code or edge runtime.
+ */
+import { del, list, put } from '@vercel/blob';
+import { toUint8Array } from './_helpers.js';
+const PROVIDER_TAG = 'vercel-blob';
+const DEFAULT_LIST_LIMIT = 1000;
+class VercelBlobProvider {
+    provider = PROVIDER_TAG;
+    token;
+    constructor(config) {
+        if (!config.token) {
+            throw new Error('Vercel Blob provider requires VercelBlobConfig.token (the ' +
+                'BLOB_READ_WRITE_TOKEN value). For new deployments prefer Cloudflare ' +
+                'R2 (provider: "r2").');
+        }
+        this.token = config.token;
+    }
+    async put(key, data, opts) {
+        if (opts?.access === 'private') {
+            throw new Error("Vercel Blob provider does not support access: 'private' — every blob " +
+                'is publicly readable. Use Cloudflare R2 for private-access patterns.');
+        }
+        // Normalize to bytes so the result carries an accurate size regardless of
+        // input shape (ReadableStream has no length until consumed). Re-wrap in a
+        // fresh Uint8Array so the Blob part is backed by a non-shared ArrayBuffer,
+        // satisfying the DOM BlobPart type under TS strict typed-array generics.
+        const body = await toUint8Array(data);
+        const result = await put(key, new Blob([new Uint8Array(body)]), {
+            access: 'public',
+            token: this.token,
+            contentType: opts?.contentType,
+            // Keys are caller-controlled (callers pre-randomize, e.g. media/<uuid>.ext);
+            // never append a second random suffix or the returned URL won't match `key`.
+            addRandomSuffix: false,
+        });
+        // Vercel Blob has no per-object user-metadata or Cache-Control-header API
+        // (only cacheControlMaxAge); opts.metadata / opts.cacheControl are ignored
+        // by this legacy provider. R2 honors both.
+        return {
+            key,
+            url: result.url,
+            size: body.byteLength,
+            provider: PROVIDER_TAG,
+        };
+    }
+    async del(keyOrUrl) {
+        // Vercel's del is idempotent (deleting an absent blob is a no-op), so this
+        // satisfies the best-effort contract. It requires the full blob URL, which
+        // is what media records persist.
+        await del(keyOrUrl, { token: this.token });
+    }
+    async list(opts) {
+        const response = await list({
+            token: this.token,
+            prefix: opts?.prefix,
+            limit: opts?.limit ?? DEFAULT_LIST_LIMIT,
+            cursor: opts?.cursor,
+        });
+        const items = response.blobs.map((blob) => ({
+            key: blob.pathname,
+            url: blob.url,
+            size: blob.size,
+            uploadedAt: blob.uploadedAt,
+        }));
+        return {
+            items,
+            cursor: response.cursor,
+            hasMore: response.hasMore,
+        };
+    }
+}
+export function createVercelBlobProvider(config) {
+    return new VercelBlobProvider(config);
+}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@revealui/core",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "RevealUI's runtime engine — admin UI, REST API, auth, rich text, plugin system, and access control. The heart of the open-source platform.",
   "license": "MIT",
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1049.0",
+    "@aws-sdk/client-s3": "^3.1053.0",
     "@electric-sql/pglite": "^0.4.5",
     "@lexical/clipboard": "^0.44.0",
     "@lexical/code": "^0.44.0",
@@ -34,7 +34,7 @@
   "devDependencies": {
     "@types/json-schema": "^7.0.15",
     "@types/pg": "^8.20.0",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
     "@vitest/coverage-v8": "^4.1.5",
     "expect-type": "^1.3.0",

package/dist/storage/vercel-blob.d.ts

@@ -1,17 +0,0 @@
-/**
- * Vercel Blob Storage Plugin
- *
- * WARNING: This module is server-only.
- * Do NOT import in client-side code or edge runtime.
- */
-import type { Plugin } from '../types/index.js';
-export interface VercelBlobStorageConfig {
-    enabled?: boolean;
-    collections?: {
-        [key: string]: boolean;
-    };
-    token?: string;
-    prefix?: string;
-}
-export declare function vercelBlobStorage(config: VercelBlobStorageConfig): Plugin;
-//# sourceMappingURL=vercel-blob.d.ts.map

package/dist/storage/vercel-blob.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"vercel-blob.d.ts","sourceRoot":"","sources":["../../src/storage/vercel-blob.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE;QACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAyFzE"}