@revealui/core 0.9.0 → 0.10.0

package/dist/storage/_xml.js

@@ -0,0 +1,75 @@
+/**
+ * Minimal, dependency-free readers for the two S3/R2 XML responses we consume:
+ * ListObjectsV2 results and `<Error>` bodies. Replaces the XML codec that
+ * @aws-sdk/client-s3 used to run for us.
+ *
+ * No regex (M2): a tag's text can never contain a raw `<` (XML escapes it to
+ * `&lt;`), so `indexOf`-based tag scanning is unambiguous.
+ */
+/** First `<tag>…</tag>` text content at or after `from`, or undefined. */
+function firstTagValue(xml, tag, from = 0) {
+    const open = `<${tag}>`;
+    const start = xml.indexOf(open, from);
+    if (start === -1)
+        return undefined;
+    const contentStart = start + open.length;
+    const end = xml.indexOf(`</${tag}>`, contentStart);
+    if (end === -1)
+        return undefined;
+    return xml.slice(contentStart, end);
+}
+/** Decode the five predefined XML entities (no regex). `&amp;` is decoded last. */
+function decodeXmlEntities(value) {
+    if (!value.includes('&'))
+        return value;
+    return value
+        .split('&lt;')
+        .join('<')
+        .split('&gt;')
+        .join('>')
+        .split('&quot;')
+        .join('"')
+        .split('&apos;')
+        .join("'")
+        .split('&amp;')
+        .join('&');
+}
+/** Parse an S3 ListObjectsV2 XML response into the fields the R2 provider needs. */
+export function parseListObjectsV2(xml) {
+    const objects = [];
+    const contentsOpen = '<Contents>';
+    const contentsClose = '</Contents>';
+    let cursor = 0;
+    for (;;) {
+        const start = xml.indexOf(contentsOpen, cursor);
+        if (start === -1)
+            break;
+        const end = xml.indexOf(contentsClose, start);
+        if (end === -1)
+            break;
+        const block = xml.slice(start + contentsOpen.length, end);
+        const key = firstTagValue(block, 'Key');
+        if (key !== undefined) {
+            const lastModified = firstTagValue(block, 'LastModified');
+            objects.push({
+                key: decodeXmlEntities(key),
+                size: Number(firstTagValue(block, 'Size') ?? '0') || 0,
+                lastModified: lastModified ? new Date(lastModified) : new Date(0),
+            });
+        }
+        cursor = end + contentsClose.length;
+    }
+    const token = firstTagValue(xml, 'NextContinuationToken');
+    return {
+        objects,
+        isTruncated: firstTagValue(xml, 'IsTruncated') === 'true',
+        nextContinuationToken: token !== undefined ? decodeXmlEntities(token) : undefined,
+    };
+}
+/** Extract `<Code>`/`<Message>` from an S3 `<Error>` response for diagnostics. */
+export function s3ErrorFields(xml) {
+    return {
+        code: firstTagValue(xml, 'Code'),
+        message: firstTagValue(xml, 'Message'),
+    };
+}

package/dist/storage/r2.d.ts

@@ -1,12 +1,24 @@
 /**
  * Cloudflare R2 implementation of StorageProvider.
  *
- * R2 is S3-compatible — uses @aws-sdk/client-s3 with a custom endpoint and
- * region='auto'. See https://developers.cloudflare.com/r2/api/s3/api/.
+ * R2 is S3-compatible. This is a native client: AWS SigV4 request signing
+ * (./_sigv4.ts, verified against AWS's official test vector) over global
+ * `fetch`, plus a small XML reader for ListObjectsV2 (./_xml.ts). No SDK
+ * dependency — only node:crypto + fetch.
+ *
+ * Path-style addressing is used for the S3 API calls
+ * (https://<account>.r2.cloudflarestorage.com/<bucket>/<key>); this has no
+ * effect on the public object URLs, which are built from `publicBaseUrl`.
  *
  * GAP-208 Phase 2a (2026-05-18). Phase 1 (interface + types) shipped in #959.
+ * Native client (dropping @aws-sdk/client-s3) landed 2026-06-09.
  *
  * Server-only. Do NOT import from client-side code or edge runtime.
+ *
+ * Known limitation (unchanged from the SDK version): request bodies are
+ * buffered fully in memory (see toUint8Array) so the payload can be hashed for
+ * SigV4. Streaming uploads (STREAMING-AWS4-HMAC-SHA256-PAYLOAD) are a future
+ * enhancement; presigned/private URLs remain Phase 2b.
  */
 import type { R2Config, StorageProvider } from './types.js';
 export declare function createR2Provider(config: R2Config): StorageProvider;

package/dist/storage/r2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/storage/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EAMV,QAAQ,EACR,eAAe,EAChB,MAAM,YAAY,CAAC;AAsHpB,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAElE"}
+{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/storage/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAMV,QAAQ,EACR,eAAe,EAChB,MAAM,YAAY,CAAC;AAkKpB,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAElE"}

package/dist/storage/r2.js

@@ -1,21 +1,37 @@
 /**
  * Cloudflare R2 implementation of StorageProvider.
  *
- * R2 is S3-compatible — uses @aws-sdk/client-s3 with a custom endpoint and
- * region='auto'. See https://developers.cloudflare.com/r2/api/s3/api/.
+ * R2 is S3-compatible. This is a native client: AWS SigV4 request signing
+ * (./_sigv4.ts, verified against AWS's official test vector) over global
+ * `fetch`, plus a small XML reader for ListObjectsV2 (./_xml.ts). No SDK
+ * dependency — only node:crypto + fetch.
+ *
+ * Path-style addressing is used for the S3 API calls
+ * (https://<account>.r2.cloudflarestorage.com/<bucket>/<key>); this has no
+ * effect on the public object URLs, which are built from `publicBaseUrl`.
  *
  * GAP-208 Phase 2a (2026-05-18). Phase 1 (interface + types) shipped in #959.
+ * Native client (dropping @aws-sdk/client-s3) landed 2026-06-09.
  *
  * Server-only. Do NOT import from client-side code or edge runtime.
+ *
+ * Known limitation (unchanged from the SDK version): request bodies are
+ * buffered fully in memory (see toUint8Array) so the payload can be hashed for
+ * SigV4. Streaming uploads (STREAMING-AWS4-HMAC-SHA256-PAYLOAD) are a future
+ * enhancement; presigned/private URLs remain Phase 2b.
  */
-import { DeleteObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
 import { toUint8Array } from './_helpers.js';
+import { EMPTY_SHA256, sha256Hex, signS3Request } from './_sigv4.js';
+import { parseListObjectsV2, s3ErrorFields } from './_xml.js';
 const PROVIDER_TAG = 'r2';
 const DEFAULT_CONTENT_TYPE = 'application/octet-stream';
 const DEFAULT_LIST_LIMIT = 1000;
+const REGION = 'auto';
 class R2Provider {
     provider = PROVIDER_TAG;
-    client;
+    accountId;
+    accessKeyId;
+    secretAccessKey;
     bucket;
     publicBaseUrl;
     constructor(config) {
@@ -25,16 +41,11 @@ class R2Provider {
                 "custom domain (e.g. 'https://media.revealui.com') or the R2 dev URL " +
                 "('https://<account-id>.r2.cloudflarestorage.com/<bucket>').");
         }
+        this.accountId = config.accountId;
+        this.accessKeyId = config.accessKeyId;
+        this.secretAccessKey = config.secretAccessKey;
         this.bucket = config.bucket;
         this.publicBaseUrl = stripTrailingSlash(config.publicBaseUrl);
-        this.client = new S3Client({
-            region: 'auto',
-            endpoint: `https://${config.accountId}.r2.cloudflarestorage.com`,
-            credentials: {
-                accessKeyId: config.accessKeyId,
-                secretAccessKey: config.secretAccessKey,
-            },
-        });
     }
     async put(key, data, opts) {
         if (opts?.access === 'private') {
@@ -43,15 +54,40 @@ class R2Provider {
                 'lands in Phase 2b.');
         }
         const body = await toUint8Array(data);
-        await this.client.send(new PutObjectCommand({
-            Bucket: this.bucket,
-            Key: key,
-            Body: body,
-            ContentType: opts?.contentType ?? DEFAULT_CONTENT_TYPE,
-            ContentLength: body.byteLength,
-            CacheControl: opts?.cacheControl,
-            Metadata: opts?.metadata,
-        }));
+        const extraHeaders = {
+            'content-type': opts?.contentType ?? DEFAULT_CONTENT_TYPE,
+        };
+        if (opts?.cacheControl) {
+            extraHeaders['cache-control'] = opts.cacheControl;
+        }
+        for (const [name, value] of Object.entries(opts?.metadata ?? {})) {
+            extraHeaders[`x-amz-meta-${name.toLowerCase()}`] = value;
+        }
+        const { url, headers } = signS3Request({
+            method: 'PUT',
+            accountId: this.accountId,
+            bucket: this.bucket,
+            key,
+            region: REGION,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            payloadHash: sha256Hex(body),
+            extraHeaders,
+            now: new Date(),
+        });
+        // No manual content-length: it is a forbidden fetch header that undici
+        // computes from the body itself, and setting it throws UND_ERR_INVALID_ARG
+        // ("invalid content-length header") on the R2 PUT. `headers` already carries
+        // the signed set. `as BodyInit` bridges the TS lib's ArrayBufferLike vs
+        // ArrayBuffer typed-array variance for fetch bodies (cf. src/api/compression.ts).
+        const response = await fetch(url, {
+            method: 'PUT',
+            headers,
+            body: body,
+        });
+        if (!response.ok) {
+            throw await storageError('PUT', key, response);
+        }
         return {
             key,
             url: `${this.publicBaseUrl}/${key}`,
@@ -61,34 +97,56 @@ class R2Provider {
     }
     async del(keyOrUrl) {
         const key = this.extractKey(keyOrUrl);
-        await this.client.send(new DeleteObjectCommand({
-            Bucket: this.bucket,
-            Key: key,
-        }));
+        const { url, headers } = signS3Request({
+            method: 'DELETE',
+            accountId: this.accountId,
+            bucket: this.bucket,
+            key,
+            region: REGION,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            payloadHash: EMPTY_SHA256,
+            now: new Date(),
+        });
+        // Best-effort: a missing key is not an error. S3/R2 returns 204 regardless;
+        // tolerate 404 defensively.
+        const response = await fetch(url, { method: 'DELETE', headers });
+        if (!response.ok && response.status !== 404) {
+            throw await storageError('DELETE', key, response);
+        }
     }
     async list(opts) {
-        const response = await this.client.send(new ListObjectsV2Command({
-            Bucket: this.bucket,
-            Prefix: opts?.prefix,
-            MaxKeys: opts?.limit ?? DEFAULT_LIST_LIMIT,
-            ContinuationToken: opts?.cursor,
-        }));
-        const items = (response.Contents ?? []).flatMap((entry) => {
-            if (!entry.Key)
-                return [];
-            return [
-                {
-                    key: entry.Key,
-                    url: `${this.publicBaseUrl}/${entry.Key}`,
-                    size: entry.Size ?? 0,
-                    uploadedAt: entry.LastModified ?? new Date(0),
-                },
-            ];
+        const { url, headers } = signS3Request({
+            method: 'GET',
+            accountId: this.accountId,
+            bucket: this.bucket,
+            region: REGION,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            payloadHash: EMPTY_SHA256,
+            query: {
+                'list-type': '2',
+                prefix: opts?.prefix,
+                'max-keys': String(opts?.limit ?? DEFAULT_LIST_LIMIT),
+                'continuation-token': opts?.cursor,
+            },
+            now: new Date(),
         });
+        const response = await fetch(url, { method: 'GET', headers });
+        if (!response.ok) {
+            throw await storageError('LIST', this.bucket, response);
+        }
+        const parsed = parseListObjectsV2(await response.text());
+        const items = parsed.objects.map((entry) => ({
+            key: entry.key,
+            url: `${this.publicBaseUrl}/${entry.key}`,
+            size: entry.size,
+            uploadedAt: entry.lastModified,
+        }));
         return {
             items,
-            cursor: response.NextContinuationToken,
-            hasMore: response.IsTruncated === true,
+            cursor: parsed.nextContinuationToken,
+            hasMore: parsed.isTruncated,
         };
     }
     extractKey(keyOrUrl) {
@@ -104,6 +162,11 @@ export function createR2Provider(config) {
     return new R2Provider(config);
 }
 // ── helpers ────────────────────────────────────────────────────────────────
+async function storageError(operation, key, response) {
+    const body = await response.text().catch(() => '');
+    const { code, message } = s3ErrorFields(body);
+    return new Error(`R2 ${operation} failed for "${key}": ${code ?? response.status} ${message ?? response.statusText}`);
+}
 function tryParseUrl(value) {
     try {
         return new URL(value);

package/package.json

@@ -1,45 +1,44 @@
 {
   "name": "@revealui/core",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "RevealUI's runtime engine — admin UI, REST API, auth, rich text, plugin system, and access control. The heart of the open-source platform.",
   "license": "MIT",
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1053.0",
-    "@electric-sql/pglite": "^0.4.5",
-    "@lexical/clipboard": "^0.44.0",
-    "@lexical/code": "^0.44.0",
-    "@lexical/html": "^0.44.0",
-    "@lexical/link": "^0.44.0",
-    "@lexical/list": "^0.44.0",
-    "@lexical/react": "^0.44.0",
-    "@lexical/rich-text": "^0.44.0",
-    "@lexical/selection": "^0.44.0",
-    "@lexical/table": "^0.44.0",
-    "@lexical/utils": "^0.44.0",
-    "@lexical/yjs": "^0.44.0",
+    "@electric-sql/pglite": "^0.5.1",
+    "@lexical/clipboard": "^0.45.0",
+    "@lexical/code": "^0.45.0",
+    "@lexical/html": "^0.45.0",
+    "@lexical/link": "^0.45.0",
+    "@lexical/list": "^0.45.0",
+    "@lexical/react": "^0.45.0",
+    "@lexical/rich-text": "^0.45.0",
+    "@lexical/selection": "^0.45.0",
+    "@lexical/table": "^0.45.0",
+    "@lexical/utils": "^0.45.0",
+    "@lexical/yjs": "^0.45.0",
     "@vercel/blob": "^2.3.3",
     "bcryptjs": "^3.0.3",
     "dataloader": "^2.2.3",
-    "jose": "^6.2.3",
-    "lexical": "^0.44.0",
+    "jose": "^5.10.0",
+    "lexical": "^0.45.0",
     "pg": "^8.21.0",
-    "yjs": "^13.6.30",
+    "yjs": "^13.6.31",
     "zod": "^4.4.3",
-    "@revealui/cache": "0.2.1",
-    "@revealui/contracts": "0.6.0",
+    "@revealui/cache": "0.2.2",
+    "@revealui/contracts": "0.6.1",
     "@revealui/resilience": "0.2.4",
-    "@revealui/security": "0.4.0",
+    "@revealui/security": "0.4.1",
     "@revealui/utils": "0.3.5"
   },
   "devDependencies": {
     "@types/json-schema": "^7.0.15",
     "@types/pg": "^8.20.0",
-    "@types/react": "^19.2.15",
+    "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@vitest/coverage-v8": "^4.1.5",
+    "@vitest/coverage-v8": "^4.1.8",
     "expect-type": "^1.3.0",
     "tsup": "^8.5.1",
-    "vitest": "^4.1.5",
+    "vitest": "^4.1.8",
     "@revealui/dev": "0.1.0"
   },
   "engines": {