@revealui/core 0.9.0 → 0.10.1

package/dist/richtext/exports/server/rsc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsc.d.ts","sourceRoot":"","sources":["../../../../src/richtext/exports/server/rsc.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,OAAO,CAAC;AAG3C,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAKtC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAyBlC,UAAU,qBAAsB,SAAQ,qBAAqB;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,kBAAmB,SAAQ,qBAAqB;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;QACjC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,GAAG,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KAC7C,CAAC;CACH;AAmBD,UAAU,mBAAoB,SAAQ,qBAAqB;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACrE,SAAQ,qBAAqB;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAMD,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,UAAU,gBAAgB;IACxB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,2BAA2B;IAC3B,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AAqSD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,CAAC,EAAE,gBAAgB,GACzB,GAAG,CAAC,OAAO,GAAG,IAAI,CAMpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,MAAM,CAAC,CA2CjB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,wBAAwB,kDAYhF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,yBAAyB,kDAYlF;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AAED,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,SAAS,EACT,WAAW,EACX,UAAU,EACV,WAAW,GACZ,EAAE,oBAAoB,kDAgBtB;AAED,eAAe,eAAe,CAAC"}
+{"version":3,"file":"rsc.d.ts","sourceRoot":"","sources":["../../../../src/richtext/exports/server/rsc.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAY,KAAK,GAAG,EAAE,MAAM,OAAO,CAAC;AAG3C,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAKtC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAyBlC,UAAU,qBAAsB,SAAQ,qBAAqB;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,kBAAmB,SAAQ,qBAAqB;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;QACjC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,GAAG,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KAC7C,CAAC;CACH;AAmBD,UAAU,mBAAoB,SAAQ,qBAAqB;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACrE,SAAQ,qBAAqB;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAMD,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,UAAU,gBAAgB;IACxB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,2BAA2B;IAC3B,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AAqSD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,CAAC,EAAE,gBAAgB,GACzB,GAAG,CAAC,OAAO,GAAG,IAAI,CAMpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,GAC7C,OAAO,CAAC,MAAM,CAAC,CA2CjB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,wBAAwB,sBAYhF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,yBAAyB,sBAYlF;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAC/E,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,GAAG,CAAC,OAAO,GAAG,IAAI,EAC5B,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,CACZ,IAAI,EAAE;QACJ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,KAAK,EAAE,MAAM,KACV,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;CACzB;AAED,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,SAAS,EACT,WAAW,EACX,UAAU,EACV,WAAW,GACZ,EAAE,oBAAoB,sBAgBtB;AAED,eAAe,eAAe,CAAC"}

package/dist/storage/_sigv4.d.ts

@@ -0,0 +1,76 @@
+/**
+ * AWS Signature Version 4 signer for the Cloudflare R2 (S3-compatible) API.
+ *
+ * Replaces the request signing that @aws-sdk/client-s3 used to do for us.
+ * Uses only node:crypto — no external dependencies, no regex.
+ *
+ * The core (`computeSigV4`) is verified byte-for-byte against the official AWS
+ * SigV4 test-suite `get-vanilla` vector in __tests__/_sigv4.test.ts.
+ *
+ * Server-only. Do NOT import from client-side code or edge runtime.
+ */
+/** Hex SHA-256 of the empty string — the payload hash for body-less requests. */
+export declare const EMPTY_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+/** Hex SHA-256 of arbitrary bytes (request payload hashing). */
+export declare function sha256Hex(data: string | Uint8Array): string;
+/**
+ * RFC 3986 percent-encoding per the AWS SigV4 spec. `encodeSlash` is false for
+ * path segments (slashes are separators) and true for query keys/values.
+ */
+export declare function awsUriEncode(input: string, encodeSlash: boolean): string;
+/** Inputs to the verified SigV4 core. All path/header values must be final. */
+export interface CanonicalInput {
+    method: string;
+    /** Already AWS-URI-encoded path (slashes preserved). */
+    canonicalPath: string;
+    /** Raw (unencoded) query pairs; encoded + sorted by the signer. */
+    query: [string, string][];
+    /** Exact header set to sign (any case; lowercased + trimmed internally). */
+    headersToSign: Record<string, string>;
+    payloadHash: string;
+    amzDate: string;
+    region: string;
+    service: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+}
+export interface SigV4Result {
+    signature: string;
+    signedHeaders: string;
+    scope: string;
+    canonicalQuery: string;
+}
+/**
+ * The verified SigV4 computation: canonical request → string-to-sign → signing
+ * key → signature. Verified against AWS's official `get-vanilla` test vector.
+ */
+export declare function computeSigV4(input: CanonicalInput): SigV4Result;
+/** Inputs for an R2/S3 request signature. */
+export interface SignS3Input {
+    method: 'GET' | 'PUT' | 'DELETE';
+    accountId: string;
+    bucket: string;
+    /** Object key; omit for bucket-level operations (e.g. ListObjectsV2). */
+    key?: string;
+    /** Query params; `undefined` values are dropped before signing. */
+    query?: Record<string, string | undefined>;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** Hex SHA-256 of the body, or EMPTY_SHA256 for body-less requests. */
+    payloadHash: string;
+    /** Extra headers to send + sign (content-type, cache-control, x-amz-meta-*). */
+    extraHeaders?: Record<string, string>;
+    now: Date;
+}
+export interface SignedS3Request {
+    url: string;
+    headers: Record<string, string>;
+}
+/**
+ * Build a signed R2 request: a path-style URL + AWS4-HMAC-SHA256 Authorization
+ * header. The `host` header is signed but not returned — fetch/undici sets it
+ * from the URL (same value), and `Host` is a forbidden header to set manually.
+ */
+export declare function signS3Request(input: SignS3Input): SignedS3Request;
+//# sourceMappingURL=_sigv4.d.ts.map

package/dist/storage/_sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_sigv4.d.ts","sourceRoot":"","sources":["../../src/storage/_sigv4.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,iFAAiF;AACjF,eAAO,MAAM,YAAY,qEAAqE,CAAC;AAE/F,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAE3D;AAQD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAaxE;AAQD,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,CAkC/D;AAED,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,CAmDjE"}

package/dist/storage/_sigv4.js

@@ -0,0 +1,134 @@
+/**
+ * AWS Signature Version 4 signer for the Cloudflare R2 (S3-compatible) API.
+ *
+ * Replaces the request signing that @aws-sdk/client-s3 used to do for us.
+ * Uses only node:crypto — no external dependencies, no regex.
+ *
+ * The core (`computeSigV4`) is verified byte-for-byte against the official AWS
+ * SigV4 test-suite `get-vanilla` vector in __tests__/_sigv4.test.ts.
+ *
+ * Server-only. Do NOT import from client-side code or edge runtime.
+ */
+import { createHash, createHmac } from 'node:crypto';
+const ALGORITHM = 'AWS4-HMAC-SHA256';
+const S3_SERVICE = 's3';
+/** Hex SHA-256 of the empty string — the payload hash for body-less requests. */
+export const EMPTY_SHA256 = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855';
+/** Hex SHA-256 of arbitrary bytes (request payload hashing). */
+export function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+function hmac(key, data) {
+    return createHmac('sha256', key).update(data, 'utf8').digest();
+}
+const UNRESERVED = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~';
+/**
+ * RFC 3986 percent-encoding per the AWS SigV4 spec. `encodeSlash` is false for
+ * path segments (slashes are separators) and true for query keys/values.
+ */
+export function awsUriEncode(input, encodeSlash) {
+    let out = '';
+    for (const byte of new TextEncoder().encode(input)) {
+        const ch = String.fromCharCode(byte);
+        if (UNRESERVED.includes(ch)) {
+            out += ch;
+        }
+        else if (ch === '/' && !encodeSlash) {
+            out += '/';
+        }
+        else {
+            out += `%${byte.toString(16).toUpperCase().padStart(2, '0')}`;
+        }
+    }
+    return out;
+}
+function toAmzDate(now) {
+    const iso = now.toISOString(); // e.g. 2026-05-18T10:00:00.000Z
+    const amzDate = `${iso.slice(0, 4)}${iso.slice(5, 7)}${iso.slice(8, 10)}T${iso.slice(11, 13)}${iso.slice(14, 16)}${iso.slice(17, 19)}Z`;
+    return { amzDate, dateStamp: amzDate.slice(0, 8) };
+}
+/**
+ * The verified SigV4 computation: canonical request → string-to-sign → signing
+ * key → signature. Verified against AWS's official `get-vanilla` test vector.
+ */
+export function computeSigV4(input) {
+    const lowered = new Map();
+    for (const [name, value] of Object.entries(input.headersToSign)) {
+        lowered.set(name.toLowerCase(), value.trim());
+    }
+    const names = [...lowered.keys()].sort();
+    const canonicalHeaders = names.map((n) => `${n}:${lowered.get(n)}\n`).join('');
+    const signedHeaders = names.join(';');
+    const canonicalQuery = [...input.query]
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .map(([k, v]) => `${awsUriEncode(k, true)}=${awsUriEncode(v, true)}`)
+        .join('&');
+    const canonicalRequest = [
+        input.method,
+        input.canonicalPath,
+        canonicalQuery,
+        canonicalHeaders,
+        signedHeaders,
+        input.payloadHash,
+    ].join('\n');
+    const dateStamp = input.amzDate.slice(0, 8);
+    const scope = `${dateStamp}/${input.region}/${input.service}/aws4_request`;
+    const stringToSign = [ALGORITHM, input.amzDate, scope, sha256Hex(canonicalRequest)].join('\n');
+    const kDate = hmac(`AWS4${input.secretAccessKey}`, dateStamp);
+    const kRegion = hmac(kDate, input.region);
+    const kService = hmac(kRegion, input.service);
+    const kSigning = hmac(kService, 'aws4_request');
+    const signature = createHmac('sha256', kSigning).update(stringToSign, 'utf8').digest('hex');
+    return { signature, signedHeaders, scope, canonicalQuery };
+}
+/**
+ * Build a signed R2 request: a path-style URL + AWS4-HMAC-SHA256 Authorization
+ * header. The `host` header is signed but not returned — fetch/undici sets it
+ * from the URL (same value), and `Host` is a forbidden header to set manually.
+ */
+export function signS3Request(input) {
+    const host = `${input.accountId}.r2.cloudflarestorage.com`;
+    const { amzDate } = toAmzDate(input.now);
+    const encodedKey = (input.key ?? '')
+        .split('/')
+        .map((segment) => awsUriEncode(segment, false))
+        .join('/');
+    const canonicalPath = input.key !== undefined
+        ? `/${awsUriEncode(input.bucket, false)}/${encodedKey}`
+        : `/${awsUriEncode(input.bucket, false)}`;
+    const query = [];
+    for (const [k, v] of Object.entries(input.query ?? {})) {
+        if (v !== undefined)
+            query.push([k, v]);
+    }
+    const headersToSign = {
+        host,
+        'x-amz-date': amzDate,
+        'x-amz-content-sha256': input.payloadHash,
+    };
+    for (const [k, v] of Object.entries(input.extraHeaders ?? {})) {
+        headersToSign[k.toLowerCase()] = v;
+    }
+    const { signature, signedHeaders, scope, canonicalQuery } = computeSigV4({
+        method: input.method,
+        canonicalPath,
+        query,
+        headersToSign,
+        payloadHash: input.payloadHash,
+        amzDate,
+        region: input.region,
+        service: S3_SERVICE,
+        accessKeyId: input.accessKeyId,
+        secretAccessKey: input.secretAccessKey,
+    });
+    const headers = {
+        'x-amz-date': amzDate,
+        'x-amz-content-sha256': input.payloadHash,
+        authorization: `${ALGORITHM} Credential=${input.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
+    };
+    for (const [k, v] of Object.entries(input.extraHeaders ?? {})) {
+        headers[k.toLowerCase()] = v;
+    }
+    const url = `https://${host}${canonicalPath}${canonicalQuery ? `?${canonicalQuery}` : ''}`;
+    return { url, headers };
+}

package/dist/storage/_xml.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Minimal, dependency-free readers for the two S3/R2 XML responses we consume:
+ * ListObjectsV2 results and `<Error>` bodies. Replaces the XML codec that
+ * @aws-sdk/client-s3 used to run for us.
+ *
+ * No regex (M2): a tag's text can never contain a raw `<` (XML escapes it to
+ * `&lt;`), so `indexOf`-based tag scanning is unambiguous.
+ */
+export interface ListedObject {
+    key: string;
+    size: number;
+    lastModified: Date;
+}
+export interface ParsedList {
+    objects: ListedObject[];
+    isTruncated: boolean;
+    nextContinuationToken?: string;
+}
+/** Parse an S3 ListObjectsV2 XML response into the fields the R2 provider needs. */
+export declare function parseListObjectsV2(xml: string): ParsedList;
+/** Extract `<Code>`/`<Message>` from an S3 `<Error>` response for diagnostics. */
+export declare function s3ErrorFields(xml: string): {
+    code?: string;
+    message?: string;
+};
+//# sourceMappingURL=_xml.d.ts.map

package/dist/storage/_xml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_xml.d.ts","sourceRoot":"","sources":["../../src/storage/_xml.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA6BH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CA6B1D;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAK9E"}

package/dist/storage/_xml.js

@@ -0,0 +1,75 @@
+/**
+ * Minimal, dependency-free readers for the two S3/R2 XML responses we consume:
+ * ListObjectsV2 results and `<Error>` bodies. Replaces the XML codec that
+ * @aws-sdk/client-s3 used to run for us.
+ *
+ * No regex (M2): a tag's text can never contain a raw `<` (XML escapes it to
+ * `&lt;`), so `indexOf`-based tag scanning is unambiguous.
+ */
+/** First `<tag>…</tag>` text content at or after `from`, or undefined. */
+function firstTagValue(xml, tag, from = 0) {
+    const open = `<${tag}>`;
+    const start = xml.indexOf(open, from);
+    if (start === -1)
+        return undefined;
+    const contentStart = start + open.length;
+    const end = xml.indexOf(`</${tag}>`, contentStart);
+    if (end === -1)
+        return undefined;
+    return xml.slice(contentStart, end);
+}
+/** Decode the five predefined XML entities (no regex). `&amp;` is decoded last. */
+function decodeXmlEntities(value) {
+    if (!value.includes('&'))
+        return value;
+    return value
+        .split('&lt;')
+        .join('<')
+        .split('&gt;')
+        .join('>')
+        .split('&quot;')
+        .join('"')
+        .split('&apos;')
+        .join("'")
+        .split('&amp;')
+        .join('&');
+}
+/** Parse an S3 ListObjectsV2 XML response into the fields the R2 provider needs. */
+export function parseListObjectsV2(xml) {
+    const objects = [];
+    const contentsOpen = '<Contents>';
+    const contentsClose = '</Contents>';
+    let cursor = 0;
+    for (;;) {
+        const start = xml.indexOf(contentsOpen, cursor);
+        if (start === -1)
+            break;
+        const end = xml.indexOf(contentsClose, start);
+        if (end === -1)
+            break;
+        const block = xml.slice(start + contentsOpen.length, end);
+        const key = firstTagValue(block, 'Key');
+        if (key !== undefined) {
+            const lastModified = firstTagValue(block, 'LastModified');
+            objects.push({
+                key: decodeXmlEntities(key),
+                size: Number(firstTagValue(block, 'Size') ?? '0') || 0,
+                lastModified: lastModified ? new Date(lastModified) : new Date(0),
+            });
+        }
+        cursor = end + contentsClose.length;
+    }
+    const token = firstTagValue(xml, 'NextContinuationToken');
+    return {
+        objects,
+        isTruncated: firstTagValue(xml, 'IsTruncated') === 'true',
+        nextContinuationToken: token !== undefined ? decodeXmlEntities(token) : undefined,
+    };
+}
+/** Extract `<Code>`/`<Message>` from an S3 `<Error>` response for diagnostics. */
+export function s3ErrorFields(xml) {
+    return {
+        code: firstTagValue(xml, 'Code'),
+        message: firstTagValue(xml, 'Message'),
+    };
+}

package/dist/storage/r2.d.ts

@@ -1,12 +1,24 @@
 /**
  * Cloudflare R2 implementation of StorageProvider.
  *
- * R2 is S3-compatible — uses @aws-sdk/client-s3 with a custom endpoint and
- * region='auto'. See https://developers.cloudflare.com/r2/api/s3/api/.
+ * R2 is S3-compatible. This is a native client: AWS SigV4 request signing
+ * (./_sigv4.ts, verified against AWS's official test vector) over global
+ * `fetch`, plus a small XML reader for ListObjectsV2 (./_xml.ts). No SDK
+ * dependency — only node:crypto + fetch.
+ *
+ * Path-style addressing is used for the S3 API calls
+ * (https://<account>.r2.cloudflarestorage.com/<bucket>/<key>); this has no
+ * effect on the public object URLs, which are built from `publicBaseUrl`.
  *
  * GAP-208 Phase 2a (2026-05-18). Phase 1 (interface + types) shipped in #959.
+ * Native client (dropping @aws-sdk/client-s3) landed 2026-06-09.
  *
  * Server-only. Do NOT import from client-side code or edge runtime.
+ *
+ * Known limitation (unchanged from the SDK version): request bodies are
+ * buffered fully in memory (see toUint8Array) so the payload can be hashed for
+ * SigV4. Streaming uploads (STREAMING-AWS4-HMAC-SHA256-PAYLOAD) are a future
+ * enhancement; presigned/private URLs remain Phase 2b.
  */
 import type { R2Config, StorageProvider } from './types.js';
 export declare function createR2Provider(config: R2Config): StorageProvider;

package/dist/storage/r2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/storage/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EAMV,QAAQ,EACR,eAAe,EAChB,MAAM,YAAY,CAAC;AAsHpB,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAElE"}
+{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/storage/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAMV,QAAQ,EACR,eAAe,EAChB,MAAM,YAAY,CAAC;AAkKpB,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAElE"}

package/dist/storage/r2.js

@@ -1,21 +1,37 @@
 /**
  * Cloudflare R2 implementation of StorageProvider.
  *
- * R2 is S3-compatible — uses @aws-sdk/client-s3 with a custom endpoint and
- * region='auto'. See https://developers.cloudflare.com/r2/api/s3/api/.
+ * R2 is S3-compatible. This is a native client: AWS SigV4 request signing
+ * (./_sigv4.ts, verified against AWS's official test vector) over global
+ * `fetch`, plus a small XML reader for ListObjectsV2 (./_xml.ts). No SDK
+ * dependency — only node:crypto + fetch.
+ *
+ * Path-style addressing is used for the S3 API calls
+ * (https://<account>.r2.cloudflarestorage.com/<bucket>/<key>); this has no
+ * effect on the public object URLs, which are built from `publicBaseUrl`.
  *
  * GAP-208 Phase 2a (2026-05-18). Phase 1 (interface + types) shipped in #959.
+ * Native client (dropping @aws-sdk/client-s3) landed 2026-06-09.
  *
  * Server-only. Do NOT import from client-side code or edge runtime.
+ *
+ * Known limitation (unchanged from the SDK version): request bodies are
+ * buffered fully in memory (see toUint8Array) so the payload can be hashed for
+ * SigV4. Streaming uploads (STREAMING-AWS4-HMAC-SHA256-PAYLOAD) are a future
+ * enhancement; presigned/private URLs remain Phase 2b.
  */
-import { DeleteObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
 import { toUint8Array } from './_helpers.js';
+import { EMPTY_SHA256, sha256Hex, signS3Request } from './_sigv4.js';
+import { parseListObjectsV2, s3ErrorFields } from './_xml.js';
 const PROVIDER_TAG = 'r2';
 const DEFAULT_CONTENT_TYPE = 'application/octet-stream';
 const DEFAULT_LIST_LIMIT = 1000;
+const REGION = 'auto';
 class R2Provider {
     provider = PROVIDER_TAG;
-    client;
+    accountId;
+    accessKeyId;
+    secretAccessKey;
     bucket;
     publicBaseUrl;
     constructor(config) {
@@ -25,16 +41,11 @@ class R2Provider {
                 "custom domain (e.g. 'https://media.revealui.com') or the R2 dev URL " +
                 "('https://<account-id>.r2.cloudflarestorage.com/<bucket>').");
         }
+        this.accountId = config.accountId;
+        this.accessKeyId = config.accessKeyId;
+        this.secretAccessKey = config.secretAccessKey;
         this.bucket = config.bucket;
         this.publicBaseUrl = stripTrailingSlash(config.publicBaseUrl);
-        this.client = new S3Client({
-            region: 'auto',
-            endpoint: `https://${config.accountId}.r2.cloudflarestorage.com`,
-            credentials: {
-                accessKeyId: config.accessKeyId,
-                secretAccessKey: config.secretAccessKey,
-            },
-        });
     }
     async put(key, data, opts) {
         if (opts?.access === 'private') {
@@ -43,15 +54,40 @@ class R2Provider {
                 'lands in Phase 2b.');
         }
         const body = await toUint8Array(data);
-        await this.client.send(new PutObjectCommand({
-            Bucket: this.bucket,
-            Key: key,
-            Body: body,
-            ContentType: opts?.contentType ?? DEFAULT_CONTENT_TYPE,
-            ContentLength: body.byteLength,
-            CacheControl: opts?.cacheControl,
-            Metadata: opts?.metadata,
-        }));
+        const extraHeaders = {
+            'content-type': opts?.contentType ?? DEFAULT_CONTENT_TYPE,
+        };
+        if (opts?.cacheControl) {
+            extraHeaders['cache-control'] = opts.cacheControl;
+        }
+        for (const [name, value] of Object.entries(opts?.metadata ?? {})) {
+            extraHeaders[`x-amz-meta-${name.toLowerCase()}`] = value;
+        }
+        const { url, headers } = signS3Request({
+            method: 'PUT',
+            accountId: this.accountId,
+            bucket: this.bucket,
+            key,
+            region: REGION,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            payloadHash: sha256Hex(body),
+            extraHeaders,
+            now: new Date(),
+        });
+        // No manual content-length: it is a forbidden fetch header that undici
+        // computes from the body itself, and setting it throws UND_ERR_INVALID_ARG
+        // ("invalid content-length header") on the R2 PUT. `headers` already carries
+        // the signed set. `as BodyInit` bridges the TS lib's ArrayBufferLike vs
+        // ArrayBuffer typed-array variance for fetch bodies (cf. src/api/compression.ts).
+        const response = await fetch(url, {
+            method: 'PUT',
+            headers,
+            body: body,
+        });
+        if (!response.ok) {
+            throw await storageError('PUT', key, response);
+        }
         return {
             key,
             url: `${this.publicBaseUrl}/${key}`,
@@ -61,34 +97,56 @@ class R2Provider {
     }
     async del(keyOrUrl) {
         const key = this.extractKey(keyOrUrl);
-        await this.client.send(new DeleteObjectCommand({
-            Bucket: this.bucket,
-            Key: key,
-        }));
+        const { url, headers } = signS3Request({
+            method: 'DELETE',
+            accountId: this.accountId,
+            bucket: this.bucket,
+            key,
+            region: REGION,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            payloadHash: EMPTY_SHA256,
+            now: new Date(),
+        });
+        // Best-effort: a missing key is not an error. S3/R2 returns 204 regardless;
+        // tolerate 404 defensively.
+        const response = await fetch(url, { method: 'DELETE', headers });
+        if (!response.ok && response.status !== 404) {
+            throw await storageError('DELETE', key, response);
+        }
     }
     async list(opts) {
-        const response = await this.client.send(new ListObjectsV2Command({
-            Bucket: this.bucket,
-            Prefix: opts?.prefix,
-            MaxKeys: opts?.limit ?? DEFAULT_LIST_LIMIT,
-            ContinuationToken: opts?.cursor,
-        }));
-        const items = (response.Contents ?? []).flatMap((entry) => {
-            if (!entry.Key)
-                return [];
-            return [
-                {
-                    key: entry.Key,
-                    url: `${this.publicBaseUrl}/${entry.Key}`,
-                    size: entry.Size ?? 0,
-                    uploadedAt: entry.LastModified ?? new Date(0),
-                },
-            ];
+        const { url, headers } = signS3Request({
+            method: 'GET',
+            accountId: this.accountId,
+            bucket: this.bucket,
+            region: REGION,
+            accessKeyId: this.accessKeyId,
+            secretAccessKey: this.secretAccessKey,
+            payloadHash: EMPTY_SHA256,
+            query: {
+                'list-type': '2',
+                prefix: opts?.prefix,
+                'max-keys': String(opts?.limit ?? DEFAULT_LIST_LIMIT),
+                'continuation-token': opts?.cursor,
+            },
+            now: new Date(),
         });
+        const response = await fetch(url, { method: 'GET', headers });
+        if (!response.ok) {
+            throw await storageError('LIST', this.bucket, response);
+        }
+        const parsed = parseListObjectsV2(await response.text());
+        const items = parsed.objects.map((entry) => ({
+            key: entry.key,
+            url: `${this.publicBaseUrl}/${entry.key}`,
+            size: entry.size,
+            uploadedAt: entry.lastModified,
+        }));
         return {
             items,
-            cursor: response.NextContinuationToken,
-            hasMore: response.IsTruncated === true,
+            cursor: parsed.nextContinuationToken,
+            hasMore: parsed.isTruncated,
         };
     }
     extractKey(keyOrUrl) {
@@ -104,6 +162,11 @@ export function createR2Provider(config) {
     return new R2Provider(config);
 }
 // ── helpers ────────────────────────────────────────────────────────────────
+async function storageError(operation, key, response) {
+    const body = await response.text().catch(() => '');
+    const { code, message } = s3ErrorFields(body);
+    return new Error(`R2 ${operation} failed for "${key}": ${code ?? response.status} ${message ?? response.statusText}`);
+}
 function tryParseUrl(value) {
     try {
         return new URL(value);

package/package.json

@@ -1,45 +1,44 @@
 {
   "name": "@revealui/core",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "RevealUI's runtime engine — admin UI, REST API, auth, rich text, plugin system, and access control. The heart of the open-source platform.",
   "license": "MIT",
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1053.0",
-    "@electric-sql/pglite": "^0.4.5",
-    "@lexical/clipboard": "^0.44.0",
-    "@lexical/code": "^0.44.0",
-    "@lexical/html": "^0.44.0",
-    "@lexical/link": "^0.44.0",
-    "@lexical/list": "^0.44.0",
-    "@lexical/react": "^0.44.0",
-    "@lexical/rich-text": "^0.44.0",
-    "@lexical/selection": "^0.44.0",
-    "@lexical/table": "^0.44.0",
-    "@lexical/utils": "^0.44.0",
-    "@lexical/yjs": "^0.44.0",
+    "@electric-sql/pglite": "^0.5.1",
+    "@lexical/clipboard": "^0.45.0",
+    "@lexical/code": "^0.45.0",
+    "@lexical/html": "^0.45.0",
+    "@lexical/link": "^0.45.0",
+    "@lexical/list": "^0.45.0",
+    "@lexical/react": "^0.45.0",
+    "@lexical/rich-text": "^0.45.0",
+    "@lexical/selection": "^0.45.0",
+    "@lexical/table": "^0.45.0",
+    "@lexical/utils": "^0.45.0",
+    "@lexical/yjs": "^0.45.0",
     "@vercel/blob": "^2.3.3",
     "bcryptjs": "^3.0.3",
     "dataloader": "^2.2.3",
-    "jose": "^6.2.3",
-    "lexical": "^0.44.0",
+    "jose": "^5.10.0",
+    "lexical": "^0.45.0",
     "pg": "^8.21.0",
-    "yjs": "^13.6.30",
+    "yjs": "^13.6.31",
     "zod": "^4.4.3",
-    "@revealui/cache": "0.2.1",
-    "@revealui/contracts": "0.6.0",
+    "@revealui/cache": "0.2.2",
+    "@revealui/contracts": "0.6.1",
     "@revealui/resilience": "0.2.4",
-    "@revealui/security": "0.4.0",
+    "@revealui/security": "0.4.1",
     "@revealui/utils": "0.3.5"
   },
   "devDependencies": {
     "@types/json-schema": "^7.0.15",
     "@types/pg": "^8.20.0",
-    "@types/react": "^19.2.15",
+    "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@vitest/coverage-v8": "^4.1.5",
+    "@vitest/coverage-v8": "^4.1.8",
     "expect-type": "^1.3.0",
     "tsup": "^8.5.1",
-    "vitest": "^4.1.5",
+    "vitest": "^4.1.8",
     "@revealui/dev": "0.1.0"
   },
   "engines": {