@buildinternet/uploads 0.1.0 → 0.1.1

package/README.md

@@ -1,64 +1,64 @@
-# @buildinternet/uploads
-
-CLI and client for **uploads.sh** — upload files, get public URLs, and produce GitHub-ready markdown. Successor to the R2 scripts in `buildinternet-skills/github-screenshots`.
-
-## CLI
-
-Binary: `uploads` (also `pnpm uploads` from repo root after `pnpm install`).
-
-Install globally or run a pinned version without installing:
-
-```bash
-npm install --global @buildinternet/uploads
-npx @buildinternet/uploads@0.1.0 --help
-```
-
-```bash
-pnpm uploads setup --env-file .env
-pnpm uploads attach ./before.png ./after.png --env-file .env
-pnpm uploads put ./shot.png --env-file .env
-pnpm uploads put ./after.png --pr 123 --comment --env-file .env
-pnpm uploads doctor --env-file .env
-```
-
-Commands: `attach`, `put`, `comment`, `list`, `delete`, `setup`, `config`, `doctor`, `health`.
-
-`attach` is the agent-friendly default for GitHub media. It accepts one or more files,
-infers the pull request for the current branch via `gh`, uploads stable URLs, and creates
-or updates one managed attachments comment. Use `--pr`, `--issue`, and `--repo` to select
-the target explicitly, or `--no-comment` to upload without changing GitHub comments.
-
-Config layers (first match wins): CLI flags → env vars → `--env-file` → `~/.config/buildinternet/config`. See `config.example` for keys.
-
-## Programmatic use
-
-```ts
-import { createUploadsClient } from "@buildinternet/uploads";
-```
-
-Agent/MCP helpers: `@buildinternet/uploads/agent` (`createUploadsWorkerFileTools` for Workers).
-
-## Layout
-
-```
-src/
-  cli.ts            Entry + help
-  commands.ts       put, list, delete, comment, …
-  client.ts         HTTP client for the API
-  github.ts         PR/issue key paths + attachment comments
-  embed.ts          Markdown image output
-bin/uploads.js      Bin shim
-```
-
-## Commands
-
-```bash
-pnpm build        # tsc → dist/
-pnpm typecheck
-pnpm test
-pnpm pack:check   # verify the npm tarball contents
-```
-
-Maintainer release instructions: [`docs/releasing.md`](../../docs/releasing.md).
-
-Agent-oriented usage: [`skills/uploads-cli/SKILL.md`](../../skills/uploads-cli/SKILL.md). REST details: [`docs/api.md`](../../docs/api.md).
+# @buildinternet/uploads
+
+CLI and client for **uploads.sh** — upload files, get public URLs, and produce GitHub-ready markdown. Successor to the R2 scripts in `buildinternet-skills/github-screenshots`.
+
+## CLI
+
+Binary: `uploads` (also `pnpm uploads` from repo root after `pnpm install`).
+
+Install globally or run a pinned version without installing:
+
+```bash
+npm install --global @buildinternet/uploads
+npx @buildinternet/uploads@0.1.0 --help
+```
+
+```bash
+pnpm uploads setup --env-file .env
+pnpm uploads attach ./before.png ./after.png --env-file .env
+pnpm uploads put ./shot.png --env-file .env
+pnpm uploads put ./after.png --pr 123 --comment --env-file .env
+pnpm uploads doctor --env-file .env
+```
+
+Commands: `attach`, `put`, `comment`, `list`, `delete`, `setup`, `config`, `doctor`, `health`.
+
+`attach` is the agent-friendly default for GitHub media. It accepts one or more files,
+infers the pull request for the current branch via `gh`, uploads stable URLs, and creates
+or updates one managed attachments comment. Use `--pr`, `--issue`, and `--repo` to select
+the target explicitly, or `--no-comment` to upload without changing GitHub comments.
+
+Config layers (first match wins): CLI flags → env vars → `--env-file` → `~/.config/buildinternet/config`. See `config.example` for keys.
+
+## Programmatic use
+
+```ts
+import { createUploadsClient } from "@buildinternet/uploads";
+```
+
+Agent/MCP helpers: `@buildinternet/uploads/agent` (`createUploadsWorkerFileTools` for Workers).
+
+## Layout
+
+```
+src/
+  cli.ts            Entry + help
+  commands.ts       put, list, delete, comment, …
+  client.ts         HTTP client for the API
+  github.ts         PR/issue key paths + attachment comments
+  embed.ts          Markdown image output
+bin/uploads.js      Bin shim
+```
+
+## Commands
+
+```bash
+pnpm build        # tsc → dist/
+pnpm typecheck
+pnpm test
+pnpm pack:check   # verify the npm tarball contents
+```
+
+Maintainer release instructions: [`docs/releasing.md`](../../docs/releasing.md).
+
+Agent-oriented usage: [`skills/uploads-cli/SKILL.md`](../../skills/uploads-cli/SKILL.md). REST details: [`docs/api.md`](../../docs/api.md).

package/dist/cli.js

@@ -5,53 +5,57 @@ import { commandWorkspace, isHelpFlag, parseArgv, parseCommandArgs, UsageError,
 import { runPut, runAttach, runList, runDelete, runHealth, runDoctor, runComment, } from "./commands.js";
 import { runConfig } from "./commands/config.js";
 import { runSetup } from "./commands/setup.js";
-const ROOT_HELP = `uploads — CLI for uploads.sh (GitHub image embeds)
-
-Usage:
-  uploads [globals] <command> [args]
-
-Config (first match wins, per key):
-  CLI flags           --api-url, --token, --workspace
-  environment         UPLOADS_API_URL, UPLOADS_TOKEN, UPLOADS_WORKSPACE
-  --env-file <path>
-  $BUILDINTERNET_CONFIG
-  ~/.config/buildinternet/config   (shared with github-screenshots)
-
-Workspace (within config layers):
-  --workspace, -w     override — global (before command) or per-command (after)
-  UPLOADS_WORKSPACE   env / config file
-  (else inferred from token up_<name>_…, else "default")
-
-Other globals (before command):
-  --api-url <url>     default: https://api.uploads.sh
-  --token <token>     or UPLOADS_TOKEN
-  --env-file <path>
-  --json              JSON on stdout
-  --quiet
-
-Commands:
-  attach <file...>     Attach media to the current PR (stable URLs + managed comment)
-  put <file>          Upload (+ URL + markdown for GitHub)
-  comment             Create/update a PR/issue attachments comment (via gh)
-  list                List objects
-  delete <key>        Delete object
-  setup               Guided config + token minting steps
-  config              Show path, init, or set shared config
-  doctor              Health + auth + workspace checks
-  health              API liveness (no auth)
-
-Put/list defaults (config file or env):
-  UPLOADS_DEFAULT_PREFIX, UPLOADS_DEFAULT_REPO, UPLOADS_DEFAULT_REF
-  UPLOADS_DEFAULT_WIDTH, UPLOADS_NO_GIT
-
-Examples:
-  uploads setup
-  uploads setup --token up_default_… --repo myorg/myapp
-  uploads attach ./before.png ./after.png
-  uploads put ./shot.png --ref 42
-  uploads doctor
-
-Agent/MCP: use createUploadsWorkerFileTools() from @buildinternet/uploads/agent on the Worker.
+import { runLogin } from "./commands/login.js";
+import { runAdmin } from "./commands/admin-enrollment.js";
+const ROOT_HELP = `uploads — CLI for uploads.sh (GitHub image embeds)
+
+Usage:
+  uploads [globals] <command> [args]
+
+Config (first match wins, per key):
+  CLI flags           --api-url, --token, --workspace
+  environment         UPLOADS_API_URL, UPLOADS_TOKEN, UPLOADS_WORKSPACE
+  --env-file <path>
+  $BUILDINTERNET_CONFIG
+  ~/.config/buildinternet/config   (shared with github-screenshots)
+
+Workspace (within config layers):
+  --workspace, -w     override — global (before command) or per-command (after)
+  UPLOADS_WORKSPACE   env / config file
+  (else inferred from token up_<name>_…, else "default")
+
+Other globals (before command):
+  --api-url <url>     default: https://api.uploads.sh
+  --token <token>     or UPLOADS_TOKEN
+  --env-file <path>
+  --json              JSON on stdout
+  --quiet
+
+Commands:
+  attach <file...>     Attach media to the current PR (stable URLs + managed comment)
+  put <file>          Upload (+ URL + markdown for GitHub)
+  comment             Create/update a PR/issue attachments comment (via gh)
+  list                List objects
+  delete <key>        Delete object
+  setup               Inspect/configure advanced CLI settings
+  login               Exchange an enrollment code and configure credentials
+  admin               Admin enrollment management
+  config              Show path, init, or set shared config
+  doctor              Health + auth + workspace checks
+  health              API liveness (no auth)
+
+Put/list defaults (config file or env):
+  UPLOADS_DEFAULT_PREFIX, UPLOADS_DEFAULT_REPO, UPLOADS_DEFAULT_REF
+  UPLOADS_DEFAULT_WIDTH, UPLOADS_NO_GIT
+
+Examples:
+  uploads setup
+  uploads setup --token up_default_… --repo myorg/myapp
+  uploads attach ./before.png ./after.png
+  uploads put ./shot.png --ref 42
+  uploads doctor
+
+Agent/MCP: use createUploadsWorkerFileTools() from @buildinternet/uploads/agent on the Worker.
 `;
 function createContext(globals, requireToken, commandArgs) {
     const cmdWorkspace = commandWorkspace(parseCommandArgs(commandArgs).flags);
@@ -122,6 +126,10 @@ export async function runCli(argv) {
                 return runConfig(cmdArgs, { json, envFile: parsed.globals.envFile }, showHelp);
             case "setup":
                 return runSetup(cmdArgs, { json, envFile: parsed.globals.envFile }, showHelp);
+            case "login":
+                return runLogin(cmdArgs, { json, apiUrl: resolveApiUrl(parsed.globals) }, showHelp);
+            case "admin":
+                return runAdmin(cmdArgs, { json, apiUrl: resolveApiUrl(parsed.globals) }, showHelp);
             case "attach":
             case "put":
             case "list":

package/dist/client.d.ts

@@ -43,6 +43,26 @@ export interface DeleteResult {
 export interface HealthResult {
     ok: boolean;
 }
+export interface EnrollmentExchangeResult {
+    apiUrl?: string;
+    workspace: string;
+    token: string;
+    scopes?: Array<"files:read" | "files:write" | "files:delete">;
+    expiresAt?: string;
+}
+export interface EnrollmentCreateResult {
+    code: string;
+    expiresAt: string;
+    tokenExpiresAt: string;
+}
+export declare function exchangeEnrollment(apiUrl: string, code: string): Promise<EnrollmentExchangeResult>;
+export declare function createEnrollment(apiUrl: string, adminToken: string, input: {
+    workspace?: string;
+    label?: string;
+    enrollmentSeconds?: number;
+    tokenExpiresInSeconds?: number;
+    scopes?: Array<"files:read" | "files:write" | "files:delete">;
+}): Promise<EnrollmentCreateResult>;
 export declare function createUploadsClient(config: UploadsClientConfig): {
     put(body: Uint8Array, opts: PutOptions & {
         filename: string;

package/dist/client.js

@@ -1,6 +1,32 @@
 import { inferContentType } from "./embed.js";
 import { UploadsError } from "./errors.js";
 import { buildScreenshotKey } from "./keys.js";
+async function jsonRequest(url, init) {
+    let res;
+    try {
+        res = await fetch(url, init);
+    }
+    catch (err) {
+        throw new UploadsError(err instanceof Error ? err.message : "network request failed", "NETWORK");
+    }
+    if (!res.ok)
+        throw await parseErrorResponse(res);
+    return (await res.json());
+}
+export function exchangeEnrollment(apiUrl, code) {
+    return jsonRequest(`${apiUrl.replace(/\/$/, "")}/auth/enrollments/exchange`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ code }),
+    });
+}
+export function createEnrollment(apiUrl, adminToken, input) {
+    return jsonRequest(`${apiUrl.replace(/\/$/, "")}/admin/enrollments`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${adminToken}`, "Content-Type": "application/json" },
+        body: JSON.stringify(input),
+    });
+}
 function encodeKeyPath(key) {
     return key.split("/").map(encodeURIComponent).join("/");
 }

package/dist/commands/admin-enrollment.d.ts

@@ -0,0 +1,7 @@
+type FileScope = "files:read" | "files:write" | "files:delete";
+export declare function parseScopes(raw: string | undefined): FileScope[] | undefined;
+export declare function runAdmin(args: string[], opts: {
+    json?: boolean;
+    apiUrl?: string;
+}, help?: boolean): Promise<number>;
+export {};

package/dist/commands/admin-enrollment.js

@@ -0,0 +1,59 @@
+import { createEnrollment } from "../client.js";
+import { flagInt, flagString, parseCommandArgs, UsageError } from "../cli-args.js";
+const HELP = `uploads admin enrollment create [options]
+
+Admin-only: create a short-lived, one-time enrollment code.
+
+Options:
+  --admin-token <token>  Or ADMIN_TOKEN (UPLOADS_ADMIN_TOKEN is a legacy alias)
+  --workspace <name>     Default: default
+  --label <label>
+  --expires-in <seconds> Default: server policy
+  --token-expires-in <seconds>  Upload token lifetime (default: server policy)
+  --scopes <list>        Comma-separated files:read,files:write,files:delete
+  --api-url <url>        Default: https://api.uploads.sh
+`;
+const FILE_SCOPES = new Set(["files:read", "files:write", "files:delete"]);
+export function parseScopes(raw) {
+    if (raw === undefined)
+        return undefined;
+    const scopes = raw
+        .split(",")
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    if (scopes.length === 0)
+        throw new UsageError("--scopes must contain at least one scope");
+    const invalid = scopes.find((scope) => !FILE_SCOPES.has(scope));
+    if (invalid)
+        throw new UsageError(`invalid scope: ${invalid} (expected files:read, files:write, or files:delete)`);
+    return [...new Set(scopes)];
+}
+export async function runAdmin(args, opts, help = false) {
+    const parsed = parseCommandArgs(args);
+    if (help || parsed.help) {
+        process.stderr.write(HELP);
+        return 0;
+    }
+    if (parsed.positionals[0] !== "enrollment" || parsed.positionals[1] !== "create")
+        throw new UsageError("expected: uploads admin enrollment create");
+    const adminToken = flagString(parsed.flags, "--admin-token") ??
+        process.env.ADMIN_TOKEN ??
+        process.env.UPLOADS_ADMIN_TOKEN;
+    if (!adminToken)
+        throw new UsageError("ADMIN_TOKEN is required for admin enrollment creation");
+    const apiUrl = flagString(parsed.flags, "--api-url") ?? opts.apiUrl ?? "https://api.uploads.sh";
+    const workspace = flagString(parsed.flags, "--workspace") ?? "default";
+    const label = flagString(parsed.flags, "--label");
+    const result = await createEnrollment(apiUrl, adminToken, {
+        workspace,
+        label,
+        enrollmentSeconds: flagInt(parsed.flags, "--expires-in", "--expires-in"),
+        tokenExpiresInSeconds: flagInt(parsed.flags, "--token-expires-in", "--token-expires-in"),
+        scopes: parseScopes(flagString(parsed.flags, "--scopes")),
+    });
+    if (opts.json)
+        process.stdout.write(JSON.stringify({ workspace, label: label ?? null, ...result }, null, 2) + "\n");
+    else
+        process.stdout.write(`Enrollment code (share once): ${result.code}\nworkspace: ${workspace}\nexpires: ${result.expiresAt}\n`);
+    return 0;
+}

package/dist/commands/login.d.ts

@@ -0,0 +1,11 @@
+import { parseCommandArgs } from "../cli-args.js";
+export declare function validateEnrollmentCode(raw: string): string;
+export declare function resolveEnrollmentCode(parsed: ReturnType<typeof parseCommandArgs>, io?: {
+    isTTY: boolean;
+    readLine: () => Promise<string>;
+    hiddenPrompt: () => Promise<string>;
+}): Promise<string>;
+export declare function runLogin(args: string[], opts: {
+    json?: boolean;
+    apiUrl?: string;
+}, help?: boolean): Promise<number>;

package/dist/commands/login.js

@@ -0,0 +1,160 @@
+import { stdin, stdout } from "node:process";
+import { loadConfigFile, redactToken, resolveConfigPath, writeConfigKeys, workspaceFromToken, } from "../config.js";
+import { exchangeEnrollment, createUploadsClient } from "../client.js";
+import { flagBool, flagString, parseCommandArgs, UsageError } from "../cli-args.js";
+const HELP = `uploads login [options]
+
+Exchange a one-time enrollment code for workspace credentials, save them, and
+verify access. Ask your uploads.sh administrator for an enrollment code.
+
+Options:
+  --code <code>       Code in argv (may be visible in shell history/process lists)
+  --code-stdin        Read one line from stdin
+  --non-interactive   Never prompt
+  --api-url <url>     API base (default: https://api.uploads.sh)
+  --path <file>       Config destination
+  --force             Replace existing saved credentials
+  --no-check          Skip doctor verification
+`;
+export function validateEnrollmentCode(raw) {
+    const code = raw.trim();
+    if (!/^upe_[A-Za-z0-9_-]{20,}$/.test(code))
+        throw new UsageError("invalid enrollment code");
+    return code;
+}
+async function readLine() {
+    let out = "";
+    for await (const chunk of stdin) {
+        out += String(chunk);
+        if (out.includes("\n"))
+            break;
+    }
+    return out.split(/\r?\n/, 1)[0] ?? "";
+}
+async function hiddenPrompt() {
+    if (!stdin.isTTY || typeof stdin.setRawMode !== "function")
+        return readLine();
+    stdout.write("Enrollment code: ");
+    stdin.setRawMode(true);
+    stdin.resume();
+    return new Promise((resolve, reject) => {
+        let value = "";
+        let settled = false;
+        const done = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            stdin.off("data", onData);
+            stdin.off("error", onError);
+            try {
+                stdin.setRawMode(false);
+            }
+            finally {
+                stdin.pause();
+                stdout.write("\n");
+            }
+            if (err)
+                reject(err);
+            else
+                resolve(value);
+        };
+        const onData = (chunk) => {
+            for (const char of chunk.toString("utf8")) {
+                if (char === "\r" || char === "\n")
+                    return done();
+                if (char === "\u0003")
+                    return done(new UsageError("login cancelled"));
+                if (char === "\u007f")
+                    value = value.slice(0, -1);
+                else
+                    value += char;
+            }
+        };
+        const onError = (err) => done(err);
+        stdin.on("data", onData);
+        stdin.on("error", onError);
+    });
+}
+export async function resolveEnrollmentCode(parsed, io = {
+    isTTY: Boolean(stdin.isTTY),
+    readLine,
+    hiddenPrompt,
+}) {
+    const direct = flagString(parsed.flags, "--code");
+    const env = process.env.UPLOADS_ENROLLMENT_CODE;
+    const fromStdin = flagBool(parsed.flags, "--code-stdin");
+    const sources = [Boolean(direct), Boolean(env), fromStdin].filter(Boolean).length;
+    if (sources > 1)
+        throw new UsageError("provide enrollment code through only one source");
+    if (direct)
+        return validateEnrollmentCode(direct);
+    if (env)
+        return validateEnrollmentCode(env);
+    if (fromStdin)
+        return validateEnrollmentCode(await io.readLine());
+    if (flagBool(parsed.flags, "--non-interactive"))
+        throw new UsageError("enrollment code required in non-interactive mode");
+    if (!io.isTTY)
+        return validateEnrollmentCode(await io.readLine());
+    return validateEnrollmentCode(await io.hiddenPrompt());
+}
+export async function runLogin(args, opts, help = false) {
+    const parsed = parseCommandArgs(args);
+    if (help || parsed.help) {
+        process.stderr.write(HELP);
+        return 0;
+    }
+    const apiUrl = flagString(parsed.flags, "--api-url") ?? opts.apiUrl ?? "https://api.uploads.sh";
+    const path = flagString(parsed.flags, "--path") ?? resolveConfigPath();
+    const force = flagBool(parsed.flags, "--force");
+    const existing = loadConfigFile(path);
+    if (existing.UPLOADS_TOKEN && !force)
+        throw new UsageError(`credentials already exist in ${path}; use --force to replace them`);
+    if (process.env.UPLOADS_TOKEN && !force)
+        throw new UsageError("UPLOADS_TOKEN is already set in the environment; unset it or use --force");
+    const code = await resolveEnrollmentCode(parsed);
+    const result = await exchangeEnrollment(apiUrl, code);
+    const encoded = workspaceFromToken(result.token);
+    if (!encoded || encoded !== result.workspace || /[\r\n]/.test(result.token))
+        throw new UsageError("enrollment returned invalid credentials");
+    const savedApiUrl = result.apiUrl ?? apiUrl;
+    const write = writeConfigKeys(path, {
+        UPLOADS_API_URL: savedApiUrl,
+        UPLOADS_WORKSPACE: result.workspace,
+        UPLOADS_TOKEN: result.token,
+    }, { force });
+    if (!["UPLOADS_API_URL", "UPLOADS_WORKSPACE", "UPLOADS_TOKEN"].every((key) => write.updated.includes(key)))
+        throw new UsageError("credentials were not fully written; retry with --force");
+    const checked = !flagBool(parsed.flags, "--no-check");
+    let doctor = { ok: true, error: undefined };
+    if (checked) {
+        try {
+            const client = createUploadsClient({
+                apiUrl: savedApiUrl,
+                workspace: result.workspace,
+                token: result.token,
+            });
+            const health = await client.health();
+            if (!health.ok)
+                throw new Error("API unhealthy");
+            await client.list({ limit: 1 });
+        }
+        catch (err) {
+            doctor = { ok: false, error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    const payload = {
+        ok: doctor.ok,
+        configPath: path,
+        workspace: result.workspace,
+        token: redactToken(result.token),
+        doctor: checked ? doctor : { skipped: true },
+    };
+    if (opts.json)
+        process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+    else {
+        process.stdout.write(`saved credentials to ${path}\nworkspace: ${result.workspace}\ntoken: ${redactToken(result.token)}\n`);
+        process[doctor.ok ? "stdout" : "stderr"].write(`doctor: ${checked ? (doctor.ok ? "ok" : `failed — ${doctor.error}`) : "skipped"}\n`);
+    }
+    return doctor.ok ? 0 : 1;
+}

package/dist/commands/setup.js

@@ -13,7 +13,7 @@ With flags: saves provided values, then optionally verifies with doctor.
 Options:
   --api-url <url>       API base (default: ${DEFAULT_API_URL})
   --workspace, -w <name>
-  --token <token>       Bearer token (mint via admin endpoint — see below)
+  --token <token>       Existing bearer token (or use uploads login)
   --prefix <path>       Default key prefix for put/list (default: screenshots)
   --repo <owner/repo>   Default repo segment for put
   --ref <id>            Default ref segment for put (PR/issue/branch/date)
@@ -41,15 +41,6 @@ function buildStatus(envFile) {
         sources: describeConfigSources({ envFile }),
     };
 }
-function mintTokenCommand(apiUrl, workspace) {
-    const body = workspace && workspace !== DEFAULT_WORKSPACE
-        ? ` \\\n  -H "Content-Type: application/json" \\\n  -d '{"workspace":"${workspace}","label":"cli"}'`
-        : "";
-    return [
-        `curl -XPOST ${apiUrl}/admin/tokens \\`,
-        `  -H "Authorization: Bearer $ADMIN_TOKEN"${body}`,
-    ].join("\n");
-}
 function formatWizard(status) {
     const lines = ["uploads setup", ""];
     lines.push(`Config file: ${status.configPath}`);
@@ -72,11 +63,10 @@ function formatWizard(status) {
     }
     lines.push("");
     if (!status.token) {
-        lines.push("Step 1 — Mint a token");
-        lines.push("  You need ADMIN_TOKEN for the API (ask your uploads.sh admin, or set it locally in apps/api/.dev.vars).");
-        lines.push("  Mint:");
-        lines.push(`    ${mintTokenCommand(status.apiUrl, status.workspace)}`);
-        lines.push("  Save:");
+        lines.push("Step 1 — Sign in");
+        lines.push("  Ask your uploads.sh administrator for a one-time enrollment code, then run:");
+        lines.push("    uploads login");
+        lines.push("  If you already have a bearer token:");
         lines.push("    uploads setup --token up_<workspace>_…");
         lines.push("");
     }
@@ -217,7 +207,7 @@ export async function runSetup(args, opts, help = false) {
         process.stderr.write("hint: run uploads doctor to verify\n");
     }
     else {
-        process.stderr.write("hint: run uploads setup to see minting instructions\n");
+        process.stderr.write("hint: run uploads login with an admin-provided enrollment code\n");
     }
     return doctorOk === false ? 1 : 0;
 }

package/dist/commands.js

@@ -16,29 +16,29 @@ async function writeJson(value) {
     await writeStdout(JSON.stringify(value, null, 2) + "\n");
 }
 // --- put ---
-const PUT_HELP = `uploads put <file> [options]
-
-Upload an image for GitHub embeds. Use "-" for stdin.
-
-Options:
-  --key <key>           Object key (default: <prefix>/<repo>/<ref>/<name>-<hash>.<ext>)
-  --prefix <path>       Key prefix (default: screenshots, or UPLOADS_DEFAULT_PREFIX)
-  --repo <owner/repo>   Repo segment (default: git remote, or UPLOADS_DEFAULT_REPO)
-  --ref <id>            PR/issue/branch segment (default: today, or UPLOADS_DEFAULT_REF)
-  --alt <text>          Alt text (default: filename)
-  --width <px>          <img width=…> markdown (or UPLOADS_DEFAULT_WIDTH)
-  --content-type <mime> Override Content-Type
-  --no-git              Don't derive --repo from git (or UPLOADS_NO_GIT=1)
-  --workspace, -w <name>  Override workspace (wins over UPLOADS_WORKSPACE and token inference)
-  --format human|url|markdown|json
-  --pr <num>            Attach to a pull request: key gh/<owner>/<repo>/pull/<num>/<name> (stable URL, no hash)
-  --issue <num>         Attach to an issue: key gh/<owner>/<repo>/issues/<num>/<name>
-  --comment             With --pr/--issue: create/update the attachments comment via your local gh auth
-
-Examples:
-  uploads put ./shot.png --repo myorg/myapp --ref 1722 --alt "New cards" --width 700
-  uploads --env-file .env put ./shot.png
-  uploads --env-file .env put ./after.png --pr 123 --comment
+const PUT_HELP = `uploads put <file> [options]
+
+Upload an image for GitHub embeds. Use "-" for stdin.
+
+Options:
+  --key <key>           Object key (default: <prefix>/<repo>/<ref>/<name>-<hash>.<ext>)
+  --prefix <path>       Key prefix (default: screenshots, or UPLOADS_DEFAULT_PREFIX)
+  --repo <owner/repo>   Repo segment (default: git remote, or UPLOADS_DEFAULT_REPO)
+  --ref <id>            PR/issue/branch segment (default: today, or UPLOADS_DEFAULT_REF)
+  --alt <text>          Alt text (default: filename)
+  --width <px>          <img width=…> markdown (or UPLOADS_DEFAULT_WIDTH)
+  --content-type <mime> Override Content-Type
+  --no-git              Don't derive --repo from git (or UPLOADS_NO_GIT=1)
+  --workspace, -w <name>  Override workspace (wins over UPLOADS_WORKSPACE and token inference)
+  --format human|url|markdown|json
+  --pr <num>            Attach to a pull request: key gh/<owner>/<repo>/pull/<num>/<name> (stable URL, no hash)
+  --issue <num>         Attach to an issue: key gh/<owner>/<repo>/issues/<num>/<name>
+  --comment             With --pr/--issue: create/update the attachments comment via your local gh auth
+
+Examples:
+  uploads put ./shot.png --repo myorg/myapp --ref 1722 --alt "New cards" --width 700
+  uploads --env-file .env put ./shot.png
+  uploads --env-file .env put ./after.png --pr 123 --comment
 `;
 /** Reads --pr/--issue (+ --repo) into a GhTarget; undefined when neither flag is present. */
 function ghTargetFromFlags(flags, run) {
@@ -72,23 +72,23 @@ async function syncAttachmentsComment(ctx, target, run) {
     return { action: created ? "created" : "updated", count: items.length };
 }
 // --- attach ---
-const ATTACH_HELP = `uploads attach <file...> [options]
-
-Upload one or more stable PR/issue attachments and maintain a single GitHub
-comment. With no target, uses the pull request for the current branch.
-
-Options:
-  --pr <num>            Attach to this pull request
-  --issue <num>         Attach to this issue
-  --repo <owner/repo>   Repository (default: gh/git inference)
-  --no-comment          Upload only; don't create/update the managed comment
-  --content-type <mime> Override Content-Type (applied to every file)
-  --workspace, -w <name>  Override workspace
-
-Examples:
-  uploads attach ./before.png ./after.png
-  uploads attach ./shot.png --pr 123 --repo myorg/myapp
-  uploads attach ./artifact.zip --issue 45 --no-comment
+const ATTACH_HELP = `uploads attach <file...> [options]
+
+Upload one or more stable PR/issue attachments and maintain a single GitHub
+comment. With no target, uses the pull request for the current branch.
+
+Options:
+  --pr <num>            Attach to this pull request
+  --issue <num>         Attach to this issue
+  --repo <owner/repo>   Repository (default: gh/git inference)
+  --no-comment          Upload only; don't create/update the managed comment
+  --content-type <mime> Override Content-Type (applied to every file)
+  --workspace, -w <name>  Override workspace
+
+Examples:
+  uploads attach ./before.png ./after.png
+  uploads attach ./shot.png --pr 123 --repo myorg/myapp
+  uploads attach ./artifact.zip --issue 45 --no-comment
 `;
 export async function runAttach(ctx, args, help = false, run = execRunner) {
     const parsed = parseCommandArgs(args);
@@ -243,14 +243,14 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
     return 0;
 }
 // --- list ---
-const LIST_HELP = `uploads list [--prefix <p>] [--pr <num> | --issue <num>] [--repo <owner/name>] [--limit <n>] [--cursor <c>] [--all] [--workspace <name>]
-
-Default prefix: UPLOADS_DEFAULT_PREFIX (screenshots if unset).
-
-Examples:
-  uploads list --prefix screenshots/
-  uploads list --pr 123
-  uploads list --all --json
+const LIST_HELP = `uploads list [--prefix <p>] [--pr <num> | --issue <num>] [--repo <owner/name>] [--limit <n>] [--cursor <c>] [--all] [--workspace <name>]
+
+Default prefix: UPLOADS_DEFAULT_PREFIX (screenshots if unset).
+
+Examples:
+  uploads list --prefix screenshots/
+  uploads list --pr 123
+  uploads list --all --json
 `;
 export async function runList(ctx, args, help = false, run = execRunner) {
     const parsed = parseCommandArgs(args);
@@ -296,10 +296,10 @@ export async function runList(ctx, args, help = false, run = execRunner) {
     return 0;
 }
 // --- delete ---
-const DELETE_HELP = `uploads delete <key> [--dry-run] [--workspace <name>]
-
-Examples:
-  uploads delete screenshots/myapp/42/shot-a1b2c3.png
+const DELETE_HELP = `uploads delete <key> [--dry-run] [--workspace <name>]
+
+Examples:
+  uploads delete screenshots/myapp/42/shot-a1b2c3.png
 `;
 export async function runDelete(ctx, args, help = false) {
     const parsed = parseCommandArgs(args);
@@ -327,16 +327,16 @@ export async function runDelete(ctx, args, help = false) {
     return 0;
 }
 // --- comment ---
-const COMMENT_HELP = `uploads comment (--pr <num> | --issue <num>) [--repo <owner/name>] [--workspace <name>]
-
-Create or update the managed attachments comment on a GitHub PR or issue,
-listing everything uploaded for it. Uses your local gh auth. Finds its own
-prior comment via a hidden marker and edits it in place; never touches other
-comments or the description.
-
-Examples:
-  uploads --env-file .env comment --pr 123
-  uploads comment --issue 45 --repo buildinternet/uploads
+const COMMENT_HELP = `uploads comment (--pr <num> | --issue <num>) [--repo <owner/name>] [--workspace <name>]
+
+Create or update the managed attachments comment on a GitHub PR or issue,
+listing everything uploaded for it. Uses your local gh auth. Finds its own
+prior comment via a hidden marker and edits it in place; never touches other
+comments or the description.
+
+Examples:
+  uploads --env-file .env comment --pr 123
+  uploads comment --issue 45 --repo buildinternet/uploads
 `;
 export async function runComment(ctx, args, help = false, run = execRunner) {
     const parsed = parseCommandArgs(args);
@@ -359,13 +359,13 @@ export async function runComment(ctx, args, help = false, run = execRunner) {
     return 0;
 }
 // --- health & doctor ---
-const HEALTH_HELP = `uploads health
-
-API liveness (no auth).
-
-Examples:
-  uploads health
-  uploads --api-url http://localhost:8787 health
+const HEALTH_HELP = `uploads health
+
+API liveness (no auth).
+
+Examples:
+  uploads health
+  uploads --api-url http://localhost:8787 health
 `;
 export async function runHealth(ctx, args, help = false) {
     if (help || parseCommandArgs(args).help) {
@@ -383,13 +383,13 @@ export async function runHealth(ctx, args, help = false) {
         await writeStdout(result.ok ? `ok (${ctx.apiUrl})\n` : `unhealthy (${ctx.apiUrl})\n`);
     return result.ok ? 0 : 1;
 }
-const DOCTOR_HELP = `uploads doctor [--workspace <name>]
-
-Checks API health, token auth, and workspace/token alignment.
-
-Examples:
-  uploads --env-file .env doctor
-  uploads --workspace acme --env-file .env doctor
+const DOCTOR_HELP = `uploads doctor [--workspace <name>]
+
+Checks API health, token auth, and workspace/token alignment.
+
+Examples:
+  uploads --env-file .env doctor
+  uploads --workspace acme --env-file .env doctor
 `;
 export async function runDoctor(ctx, args, help = false) {
     if (help || parseCommandArgs(args).help) {

package/dist/config-file.js

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { homedir } from "node:os";
 export const UPLOADS_CONFIG_KEYS = [
@@ -162,6 +162,10 @@ const INIT_HEADER = `# uploads.sh CLI — shared buildinternet config
 /** Create or update UPLOADS_* keys in the shared config file. Preserves other keys. */
 export function writeConfigKeys(path, keys, opts) {
     const entries = Object.entries(keys).filter(([, v]) => v !== undefined && v !== "");
+    for (const [key, value] of entries) {
+        if (/[\r\n]/.test(value))
+            throw new Error(`invalid newline in ${key}`);
+    }
     if (entries.length === 0) {
         throw new Error("no config values to write");
     }
@@ -187,7 +191,15 @@ export function writeConfigKeys(path, keys, opts) {
             updated.push(key);
         }
     }
-    writeFileSync(path, lines.join("\n").replace(/\n*$/, "\n"), "utf8");
+    const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
+    writeFileSync(tmp, lines.join("\n").replace(/\n*$/, "\n"), { encoding: "utf8", mode: 0o600 });
+    renameSync(tmp, path);
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        /* Windows/filesystems may not support modes. */
+    }
     return { path, created: !existed, updated };
 }
 export function configValuesFromClient(config, defaults) {

package/dist/config.js

@@ -141,6 +141,7 @@ export function resolveConfig(flags) {
 function missingTokenMessage(configPath) {
     return [
         "UPLOADS_TOKEN is required.",
+        "  uploads login                         # exchange an admin-provided enrollment code",
         `  uploads setup --token <token>         # guided setup → ${configPath}`,
         `  uploads config init --token <token>   # writes ${configPath}`,
         "  or set UPLOADS_TOKEN in env, pass --token, or use --env-file",

package/package.json

@@ -1,60 +1,60 @@
-{
-  "name": "@buildinternet/uploads",
-  "version": "0.1.0",
-  "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
-  "type": "module",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/buildinternet/uploads.git",
-    "directory": "packages/uploads"
-  },
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    },
-    "./agent": {
-      "types": "./dist/agent.d.ts",
-      "import": "./dist/agent.js"
-    }
-  },
-  "bin": {
-    "uploads": "./bin/uploads.js"
-  },
-  "files": [
-    "bin",
-    "dist",
-    "README.md"
-  ],
-  "scripts": {
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit",
-    "build": "tsc",
-    "pack:check": "node ./scripts/check-pack.mjs",
-    "prepublishOnly": "npm run build"
-  },
-  "engines": {
-    "node": ">=22"
-  },
-  "peerDependencies": {
-    "files-sdk": "^2.1.0"
-  },
-  "peerDependenciesMeta": {
-    "files-sdk": {
-      "optional": true
-    }
-  },
-  "devDependencies": {
-    "@types/node": "^26.1.0",
-    "ai": "^6.0.0",
-    "files-sdk": "^2.1.0",
-    "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
-  },
-  "publishConfig": {
-    "access": "public",
-    "provenance": true
-  }
-}
+{
+  "name": "@buildinternet/uploads",
+  "version": "0.1.1",
+  "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/buildinternet/uploads.git",
+    "directory": "packages/uploads"
+  },
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./agent": {
+      "types": "./dist/agent.d.ts",
+      "import": "./dist/agent.js"
+    }
+  },
+  "bin": {
+    "uploads": "bin/uploads.js"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "build": "tsc",
+    "pack:check": "node ./scripts/check-pack.mjs",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "peerDependencies": {
+    "files-sdk": "^2.1.0"
+  },
+  "peerDependenciesMeta": {
+    "files-sdk": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.0",
+    "ai": "^6.0.0",
+    "files-sdk": "^2.1.0",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.10"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}