@buildinternet/uploads 0.1.0 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Build Internet
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,64 +1,79 @@
-# @buildinternet/uploads
-
-CLI and client for **uploads.sh** — upload files, get public URLs, and produce GitHub-ready markdown. Successor to the R2 scripts in `buildinternet-skills/github-screenshots`.
-
-## CLI
-
-Binary: `uploads` (also `pnpm uploads` from repo root after `pnpm install`).
-
-Install globally or run a pinned version without installing:
-
-```bash
-npm install --global @buildinternet/uploads
-npx @buildinternet/uploads@0.1.0 --help
-```
-
-```bash
-pnpm uploads setup --env-file .env
-pnpm uploads attach ./before.png ./after.png --env-file .env
-pnpm uploads put ./shot.png --env-file .env
-pnpm uploads put ./after.png --pr 123 --comment --env-file .env
-pnpm uploads doctor --env-file .env
-```
-
-Commands: `attach`, `put`, `comment`, `list`, `delete`, `setup`, `config`, `doctor`, `health`.
-
-`attach` is the agent-friendly default for GitHub media. It accepts one or more files,
-infers the pull request for the current branch via `gh`, uploads stable URLs, and creates
-or updates one managed attachments comment. Use `--pr`, `--issue`, and `--repo` to select
-the target explicitly, or `--no-comment` to upload without changing GitHub comments.
-
-Config layers (first match wins): CLI flags → env vars → `--env-file` → `~/.config/buildinternet/config`. See `config.example` for keys.
-
-## Programmatic use
-
-```ts
-import { createUploadsClient } from "@buildinternet/uploads";
-```
-
-Agent/MCP helpers: `@buildinternet/uploads/agent` (`createUploadsWorkerFileTools` for Workers).
-
-## Layout
-
-```
-src/
-  cli.ts            Entry + help
-  commands.ts       put, list, delete, comment, …
-  client.ts         HTTP client for the API
-  github.ts         PR/issue key paths + attachment comments
-  embed.ts          Markdown image output
-bin/uploads.js      Bin shim
-```
-
-## Commands
-
-```bash
-pnpm build        # tsc → dist/
-pnpm typecheck
-pnpm test
-pnpm pack:check   # verify the npm tarball contents
-```
-
-Maintainer release instructions: [`docs/releasing.md`](../../docs/releasing.md).
-
-Agent-oriented usage: [`skills/uploads-cli/SKILL.md`](../../skills/uploads-cli/SKILL.md). REST details: [`docs/api.md`](../../docs/api.md).
+# @buildinternet/uploads
+
+CLI and client for **uploads.sh** — upload files, get public URLs, and produce GitHub-ready markdown. Successor to the R2 scripts in `buildinternet-skills/github-screenshots`.
+
+## CLI
+
+Binary: `uploads` (also `pnpm uploads` from repo root after `pnpm install`).
+
+Install globally or run a pinned version without installing:
+
+```bash
+npm install --global @buildinternet/uploads
+npx @buildinternet/uploads@0.1.0 --help
+```
+
+```bash
+pnpm uploads setup --env-file .env
+pnpm uploads attach ./before.png ./after.png --env-file .env
+pnpm uploads put ./shot.png --env-file .env
+pnpm uploads put ./after.png --pr 123 --comment --env-file .env
+pnpm uploads doctor --env-file .env
+```
+
+Commands: `attach`, `put`, `comment`, `list`, `delete`, `usage`, `reconcile`,
+`purge-expired`, `setup`, `install`, `config`, `doctor`, `health`, `mcp`.
+
+`attach` is the agent-friendly default for GitHub media. It accepts one or more files,
+infers the pull request for the current branch via `gh`, uploads stable URLs, and creates
+or updates one managed attachments comment. Use `--pr`, `--issue`, and `--repo` to select
+the target explicitly, or `--no-comment` to upload without changing GitHub comments.
+
+Config layers (first match wins): CLI flags → env vars → `--env-file` → `~/.config/buildinternet/config`. See `config.example` for keys.
+
+## MCP server
+
+`uploads mcp` serves the Model Context Protocol over stdio (newline-delimited JSON-RPC, no extra dependencies). Tools mirror the CLI commands one-to-one — `put`, `attach`, `list`, `delete`, `usage`, `reconcile`, `purge_expired`, `comment`, `health`, `doctor` — with the same config resolution and defaults, plus a per-call `workspace` argument. Interactive/credential commands (`setup`, `login`, `admin`, `config`) are not exposed. A token isn't required to start the server; auth errors surface per tool call (`health` needs no auth).
+
+```json
+{ "command": "uploads", "args": ["--env-file", "/path/to/.env", "mcp"] }
+```
+
+Or with `UPLOADS_TOKEN`/`UPLOADS_WORKSPACE` in the environment or user config. Claude Code: `claude mcp add uploads -- uploads --env-file /path/to/.env mcp`.
+
+For HTTP clients there's also a hosted variant at `https://agents.uploads.sh/mcp` — the workspace is inferred from the bearer token, so only the URL and token are needed (`https://agents.uploads.sh/<workspace>/mcp` and the `mcp.uploads.sh` hostname also work). Tools: put/list/delete/health, same bearer tokens as the REST API — see `apps/mcp` in the repo. `uploads install` registers it with Claude Code (and installs the agent skill) in one step. Its `put` takes no content type: the stored type is sniffed server-side from the bytes and checked against the workspace allowlist, and writes are rate limited per workspace.
+
+## Programmatic use
+
+```ts
+import { createUploadsClient } from "@buildinternet/uploads";
+```
+
+Agent/MCP helpers: `@buildinternet/uploads/agent` (`createUploadsWorkerFileTools` for Workers); for local stdio MCP, use `uploads mcp` (above).
+
+## Layout
+
+```
+src/
+  cli.ts            Entry + help
+  commands.ts       put, list, delete, comment, …
+  commands/mcp.ts   `mcp` command entry
+  mcp/              Stdio MCP server (server.ts, tools.ts)
+  client.ts         HTTP client for the API
+  github.ts         PR/issue key paths + attachment comments
+  embed.ts          Markdown image output
+bin/uploads.js      Bin shim
+```
+
+## Commands
+
+```bash
+pnpm build        # tsc → dist/
+pnpm typecheck
+pnpm test
+pnpm pack:check   # verify the npm tarball contents
+```
+
+Maintainer release instructions: [`docs/releasing.md`](../../docs/releasing.md).
+
+Agent-oriented usage: [`skills/uploads-cli/SKILL.md`](../../skills/uploads-cli/SKILL.md). REST details: [`docs/api.md`](../../docs/api.md).

package/dist/cli.js

@@ -2,56 +2,70 @@ import { createUploadsClient } from "./client.js";
 import { resolveApiUrl, resolveConfig } from "./config.js";
 import { UploadsError } from "./errors.js";
 import { commandWorkspace, isHelpFlag, parseArgv, parseCommandArgs, UsageError, } from "./cli-args.js";
-import { runPut, runAttach, runList, runDelete, runHealth, runDoctor, runComment, } from "./commands.js";
+import { runPut, runAttach, runList, runDelete, runHealth, runDoctor, runComment, runUsage, runReconcile, runPurgeExpired, } from "./commands.js";
 import { runConfig } from "./commands/config.js";
 import { runSetup } from "./commands/setup.js";
-const ROOT_HELP = `uploads — CLI for uploads.sh (GitHub image embeds)
-
-Usage:
-  uploads [globals] <command> [args]
-
-Config (first match wins, per key):
-  CLI flags           --api-url, --token, --workspace
-  environment         UPLOADS_API_URL, UPLOADS_TOKEN, UPLOADS_WORKSPACE
-  --env-file <path>
-  $BUILDINTERNET_CONFIG
-  ~/.config/buildinternet/config   (shared with github-screenshots)
-
-Workspace (within config layers):
-  --workspace, -w     override — global (before command) or per-command (after)
-  UPLOADS_WORKSPACE   env / config file
-  (else inferred from token up_<name>_…, else "default")
-
-Other globals (before command):
-  --api-url <url>     default: https://api.uploads.sh
-  --token <token>     or UPLOADS_TOKEN
-  --env-file <path>
-  --json              JSON on stdout
-  --quiet
-
-Commands:
-  attach <file...>     Attach media to the current PR (stable URLs + managed comment)
-  put <file>          Upload (+ URL + markdown for GitHub)
-  comment             Create/update a PR/issue attachments comment (via gh)
-  list                List objects
-  delete <key>        Delete object
-  setup               Guided config + token minting steps
-  config              Show path, init, or set shared config
-  doctor              Health + auth + workspace checks
-  health              API liveness (no auth)
-
-Put/list defaults (config file or env):
-  UPLOADS_DEFAULT_PREFIX, UPLOADS_DEFAULT_REPO, UPLOADS_DEFAULT_REF
-  UPLOADS_DEFAULT_WIDTH, UPLOADS_NO_GIT
-
-Examples:
-  uploads setup
-  uploads setup --token up_default_… --repo myorg/myapp
-  uploads attach ./before.png ./after.png
-  uploads put ./shot.png --ref 42
-  uploads doctor
-
-Agent/MCP: use createUploadsWorkerFileTools() from @buildinternet/uploads/agent on the Worker.
+import { runLogin } from "./commands/login.js";
+import { runAdmin } from "./commands/admin-enrollment.js";
+import { runMcp } from "./commands/mcp.js";
+import { runInstall } from "./commands/install.js";
+const ROOT_HELP = `uploads — CLI for uploads.sh (GitHub image embeds)
+
+Usage:
+  uploads [globals] <command> [args]
+
+Config (first match wins, per key):
+  CLI flags           --api-url, --token, --workspace
+  environment         UPLOADS_API_URL, UPLOADS_TOKEN, UPLOADS_WORKSPACE
+  --env-file <path>
+  $BUILDINTERNET_CONFIG
+  ~/.config/buildinternet/config   (shared with github-screenshots)
+
+Workspace (within config layers):
+  --workspace, -w     override — global (before command) or per-command (after)
+  UPLOADS_WORKSPACE   env / config file
+  (else inferred from token up_<name>_…, else "default")
+
+Other globals (before command):
+  --api-url <url>     default: https://api.uploads.sh
+  --token <token>     or UPLOADS_TOKEN
+  --env-file <path>
+  --json              JSON on stdout
+  --quiet
+
+Commands:
+  attach <file...>     Attach media to the current PR (stable URLs + managed comment)
+  put <file>          Upload (+ URL + markdown for GitHub)
+  comment             Create/update a PR/issue attachments comment (via gh)
+  list                List objects
+  delete <key>        Delete object
+  usage               Workspace storage / upload counters
+  reconcile           Rebuild usage ledger from storage
+  purge-expired       Delete objects past retentionDays
+  setup               Inspect/configure advanced CLI settings
+  install             Install the agent skill + register the remote MCP server
+  login               Exchange an enrollment code and configure credentials
+  admin               Admin enrollment management
+  config              Show path, init, or set shared config
+  doctor              Health + auth + workspace checks
+  health              API liveness (no auth)
+  mcp                 Serve MCP over stdio (tools mirror the CLI)
+
+Put/list defaults (config file or env):
+  UPLOADS_DEFAULT_PREFIX, UPLOADS_DEFAULT_REPO, UPLOADS_DEFAULT_REF
+  UPLOADS_DEFAULT_WIDTH, UPLOADS_NO_GIT
+
+Examples:
+  uploads setup
+  uploads setup --token up_default_… --repo myorg/myapp
+  uploads attach ./before.png ./after.png
+  uploads put ./shot.png --ref 42
+  uploads doctor
+
+Agent/MCP: \`uploads install\` sets up the agent skill and the hosted MCP server
+(https://agents.uploads.sh/mcp, workspace inferred from the token). Run
+\`uploads mcp\` for local stdio, or use createUploadsWorkerFileTools()
+from @buildinternet/uploads/agent on the Worker.
 `;
 function createContext(globals, requireToken, commandArgs) {
     const cmdWorkspace = commandWorkspace(parseCommandArgs(commandArgs).flags);
@@ -80,6 +94,8 @@ function exitCode(err) {
                 return 2;
             case "UNAUTHORIZED":
             case "NOT_FOUND":
+            case "STORAGE_QUOTA":
+            case "UPLOAD_BUDGET":
                 return 3;
             case "NETWORK":
                 return 4;
@@ -122,10 +138,21 @@ export async function runCli(argv) {
                 return runConfig(cmdArgs, { json, envFile: parsed.globals.envFile }, showHelp);
             case "setup":
                 return runSetup(cmdArgs, { json, envFile: parsed.globals.envFile }, showHelp);
+            case "login":
+                return runLogin(cmdArgs, { json, apiUrl: resolveApiUrl(parsed.globals) }, showHelp);
+            case "admin":
+                return runAdmin(cmdArgs, { json, apiUrl: resolveApiUrl(parsed.globals) }, showHelp);
+            case "mcp":
+                return runMcp(cmdArgs, { globals: parsed.globals }, showHelp);
+            case "install":
+                return runInstall(cmdArgs, { globals: parsed.globals, json }, showHelp);
             case "attach":
             case "put":
             case "list":
             case "delete":
+            case "usage":
+            case "reconcile":
+            case "purge-expired":
             case "doctor":
             case "comment": {
                 const ctx = createContext(parsed.globals, !showHelp, cmdArgs);
@@ -140,6 +167,12 @@ export async function runCli(argv) {
                         return runList(ctx, cmdArgs, showHelp);
                     case "delete":
                         return runDelete(ctx, cmdArgs, showHelp);
+                    case "usage":
+                        return runUsage(ctx, cmdArgs, showHelp);
+                    case "reconcile":
+                        return runReconcile(ctx, cmdArgs, showHelp);
+                    case "purge-expired":
+                        return runPurgeExpired(ctx, cmdArgs, showHelp);
                     case "doctor":
                         return runDoctor(ctx, cmdArgs, showHelp);
                 }

package/dist/client.d.ts

@@ -43,13 +43,80 @@ export interface DeleteResult {
 export interface HealthResult {
     ok: boolean;
 }
+export interface UsageResult {
+    workspace: string;
+    bytes: number;
+    objects: number;
+    uploadsInPeriod: number;
+    periodStart: string;
+    updatedAt: string;
+    maxStorageBytes?: number;
+    storageRemainingBytes?: number;
+    maxUploadsPerPeriod?: number;
+    uploadsRemaining?: number;
+}
+export interface ReconcileResult {
+    workspace: string;
+    bytes: number;
+    objects: number;
+    previous: {
+        bytes: number;
+        objects: number;
+    };
+    changed: boolean;
+    usage: UsageResult;
+}
+export interface PurgeExpiredResult {
+    workspace: string;
+    retentionDays: number;
+    cutoff: string;
+    deleted: number;
+    freedBytes: number;
+    keys: string[];
+    keysTruncated: boolean;
+    reconcile: ReconcileResult;
+}
+export type PurgeExpiredResponse = PurgeExpiredResult | {
+    skipped: true;
+    reason: string;
+};
+export interface EnrollmentExchangeResult {
+    apiUrl?: string;
+    workspace: string;
+    token: string;
+    scopes?: Array<"files:read" | "files:write" | "files:delete">;
+    expiresAt?: string;
+}
+export interface EnrollmentCreateResult {
+    code: string;
+    expiresAt: string;
+    tokenExpiresAt: string;
+}
+export declare function exchangeEnrollment(apiUrl: string, code: string): Promise<EnrollmentExchangeResult>;
+export declare function createEnrollment(apiUrl: string, adminToken: string, input: {
+    workspace?: string;
+    label?: string;
+    enrollmentSeconds?: number;
+    tokenExpiresInSeconds?: number;
+    scopes?: Array<"files:read" | "files:write" | "files:delete">;
+}): Promise<EnrollmentCreateResult>;
 export declare function createUploadsClient(config: UploadsClientConfig): {
     put(body: Uint8Array, opts: PutOptions & {
         filename: string;
     }): Promise<PutResult>;
-    list(opts?: ListOptions): Promise<ListResult>;
+    list: (opts?: ListOptions) => Promise<ListResult>;
+    /** Follow cursors (optionally starting from one) and return every remaining item. */
+    listAll(opts?: Omit<ListOptions, "cursor"> & {
+        cursor?: string;
+    }): Promise<ListItem[]>;
     delete(key: string): Promise<DeleteResult>;
     head(key: string): Promise<HeadResult>;
     health(): Promise<HealthResult>;
+    /** Workspace storage / upload counters (+ limits when configured). */
+    usage(): Promise<UsageResult>;
+    /** Rebuild ledger bytes/objects from storage (source of truth). */
+    reconcile(): Promise<ReconcileResult>;
+    /** Delete objects past retentionDays (if set), then reconcile. */
+    purgeExpired(): Promise<PurgeExpiredResponse>;
 };
 export type UploadsClient = ReturnType<typeof createUploadsClient>;

package/dist/client.js

@@ -1,13 +1,42 @@
 import { inferContentType } from "./embed.js";
 import { UploadsError } from "./errors.js";
 import { buildScreenshotKey } from "./keys.js";
+async function jsonRequest(url, init) {
+    let res;
+    try {
+        res = await fetch(url, init);
+    }
+    catch (err) {
+        throw new UploadsError(err instanceof Error ? err.message : "network request failed", "NETWORK");
+    }
+    if (!res.ok)
+        throw await parseErrorResponse(res);
+    return (await res.json());
+}
+export function exchangeEnrollment(apiUrl, code) {
+    return jsonRequest(`${apiUrl.replace(/\/$/, "")}/auth/enrollments/exchange`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ code }),
+    });
+}
+export function createEnrollment(apiUrl, adminToken, input) {
+    return jsonRequest(`${apiUrl.replace(/\/$/, "")}/admin/enrollments`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${adminToken}`, "Content-Type": "application/json" },
+        body: JSON.stringify(input),
+    });
+}
 function encodeKeyPath(key) {
     return key.split("/").map(encodeURIComponent).join("/");
 }
 function filesBase(config) {
     return `${config.apiUrl}/v1/${encodeURIComponent(config.workspace)}/files`;
 }
-function mapApiError(status, error) {
+function usageBase(config) {
+    return `${config.apiUrl}/v1/${encodeURIComponent(config.workspace)}/usage`;
+}
+function mapApiError(status, error, code) {
     const normalized = error.toLowerCase();
     if (status === 401 || normalized === "unauthorized") {
         return new UploadsError(error, "UNAUTHORIZED", status);
@@ -18,6 +47,13 @@ function mapApiError(status, error) {
     if (status === 400 && normalized === "invalid key") {
         return new UploadsError(error, "INVALID_KEY", status);
     }
+    // Prefer stable body.code — bare 429 is also used for write rate limits.
+    if (status === 507 || code === "storage_quota_exceeded") {
+        return new UploadsError(error, "STORAGE_QUOTA", status);
+    }
+    if (code === "upload_budget_exceeded") {
+        return new UploadsError(error, "UPLOAD_BUDGET", status);
+    }
     return new UploadsError(error, "API_ERROR", status);
 }
 async function parseErrorResponse(res) {
@@ -25,7 +61,10 @@ async function parseErrorResponse(res) {
     const message = typeof body === "object" && body && "error" in body && typeof body.error === "string"
         ? body.error
         : res.statusText || "request failed";
-    return mapApiError(res.status, message);
+    const code = typeof body === "object" && body && "code" in body && typeof body.code === "string"
+        ? body.code
+        : undefined;
+    return mapApiError(res.status, message, code);
 }
 export function createUploadsClient(config) {
     async function request(method, path, opts) {
@@ -52,6 +91,17 @@ export function createUploadsClient(config) {
             return undefined;
         return (await res.json());
     }
+    async function list(opts = {}) {
+        const params = new URLSearchParams();
+        if (opts.prefix)
+            params.set("prefix", opts.prefix);
+        if (opts.limit != null)
+            params.set("limit", String(opts.limit));
+        if (opts.cursor)
+            params.set("cursor", opts.cursor);
+        const qs = params.toString();
+        return request("GET", `${filesBase(config)}${qs ? `?${qs}` : ""}`);
+    }
     return {
         async put(body, opts) {
             const key = opts.key ??
@@ -73,16 +123,17 @@ export function createUploadsClient(config) {
             }
             return { ...result, url: result.url };
         },
-        async list(opts = {}) {
-            const params = new URLSearchParams();
-            if (opts.prefix)
-                params.set("prefix", opts.prefix);
-            if (opts.limit != null)
-                params.set("limit", String(opts.limit));
-            if (opts.cursor)
-                params.set("cursor", opts.cursor);
-            const qs = params.toString();
-            return request("GET", `${filesBase(config)}${qs ? `?${qs}` : ""}`);
+        list,
+        /** Follow cursors (optionally starting from one) and return every remaining item. */
+        async listAll(opts = {}) {
+            const items = [];
+            let cursor = opts.cursor;
+            do {
+                const page = await list({ ...opts, cursor });
+                items.push(...page.items);
+                cursor = page.cursor ?? undefined;
+            } while (cursor);
+            return items;
         },
         async delete(key) {
             return request("DELETE", `${filesBase(config)}/${encodeKeyPath(key)}`);
@@ -93,5 +144,17 @@ export function createUploadsClient(config) {
         async health() {
             return request("GET", `${config.apiUrl}/health`, { auth: false });
         },
+        /** Workspace storage / upload counters (+ limits when configured). */
+        async usage() {
+            return request("GET", usageBase(config));
+        },
+        /** Rebuild ledger bytes/objects from storage (source of truth). */
+        async reconcile() {
+            return request("POST", `${usageBase(config)}/reconcile`);
+        },
+        /** Delete objects past retentionDays (if set), then reconcile. */
+        async purgeExpired() {
+            return request("POST", `${usageBase(config)}/purge-expired`);
+        },
     };
 }

package/dist/commands/admin-enrollment.d.ts

@@ -0,0 +1,7 @@
+type FileScope = "files:read" | "files:write" | "files:delete";
+export declare function parseScopes(raw: string | undefined): FileScope[] | undefined;
+export declare function runAdmin(args: string[], opts: {
+    json?: boolean;
+    apiUrl?: string;
+}, help?: boolean): Promise<number>;
+export {};

package/dist/commands/admin-enrollment.js

@@ -0,0 +1,59 @@
+import { createEnrollment } from "../client.js";
+import { flagInt, flagString, parseCommandArgs, UsageError } from "../cli-args.js";
+const HELP = `uploads admin enrollment create [options]
+
+Admin-only: create a short-lived, one-time enrollment code.
+
+Options:
+  --admin-token <token>  Or ADMIN_TOKEN (UPLOADS_ADMIN_TOKEN is a legacy alias)
+  --workspace <name>     Default: default
+  --label <label>
+  --expires-in <seconds> Default: server policy
+  --token-expires-in <seconds>  Upload token lifetime (default: server policy)
+  --scopes <list>        Comma-separated files:read,files:write,files:delete
+  --api-url <url>        Default: https://api.uploads.sh
+`;
+const FILE_SCOPES = new Set(["files:read", "files:write", "files:delete"]);
+export function parseScopes(raw) {
+    if (raw === undefined)
+        return undefined;
+    const scopes = raw
+        .split(",")
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    if (scopes.length === 0)
+        throw new UsageError("--scopes must contain at least one scope");
+    const invalid = scopes.find((scope) => !FILE_SCOPES.has(scope));
+    if (invalid)
+        throw new UsageError(`invalid scope: ${invalid} (expected files:read, files:write, or files:delete)`);
+    return [...new Set(scopes)];
+}
+export async function runAdmin(args, opts, help = false) {
+    const parsed = parseCommandArgs(args);
+    if (help || parsed.help) {
+        process.stderr.write(HELP);
+        return 0;
+    }
+    if (parsed.positionals[0] !== "enrollment" || parsed.positionals[1] !== "create")
+        throw new UsageError("expected: uploads admin enrollment create");
+    const adminToken = flagString(parsed.flags, "--admin-token") ??
+        process.env.ADMIN_TOKEN ??
+        process.env.UPLOADS_ADMIN_TOKEN;
+    if (!adminToken)
+        throw new UsageError("ADMIN_TOKEN is required for admin enrollment creation");
+    const apiUrl = flagString(parsed.flags, "--api-url") ?? opts.apiUrl ?? "https://api.uploads.sh";
+    const workspace = flagString(parsed.flags, "--workspace") ?? "default";
+    const label = flagString(parsed.flags, "--label");
+    const result = await createEnrollment(apiUrl, adminToken, {
+        workspace,
+        label,
+        enrollmentSeconds: flagInt(parsed.flags, "--expires-in", "--expires-in"),
+        tokenExpiresInSeconds: flagInt(parsed.flags, "--token-expires-in", "--token-expires-in"),
+        scopes: parseScopes(flagString(parsed.flags, "--scopes")),
+    });
+    if (opts.json)
+        process.stdout.write(JSON.stringify({ workspace, label: label ?? null, ...result }, null, 2) + "\n");
+    else
+        process.stdout.write(`Enrollment code (share once): ${result.code}\nworkspace: ${workspace}\nexpires: ${result.expiresAt}\n`);
+    return 0;
+}

package/dist/commands/install.d.ts

@@ -0,0 +1,8 @@
+import { type GlobalFlags } from "../cli-args.js";
+import { type CommandRunner } from "../github-gh.js";
+export declare const DEFAULT_MCP_URL = "https://agents.uploads.sh/mcp";
+export declare function runInstall(args: string[], opts: {
+    globals: GlobalFlags;
+    json?: boolean;
+    runner?: CommandRunner;
+}, help?: boolean): Promise<number>;