@buildinternet/uploads 0.3.0 → 0.5.0

package/README.md

@@ -1,14 +1,14 @@
 # @buildinternet/uploads
 
-CLI and client for **uploads.sh** — upload files, get public URLs, and produce GitHub-ready markdown. Successor to the R2 scripts in `buildinternet-skills/github-screenshots`.
+CLI and client for **uploads.sh** — upload files, get public URLs, and produce GitHub-ready markdown.
 
 ## CLI
 
-Binary: **`uploads`**. Install globally (or use a pinned `npx` one-shot):
+Binary: **`uploads`**. Install globally (or use an `npx` one-shot):
 
 ```bash
 npm install --global @buildinternet/uploads
-npx @buildinternet/uploads@0.1.0 --help
+npx @buildinternet/uploads --help
 ```
 
 ```bash

package/dist/agent.js

@@ -15,7 +15,7 @@ export function createUploadsWorkerFileTools(files, opts = {}) {
         },
         overrides: {
             uploadFile: {
-                description: "Upload a file for public hosting (e.g. GitHub embeds). Prefer keys under screenshots/.",
+                description: "Upload a non-sensitive file for public hosting (e.g. GitHub embeds). GitHub repository visibility does not restrict access; prefer keys under screenshots/.",
             },
             ...overrides,
         },

package/dist/cli.js

@@ -19,7 +19,7 @@ Config (first match wins, per key):
   environment         UPLOADS_API_URL, UPLOADS_TOKEN, UPLOADS_WORKSPACE
   --env-file <path>
   $BUILDINTERNET_CONFIG
-  ~/.config/buildinternet/config   (shared with github-screenshots)
+  ~/.config/buildinternet/config
 
 Workspace (within config layers):
   --workspace, -w     override — global (before command) or per-command (after)
@@ -45,7 +45,7 @@ Commands:
   setup               Inspect/configure advanced CLI settings
   install             Install the agent skill + register the remote MCP server
   login               Exchange an enrollment code and configure credentials
-  admin               Admin enrollment management
+  admin               Admin invitation management
   config              Show path, init, or set shared config
   doctor              Health + auth + workspace checks
   health              API liveness (no auth)

package/dist/client.d.ts

@@ -1,4 +1,13 @@
 import type { UploadsClientConfig } from "./config.js";
+/** Allowlisted object provenance (maps to X-Uploads-Meta-* on put). */
+export type ProvenanceInput = {
+    client?: string;
+    "client-version"?: string;
+    "source-name"?: string;
+    optimized?: "0" | "1";
+    frame?: string;
+    "keep-exif"?: "0" | "1";
+};
 export interface PutOptions {
     key?: string;
     contentType?: string;
@@ -6,6 +15,8 @@ export interface PutOptions {
     repo?: string;
     ref?: string;
     deriveRepoFromGit?: boolean;
+    /** Stored as R2 custom metadata; echoed on put/head. */
+    provenance?: ProvenanceInput;
 }
 export interface ListOptions {
     prefix?: string;
@@ -18,6 +29,7 @@ export interface PutResult {
     url: string;
     size: number;
     contentType: string;
+    metadata?: Record<string, string>;
 }
 export interface ListItem {
     key: string;
@@ -35,6 +47,7 @@ export interface HeadResult {
     size: number;
     contentType: string;
     uploaded?: string;
+    metadata?: Record<string, string>;
 }
 export interface DeleteResult {
     key: string;
@@ -88,14 +101,17 @@ export interface EnrollmentExchangeResult {
     expiresAt?: string;
 }
 export interface EnrollmentCreateResult {
+    pageId: string;
     code: string;
     expiresAt: string;
     tokenExpiresAt: string;
+    emailed?: boolean;
 }
 export declare function exchangeEnrollment(apiUrl: string, code: string): Promise<EnrollmentExchangeResult>;
 export declare function createEnrollment(apiUrl: string, adminToken: string, input: {
     workspace?: string;
     label?: string;
+    email?: string;
     enrollmentSeconds?: number;
     tokenExpiresInSeconds?: number;
     scopes?: Array<"files:read" | "files:write" | "files:delete">;

package/dist/client.js

@@ -38,19 +38,19 @@ function usageBase(config) {
 }
 function mapApiError(status, error, code) {
     const normalized = error.toLowerCase();
-    if (status === 401 || normalized === "unauthorized") {
+    if (status === 401 || code === "unauthorized" || normalized === "unauthorized") {
         return new UploadsError(error, "UNAUTHORIZED", status);
     }
-    if (status === 404 || normalized === "not found") {
+    if (status === 404 || code === "not_found" || normalized === "not found") {
         return new UploadsError(error, "NOT_FOUND", status);
     }
-    if (status === 400 && normalized === "invalid key") {
+    if (code === "invalid_key" || (status === 400 && normalized === "invalid key")) {
         return new UploadsError(error, "INVALID_KEY", status);
     }
     if (code === "key_prefix_not_allowed" || code === "key_too_deep") {
         return new UploadsError(error, "KEY_POLICY", status);
     }
-    // Prefer stable body.code — bare 429 is also used for write rate limits.
+    // Prefer stable body code — bare 429 is also used for write rate limits.
     if (status === 507 || code === "storage_quota_exceeded") {
         return new UploadsError(error, "STORAGE_QUOTA", status);
     }
@@ -59,15 +59,34 @@ function mapApiError(status, error, code) {
     }
     return new UploadsError(error, "API_ERROR", status);
 }
+/**
+ * Parse API error bodies. Prefers the nested envelope
+ * `{ error: { code, type, message, details? } }`; still accepts the legacy
+ * flat `{ error: string, code?: string }` shape.
+ */
+function extractErrorFields(body) {
+    if (typeof body === "object" && body && "error" in body) {
+        const err = body.error;
+        if (typeof err === "object" && err && "message" in err) {
+            const nested = err;
+            return {
+                message: typeof nested.message === "string" ? nested.message : "request failed",
+                code: typeof nested.code === "string" ? nested.code : undefined,
+            };
+        }
+        if (typeof err === "string") {
+            const code = "code" in body && typeof body.code === "string"
+                ? body.code
+                : undefined;
+            return { message: err, code };
+        }
+    }
+    return { message: "request failed" };
+}
 async function parseErrorResponse(res) {
     const body = await res.json().catch(() => ({}));
-    const message = typeof body === "object" && body && "error" in body && typeof body.error === "string"
-        ? body.error
-        : res.statusText || "request failed";
-    const code = typeof body === "object" && body && "code" in body && typeof body.code === "string"
-        ? body.code
-        : undefined;
-    return mapApiError(res.status, message, code);
+    const { message, code } = extractErrorFields(body);
+    return mapApiError(res.status, message || res.statusText || "request failed", code);
 }
 export function createUploadsClient(config) {
     async function request(method, path, opts) {
@@ -117,9 +136,16 @@ export function createUploadsClient(config) {
                     deriveRepoFromGit: opts.deriveRepoFromGit,
                 }));
             const contentType = opts.contentType ?? inferContentType(opts.filename);
+            const headers = { "Content-Type": contentType };
+            if (opts.provenance) {
+                for (const [k, v] of Object.entries(opts.provenance)) {
+                    if (v !== undefined && v !== "")
+                        headers[`X-Uploads-Meta-${k}`] = v;
+                }
+            }
             const result = await request("PUT", `${filesBase(config)}/${encodeKeyPath(key)}`, {
                 body,
-                headers: { "Content-Type": contentType },
+                headers,
             });
             if (result.url == null) {
                 throw new UploadsError("upload succeeded but workspace has no publicBaseUrl", "NO_PUBLIC_URL", 201);

package/dist/commands/admin-enrollment.d.ts

@@ -1,4 +1,6 @@
 type FileScope = "files:read" | "files:write" | "files:delete";
+export declare function invitePageUrl(apiUrl: string, pageId: string, webUrl?: string): string;
+export declare function inviteMagicLink(pageUrl: string, code: string): string;
 export declare function parseScopes(raw: string | undefined): FileScope[] | undefined;
 export declare function runAdmin(args: string[], opts: {
     json?: boolean;

package/dist/commands/admin-enrollment.js

@@ -1,8 +1,12 @@
 import { createEnrollment } from "../client.js";
-import { flagInt, flagString, parseCommandArgs, UsageError } from "../cli-args.js";
-const HELP = `uploads admin enrollment create [options]
+import { flagBool, flagInt, flagString, parseCommandArgs, UsageError } from "../cli-args.js";
+const HELP = `uploads admin invite create [options]
 
-Admin-only: create a short-lived, one-time enrollment code.
+Admin-only: create a short-lived invitation for an existing workspace.
+Prints one magic link whose URL fragment carries the single-use code — treat the
+link like a password. Pass --separate-code for the legacy two-channel output (a
+non-secret page URL plus a code you share separately). The legacy
+"admin enrollment create" spelling is accepted.
 
 Options:
   --admin-token <token>  Or ADMIN_TOKEN (UPLOADS_ADMIN_TOKEN is a legacy alias)
@@ -11,9 +15,34 @@ Options:
   --expires-in <seconds> Default: server policy
   --token-expires-in <seconds>  Upload token lifetime (default: server policy)
   --scopes <list>        Comma-separated files:read,files:write,files:delete
+  --email <address>      Email the invite link to this recipient (from invites@uploads.sh)
+  --separate-code        Two-channel output: non-secret page URL + separate code
   --api-url <url>        Default: https://api.uploads.sh
+  --web-url <url>        Invite-page origin (defaults from --api-url)
 `;
 const FILE_SCOPES = new Set(["files:read", "files:write", "files:delete"]);
+export function invitePageUrl(apiUrl, pageId, webUrl) {
+    let url;
+    try {
+        url = new URL(webUrl ?? apiUrl);
+    }
+    catch {
+        throw new UsageError("invalid invite web URL");
+    }
+    if (!webUrl && url.hostname.startsWith("api."))
+        url.hostname = url.hostname.slice(4);
+    url.pathname = "/invite";
+    url.search = "";
+    url.hash = "";
+    url.searchParams.set("id", pageId);
+    return url.toString();
+}
+// Compose the self-contained magic link. The one-time code rides in the URL
+// fragment (#code=…), which browsers never send to the server, so opening the
+// page neither leaks nor consumes it — only the CLI's exchange call redeems it.
+export function inviteMagicLink(pageUrl, code) {
+    return `${pageUrl}#code=${encodeURIComponent(code)}`;
+}
 export function parseScopes(raw) {
     if (raw === undefined)
         return undefined;
@@ -34,26 +63,44 @@ export async function runAdmin(args, opts, help = false) {
         process.stderr.write(HELP);
         return 0;
     }
-    if (parsed.positionals[0] !== "enrollment" || parsed.positionals[1] !== "create")
-        throw new UsageError("expected: uploads admin enrollment create");
+    if (!["invite", "enrollment"].includes(parsed.positionals[0] ?? "") ||
+        parsed.positionals[1] !== "create")
+        throw new UsageError("expected: uploads admin invite create");
     const adminToken = flagString(parsed.flags, "--admin-token") ??
         process.env.ADMIN_TOKEN ??
         process.env.UPLOADS_ADMIN_TOKEN;
     if (!adminToken)
         throw new UsageError("ADMIN_TOKEN is required for admin enrollment creation");
     const apiUrl = flagString(parsed.flags, "--api-url") ?? opts.apiUrl ?? "https://api.uploads.sh";
+    const webUrl = flagString(parsed.flags, "--web-url");
     const workspace = flagString(parsed.flags, "--workspace") ?? "default";
     const label = flagString(parsed.flags, "--label");
+    const email = flagString(parsed.flags, "--email");
     const result = await createEnrollment(apiUrl, adminToken, {
         workspace,
         label,
+        email,
         enrollmentSeconds: flagInt(parsed.flags, "--expires-in", "--expires-in"),
         tokenExpiresInSeconds: flagInt(parsed.flags, "--token-expires-in", "--token-expires-in"),
         scopes: parseScopes(flagString(parsed.flags, "--scopes")),
     });
-    if (opts.json)
-        process.stdout.write(JSON.stringify({ workspace, label: label ?? null, ...result }, null, 2) + "\n");
+    const separateCode = flagBool(parsed.flags, "--separate-code");
+    const pageUrl = invitePageUrl(apiUrl, result.pageId, webUrl);
+    const link = separateCode ? pageUrl : inviteMagicLink(pageUrl, result.code);
+    const footer = `workspace: ${workspace}\nexpires: ${result.expiresAt}\n`;
+    if (opts.json) {
+        process.stdout.write(JSON.stringify({ workspace, label: label ?? null, url: link, ...result }, null, 2) + "\n");
+        return 0;
+    }
+    if (email && result.emailed) {
+        process.stdout.write(`Invite emailed to ${email}\n${footer}`);
+        return 0;
+    }
+    if (email && result.emailed === false)
+        process.stderr.write("warning: email delivery failed; share this link instead\n");
+    if (separateCode)
+        process.stdout.write(`Invite page: ${pageUrl}\nOne-time code (share separately): ${result.code}\n${footer}`);
     else
-        process.stdout.write(`Enrollment code (share once): ${result.code}\nworkspace: ${workspace}\nexpires: ${result.expiresAt}\n`);
+        process.stdout.write(`Invite link (contains the one-time code — treat like a password):\n${link}\n${footer}`);
     return 0;
 }

package/dist/commands.js

@@ -11,6 +11,7 @@ import { resolveRepo, resolveCurrentPullRequest, execRunner, upsertAttachmentsCo
 import { resolvePutPrefix } from "./destinations.js";
 import { optimizeImageForUpload, rewriteKeyExtension, } from "./optimize.js";
 import { applyFrame, resolveFrameId } from "./frame.js";
+import { buildCliProvenance } from "./provenance.js";
 // --- put ---
 const PUT_HELP = `uploads put <file> [options]
 
@@ -24,6 +25,10 @@ upload as-is, or --keep-exif when image metadata matters for the discussion.
 Optional --frame wraps the image in a device/browser chrome before optimize
 (default off). See: uploads put --help frames
 
+Uploads are public. --pr/--issue keys include the repo, number, and filename and
+remain public even for private/internal GitHub repositories. Upload only media
+that is safe at a predictable public URL.
+
 Options:
   --key <key>           Object key (default: <prefix>/<repo>/<ref>/<name>-<hash>.<ext>)
   --destination <id>    Typed root: screenshots | gh | f (sets --prefix)
@@ -165,6 +170,10 @@ const ATTACH_HELP = `uploads attach <file...> [options]
 Upload one or more stable PR/issue attachments and maintain a single GitHub
 comment. With no target, uses the pull request for the current branch.
 
+Attachments are public and their repo/number/filename keys are predictable.
+Private/internal GitHub repository visibility does not restrict access; upload
+only media that is safe at a public URL.
+
 Still images are optimized to WebP by default (same as put). Use --no-optimize
 to upload originals. Optional --frame wraps images in device/browser chrome.
 
@@ -230,6 +239,12 @@ export async function runAttach(ctx, args, help = false, run = execRunner) {
             filename: prepared.filename,
             key: ghAttachmentKey(target, prepared.filename),
             contentType: prepared.optimized ? prepared.contentType : contentTypeOverride,
+            provenance: buildCliProvenance({
+                sourceName,
+                optimized: prepared.optimized,
+                frameId: prepared.frame?.framed ? prepared.frame.frameId : undefined,
+                keepExif: optimizeOpts.keepExif === true,
+            }),
         });
         results.push({
             ...result,
@@ -363,6 +378,12 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
         ref: flagString(parsed.flags, "--ref") ?? defaults.ref,
         contentType: prepared.optimized ? prepared.contentType : contentTypeOverride,
         deriveRepoFromGit: !noGit,
+        provenance: buildCliProvenance({
+            sourceName,
+            optimized: prepared.optimized,
+            frameId: prepared.frame?.framed ? prepared.frame.frameId : undefined,
+            keepExif: optimizeOpts.keepExif === true,
+        }),
     });
     const markdown = buildMarkdown(result.url, { alt, width });
     const optimizeMeta = {

package/dist/index.d.ts

@@ -3,7 +3,8 @@ export { sanitizeKeySegment, sha256Short, deriveRepoFromGit, buildScreenshotKey
 export { BUILTIN_DESTINATIONS, isBuiltinDestination, keyMatchesDestination, resolveDestinationRoot, resolvePutPrefix, type BuiltinDestinationId, } from "./destinations.js";
 export { DEFAULT_API_URL, DEFAULT_WORKSPACE, UPLOADS_CONFIG_KEYS, defaultConfigPath, resolveConfigPath, loadConfigFile, loadEnvFile, resolveApiUrl, resolveConfig, describeConfigSources, redactToken, writeConfigKeys, configValuesFromClient, putDefaultsToConfigValues, resolvePutDefaults, mergePutDefaults, workspaceFromToken, workspaceMismatch, type UploadsClientConfig, type ResolvedConfig, type WorkspaceSource, type ConfigValueSource, type ConfigSources, type UploadsConfigKey, type UploadsConfigValues, type PutDefaults, } from "./config.js";
 export { UploadsError, type UploadsErrorCode } from "./errors.js";
-export { createUploadsClient, type UploadsClient, type PutOptions, type ListOptions, type PutResult, type ListItem, type ListResult, type HeadResult, type DeleteResult, type HealthResult, type UsageResult, type ReconcileResult, type PurgeExpiredResult, type PurgeExpiredResponse, } from "./client.js";
+export { createUploadsClient, type UploadsClient, type PutOptions, type ProvenanceInput, type ListOptions, type PutResult, type ListItem, type ListResult, type HeadResult, type DeleteResult, type HealthResult, type UsageResult, type ReconcileResult, type PurgeExpiredResult, type PurgeExpiredResponse, } from "./client.js";
+export { buildCliProvenance } from "./provenance.js";
 export { ATTACHMENTS_MARKER, attachmentsCommentBody, ghAttachmentKey, ghKeyPrefix, isValidRepo, parseRepoFromRemoteUrl, type AttachmentItem, type GhTarget, type GhTargetKind, } from "./github.js";
 export { DEFAULT_OPTIMIZE_MAX_EDGE, DEFAULT_OPTIMIZE_QUALITY, optimizeImageForUpload, rewriteKeyExtension, withImageExtension, type OptimizeImageOptions, type OptimizeImageResult, type OptimizeOutputFormat, } from "./optimize.js";
 export { FRAME_PRESETS, applyFrame, listFramePresets, resolveFrameId, type FrameFit, type FrameOptions, type FrameResult, } from "./frame.js";

package/dist/index.js

@@ -4,6 +4,7 @@ export { BUILTIN_DESTINATIONS, isBuiltinDestination, keyMatchesDestination, reso
 export { DEFAULT_API_URL, DEFAULT_WORKSPACE, UPLOADS_CONFIG_KEYS, defaultConfigPath, resolveConfigPath, loadConfigFile, loadEnvFile, resolveApiUrl, resolveConfig, describeConfigSources, redactToken, writeConfigKeys, configValuesFromClient, putDefaultsToConfigValues, resolvePutDefaults, mergePutDefaults, workspaceFromToken, workspaceMismatch, } from "./config.js";
 export { UploadsError } from "./errors.js";
 export { createUploadsClient, } from "./client.js";
+export { buildCliProvenance } from "./provenance.js";
 export { ATTACHMENTS_MARKER, attachmentsCommentBody, ghAttachmentKey, ghKeyPrefix, isValidRepo, parseRepoFromRemoteUrl, } from "./github.js";
 export { DEFAULT_OPTIMIZE_MAX_EDGE, DEFAULT_OPTIMIZE_QUALITY, optimizeImageForUpload, rewriteKeyExtension, withImageExtension, } from "./optimize.js";
 export { FRAME_PRESETS, applyFrame, listFramePresets, resolveFrameId, } from "./frame.js";

package/dist/mcp/tools.js

@@ -15,6 +15,7 @@ import { buildMarkdown } from "../embed.js";
 import { resolvePutPrefix } from "../destinations.js";
 import { ghAttachmentKey, ghKeyPrefix } from "../github.js";
 import { rewriteKeyExtension } from "../optimize.js";
+import { buildCliProvenance } from "../provenance.js";
 import { execRunner, resolveCurrentPullRequest, resolveRepo, } from "../github-gh.js";
 import { optPosInt, optString, usage } from "./args.js";
 function optBool(args, name) {
@@ -137,7 +138,7 @@ export function createUploadsMcpTools(opts) {
     return [
         {
             name: "put",
-            description: "Upload a file to uploads.sh and get a public URL plus GitHub-ready embed markdown (the returned `markdown` is ready to paste into a PR or issue). Pass `file` (a local path) or `contentBase64` + `filename` for in-memory content; with `pr`/`issue` the key is stable (same filename → same URL) and `comment` syncs the managed attachments comment.",
+            description: "Upload a file to uploads.sh and get a public URL plus GitHub-ready embed markdown (the returned `markdown` is ready to paste into a PR or issue). Pass `file` (a local path) or `contentBase64` + `filename` for in-memory content; with `pr`/`issue` the key is stable (same filename → same URL) and `comment` syncs the managed attachments comment. All uploads are public; pr/issue keys are predictable and remain public for private/internal GitHub repositories, so upload only non-sensitive media.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -254,9 +255,11 @@ export function createUploadsMcpTools(opts) {
                     : new Uint8Array(Buffer.from(contentBase64, "base64"));
                 const sourceName = file !== undefined ? (filenameArg ?? basename(file)) : filenameArg;
                 const defaults = resolvePutDefaults({ envFile: globals.envFile });
+                const frameOpts = mcpFrameOptions(args);
+                const optimizeOpts = mcpOptimizeOptions(args, defaults);
                 const prepared = await prepareImageForUpload(bytes, sourceName, {
-                    ...mcpFrameOptions(args),
-                    optimize: mcpOptimizeOptions(args, defaults),
+                    ...frameOpts,
+                    optimize: optimizeOpts,
                 });
                 const filename = prepared.filename;
                 let key = target ? ghAttachmentKey(target, filename) : keyArg;
@@ -271,6 +274,13 @@ export function createUploadsMcpTools(opts) {
                     ref: refArg ?? defaults.ref,
                     contentType: prepared.optimized ? prepared.contentType : optString(args, "contentType"),
                     deriveRepoFromGit: !noGit,
+                    provenance: buildCliProvenance({
+                        sourceName,
+                        client: "uploads-mcp",
+                        optimized: prepared.optimized,
+                        frameId: prepared.frame?.framed ? prepared.frame.frameId : undefined,
+                        keepExif: optimizeOpts.keepExif === true,
+                    }),
                 });
                 const markdown = buildMarkdown(result.url, {
                     alt: optString(args, "alt") ?? sourceName,
@@ -292,7 +302,7 @@ export function createUploadsMcpTools(opts) {
         },
         {
             name: "attach",
-            description: "Upload one or more files as stable PR/issue attachments and maintain a single managed GitHub comment listing them (each upload's `markdown` is ready to paste into GitHub). With no pr/issue, targets the pull request for the current branch.",
+            description: "Upload one or more files as stable PR/issue attachments and maintain a single managed GitHub comment listing them (each upload's `markdown` is ready to paste into GitHub). With no pr/issue, targets the pull request for the current branch. Attachments are public and their repo/number/filename keys are predictable even for private/internal GitHub repositories; upload only non-sensitive media.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -352,6 +362,13 @@ export function createUploadsMcpTools(opts) {
                         filename: prepared.filename,
                         key: ghAttachmentKey(target, prepared.filename),
                         contentType: prepared.optimized ? prepared.contentType : contentType,
+                        provenance: buildCliProvenance({
+                            sourceName,
+                            client: "uploads-mcp",
+                            optimized: prepared.optimized,
+                            frameId: prepared.frame?.framed ? prepared.frame.frameId : undefined,
+                            keepExif: optimizeOpts.keepExif === true,
+                        }),
                     });
                     uploads.push({
                         ...result,

package/dist/provenance.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Client-side provenance headers for put (X-Uploads-Meta-*).
+ * API allowlists keys; secrets never go here.
+ */
+import type { ProvenanceInput } from "./client.js";
+export declare function buildCliProvenance(opts: {
+    sourceName: string;
+    optimized?: boolean;
+    frameId?: string;
+    keepExif?: boolean;
+    client?: string;
+}): ProvenanceInput;

package/dist/provenance.js

@@ -0,0 +1,29 @@
+import { createRequire } from "node:module";
+let cachedVersion;
+function packageVersion() {
+    if (cachedVersion)
+        return cachedVersion;
+    try {
+        const require = createRequire(import.meta.url);
+        const pkg = require("../package.json");
+        cachedVersion = pkg.version ?? "0.0.0";
+    }
+    catch {
+        cachedVersion = "0.0.0";
+    }
+    return cachedVersion;
+}
+export function buildCliProvenance(opts) {
+    const provenance = {
+        client: opts.client ?? "uploads-cli",
+        "client-version": packageVersion(),
+        "source-name": opts.sourceName.slice(0, 128),
+    };
+    if (opts.optimized)
+        provenance.optimized = "1";
+    if (opts.frameId)
+        provenance.frame = opts.frameId.slice(0, 64);
+    if (opts.keepExif)
+        provenance["keep-exif"] = "1";
+    return provenance;
+}

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",
+  "sideEffects": false,
   "license": "MIT",
   "repository": {
     "type": "git",