@buildinternet/uploads 0.33.0 → 0.34.0

package/README.md

@@ -17,6 +17,8 @@ uploads --version
 uploads attach ./before.png ./after.png
 uploads screenshot https://app.example --pr 123 --comment   # capture + host in one step
 uploads screenshot ./report.html --dark --selector "main"
+uploads screenshot http://localhost:3000 --via local --annotate ./callouts.json
+uploads annotate ./shot.png --spec ./callouts.json --out ./shot.marked.png
 uploads put ./shot.png
 uploads put ./shot.png --destination screenshots
 uploads put ./shot.png --no-optimize

package/dist/commands/install.d.ts

@@ -8,6 +8,17 @@ export interface StepResult {
     error?: string;
     output?: string;
 }
+/** npm 7+ for `npx -y`. Node 22 ships npm 10+; this catches ancient/system npm. */
+export declare const MIN_NPM_MAJOR_FOR_SKILLS = 7;
+/** Install guidance when a host binary is missing (not "run manually: <same binary>"). */
+export declare function missingBinaryHint(binary: string): string;
+export declare function npmTooOldHint(version: string): string;
+/**
+ * Probe npx/npm once before the per-skill loop. Returns an error string when
+ * tooling is missing/too old; undefined means skill steps should proceed.
+ * Non-ENOENT npx failures are left for the real `skills add` to surface.
+ */
+export declare function probeSkillTooling(run: CommandRunner): string | undefined;
 export declare function runStep(run: CommandRunner, command: string[]): StepResult;
 export declare function runInstall(args: string[], opts: {
     globals: GlobalFlags;

package/dist/commands/install.js

@@ -33,9 +33,11 @@ What it does:
 
 What runs under the hood:
   skill   npx -y skills add ${SKILL_SOURCE} --skill <name> -g -y -a '*'
-          (once per skill: ${SKILL_NAMES.join(", ")})
+          (once per skill: ${SKILL_NAMES.join(", ")}; needs Node 22+ / npm 7+
+          with npx on PATH — missing tooling fails once with install guidance)
   mcp     claude mcp add --transport http uploads ${DEFAULT_MCP_URL} \\
             --header "Authorization: Bearer <token>"
+          (needs the Claude Code CLI on PATH)
   hooks   write/merge ~/.grok/hooks/… and ~/.cursor/hooks.json when present
 
 Options:
@@ -51,6 +53,8 @@ Examples:
   uploads install hooks
   uploads install --dry-run
 `;
+/** npm 7+ for `npx -y`. Node 22 ships npm 10+; this catches ancient/system npm. */
+export const MIN_NPM_MAJOR_FOR_SKILLS = 7;
 /** Mask Bearer credentials and the configured token in any printed text. */
 function redactor(token) {
     return (text) => {
@@ -60,6 +64,55 @@ function redactor(token) {
         return out;
     };
 }
+function isEnoent(err) {
+    return err?.code === "ENOENT";
+}
+/** Install guidance when a host binary is missing (not "run manually: <same binary>"). */
+export function missingBinaryHint(binary) {
+    switch (binary) {
+        case "npx":
+        case "npm":
+            return (`${binary} not found on PATH — skill install needs Node.js (npm includes npx). ` +
+                `Install Node 22+ from https://nodejs.org (or your package manager), open a new shell, ` +
+                `confirm \`${binary} --version\` works, then re-run \`uploads install skill\`.`);
+        case "claude":
+            return (`claude not found on PATH — MCP install needs the Claude Code CLI. ` +
+                `Install it from https://docs.anthropic.com/en/docs/claude-code, ensure \`claude\` is on PATH, ` +
+                `then re-run \`uploads install mcp\`. Skills and hooks still work without Claude Code.`);
+        default:
+            return `${binary} not found on PATH — install it and ensure it is available in this shell.`;
+    }
+}
+export function npmTooOldHint(version) {
+    return (`npm ${version} is too old for skill install (need npm ${MIN_NPM_MAJOR_FOR_SKILLS}+ for \`npx -y\`). ` +
+        `Upgrade Node/npm (Node 22+ recommended: https://nodejs.org), confirm \`npm --version\`, ` +
+        `then re-run \`uploads install skill\`.`);
+}
+/**
+ * Probe npx/npm once before the per-skill loop. Returns an error string when
+ * tooling is missing/too old; undefined means skill steps should proceed.
+ * Non-ENOENT npx failures are left for the real `skills add` to surface.
+ */
+export function probeSkillTooling(run) {
+    try {
+        run("npx", ["--version"]);
+    }
+    catch (err) {
+        return isEnoent(err) ? missingBinaryHint("npx") : undefined;
+    }
+    try {
+        const out = run("npm", ["--version"]).trim();
+        const major = Number.parseInt(out.split(".")[0] ?? "", 10);
+        if (Number.isFinite(major) && major < MIN_NPM_MAJOR_FOR_SKILLS) {
+            return npmTooOldHint(out);
+        }
+    }
+    catch (err) {
+        if (isEnoent(err))
+            return missingBinaryHint("npm");
+    }
+    return undefined;
+}
 export function runStep(run, command) {
     try {
         const output = run(command[0], command.slice(1)).trim();
@@ -67,10 +120,11 @@ export function runStep(run, command) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        const hint = err.code === "ENOENT"
-            ? `${command[0]} not found on PATH — install it, or run manually: ${command.join(" ")}`
-            : message;
-        return { command, ok: false, error: hint };
+        return {
+            command,
+            ok: false,
+            error: isEnoent(err) ? missingBinaryHint(command[0]) : message,
+        };
     }
 }
 function skillCommand(skill) {
@@ -115,31 +169,63 @@ function peekToken(globals) {
         return undefined;
     }
 }
-function printHumanSteps(results, redact, verbose, mcpName) {
-    for (const [step, r] of Object.entries(results)) {
-        const cmd = redact(r.command.join(" "));
-        if (r.skipped === "dry-run") {
-            process.stdout.write(`${step}: would run — ${cmd}\n`);
-        }
-        else if (r.skipped === "sign-in") {
-            process.stdout.write(`${step}: skipped — ${redact(r.error ?? "needs sign-in")}\n`);
-        }
-        else if (r.skipped === "already-configured") {
-            process.stdout.write(`${step}: already configured — "${mcpName}" is registered in Claude Code (nothing to do)\n` +
-                `  To re-register (e.g. with a new token): claude mcp remove ${mcpName} && uploads install mcp\n`);
+function printOneHumanStep(step, r, redact, verbose, mcpName) {
+    const cmd = redact(r.command.join(" "));
+    if (r.skipped === "dry-run") {
+        process.stdout.write(`${step}: would run — ${cmd}\n`);
+    }
+    else if (r.skipped === "sign-in") {
+        process.stdout.write(`${step}: skipped — ${redact(r.error ?? "needs sign-in")}\n`);
+    }
+    else if (r.skipped === "already-configured") {
+        process.stdout.write(`${step}: already configured — "${mcpName}" is registered in Claude Code (nothing to do)\n` +
+            `  To re-register (e.g. with a new token): claude mcp remove ${mcpName} && uploads install mcp\n`);
+    }
+    else if (r.ok) {
+        process.stdout.write(`${step}: ok\n`);
+        if (verbose && r.output) {
+            process.stdout.write(`  ${redact(r.output).split("\n").join("\n  ")}\n`);
         }
-        else if (r.ok) {
-            process.stdout.write(`${step}: ok\n`);
-            if (verbose && r.output) {
-                process.stdout.write(`  ${redact(r.output).split("\n").join("\n  ")}\n`);
+    }
+    else {
+        process.stderr.write(`${step}: failed — ${redact(r.error ?? "")}\n`);
+        if (verbose)
+            process.stderr.write(`  command: ${cmd}\n`);
+    }
+}
+/** Shared error when every skill step failed identically; otherwise undefined. */
+function identicalSkillFailure(skillEntries) {
+    if (skillEntries.length < 2)
+        return undefined;
+    const error = skillEntries[0]?.[1].error;
+    if (!error)
+        return undefined;
+    const allSame = skillEntries.every(([, r]) => !r.ok && !r.skipped && r.error === error);
+    return allSame ? error : undefined;
+}
+/** Collapse identical skill failures to one `skills:` line (missing npx, old npm, …). */
+function printHumanSteps(results, redact, verbose, mcpName) {
+    const entries = Object.entries(results);
+    const skillEntries = entries.filter(([step]) => step.startsWith("skill:"));
+    const sharedError = identicalSkillFailure(skillEntries);
+    if (sharedError !== undefined) {
+        process.stderr.write(`skills: failed — ${redact(sharedError)}\n`);
+        if (verbose) {
+            for (const [step, r] of skillEntries) {
+                process.stderr.write(`  ${step}: ${redact(r.command.join(" "))}\n`);
             }
         }
-        else {
-            process.stderr.write(`${step}: failed — ${redact(r.error ?? "")}\n`);
-            if (verbose)
-                process.stderr.write(`  command: ${cmd}\n`);
+    }
+    else {
+        for (const [step, r] of skillEntries) {
+            printOneHumanStep(step, r, redact, verbose, mcpName);
         }
     }
+    for (const [step, r] of entries) {
+        if (step.startsWith("skill:"))
+            continue;
+        printOneHumanStep(step, r, redact, verbose, mcpName);
+    }
 }
 function printSuccessFooter(steps, signedIn) {
     process.stdout.write(`\nDone — ${steps.join(" and ")} ready.\n` +
@@ -187,11 +273,18 @@ export async function runInstall(args, opts, help = false) {
     if (target === "skill" || target === "all") {
         if (human)
             process.stdout.write("Installing skills…\n");
+        const toolingError = dryRun ? undefined : probeSkillTooling(run);
         for (const skill of SKILL_NAMES) {
             const command = skillCommand(skill);
-            results[`skill:${skill}`] = dryRun
-                ? { command, ok: true, skipped: "dry-run" }
-                : runStep(run, command);
+            if (dryRun) {
+                results[`skill:${skill}`] = { command, ok: true, skipped: "dry-run" };
+            }
+            else if (toolingError) {
+                results[`skill:${skill}`] = { command, ok: false, error: toolingError };
+            }
+            else {
+                results[`skill:${skill}`] = runStep(run, command);
+            }
         }
     }
     if (target === "mcp" || target === "all") {
@@ -264,14 +357,26 @@ export async function runInstall(args, opts, help = false) {
         printSuccessFooter(stepLabels, signedIn);
     }
     else if (failed && !dryRun && skillsOk && results.mcp && !results.mcp.ok) {
-        const next = results.mcp.skipped === "sign-in"
-            ? "Sign in with `uploads login`, then re-run `uploads install mcp`."
-            : "Fix the MCP step above, then re-run `uploads install mcp`.";
+        let next;
+        if (results.mcp.skipped === "sign-in") {
+            next = "Sign in with `uploads login`, then re-run `uploads install mcp`.";
+        }
+        else if (results.mcp.error?.includes("not found on PATH")) {
+            next = "Install the Claude Code CLI (or skip MCP), then re-run `uploads install mcp`.";
+        }
+        else {
+            next = "Fix the MCP step above, then re-run `uploads install mcp`.";
+        }
         process.stdout.write(`\nSkills are installed. ${next}\n`);
     }
     else if (failed && !dryRun && skillsFailed) {
-        // Mixed or total skill failure used to print only per-step lines (#191).
-        process.stdout.write("\nSkill install incomplete. Fix the errors above, then re-run `uploads install skill`.\n");
+        // Closing guidance when skills fail (issue #191: used to be per-step only).
+        const skillErrText = skillResults.map((r) => r.error ?? "").join("\n");
+        const toolingMissing = /npx not found|npm not found|too old for skill install/i.test(skillErrText);
+        process.stdout.write(toolingMissing
+            ? "\nSkill install needs a working Node.js toolchain (npx + npm 7+ on PATH). " +
+                "Fix that, then re-run `uploads install skill`.\n"
+            : "\nSkill install incomplete. Fix the errors above, then re-run `uploads install skill`.\n");
     }
     return failed ? 1 : 0;
 }

package/dist/commands.js

@@ -5,6 +5,7 @@ import { createUploadsClient, } from "./client.js";
 import { parseCommandArgs, flagString, flagBool, flagInt, flagValues, UsageError, } from "./cli-args.js";
 import { resolvePutDefaults, workspaceMismatch, workspaceFromToken, } from "./config.js";
 import { buildMarkdown } from "./embed.js";
+import { readLocalRepoCommentConfig, resolveCommentOptions } from "./comment-config.js";
 import { urlForGithubEmbed } from "./public-urls.js";
 import { UploadsError } from "./errors.js";
 import { writeJson, writeStdout } from "./io.js";
@@ -12,7 +13,7 @@ import { imageFactsFromBytes } from "./image-facts.js";
 import { parseMetaFlags, validateMetaMap } from "./metadata.js";
 import { mergeDerivedMeta, nearMissMetaWarnings, validateStateValue } from "./metadata-vocab.js";
 import { mergeSidecarMeta } from "./sidecar.js";
-import { ghAttachmentKey, ghBranchAttachmentKey, ghBranchKeyPrefix, ghKeyPrefix, ghMetadataFromTarget, parseGhKey, ghMetadataForBranch, attachmentsCommentBody, attachmentsMarker, normalizeGithubCoordinate, } from "./github.js";
+import { ghAttachmentKey, ghBranchAttachmentKey, ghBranchKeyPrefix, ghKeyPrefix, ghMetadataFromTarget, parseGhKey, ghMetadataForBranch, attachmentsCommentBody, attachmentsMarker, AUTO_RENDER_OPTIONS, GH_FALLBACK_AUTHOR_NOTE, normalizeGithubCoordinate, } from "./github.js";
 import { resolveRepo, resolveCurrentPullRequest, resolveCurrentBranch, resolveDefaultBranch, classifyGhNumber, execRunner, timedExecRunner, ghMetadataFromTargetWithTitle, upsertAttachmentsComment, } from "./github-gh.js";
 import { deriveRepoFromGit } from "./keys.js";
 import { resolvePutPrefix } from "./destinations.js";
@@ -104,9 +105,13 @@ Options:
   --format human|url|markdown|json
   --pr <num>            Attach to a pull request: key gh/<owner>/<repo>/pull/<num>/<name> (stable URL, no hash)
   --issue <num>         Attach to an issue: key gh/<owner>/<repo>/issues/<num>/<name>
-  --comment             With --pr/--issue: update one managed comment with
-                        attachments and linked galleries. Posts as uploads-sh[bot]
-                        when the GitHub App is installed; otherwise via local gh.
+  --comment             With --pr/--issue, the managed comment sync runs by
+                        default; --comment is accepted as a no-op for
+                        back-compat (kept redundant with the default).
+  --no-comment          With --pr/--issue: skip updating the managed comment
+                        with attachments and linked galleries. Otherwise it
+                        posts as uploads-sh[bot] when the GitHub App is
+                        installed, or via local gh as a fallback.
   --gallery <id>         Add the uploaded object(s) to this public gallery
   --meta <k=v>          Queryable custom metadata (repeatable; value may contain "="): key ^[a-z][a-z0-9._-]{0,63}$, value 1-512 printable ASCII, max 24 pairs
                         Re-uploading to an existing key WITH --meta replaces that file's
@@ -117,7 +122,7 @@ Options:
   --replace             Allow overwriting an existing object on a strict (--key/default) key
                         (or UPLOADS_OVERWRITE=1). No effect on --pr/--issue, which always overwrite.
   --dry-run             Print key + public URL without uploading; reports if the key would replace
-                        (or, on a strict key, be refused). Not with --comment/--gallery
+                        (or, on a strict key, be refused). Not with --gallery
 
 A bare put (no --pr/--issue/--key) on a non-default git branch prints a one-line
 nudge toward --pr/attach --branch (stderr in human mode, a "hint" field in
@@ -543,7 +548,31 @@ export async function syncAttachmentsComment(client, target, run, workspace, opt
         }
     }));
     const marker = attachmentsMarker(workspace);
-    const body = attachmentsCommentBody(items, previewGalleries, marker);
+    // Honor a committed .uploads.yml on the working tree (issue #307). This CLI
+    // process has no server-side WorkspaceRecord in scope (see the note above),
+    // so it resolves against `null` workspace defaults — a documented
+    // divergence from the bot path (commands.ts:728 / apps/api's
+    // resolveRepoCommentOptions, which also layers the workspace's own
+    // githubComment* fields).
+    let renderOptions = AUTO_RENDER_OPTIONS;
+    try {
+        const root = run("git", ["rev-parse", "--show-toplevel"]).trim();
+        const { config } = readLocalRepoCommentConfig(root);
+        const { options } = resolveCommentOptions(config, null);
+        renderOptions = {
+            imageWidth: options.imageWidth,
+            maxInlineImages: options.maxInlineImages,
+            metaPath: options.metaPath,
+            metaState: options.metaState,
+            note: options.note,
+        };
+    }
+    catch {
+        // Not a git repo, or the config file couldn't be read — fall back to auto.
+    }
+    // Append only on the local-gh path: bot posts already carry the uploads-sh
+    // bot identity, so this note would be wrong there.
+    const body = `${attachmentsCommentBody(items, previewGalleries, marker, renderOptions)}\n${GH_FALLBACK_AUTHOR_NOTE}`;
     const count = items.length + previewGalleries.length;
     // Empty (count 0) renders the neutral empty-state body but must not create a
     // comment — it only rewrites one that already exists (`action: "skipped"`
@@ -1502,7 +1531,10 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
     const destFlag = flagString(parsed.flags, "--destination");
     const prefixFlag = flagString(parsed.flags, "--prefix");
     const ghTarget = ghTargetFromFlags(parsed.flags, run);
-    const wantComment = parsed.flags.has("--comment");
+    // Comment sync runs by default with --pr/--issue (matches `attach`); opt
+    // out with --no-comment. --comment is accepted as a redundant no-op for
+    // back-compat with scripts written before this default flipped (#537).
+    const wantComment = !parsed.flags.has("--no-comment");
     const galleryId = flagString(parsed.flags, "--gallery");
     const nameFlag = flagString(parsed.flags, "--name");
     const dryRun = flagBool(parsed.flags, "--dry-run");
@@ -1521,17 +1553,21 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
         validateMetaMap(merged);
         return merged;
     })();
-    if (wantComment && typeof parsed.flags.get("--comment") === "string") {
+    if (parsed.flags.has("--comment") && typeof parsed.flags.get("--comment") === "string") {
         throw new UsageError("--comment takes no value — place it after the file argument");
     }
+    if (parsed.flags.has("--no-comment") && typeof parsed.flags.get("--no-comment") === "string") {
+        throw new UsageError("--no-comment takes no value");
+    }
     if (parsed.flags.has("--auto") && typeof parsed.flags.get("--auto") === "string") {
         throw new UsageError("--auto takes no value");
     }
     if (parsed.flags.has("--no-auto") && typeof parsed.flags.get("--no-auto") === "string") {
         throw new UsageError("--no-auto takes no value");
     }
-    if (wantComment && !ghTarget)
-        throw new UsageError("--comment requires --pr or --issue");
+    if (parsed.flags.has("--no-comment") && !ghTarget) {
+        throw new UsageError("--no-comment requires --pr or --issue");
+    }
     if (multi) {
         if (keyHint)
             throw new UsageError("--key cannot be combined with multiple files");
@@ -1558,12 +1594,8 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
         if (keyHint)
             throw new UsageError("--name cannot be combined with --key");
     }
-    if (dryRun) {
-        if (wantComment)
-            throw new UsageError("--dry-run cannot be combined with --comment");
-        if (galleryId)
-            throw new UsageError("--dry-run cannot be combined with --gallery");
-    }
+    if (dryRun && galleryId)
+        throw new UsageError("--dry-run cannot be combined with --gallery");
     let resolvedPrefix;
     try {
         resolvedPrefix = resolvePutPrefix({
@@ -1758,7 +1790,7 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
     }
     let comment;
     let commentError;
-    if (wantComment && ghTarget && uploads.length > 0) {
+    if (wantComment && ghTarget && !dryRun && uploads.length > 0) {
         try {
             comment = await syncAttachmentsComment(ctx.client, ghTarget, run, ctx.config.workspace);
             if (logHuman)

package/dist/comment-config.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Published-CLI COPY of the workspace parser/resolver (issue #307)
+ * (packages/comment-config/src/index.ts). The published CLI imports no
+ * @uploads/* package, so that private package cannot be shared here — its
+ * parser/resolver is copied verbatim below. Kept in sync by
+ * test/fixtures/comment-config-golden.json, asserted from both sides (this
+ * package's comment-config.test.ts and the canonical package's
+ * index.test.ts) — change both copies together. `readLocalRepoCommentConfig`
+ * below is CLI-only: it reads the six candidate config paths off the working
+ * tree (the server instead fetches them from GitHub's contents API —
+ * apps/api/src/repo-comment-config.ts).
+ */
+export interface RepoCommentConfig {
+    imageWidth?: "auto" | "full" | number;
+    maxInlineImages?: number;
+    metaPath?: boolean;
+    metaState?: boolean;
+    linkToFilePage?: boolean;
+    note?: string;
+}
+export interface WorkspaceCommentDefaults {
+    imageWidth?: "full" | number;
+    maxInlineImages?: number;
+    showMetadata?: boolean;
+    linkToFilePage?: boolean;
+    note?: string;
+}
+export interface ResolvedCommentOptions {
+    imageWidth: "auto" | "full" | number;
+    maxInlineImages: number;
+    metaPath: boolean;
+    metaState: boolean;
+    linkToFilePage: boolean;
+    note: string | null;
+}
+export type OptionSource = "repo" | "workspace" | "auto";
+export declare const AUTO_COMMENT_OPTIONS: ResolvedCommentOptions;
+export declare const NOTE_MAX_CHARS = 500;
+export declare function parseRepoCommentConfig(text: string, format: "yaml" | "json"): {
+    config: RepoCommentConfig | null;
+    warnings: string[];
+};
+export declare function resolveCommentOptions(repo: RepoCommentConfig | null, ws: WorkspaceCommentDefaults | null): {
+    options: ResolvedCommentOptions;
+    source: Record<keyof ResolvedCommentOptions, OptionSource>;
+};
+/**
+ * Candidate paths, checked in this order — the first hit wins. Must match
+ * the server's REPO_CONFIG_PATHS exactly (apps/api/src/repo-comment-config.ts)
+ * so a committed config resolves identically whether the bot or the local
+ * gh fallback renders the comment.
+ */
+export declare const REPO_CONFIG_PATHS: readonly [".uploads.yml", ".uploads.yaml", ".uploads.json", ".github/uploads.yml", ".github/uploads.yaml", ".github/uploads.json"];
+/**
+ * Read the repo's comment config off the local working tree — the CLI has no
+ * GitHub App installation token to fetch via the contents API, so this reads
+ * `rootDir` directly. Returns the first candidate that exists (readable or
+ * not); an unreadable file (permissions, or a directory at that path) is
+ * treated as absent and the search continues to the next candidate, matching
+ * a 404 in the server-side fetch.
+ */
+export declare function readLocalRepoCommentConfig(rootDir: string): {
+    config: RepoCommentConfig | null;
+    path: string | null;
+    warnings: string[];
+};

package/dist/comment-config.js

@@ -0,0 +1,188 @@
+/**
+ * Published-CLI COPY of the workspace parser/resolver (issue #307)
+ * (packages/comment-config/src/index.ts). The published CLI imports no
+ * @uploads/* package, so that private package cannot be shared here — its
+ * parser/resolver is copied verbatim below. Kept in sync by
+ * test/fixtures/comment-config-golden.json, asserted from both sides (this
+ * package's comment-config.test.ts and the canonical package's
+ * index.test.ts) — change both copies together. `readLocalRepoCommentConfig`
+ * below is CLI-only: it reads the six candidate config paths off the working
+ * tree (the server instead fetches them from GitHub's contents API —
+ * apps/api/src/repo-comment-config.ts).
+ */
+import fs from "node:fs";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+export const AUTO_COMMENT_OPTIONS = {
+    imageWidth: "auto",
+    maxInlineImages: 16, // MAX_INLINE_ATTACHMENT_IMAGES — renderer copies own the constant
+    metaPath: true,
+    metaState: true,
+    linkToFilePage: true,
+    note: null,
+};
+export const NOTE_MAX_CHARS = 500;
+const WIDTH_MIN = 160;
+const WIDTH_MAX = 1000;
+const MAX_INLINE_MIN = 1;
+const MAX_INLINE_MAX = 48;
+const clamp = (n, lo, hi) => Math.min(hi, Math.max(lo, Math.round(n)));
+export function parseRepoCommentConfig(text, format) {
+    const warnings = [];
+    let root;
+    try {
+        root = format === "json" ? JSON.parse(text) : parseYaml(text);
+    }
+    catch {
+        return { config: null, warnings: ["config file could not be parsed; ignoring it"] };
+    }
+    if (typeof root !== "object" || root === null || Array.isArray(root)) {
+        return { config: null, warnings };
+    }
+    const comment = root.comment;
+    if (typeof comment !== "object" || comment === null || Array.isArray(comment)) {
+        return { config: null, warnings };
+    }
+    const c = comment;
+    const config = {};
+    // imageWidth: "auto" | "full" | finite number (clamped)
+    if ("imageWidth" in c) {
+        const v = c.imageWidth;
+        if (v === "auto" || v === "full")
+            config.imageWidth = v;
+        else if (typeof v === "number" && Number.isFinite(v))
+            config.imageWidth = clamp(v, WIDTH_MIN, WIDTH_MAX);
+        else
+            warnings.push(`imageWidth: expected "auto", "full", or a number; dropped`);
+    }
+    // maxInlineImages: finite number (clamped)
+    if ("maxInlineImages" in c) {
+        const v = c.maxInlineImages;
+        if (typeof v === "number" && Number.isFinite(v))
+            config.maxInlineImages = clamp(v, MAX_INLINE_MIN, MAX_INLINE_MAX);
+        else
+            warnings.push(`maxInlineImages: expected a number; dropped`);
+    }
+    // linkToFilePage: boolean
+    if ("linkToFilePage" in c) {
+        const v = c.linkToFilePage;
+        if (typeof v === "boolean")
+            config.linkToFilePage = v;
+        else
+            warnings.push(`linkToFilePage: expected a boolean; dropped`);
+    }
+    // meta.path / meta.state: booleans nested under `meta`
+    if ("meta" in c) {
+        const v = c.meta;
+        if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+            const meta = v;
+            if ("path" in meta) {
+                if (typeof meta.path === "boolean")
+                    config.metaPath = meta.path;
+                else
+                    warnings.push(`meta.path: expected a boolean; dropped`);
+            }
+            if ("state" in meta) {
+                if (typeof meta.state === "boolean")
+                    config.metaState = meta.state;
+                else
+                    warnings.push(`meta.state: expected a boolean; dropped`);
+            }
+        }
+        else {
+            warnings.push(`meta: expected an object; dropped`);
+        }
+    }
+    // note: non-empty trimmed string, max NOTE_MAX_CHARS (never truncated)
+    if ("note" in c) {
+        const v = c.note;
+        if (typeof v === "string") {
+            const trimmed = v.trim();
+            if (trimmed.length === 0) {
+                // empty/whitespace note is treated as absent
+            }
+            else if (trimmed.length > NOTE_MAX_CHARS) {
+                warnings.push(`note: longer than ${NOTE_MAX_CHARS} characters; dropped (not truncated)`);
+            }
+            else {
+                config.note = trimmed;
+            }
+        }
+        else {
+            warnings.push(`note: expected a string; dropped`);
+        }
+    }
+    return { config, warnings };
+}
+export function resolveCommentOptions(repo, ws) {
+    const wsAsRepo = {
+        ...(ws?.imageWidth !== undefined ? { imageWidth: ws.imageWidth } : {}),
+        ...(ws?.maxInlineImages !== undefined ? { maxInlineImages: ws.maxInlineImages } : {}),
+        ...(ws?.showMetadata !== undefined
+            ? { metaPath: ws.showMetadata, metaState: ws.showMetadata }
+            : {}),
+        ...(ws?.linkToFilePage !== undefined ? { linkToFilePage: ws.linkToFilePage } : {}),
+        ...(ws?.note ? { note: ws.note } : {}),
+    };
+    const options = { ...AUTO_COMMENT_OPTIONS };
+    const source = Object.fromEntries(Object.keys(AUTO_COMMENT_OPTIONS).map((k) => [k, "auto"]));
+    const apply = (cfg, from) => {
+        for (const key of [
+            "imageWidth",
+            "maxInlineImages",
+            "metaPath",
+            "metaState",
+            "linkToFilePage",
+        ]) {
+            if (cfg[key] !== undefined && source[key] === "auto") {
+                options[key] = cfg[key];
+                source[key] = from;
+            }
+        }
+        if (cfg.note !== undefined && source.note === "auto") {
+            options.note = cfg.note;
+            source.note = from;
+        }
+    };
+    if (repo)
+        apply(repo, "repo");
+    apply(wsAsRepo, "workspace");
+    return { options, source };
+}
+/**
+ * Candidate paths, checked in this order — the first hit wins. Must match
+ * the server's REPO_CONFIG_PATHS exactly (apps/api/src/repo-comment-config.ts)
+ * so a committed config resolves identically whether the bot or the local
+ * gh fallback renders the comment.
+ */
+export const REPO_CONFIG_PATHS = [
+    ".uploads.yml",
+    ".uploads.yaml",
+    ".uploads.json",
+    ".github/uploads.yml",
+    ".github/uploads.yaml",
+    ".github/uploads.json",
+];
+/**
+ * Read the repo's comment config off the local working tree — the CLI has no
+ * GitHub App installation token to fetch via the contents API, so this reads
+ * `rootDir` directly. Returns the first candidate that exists (readable or
+ * not); an unreadable file (permissions, or a directory at that path) is
+ * treated as absent and the search continues to the next candidate, matching
+ * a 404 in the server-side fetch.
+ */
+export function readLocalRepoCommentConfig(rootDir) {
+    for (const candidate of REPO_CONFIG_PATHS) {
+        let text;
+        try {
+            text = fs.readFileSync(join(rootDir, candidate), "utf8");
+        }
+        catch {
+            continue;
+        }
+        const format = candidate.endsWith(".json") ? "json" : "yaml";
+        const { config, warnings } = parseRepoCommentConfig(text, format);
+        return { config, path: candidate, warnings };
+    }
+    return { config: null, path: null, warnings: [] };
+}

package/dist/github-gh.js

@@ -2,7 +2,26 @@ import { execFileSync } from "node:child_process";
 import { UsageError } from "./cli-args.js";
 import { ATTACHMENTS_MARKER, ghMetadataFromTarget, isValidRepo, parseRepoFromRemoteUrl, } from "./github.js";
 import { META_VALUE_MAX, isMetaValueSafe } from "./metadata.js";
-export const execRunner = (cmd, args, input) => execFileSync(cmd, args, { encoding: "utf8", input, stdio: ["pipe", "pipe", "pipe"] });
+/**
+ * Windows npm shims are `.cmd`/`.bat`; bare `execFileSync` ENOENTs them.
+ * Retry once with `shell: true` so PATHEXT resolves the shim. Other platforms
+ * and non-ENOENT errors stay on the no-shell path. Args are from our CLI, not
+ * free-form shell strings.
+ */
+function execFileSyncCompat(cmd, args, opts) {
+    try {
+        return execFileSync(cmd, args, opts);
+    }
+    catch (err) {
+        const isWinShim = process.platform === "win32" &&
+            err.code === "ENOENT" &&
+            !/\.(cmd|bat|exe|com)$/i.test(cmd);
+        if (isWinShim)
+            return execFileSync(cmd, args, { ...opts, shell: true });
+        throw err;
+    }
+}
+export const execRunner = (cmd, args, input) => execFileSyncCompat(cmd, args, { encoding: "utf8", input, stdio: ["pipe", "pipe", "pipe"] });
 /**
  * A `CommandRunner` bounded by `timeoutMs` (node's native `execFileSync`
  * `timeout` option). There is no other subprocess-timeout wrapper in this
@@ -10,7 +29,7 @@ export const execRunner = (cmd, args, input) => execFileSync(cmd, args, { encodi
  * that must never block its caller for long (e.g. the bare-`put` nudge's `gh
  * pr view` check, issue #393), pass this instead of the default `execRunner`.
  */
-export const timedExecRunner = (timeoutMs) => (cmd, args, input) => execFileSync(cmd, args, {
+export const timedExecRunner = (timeoutMs) => (cmd, args, input) => execFileSyncCompat(cmd, args, {
     encoding: "utf8",
     input,
     stdio: ["pipe", "pipe", "pipe"],

package/dist/github.d.ts

@@ -74,6 +74,22 @@ export declare function attachmentsMarker(workspace?: string): string;
  * into a `<details>` link list. Keeps very large threads from becoming a wall
  * of images. */
 export declare const MAX_INLINE_ATTACHMENT_IMAGES = 16;
+/**
+ * Per-render knobs for the managed comment (issue #307), sourced from repo
+ * comment config. `imageWidth: "auto"` preserves today's per-item width
+ * heuristics (`attachmentImageWidth`/`posterImageWidth`/pair cap); `"full"`
+ * omits the `width` attribute entirely; a number overrides every width site.
+ */
+export interface CommentRenderOptions {
+    imageWidth: "auto" | "full" | number;
+    maxInlineImages: number;
+    metaPath: boolean;
+    metaState: boolean;
+    note: string | null;
+}
+/** Today's behavior, expressed as options — the default for every caller that
+ * hasn't opted into repo comment config. */
+export declare const AUTO_RENDER_OPTIONS: CommentRenderOptions;
 export interface AttachmentItem {
     key: string;
     url: string | null;
@@ -137,4 +153,9 @@ export declare const ATTACHMENT_IMAGE_WIDTH_PAIR = 320;
  * Render the one marker-owned GitHub comment. When there are no galleries this
  * intentionally preserves the legacy attachment-only body byte-for-byte.
  */
-export declare function attachmentsCommentBody(items: AttachmentItem[], galleries?: GalleryCommentItem[], marker?: string): string;
+export declare function attachmentsCommentBody(items: AttachmentItem[], galleries?: GalleryCommentItem[], marker?: string, options?: CommentRenderOptions): string;
+/**
+ * Extra footer line appended only on the local-`gh` fallback path (never on
+ * bot-authored comments). Short note that the App isn't on this repo yet.
+ */
+export declare const GH_FALLBACK_AUTHOR_NOTE = "<sub><a href=\"https://github.com/apps/uploads-sh\">Install the uploads GitHub App</a> for bot-managed comments.</sub>";

package/dist/github.js

@@ -162,6 +162,15 @@ export function attachmentsMarker(workspace) {
  * into a `<details>` link list. Keeps very large threads from becoming a wall
  * of images. */
 export const MAX_INLINE_ATTACHMENT_IMAGES = 16;
+/** Today's behavior, expressed as options — the default for every caller that
+ * hasn't opted into repo comment config. */
+export const AUTO_RENDER_OPTIONS = {
+    imageWidth: "auto",
+    maxInlineImages: MAX_INLINE_ATTACHMENT_IMAGES,
+    metaPath: true,
+    metaState: true,
+    note: null,
+};
 /** Default max width for images in the managed attachments comment (HTML img). */
 export const ATTACHMENT_IMAGE_WIDTH_DEFAULT = 400;
 /** Portrait / device mockups — keep phones readable, not full-column. */
@@ -241,19 +250,19 @@ function escapeMarkdownText(s) {
  * alone it is a stray character, and as a prefix next to `state` it is
  * noise. Only exact `/` after trim is suppressed.
  */
-function metaCaptionParts(meta) {
+function metaCaptionParts(meta, options) {
     const parts = [];
     const path = meta?.path?.trim();
-    if (path && path !== "/")
+    if (options.metaPath && path && path !== "/")
         parts.push(path);
     const state = meta?.state?.trim();
-    if (state)
+    if (options.metaState && state)
         parts.push(state);
     return parts;
 }
 /** `<sub>` caption body for an inline image, or null when there is nothing to say. */
-function metaCaptionHtml(meta) {
-    const parts = metaCaptionParts(meta);
+function metaCaptionHtml(meta, options) {
+    const parts = metaCaptionParts(meta, options);
     return parts.length > 0 ? parts.map(escapeHtmlText).join(" · ") : null;
 }
 /**
@@ -261,12 +270,32 @@ function metaCaptionHtml(meta) {
  * HTML-escapes first, then markdown-escapes: HTML escaping introduces no
  * backslashes or brackets, so the markdown pass cannot corrupt its entities.
  */
-function metaCaptionMarkdown(meta) {
-    const parts = metaCaptionParts(meta);
+function metaCaptionMarkdown(meta, options) {
+    const parts = metaCaptionParts(meta, options);
     if (parts.length === 0)
         return "";
     return ` · ${parts.map((p) => escapeMarkdownText(escapeHtmlText(p))).join(" · ")}`;
 }
+/** Resolved pixel width for an image site, or `null` meaning "omit the width
+ * attribute". `"auto"` defers to the caller's per-item heuristic (`autoPx`);
+ * `"full"` always omits; a number always wins. */
+function resolvedWidth(autoPx, options) {
+    if (options.imageWidth === "auto")
+        return autoPx;
+    if (options.imageWidth === "full")
+        return null;
+    return options.imageWidth;
+}
+/** Every `<img>` tag in the managed comment goes through here so the
+ * omit-width-attribute case ("full") can't drift between call sites.
+ *
+ * `escapedAlt`/`escapedSrc` must already be attribute-escaped (via
+ * `escapeHtmlAttr`) by the caller — this function interpolates them as-is
+ * and does not escape them itself. */
+function imgTag(w, escapedAlt, escapedSrc) {
+    const widthAttr = w === null ? "" : ` width="${w}"`;
+    return `<img${widthAttr} alt="${escapedAlt}" src="${escapedSrc}">`;
+}
 /** Extract the filename stem's before/after token (issue #419 fallback pairing).
  * `base` is the stem lowercased with the token removed; `null` when the stem
  * carries no recognizable before/after token. Requires a separator (`-`, `_`,
@@ -363,32 +392,35 @@ function pairAttachments(items, isImageAt) {
  * than a standalone image so two side by side stay under GitHub's comment
  * column width (and don't overflow on mobile). */
 export const ATTACHMENT_IMAGE_WIDTH_PAIR = 320;
-function renderPairCell(item, label) {
+function renderPairCell(item, label, options) {
     const name = item.key.slice(item.key.lastIndexOf("/") + 1);
     const src = item.embedUrl ?? item.url;
     const link = item.pageUrl ?? item.url;
-    const w = Math.min(attachmentImageWidth(name), ATTACHMENT_IMAGE_WIDTH_PAIR);
+    const autoPx = Math.min(attachmentImageWidth(name), ATTACHMENT_IMAGE_WIDTH_PAIR);
+    const w = resolvedWidth(autoPx, options);
     const alt = escapeHtmlAttr(name);
     const href = escapeHtmlAttr((link ?? src));
     const imgSrc = escapeHtmlAttr(src);
-    const caption = metaCaptionHtml(item.meta);
+    const caption = metaCaptionHtml(item.meta, options);
     const captionHtml = caption ? `<br><sub>${caption}</sub>` : "";
-    return `<td align="center"><sub><strong>${label}</strong></sub><br><a href="${href}"><img width="${w}" alt="${alt}" src="${imgSrc}"></a>${captionHtml}</td>`;
+    return `<td align="center"><sub><strong>${label}</strong></sub><br><a href="${href}">${imgTag(w, alt, imgSrc)}</a>${captionHtml}</td>`;
 }
 /** One side-by-side before/after row (issue #419): a single HTML table so
  * GitHub renders both images on one line, with `Before`/`After` labels and
  * each side's usual path/state caption preserved underneath. */
-function renderPairRow(beforeItem, afterItem) {
-    return `<table><tr>${renderPairCell(beforeItem, "Before")}${renderPairCell(afterItem, "After")}</tr></table>`;
+function renderPairRow(beforeItem, afterItem, options) {
+    return `<table><tr>${renderPairCell(beforeItem, "Before", options)}${renderPairCell(afterItem, "After", options)}</tr></table>`;
 }
 /**
  * Render the one marker-owned GitHub comment. When there are no galleries this
  * intentionally preserves the legacy attachment-only body byte-for-byte.
  */
-export function attachmentsCommentBody(items, galleries = [], marker = ATTACHMENTS_MARKER) {
+export function attachmentsCommentBody(items, galleries = [], marker = ATTACHMENTS_MARKER, options = AUTO_RENDER_OPTIONS) {
     const sorted = items.toSorted((a, b) => a.key.localeCompare(b.key));
     const sortedGalleries = galleries.toSorted((a, b) => a.title.localeCompare(b.title) || a.url.localeCompare(b.url));
     const lines = [marker];
+    if (options.note)
+        lines.push(options.note, "");
     if (sortedGalleries.length > 0) {
         lines.push("### 🖼️ Galleries", "");
         for (const gallery of sortedGalleries) {
@@ -397,7 +429,8 @@ export function attachmentsCommentBody(items, galleries = [], marker = ATTACHMEN
             for (const preview of gallery.previews ?? []) {
                 const previewHref = preview.itemUrl ? escapeHtmlAttr(preview.itemUrl) : href;
                 const previewSrc = escapeHtmlAttr(preview.embedUrl ?? preview.url);
-                lines.push(`<a href="${previewHref}"><img width="320" alt="${escapeHtmlAttr(preview.alt)}" src="${previewSrc}"></a>`);
+                const previewW = resolvedWidth(320, options);
+                lines.push(`<a href="${previewHref}">${imgTag(previewW, escapeHtmlAttr(preview.alt), previewSrc)}</a>`);
             }
             lines.push(`<sub><a href="${href}">Open gallery</a></sub>`, "");
         }
@@ -421,12 +454,12 @@ export function attachmentsCommentBody(items, galleries = [], marker = ATTACHMEN
         const partnerIdx = partnerOf.get(idx);
         if (partnerIdx !== undefined) {
             const partner = sorted[partnerIdx];
-            if (inlinedImages + 2 <= MAX_INLINE_ATTACHMENT_IMAGES) {
+            if (inlinedImages + 2 <= options.maxInlineImages) {
                 inlinedImages += 2;
                 consumedByPair.add(partnerIdx);
                 const beforeItem = roleOf.get(idx) === "before" ? item : partner;
                 const afterItem = roleOf.get(idx) === "before" ? partner : item;
-                lines.push(renderPairRow(beforeItem, afterItem), "");
+                lines.push(renderPairRow(beforeItem, afterItem, options), "");
                 continue;
             }
             // Cap already full for a two-image row — degrade this pair to two
@@ -442,7 +475,7 @@ export function attachmentsCommentBody(items, galleries = [], marker = ATTACHMEN
         const isImage = Boolean(src) && inferContentType(name).startsWith("image/");
         const isPosterVideo = Boolean(item.posterUrl) && inferContentType(name).startsWith("video/");
         const inlines = isImage || isPosterVideo;
-        if (inlines && inlinedImages >= MAX_INLINE_ATTACHMENT_IMAGES) {
+        if (inlines && inlinedImages >= options.maxInlineImages) {
             // Cap hit — defer to the collapsed overflow list below rather than
             // embedding every remaining image inline.
             overflowImages.push(item);
@@ -450,37 +483,39 @@ export function attachmentsCommentBody(items, galleries = [], marker = ATTACHMEN
         }
         if (isPosterVideo) {
             inlinedImages++;
-            const w = posterImageWidth(item.videoMeta, name);
+            const autoPx = posterImageWidth(item.videoMeta, name);
+            const w = resolvedWidth(autoPx, options);
             const href = escapeHtmlAttr(link ?? item.posterUrl);
-            lines.push(`<a href="${href}"><img width="${w}" alt="${escapeHtmlAttr(name)}" src="${escapeHtmlAttr(item.posterUrl)}"></a>`);
+            lines.push(`<a href="${href}">${imgTag(w, escapeHtmlAttr(name), escapeHtmlAttr(item.posterUrl))}</a>`);
             // GitHub strips <video>, so a still frame needs an explicit affordance
             // or it reads as a screenshot.
             const parts = ["▶ Play video"];
             if (item.videoMeta?.durationSeconds != null) {
                 parts.push(formatDuration(item.videoMeta.durationSeconds));
             }
-            parts.push(...metaCaptionParts(item.meta).map(escapeHtmlText));
+            parts.push(...metaCaptionParts(item.meta, options).map(escapeHtmlText));
             lines.push(`<sub>${parts.join(" · ")}</sub>`, "");
         }
         else if (isImage) {
             inlinedImages++;
             // Markdown ![]() has no width control — phone frames become full-column giants.
             // img src uses embed host when available (Camo revalidates); click-through prefers the file page.
-            const w = attachmentImageWidth(name);
+            const autoPx = attachmentImageWidth(name);
+            const w = resolvedWidth(autoPx, options);
             const alt = escapeHtmlAttr(name);
             const href = escapeHtmlAttr(link ?? src);
             const imgSrc = escapeHtmlAttr(src);
-            lines.push(`<a href="${href}"><img width="${w}" alt="${alt}" src="${imgSrc}"></a>`);
-            const caption = metaCaptionHtml(item.meta);
+            lines.push(`<a href="${href}">${imgTag(w, alt, imgSrc)}</a>`);
+            const caption = metaCaptionHtml(item.meta, options);
             if (caption)
                 lines.push(`<sub>${caption}</sub>`);
             lines.push("");
         }
         else if (link) {
-            lines.push(`- [${name}](${link})${metaCaptionMarkdown(item.meta)}`);
+            lines.push(`- [${name}](${link})${metaCaptionMarkdown(item.meta, options)}`);
         }
         else {
-            lines.push(`- ${name}${metaCaptionMarkdown(item.meta)}`);
+            lines.push(`- ${name}${metaCaptionMarkdown(item.meta, options)}`);
         }
     }
     if (overflowImages.length > 0) {
@@ -489,7 +524,7 @@ export function attachmentsCommentBody(items, galleries = [], marker = ATTACHMEN
         for (const item of overflowImages) {
             const name = item.key.slice(item.key.lastIndexOf("/") + 1);
             const link = item.pageUrl ?? item.url;
-            const suffix = metaCaptionMarkdown(item.meta);
+            const suffix = metaCaptionMarkdown(item.meta, options);
             lines.push(link ? `- [${name}](${link})${suffix}` : `- ${name}${suffix}`);
         }
         lines.push("", "</details>", "");
@@ -506,3 +541,8 @@ export function attachmentsCommentBody(items, galleries = [], marker = ATTACHMEN
     lines.push('<sub>Add media: <code>uploads put &lt;file&gt; --pr &lt;N&gt; --comment</code> (or <code>--issue &lt;N&gt;</code>) · <a href="https://uploads.sh/docs/github-app">docs</a></sub>');
     return lines.join("\n");
 }
+/**
+ * Extra footer line appended only on the local-`gh` fallback path (never on
+ * bot-authored comments). Short note that the App isn't on this repo yet.
+ */
+export const GH_FALLBACK_AUTHOR_NOTE = '<sub><a href="https://github.com/apps/uploads-sh">Install the uploads GitHub App</a> for bot-managed comments.</sub>';

package/dist/index.d.ts

@@ -7,7 +7,7 @@ export { UploadsError, type UploadsErrorCode } from "./errors.js";
 export { createUploadsClient, type UploadsClient, type PutOptions, type ProvenanceInput, type ListOptions, type PutResult, type ListItem, type ListResult, type HeadResult, type DeleteResult, type GalleryItem, type Gallery, type GallerySummary, type GalleryListOptions, type GalleryListResult, type CreateGalleryOptions, type AddGalleryItemOptions, type DeleteGalleryOptions, type HealthResult, type UsageResult, type ReconcileResult, type PurgeExpiredResult, type PurgeExpiredResponse, type FindFilesOptions, type FindFilesItem, type FindFilesResult, type GetMetadataResult, type PatchMetadataOptions, } from "./client.js";
 export { buildCliProvenance } from "./provenance.js";
 export { META_KEY_RE, META_VALUE_MAX, META_MAX_KEYS, META_MAX_TOTAL_BYTES, validateMetaEntry, parseMetaPair, parseMetaFlags, } from "./metadata.js";
-export { ATTACHMENTS_MARKER, attachmentsCommentBody, ghAttachmentKey, ghKeyPrefix, ghMetadataFromTarget, ghBranchAttachmentKey, ghBranchKeyPrefix, ghMetadataForBranch, isValidRepo, parseRepoFromRemoteUrl, type AttachmentItem, type GhTarget, type GhTargetKind, } from "./github.js";
+export { ATTACHMENTS_MARKER, attachmentsCommentBody, GH_FALLBACK_AUTHOR_NOTE, ghAttachmentKey, ghKeyPrefix, ghMetadataFromTarget, ghBranchAttachmentKey, ghBranchKeyPrefix, ghMetadataForBranch, isValidRepo, parseRepoFromRemoteUrl, type AttachmentItem, type GhTarget, type GhTargetKind, } from "./github.js";
 export { DEFAULT_OPTIMIZE_MAX_EDGE, DEFAULT_OPTIMIZE_QUALITY, optimizeImageForUpload, rewriteKeyExtension, withImageExtension, type OptimizeImageOptions, type OptimizeImageResult, type OptimizeOutputFormat, } from "./optimize.js";
 export { FRAME_PRESETS, applyFrame, listFramePresets, resolveFrameId, type FrameFit, type FrameOptions, type FrameResult, } from "./frame.js";
 export { execRunner, resolveRepo, upsertAttachmentsComment, type CommandRunner, } from "./github-gh.js";

package/dist/index.js

@@ -7,7 +7,7 @@ export { UploadsError } from "./errors.js";
 export { createUploadsClient, } from "./client.js";
 export { buildCliProvenance } from "./provenance.js";
 export { META_KEY_RE, META_VALUE_MAX, META_MAX_KEYS, META_MAX_TOTAL_BYTES, validateMetaEntry, parseMetaPair, parseMetaFlags, } from "./metadata.js";
-export { ATTACHMENTS_MARKER, attachmentsCommentBody, ghAttachmentKey, ghKeyPrefix, ghMetadataFromTarget, ghBranchAttachmentKey, ghBranchKeyPrefix, ghMetadataForBranch, isValidRepo, parseRepoFromRemoteUrl, } from "./github.js";
+export { ATTACHMENTS_MARKER, attachmentsCommentBody, GH_FALLBACK_AUTHOR_NOTE, ghAttachmentKey, ghKeyPrefix, ghMetadataFromTarget, ghBranchAttachmentKey, ghBranchKeyPrefix, ghMetadataForBranch, isValidRepo, parseRepoFromRemoteUrl, } from "./github.js";
 export { DEFAULT_OPTIMIZE_MAX_EDGE, DEFAULT_OPTIMIZE_QUALITY, optimizeImageForUpload, rewriteKeyExtension, withImageExtension, } from "./optimize.js";
 export { FRAME_PRESETS, applyFrame, listFramePresets, resolveFrameId, } from "./frame.js";
 export { execRunner, resolveRepo, upsertAttachmentsComment, } from "./github-gh.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",
   "sideEffects": false,
@@ -61,7 +61,8 @@
     "opentype.js": "^2.0.0",
     "perfect-freehand": "^1.2.3",
     "roughjs": "^4.6.6",
-    "sharp": "^0.35.3"
+    "sharp": "^0.35.3",
+    "yaml": "^2.6.0"
   },
   "optionalDependencies": {
     "playwright-core": "^1.61.1"