@buildinternet/uploads 0.46.1 → 0.46.3

package/dist/client.js

@@ -4,14 +4,104 @@ import { UploadsError } from "./errors.js";
 import { buildScreenshotKey } from "./keys.js";
 import { packageVersion } from "./package-version.js";
 import { resolveEmbedUrl } from "./public-urls.js";
-async function jsonRequest(url, init) {
-    let res;
+// --- Request resilience (issue #809) ---------------------------------------
+//
+// Bare `fetch` has no timeout — undici's default header timeout is ~5
+// minutes, so a backend stall (see the 2026-08-23 D1 stall incident, #808)
+// hangs the CLI silently for that whole window instead of failing fast like
+// the workers now do (#805-#807). Every core API call routes through
+// `resilientFetch` for a bounded timeout and a single bounded retry.
+//
+// Timeouts: short for JSON control calls, longer for the one content-bytes
+// call (file `put`), matching the side-channel calls' pattern (telemetry.ts,
+// update-check.ts already carry AbortController timeouts — this closes the
+// gap on the core path).
+const JSON_TIMEOUT_MS = 15_000;
+const CONTENT_TIMEOUT_MS = 60_000;
+// At most one retry. Retried on network errors, 503, and 429 — and only for
+// GET/PUT, since a `put` is byte-idempotent (same key, same bytes) but a
+// POST/DELETE/PATCH might not be, and telling "no bytes sent" apart from "the
+// mutation already landed" isn't reliable enough to risk a double-apply.
+const MAX_ATTEMPTS = 2;
+const RETRYABLE_METHODS = new Set(["GET", "PUT"]);
+const RETRYABLE_STATUSES = new Set([429, 503]);
+const DEFAULT_RETRY_DELAY_MS = 2_000;
+// Cap an honored X-Retry-After so a large server-suggested backoff can't
+// stall a hook/CI step for minutes.
+const MAX_RETRY_AFTER_DELAY_MS = 10_000;
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Seconds-valued retry delay from the response, capped; falls back to the default backoff. */
+function retryDelayMs(res) {
+    const raw = res?.headers.get("x-retry-after") ?? res?.headers.get("retry-after");
+    const seconds = raw ? Number(raw) : NaN;
+    if (Number.isFinite(seconds) && seconds > 0) {
+        return Math.min(seconds * 1000, MAX_RETRY_AFTER_DELAY_MS);
+    }
+    return DEFAULT_RETRY_DELAY_MS;
+}
+/** One-line stderr notice so a hook/CI log explains the pause (issue #809). */
+function printRetryNotice(label, delayMs) {
+    const seconds = delayMs % 1000 === 0 ? `${delayMs / 1000}s` : `${Math.round(delayMs) / 1000}s`;
+    process.stderr.write(`warning: uploads.sh ${label}, retrying in ${seconds}…\n`);
+}
+/**
+ * fetch with a per-request AbortController timeout. A timeout (or any other
+ * fetch rejection) surfaces as `UploadsError` code `NETWORK`, naming the
+ * timeout so hook/CI logs are diagnosable.
+ */
+async function fetchWithTimeout(url, init, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        res = await fetch(url, init);
+        return await fetch(url, { ...init, signal: controller.signal });
     }
     catch (err) {
+        if (controller.signal.aborted) {
+            throw new UploadsError(`request timed out after ${timeoutMs}ms`, "NETWORK");
+        }
         throw new UploadsError(err instanceof Error ? err.message : "network request failed", "NETWORK");
     }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * The shared resilience core for both `jsonRequest` and
+ * `createUploadsClient`'s `request`: bounded timeout + bounded retry on
+ * network errors, 503, and 429, honoring `X-Retry-After` when present.
+ * Never retries a non-idempotent method (see `RETRYABLE_METHODS` above).
+ * Returns the raw `Response` on the final attempt — callers still handle
+ * `!res.ok` themselves via `parseErrorResponse`.
+ */
+async function resilientFetch(method, url, init, timeoutMs) {
+    const retryable = RETRYABLE_METHODS.has(method.toUpperCase());
+    for (let attempt = 1;; attempt++) {
+        let res;
+        let networkErr;
+        try {
+            res = await fetchWithTimeout(url, init, timeoutMs);
+        }
+        catch (err) {
+            networkErr = err;
+        }
+        const canRetry = retryable &&
+            attempt < MAX_ATTEMPTS &&
+            (networkErr !== undefined || (res !== undefined && RETRYABLE_STATUSES.has(res.status)));
+        if (!canRetry) {
+            if (networkErr)
+                throw networkErr;
+            return res;
+        }
+        const delayMs = retryDelayMs(res);
+        printRetryNotice(res ? `responded ${res.status}` : "request failed", delayMs);
+        await sleep(delayMs);
+    }
+}
+async function jsonRequest(url, init) {
+    const method = (init.method ?? "GET").toUpperCase();
+    const res = await resilientFetch(method, url, init, JSON_TIMEOUT_MS);
     if (!res.ok)
         throw await parseErrorResponse(res);
     return (await res.json());
@@ -280,18 +370,7 @@ export function createUploadsClient(config) {
         if (opts?.auth !== false) {
             headers.Authorization = `Bearer ${config.token}`;
         }
-        let res;
-        try {
-            res = await fetch(path, {
-                method,
-                headers,
-                body: opts?.body,
-            });
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "network request failed";
-            throw new UploadsError(message, "NETWORK");
-        }
+        const res = await resilientFetch(method, path, { method, headers, body: opts?.body }, opts?.longTimeout ? CONTENT_TIMEOUT_MS : JSON_TIMEOUT_MS);
         if (!res.ok) {
             throw await parseErrorResponse(res);
         }
@@ -383,6 +462,7 @@ export function createUploadsClient(config) {
             const result = await request("PUT", `${canonicalFilesBase(config)}/${encodeKeyPath(key)}`, {
                 body,
                 headers,
+                longTimeout: true,
             });
             if (result.url == null) {
                 throw new UploadsError("upload succeeded but workspace has no publicBaseUrl", "NO_PUBLIC_URL", 201);

package/dist/commands/login.d.ts

@@ -17,10 +17,10 @@ export declare function resolveEnrollmentCode(parsed: ReturnType<typeof parseCom
     hiddenPrompt: () => Promise<string>;
 }): Promise<string>;
 /**
- * Auth worker base URL: explicit flag > UPLOADS_AUTH_URL > swap an `api.` host
- * label for `auth.` > the production default. Local multi-worker dev (where
- * auth runs on a different loopback port than the API) needs an explicit
- * --auth-url / UPLOADS_AUTH_URL.
+ * Auth base URL: explicit flag > UPLOADS_AUTH_URL > derived from the API base
+ * (`api.<domain>` → `<domain>`, same-origin auth since #731) > the production
+ * default. Local multi-worker dev (where auth runs on a different loopback port
+ * than the API) needs an explicit --auth-url / UPLOADS_AUTH_URL.
  */
 export declare function resolveAuthUrl(parsed: ReturnType<typeof parseCommandArgs>, apiUrl: string): string;
 export interface DeviceLoginIo {

package/dist/commands/login.js

@@ -25,7 +25,7 @@ Options:
   --scopes <list>     Comma-separated scopes (default:
                       files:read,files:write,files:delete)
   --label <text>      Token label (default: this machine's hostname)
-  --auth-url <url>    Auth base (default: https://auth.uploads.sh)
+  --auth-url <url>    Auth base (default: https://uploads.sh)
   --no-open           Don't try to open a browser automatically
   --code <code>       Fallback: use a pre-existing enrollment code instead of
                       device login (visible in shell history)
@@ -160,10 +160,10 @@ function hasEnrollmentSource(parsed) {
         Boolean(process.env.UPLOADS_ENROLLMENT_CODE));
 }
 /**
- * Auth worker base URL: explicit flag > UPLOADS_AUTH_URL > swap an `api.` host
- * label for `auth.` > the production default. Local multi-worker dev (where
- * auth runs on a different loopback port than the API) needs an explicit
- * --auth-url / UPLOADS_AUTH_URL.
+ * Auth base URL: explicit flag > UPLOADS_AUTH_URL > derived from the API base
+ * (`api.<domain>` → `<domain>`, same-origin auth since #731) > the production
+ * default. Local multi-worker dev (where auth runs on a different loopback port
+ * than the API) needs an explicit --auth-url / UPLOADS_AUTH_URL.
  */
 export function resolveAuthUrl(parsed, apiUrl) {
     const explicit = flagString(parsed.flags, "--auth-url") ?? process.env.UPLOADS_AUTH_URL;

package/dist/config.d.ts

@@ -4,7 +4,14 @@ export interface UploadsClientConfig {
     workspace: string;
     token: string;
 }
-/** Derive auth origin from an API base (`api.` → `auth.`), else production default. */
+/**
+ * Derive the auth base URL from an API base. Since #731 the auth endpoints are
+ * served same-origin on the app origin (`<origin>/api/auth`, web proxies to the
+ * auth worker), not an `auth.` subdomain — so the canonical `api.<domain>`
+ * shape maps to its parent (`api.uploads.sh` → `uploads.sh`). Falls back to the
+ * production origin. Local multi-worker dev, where auth listens on a different
+ * loopback port, still needs an explicit `--auth-url` / `UPLOADS_AUTH_URL`.
+ */
 export declare function authUrlFromApi(apiUrl: string): string;
 export declare const DEFAULT_API_URL = "https://api.uploads.sh";
 export declare const DEFAULT_WORKSPACE = "default";

package/dist/config.js

@@ -2,19 +2,26 @@ import { existsSync, readFileSync } from "node:fs";
 import { loadConfigFile, resolveConfigPath } from "./config-file.js";
 import { UploadsError } from "./errors.js";
 export { defaultConfigPath, resolveConfigPath, loadConfigFile, redactToken, writeConfigKeys, removeConfigKeys, configValuesFromClient, putDefaultsToConfigValues, resolvePutDefaults, mergePutDefaults, resolveScreenshotDefaults, UPLOADS_CONFIG_KEYS, } from "./config-file.js";
-/** Derive auth origin from an API base (`api.` → `auth.`), else production default. */
+/**
+ * Derive the auth base URL from an API base. Since #731 the auth endpoints are
+ * served same-origin on the app origin (`<origin>/api/auth`, web proxies to the
+ * auth worker), not an `auth.` subdomain — so the canonical `api.<domain>`
+ * shape maps to its parent (`api.uploads.sh` → `uploads.sh`). Falls back to the
+ * production origin. Local multi-worker dev, where auth listens on a different
+ * loopback port, still needs an explicit `--auth-url` / `UPLOADS_AUTH_URL`.
+ */
 export function authUrlFromApi(apiUrl) {
     try {
         const url = new URL(apiUrl);
         if (url.hostname.startsWith("api.")) {
-            url.hostname = `auth.${url.hostname.slice(4)}`;
+            url.hostname = url.hostname.slice(4);
             return url.origin;
         }
     }
     catch {
         // fall through
     }
-    return "https://auth.uploads.sh";
+    return "https://uploads.sh";
 }
 export const DEFAULT_API_URL = "https://api.uploads.sh";
 export const DEFAULT_WORKSPACE = "default";

package/dist/session-cli-version.js

@@ -47,7 +47,7 @@ export async function syncSessionCliVersion(opts = {}) {
     const apiUrl = opts.apiUrl ?? fromFile.UPLOADS_API_URL ?? process.env.UPLOADS_API_URL;
     const authUrl = (opts.authUrl ??
         process.env.UPLOADS_AUTH_URL ??
-        (apiUrl ? authUrlFromApi(apiUrl) : "https://auth.uploads.sh")).replace(/\/$/, "");
+        (apiUrl ? authUrlFromApi(apiUrl) : "https://uploads.sh")).replace(/\/$/, "");
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), POST_TIMEOUT_MS);
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.46.1",
+  "version": "0.46.3",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",
   "sideEffects": false,
@@ -48,7 +48,7 @@
   "devDependencies": {
     "@types/node": "^26.1.0",
     "ai": "^6.0.0",
-    "files-sdk": "^2.2.4",
+    "files-sdk": "^2.2.5",
     "typescript": "^7.0.2",
     "vitest": "^4.1.10"
   },