@buildinternet/uploads 0.46.2 → 0.46.3

package/dist/commands/login.d.ts

@@ -17,10 +17,10 @@ export declare function resolveEnrollmentCode(parsed: ReturnType<typeof parseCom
     hiddenPrompt: () => Promise<string>;
 }): Promise<string>;
 /**
- * Auth worker base URL: explicit flag > UPLOADS_AUTH_URL > swap an `api.` host
- * label for `auth.` > the production default. Local multi-worker dev (where
- * auth runs on a different loopback port than the API) needs an explicit
- * --auth-url / UPLOADS_AUTH_URL.
+ * Auth base URL: explicit flag > UPLOADS_AUTH_URL > derived from the API base
+ * (`api.<domain>` → `<domain>`, same-origin auth since #731) > the production
+ * default. Local multi-worker dev (where auth runs on a different loopback port
+ * than the API) needs an explicit --auth-url / UPLOADS_AUTH_URL.
  */
 export declare function resolveAuthUrl(parsed: ReturnType<typeof parseCommandArgs>, apiUrl: string): string;
 export interface DeviceLoginIo {

package/dist/commands/login.js

@@ -25,7 +25,7 @@ Options:
   --scopes <list>     Comma-separated scopes (default:
                       files:read,files:write,files:delete)
   --label <text>      Token label (default: this machine's hostname)
-  --auth-url <url>    Auth base (default: https://auth.uploads.sh)
+  --auth-url <url>    Auth base (default: https://uploads.sh)
   --no-open           Don't try to open a browser automatically
   --code <code>       Fallback: use a pre-existing enrollment code instead of
                       device login (visible in shell history)
@@ -160,10 +160,10 @@ function hasEnrollmentSource(parsed) {
         Boolean(process.env.UPLOADS_ENROLLMENT_CODE));
 }
 /**
- * Auth worker base URL: explicit flag > UPLOADS_AUTH_URL > swap an `api.` host
- * label for `auth.` > the production default. Local multi-worker dev (where
- * auth runs on a different loopback port than the API) needs an explicit
- * --auth-url / UPLOADS_AUTH_URL.
+ * Auth base URL: explicit flag > UPLOADS_AUTH_URL > derived from the API base
+ * (`api.<domain>` → `<domain>`, same-origin auth since #731) > the production
+ * default. Local multi-worker dev (where auth runs on a different loopback port
+ * than the API) needs an explicit --auth-url / UPLOADS_AUTH_URL.
  */
 export function resolveAuthUrl(parsed, apiUrl) {
     const explicit = flagString(parsed.flags, "--auth-url") ?? process.env.UPLOADS_AUTH_URL;

package/dist/config.d.ts

@@ -4,7 +4,14 @@ export interface UploadsClientConfig {
     workspace: string;
     token: string;
 }
-/** Derive auth origin from an API base (`api.` → `auth.`), else production default. */
+/**
+ * Derive the auth base URL from an API base. Since #731 the auth endpoints are
+ * served same-origin on the app origin (`<origin>/api/auth`, web proxies to the
+ * auth worker), not an `auth.` subdomain — so the canonical `api.<domain>`
+ * shape maps to its parent (`api.uploads.sh` → `uploads.sh`). Falls back to the
+ * production origin. Local multi-worker dev, where auth listens on a different
+ * loopback port, still needs an explicit `--auth-url` / `UPLOADS_AUTH_URL`.
+ */
 export declare function authUrlFromApi(apiUrl: string): string;
 export declare const DEFAULT_API_URL = "https://api.uploads.sh";
 export declare const DEFAULT_WORKSPACE = "default";

package/dist/config.js

@@ -2,19 +2,26 @@ import { existsSync, readFileSync } from "node:fs";
 import { loadConfigFile, resolveConfigPath } from "./config-file.js";
 import { UploadsError } from "./errors.js";
 export { defaultConfigPath, resolveConfigPath, loadConfigFile, redactToken, writeConfigKeys, removeConfigKeys, configValuesFromClient, putDefaultsToConfigValues, resolvePutDefaults, mergePutDefaults, resolveScreenshotDefaults, UPLOADS_CONFIG_KEYS, } from "./config-file.js";
-/** Derive auth origin from an API base (`api.` → `auth.`), else production default. */
+/**
+ * Derive the auth base URL from an API base. Since #731 the auth endpoints are
+ * served same-origin on the app origin (`<origin>/api/auth`, web proxies to the
+ * auth worker), not an `auth.` subdomain — so the canonical `api.<domain>`
+ * shape maps to its parent (`api.uploads.sh` → `uploads.sh`). Falls back to the
+ * production origin. Local multi-worker dev, where auth listens on a different
+ * loopback port, still needs an explicit `--auth-url` / `UPLOADS_AUTH_URL`.
+ */
 export function authUrlFromApi(apiUrl) {
     try {
         const url = new URL(apiUrl);
         if (url.hostname.startsWith("api.")) {
-            url.hostname = `auth.${url.hostname.slice(4)}`;
+            url.hostname = url.hostname.slice(4);
             return url.origin;
         }
     }
     catch {
         // fall through
     }
-    return "https://auth.uploads.sh";
+    return "https://uploads.sh";
 }
 export const DEFAULT_API_URL = "https://api.uploads.sh";
 export const DEFAULT_WORKSPACE = "default";

package/dist/session-cli-version.js

@@ -47,7 +47,7 @@ export async function syncSessionCliVersion(opts = {}) {
     const apiUrl = opts.apiUrl ?? fromFile.UPLOADS_API_URL ?? process.env.UPLOADS_API_URL;
     const authUrl = (opts.authUrl ??
         process.env.UPLOADS_AUTH_URL ??
-        (apiUrl ? authUrlFromApi(apiUrl) : "https://auth.uploads.sh")).replace(/\/$/, "");
+        (apiUrl ? authUrlFromApi(apiUrl) : "https://uploads.sh")).replace(/\/$/, "");
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), POST_TIMEOUT_MS);
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.46.2",
+  "version": "0.46.3",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",
   "sideEffects": false,