@buildinternet/uploads 0.47.0 → 0.48.1

package/README.md

@@ -204,6 +204,8 @@ Config layers (first match wins): CLI flags → env vars → `--env-file` → `~
 
 Or with `UPLOADS_TOKEN`/`UPLOADS_WORKSPACE` in the environment or user config. Claude Code: `claude mcp add uploads -- uploads --env-file /path/to/.env mcp`.
 
+The MCP Registry lists this server as `sh.uploads/mcp`.
+
 For HTTP clients there's also a hosted variant at `https://agents.uploads.sh/mcp` — the workspace is inferred from the bearer token, so only the URL and token are needed (`https://agents.uploads.sh/<workspace>/mcp` and the `mcp.uploads.sh` hostname also work). Tools: file operations (including `get_metadata` / `set_metadata` / `find_files`) plus `gallery_create`, `gallery_get`, `gallery_add`, `gallery_link`, and `gallery_find_by_reference`; all use the same bearer-token workspace scopes and gallery URLs come from the API — see `apps/mcp` in the repo. The hosted `put` also accepts a `metadata` param. `uploads install` registers the skills + hosted MCP with whichever of Claude Code, Codex, and Grok are on PATH (a missing CLI is skipped) + Grok/Cursor hooks (short progress; `--verbose` for underlying output). Claude and Codex use their plugins for the same pre-PR screenshot reminder (`uploads hook pre-pr-screenshot`). Its `put` takes no content type: the stored type is sniffed server-side from the bytes and checked against the workspace allowlist, and writes are rate limited per workspace.
 
 ## Programmatic use

package/dist/client.d.ts

@@ -439,6 +439,23 @@ export interface UsageResult {
     storageRemainingBytes?: number;
     maxUploadsPerPeriod?: number;
     uploadsRemaining?: number;
+    /** Bytes still on hosted storage (shared-lane residue). */
+    sharedBytes?: number;
+    /** "shared" = BYO bucket active: the storage cap meters only hosted
+     * residue; the customer's own bucket is unmetered. */
+    storageBudgetBasis?: "total" | "shared";
+    /** Bearer-safe lane summary (issue #775; servers ≥ this field's release). */
+    storage?: {
+        mode: "shared" | "byo";
+        /** Demoted former-active lanes that still serve previously uploaded files. */
+        fallbackLanes: number;
+        health: {
+            ok: boolean;
+            code?: string;
+            message?: string;
+            since?: string;
+        };
+    };
     /** File scopes of the presented token (servers ≥ this field's release). */
     scopes?: Array<TokenScope>;
     /**

package/dist/commands/mcp.js

@@ -2,7 +2,7 @@ import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { AjvJsonSchemaValidator } from "@modelcontextprotocol/server/validators/ajv";
 import { parseCommandArgs } from "../cli-args.js";
 import { resolveApiUrl } from "../config.js";
-import { createMcpServer } from "../mcp/server.js";
+import { createMcpServer, MCP_SERVER_ICONS } from "../mcp/server.js";
 import { createUploadsMcpTools } from "../mcp/tools.js";
 import { packageVersion } from "../package-version.js";
 import { writeCommandHelp } from "../cli-style.js";
@@ -35,7 +35,7 @@ export async function runMcp(args, opts, help = false) {
     // `@cfworker/json-schema` provider instead).
     const validator = new AjvJsonSchemaValidator();
     const handle = serveStdio(() => createMcpServer({
-        serverInfo: { name: "uploads", version: packageVersion() },
+        serverInfo: { name: "uploads", version: packageVersion(), icons: MCP_SERVER_ICONS },
         tools: createUploadsMcpTools({ globals: opts.globals }),
         apiUrl: resolveApiUrl(opts.globals),
         validator,

package/dist/commands.d.ts

@@ -615,16 +615,18 @@ export interface DoctorReport {
     /** Workspace/token mismatch warning (also present in hints). */
     warning?: string;
     /**
-     * Bring-your-own-bucket storage status (issue #583 Phase 3). `GET
-     * /me/workspaces/:name/storage` is session-gated (Better Auth cookie or
-     * bearer via the AUTH service — see `session-auth.ts`); the CLI only ever
-     * holds a minted `up_<workspace>_…` workspace token, never a session
-     * bearer, so doctor cannot reach that route today. Until a token-authed
-     * read path exists, this is an honest "can't check from here" rather than
-     * a fabricated mode.
+     * Storage-lane summary (issue #775): the usage endpoint carries a
+     * bearer-safe `storage` object (mode + fallback-lane count + health), so
+     * doctor reports it from the same call it already makes. `checked` is
+     * false when usage failed or the server predates the field — then `note`
+     * falls back to the honest "can't check from here" line (the full
+     * projection on `GET /me/workspaces/:name/storage` stays session-gated).
      */
     storage: {
-        checked: false;
+        checked: boolean;
+        mode?: "shared" | "byo";
+        fallbackLanes?: number;
+        healthy?: boolean;
         note: string;
     };
     hints: string[];

package/dist/commands.js

@@ -3483,6 +3483,10 @@ export async function buildDoctorReport(config, client, detectRoots) {
         }
     }
     let usage;
+    let storage = {
+        checked: false,
+        note: "not checked from the CLI — this server doesn't report a storage summary on the usage endpoint; sign in on the web (Account → workspace → Settings) to view mode and verification status",
+    };
     let scopes;
     if (authOk) {
         try {
@@ -3493,6 +3497,23 @@ export async function buildDoctorReport(config, client, detectRoots) {
                 objects: snap.objects,
                 uploadsInPeriod: snap.uploadsInPeriod,
             };
+            if (snap.storage) {
+                const laneNote = snap.storage.fallbackLanes > 0
+                    ? ` (${snap.storage.fallbackLanes} previous lane${snap.storage.fallbackLanes === 1 ? "" : "s"} still serving old files)`
+                    : "";
+                const healthNote = snap.storage.health.ok
+                    ? ""
+                    : " — not working; rotate credentials on the web settings page";
+                storage = {
+                    checked: true,
+                    mode: snap.storage.mode,
+                    fallbackLanes: snap.storage.fallbackLanes,
+                    healthy: snap.storage.health.ok,
+                    note: (snap.storage.mode === "byo" ? "your bucket" : "hosted storage") +
+                        laneNote +
+                        healthNote,
+                };
+            }
             scopes = snap.scopes;
             if (scopes && !scopes.includes("files:delete")) {
                 hints.push("token lacks files:delete (`uploads delete` will be forbidden) — re-run `uploads login` for a full-scope token");
@@ -3522,10 +3543,7 @@ export async function buildDoctorReport(config, client, detectRoots) {
         usage,
         scopes,
         warning: mismatch,
-        storage: {
-            checked: false,
-            note: "not checked from the CLI — storage settings (shared vs. bring-your-own-bucket) live behind a signed-in session; sign in on the web (Account → workspace → Settings) to view mode and verification status",
-        },
+        storage,
         hints,
         browser,
     };

package/dist/format-usage.d.ts

@@ -9,6 +9,11 @@ export type UsageSnapshotLike = {
     storageRemainingBytes?: number;
     maxUploadsPerPeriod?: number;
     uploadsRemaining?: number;
+    /** Bytes still on hosted storage (shared-lane residue). */
+    sharedBytes?: number;
+    /** "shared" = BYO bucket active: the storage cap meters only hosted
+     * residue; bytes in the customer's own bucket are unmetered. */
+    storageBudgetBasis?: "total" | "shared";
     /** Catalog plan id when the API reports it (`free` | `pro`). */
     plan?: string;
 };

package/dist/format-usage.js

@@ -11,9 +11,14 @@ import { formatByteSize, formatMarketedBytes } from "./format-bytes.js";
 import { BRAND } from "./cli-brand.js";
 /** True when the API reported any cumulative workspace quota. */
 export function isUsageMetered(result) {
-    return (usagePct(result.bytes, result.maxStorageBytes) !== null ||
+    return (usagePct(storageMeteredBytes(result), result.maxStorageBytes) !== null ||
         usagePct(result.uploadsInPeriod, result.maxUploadsPerPeriod) !== null);
 }
+/** The usage number the storage cap actually meters — hosted residue only
+ * when a BYO bucket is active (`storageBudgetBasis: "shared"`). */
+function storageMeteredBytes(result) {
+    return result.storageBudgetBasis === "shared" ? (result.sharedBytes ?? 0) : result.bytes;
+}
 /** 0–100, one decimal. Missing/invalid caps → no bar. Matches web `usagePct`. */
 export function usagePct(value, max) {
     if (typeof max !== "number" || !(max > 0) || !Number.isFinite(value))
@@ -112,21 +117,26 @@ export function formatUsageHuman(result, opts = {}) {
     const label = planLabel(result.plan);
     if (label)
         lines.push(`plan:      ${label}`);
-    const storagePct = usagePct(result.bytes, result.maxStorageBytes);
+    const byoActive = result.storageBudgetBasis === "shared";
+    const meteredBytes = storageMeteredBytes(result);
+    const storagePct = usagePct(meteredBytes, result.maxStorageBytes);
     if (storagePct !== null && result.maxStorageBytes != null) {
         // Caps (and remaining-against-cap) use SI marketed formatting so Free's
         // 250_000_000 reads as "250 MB", not binary "238.4 MB". Used bytes share
         // the same base on this line so the three numbers stay coherent.
-        const detail = `${formatMarketedBytes(result.bytes)} / ${formatMarketedBytes(result.maxStorageBytes)}` +
+        const detail = `${formatMarketedBytes(meteredBytes)} / ${formatMarketedBytes(result.maxStorageBytes)}` +
             (result.storageRemainingBytes != null
                 ? ` (${formatMarketedBytes(result.storageRemainingBytes)} free)`
                 : "");
         const bar = formatProgressBar(storagePct, { width, color });
-        lines.push(`storage:   ${bar}  ${detail}`);
+        lines.push(`storage:   ${bar}  ${detail}${byoActive ? " on hosted storage" : ""}`);
     }
     else {
         lines.push(`storage:   ${formatByteSize(result.bytes)}`);
     }
+    if (byoActive) {
+        lines.push("note:      your own bucket is unmetered — the storage quota only counts files on hosted storage");
+    }
     lines.push(`objects:   ${formatCount(result.objects)}`);
     const uploadsPct = usagePct(result.uploadsInPeriod, result.maxUploadsPerPeriod);
     if (uploadsPct !== null && result.maxUploadsPerPeriod != null) {

package/dist/mcp/server.d.ts

@@ -17,7 +17,7 @@
  * The stdio transport comes from `@modelcontextprotocol/server/stdio`; logs
  * must never go to stdout.
  */
-import { McpServer, type jsonSchemaValidator } from "@modelcontextprotocol/server";
+import { McpServer, type Implementation, type jsonSchemaValidator } from "@modelcontextprotocol/server";
 export { appProp, canonicalMetaFromArgs, METADATA_DESCRIPTION, metadataArgWithCanonical, metadataProp, stateProp, optBool, optPosInt, optString, optStringArray, optStringRecord, usage, type ToolArgs, } from "./args.js";
 export { ToolBatchError, batchFailureMessage } from "./batch-error.js";
 export { mapBounded } from "../async.js";
@@ -81,11 +81,14 @@ export interface McpTool {
     outputSchema?: Record<string, unknown>;
     handler: (args: Record<string, unknown>) => Promise<unknown>;
 }
+/**
+ * Brand mark on `serverInfo.icons` (MCP `Icon`, spec 2026-07-28). PNG is the
+ * type clients that render icons MUST support. The file is the site's
+ * apple-touch-icon (180×180 pixel chevron), already public on uploads.sh.
+ */
+export declare const MCP_SERVER_ICONS: NonNullable<Implementation["icons"]>;
 export declare function createMcpServer(opts: {
-    serverInfo: {
-        name: string;
-        version: string;
-    };
+    serverInfo: Implementation;
     tools: McpTool[];
     /** API base for telemetry (honors uploads --api-url). */
     apiUrl?: string;

package/dist/mcp/server.js

@@ -138,6 +138,18 @@ function wrapHandler(tool, apiUrl) {
         }
     };
 }
+/**
+ * Brand mark on `serverInfo.icons` (MCP `Icon`, spec 2026-07-28). PNG is the
+ * type clients that render icons MUST support. The file is the site's
+ * apple-touch-icon (180×180 pixel chevron), already public on uploads.sh.
+ */
+export const MCP_SERVER_ICONS = [
+    {
+        src: "https://uploads.sh/apple-touch-icon.png",
+        mimeType: "image/png",
+        sizes: ["180x180"],
+    },
+];
 export function createMcpServer(opts) {
     const { serverInfo, tools, apiUrl, validator } = opts;
     const server = new McpServer(serverInfo, {

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.47.0",
+  "version": "0.48.1",
+  "mcpName": "sh.uploads/mcp",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",
   "sideEffects": false,