@buildinternet/uploads 0.8.0 → 0.10.0

package/dist/commands/session.js

@@ -0,0 +1,140 @@
+/**
+ * Session commands: whoami / status (show identity) and logout (clear token).
+ */
+import { describeConfigSources, loadConfigFile, redactToken, removeConfigKeys, resolveConfig, resolveConfigPath, workspaceFromToken, } from "../config.js";
+import { flagBool, flagString, parseCommandArgs } from "../cli-args.js";
+import { writeCommandHelp } from "../cli-style.js";
+import { writeJson } from "../io.js";
+const WHOAMI_HELP = `uploads whoami
+
+Show the active CLI identity: workspace, token (redacted), API URL, and where
+each value came from. Alias: uploads status.
+
+Does not call the API (offline). Use uploads doctor to verify the token works.
+
+Options:
+  --path <file>       Config file to inspect (default: shared buildinternet config)
+  --json              JSON on stdout
+
+Examples:
+  uploads whoami
+  uploads status --json
+  uploads whoami --path ./my.env
+`;
+const LOGOUT_HELP = `uploads logout
+
+Remove the saved UPLOADS_TOKEN from the shared config file so this machine is
+no longer signed in for the CLI. Does not revoke the token on the server.
+
+Environment variables (UPLOADS_TOKEN) are not unset — export them yourself if set.
+
+Options:
+  --path <file>       Config file to edit (default: shared buildinternet config)
+  --json              JSON on stdout
+
+Examples:
+  uploads logout
+  uploads logout --path ./my.env
+`;
+export function buildWhoamiReport(opts) {
+    const flags = {
+        envFile: opts.envFile,
+        token: opts.token,
+        workspace: opts.workspace,
+        apiUrl: opts.apiUrl,
+    };
+    const config = resolveConfig({ ...flags, requireToken: false });
+    const sources = describeConfigSources(flags);
+    const tokenInConfig = Boolean(loadConfigFile(config.configPath).UPLOADS_TOKEN);
+    return {
+        signedIn: Boolean(config.token),
+        workspace: config.workspace,
+        workspaceSource: sources.workspace,
+        workspaceFromToken: config.token ? workspaceFromToken(config.token) : undefined,
+        token: redactToken(config.token || undefined),
+        tokenSource: sources.token,
+        tokenInConfig,
+        apiUrl: config.apiUrl,
+        apiUrlSource: sources.apiUrl,
+        configPath: config.configPath,
+        configExists: config.configExists,
+    };
+}
+function formatWhoami(report) {
+    const cfg = `${report.configPath}${report.configExists ? "" : " (missing)"}`;
+    const lines = [
+        `signed in:  ${report.signedIn ? "yes" : "no"}`,
+        `workspace:  ${report.workspace} (${report.workspaceSource})`,
+    ];
+    if (report.workspaceFromToken && report.workspaceFromToken !== report.workspace) {
+        lines.push(`token ws:   ${report.workspaceFromToken} (encoded in token)`);
+    }
+    if (report.signedIn) {
+        lines.push(`token:      ${report.token} (${report.tokenSource})`);
+    }
+    lines.push(`api:        ${report.apiUrl} (${report.apiUrlSource})`);
+    lines.push(`config:     ${cfg}`);
+    if (!report.signedIn) {
+        lines.push("", "hint: run uploads login to sign in");
+    }
+    else if (report.tokenSource === "env" && !report.tokenInConfig) {
+        lines.push("", "note: token is from the environment, not the config file", "      uploads logout only clears the config file");
+    }
+    return lines.join("\n") + "\n";
+}
+function wantsJson(opts, parsed) {
+    return Boolean(opts.json || flagBool(parsed.flags, "--json"));
+}
+export async function runWhoami(args, opts, help = false) {
+    const parsed = parseCommandArgs(args);
+    if (help || parsed.help) {
+        writeCommandHelp(WHOAMI_HELP);
+        return 0;
+    }
+    const report = buildWhoamiReport({
+        envFile: flagString(parsed.flags, "--path") ?? opts.envFile,
+        token: opts.token,
+        workspace: opts.workspace,
+        apiUrl: opts.apiUrl,
+    });
+    if (wantsJson(opts, parsed))
+        await writeJson(report);
+    else
+        process.stdout.write(formatWhoami(report));
+    return report.signedIn ? 0 : 1;
+}
+export async function runLogout(args, opts, help = false) {
+    const parsed = parseCommandArgs(args);
+    if (help || parsed.help) {
+        writeCommandHelp(LOGOUT_HELP);
+        return 0;
+    }
+    const path = flagString(parsed.flags, "--path") ?? resolveConfigPath({ envFile: opts.envFile });
+    const hadFileToken = Boolean(loadConfigFile(path).UPLOADS_TOKEN);
+    const envTokenStillSet = Boolean(process.env.UPLOADS_TOKEN);
+    const result = removeConfigKeys(path, ["UPLOADS_TOKEN"]);
+    const payload = {
+        path: result.path,
+        removed: result.removed,
+        configExisted: result.existed,
+        hadTokenInConfig: hadFileToken,
+        envTokenStillSet,
+    };
+    if (wantsJson(opts, parsed)) {
+        await writeJson(payload);
+        return 0;
+    }
+    if (result.removed.includes("UPLOADS_TOKEN")) {
+        process.stdout.write(`signed out — removed UPLOADS_TOKEN from ${result.path}\n`);
+    }
+    else if (!result.existed) {
+        process.stdout.write(`no config file at ${result.path} — already signed out\n`);
+    }
+    else {
+        process.stdout.write(`no UPLOADS_TOKEN in ${result.path} — already signed out\n`);
+    }
+    if (envTokenStillSet) {
+        process.stderr.write("note: UPLOADS_TOKEN is still set in the environment; unset it to fully sign out\n");
+    }
+    return 0;
+}

package/dist/commands/setup.js

@@ -2,6 +2,7 @@ import { createUploadsClient } from "../client.js";
 import { DEFAULT_API_URL, DEFAULT_WORKSPACE, describeConfigSources, putDefaultsToConfigValues, redactToken, resolveApiUrl, resolveConfig, resolveConfigPath, resolvePutDefaults, writeConfigKeys, workspaceFromToken, } from "../config.js";
 import { flagBool, flagInt, flagString, parseCommandArgs, UsageError } from "../cli-args.js";
 import { UploadsError } from "../errors.js";
+import { writeCommandHelp } from "../cli-style.js";
 const SETUP_HELP = `uploads setup — guided CLI configuration
 
 Writes UPLOADS_* keys to the shared buildinternet config file and prints
@@ -99,7 +100,7 @@ function formatWizard(status) {
 export async function runSetup(args, opts, help = false) {
     const parsed = parseCommandArgs(args);
     if (help || parsed.help) {
-        process.stderr.write(SETUP_HELP);
+        writeCommandHelp(SETUP_HELP);
         return 0;
     }
     const apiUrl = flagString(parsed.flags, "--api-url");

package/dist/commands.js

@@ -9,12 +9,14 @@ import { UploadsError } from "./errors.js";
 import { writeJson, writeStdout } from "./io.js";
 import { parseMetaFlags, validateMetaMap } from "./metadata.js";
 import { ghAttachmentKey, ghKeyPrefix, ghMetadataFromTarget, attachmentsCommentBody, normalizeGithubCoordinate, } from "./github.js";
-import { resolveRepo, resolveCurrentPullRequest, execRunner, upsertAttachmentsComment, } from "./github-gh.js";
+import { resolveRepo, resolveCurrentPullRequest, classifyGhNumber, execRunner, upsertAttachmentsComment, } from "./github-gh.js";
 import { resolvePutPrefix } from "./destinations.js";
 import { optimizeImageForUpload, rewriteKeyExtension, } from "./optimize.js";
 import { applyFrame, resolveFrameId } from "./frame.js";
 import { buildCliProvenance } from "./provenance.js";
+import { formatByteSize } from "./format-bytes.js";
 import { packageVersion } from "./package-version.js";
+import { writeCommandHelp } from "./cli-style.js";
 /** Read a local file (or `-` for stdin). Missing path → FILE_NOT_FOUND (exit 2). */
 export function readFileArg(fileArg) {
     try {
@@ -44,6 +46,11 @@ Uploads are public. --pr/--issue keys include the repo, number, and filename and
 remain public even for private/internal GitHub repositories. Upload only media
 that is safe at a predictable public URL.
 
+Re-uploading the same key overwrites in place (no prompt) so embeds hot-swap;
+human mode prints ">> replaced existing object (same URL)" after a real put,
+or ">> would replace existing object (same URL)" on --dry-run when the key
+already exists.
+
 Human/json output includes durable url and (when dual-host applies) embedUrl.
 MARKDOWN prefers embedUrl for GitHub. Override: UPLOADS_EMBED_PUBLIC_BASE_URL.
 
@@ -65,6 +72,8 @@ Options:
   --optimize-quality <1-100>  WebP quality (default: 85)
   --keep-exif           Keep EXIF/XMP/ICC when optimizing (default: strip for privacy)
   --no-git              Don't derive --repo from git (or UPLOADS_NO_GIT=1)
+  --auto                Resolve current PR/issue and stamp gh.* metadata (default on)
+  --no-auto             Skip gh.* auto-resolution (also skipped by --no-git or UPLOADS_NO_AUTO_META=1)
   --workspace, -w <name>  Override workspace (wins over UPLOADS_WORKSPACE and token inference)
   --format human|url|markdown|json
   --pr <num>            Attach to a pull request: key gh/<owner>/<repo>/pull/<num>/<name> (stable URL, no hash)
@@ -75,7 +84,7 @@ Options:
                         Re-uploading to an existing key WITH --meta replaces that file's
                         entire metadata set; without --meta the existing metadata is
                         preserved. Use "uploads meta set" to edit individual keys.
-  --dry-run             Print key + public URL without uploading. Not with --comment/--gallery
+  --dry-run             Print key + public URL without uploading; reports if the key would replace an existing object. Not with --comment/--gallery
 
 Exit codes: 0 ok · 2 usage/token/file · 3 auth/policy · 4 network · 1 other.
 Scripted formats (json|url|markdown) also print failures on stdout.
@@ -107,6 +116,24 @@ export function makeGhTarget(pr, issue, repoArg, run) {
 function ghTargetFromFlags(flags, run) {
     return makeGhTarget(flagInt(flags, "--pr", "--pr"), flagInt(flags, "--issue", "--issue"), flagString(flags, "--repo"), run);
 }
+/**
+ * Best-effort GitHub target for the default put path (no --pr/--issue). A
+ * numeric --ref is classified as pull vs issue; otherwise the current branch's
+ * PR is resolved. Never throws — any failure yields undefined so the upload
+ * proceeds without gh metadata.
+ */
+function resolveAutoGhTarget(repoArg, ref, run) {
+    try {
+        const repo = resolveRepo(repoArg, run);
+        if (ref !== undefined && /^\d+$/.test(ref) && Number(ref) > 0) {
+            return classifyGhNumber(repo, Number.parseInt(ref, 10), run);
+        }
+        return resolveCurrentPullRequest(repo, run);
+    }
+    catch {
+        return undefined;
+    }
+}
 /** Shared put/attach optimize flags + UPLOADS_NO_OPTIMIZE default. */
 export function optimizeOptionsFromFlags(flags, defaults) {
     if (flags.has("--no-optimize") && typeof flags.get("--no-optimize") === "string") {
@@ -128,13 +155,20 @@ export function optimizeOptionsFromFlags(flags, defaults) {
 }
 function formatOptimizeNote(opt) {
     if (opt.optimized) {
-        return `optimized ${opt.originalBytes} → ${opt.outputBytes} bytes (${opt.filename})`;
+        return `optimized ${formatByteSize(opt.originalBytes)} → ${formatByteSize(opt.outputBytes)} (${opt.filename})`;
     }
     if (opt.skippedReason && opt.skippedReason !== "disabled") {
         return `optimize skipped (${opt.skippedReason})`;
     }
     return undefined;
 }
+function writeReplacedNote(replaced, quiet, dryRun = false) {
+    if (!quiet && replaced) {
+        process.stderr.write(dryRun
+            ? `>> would replace existing object (same URL)\n`
+            : `>> replaced existing object (same URL)\n`);
+    }
+}
 /** Frame (optional) then optimize — shared by put/attach/MCP. */
 export async function prepareImageForUpload(bytes, filename, opts) {
     let currentBytes = bytes;
@@ -239,6 +273,10 @@ Attachments are public and their repo/number/filename keys are predictable.
 Private/internal GitHub repository visibility does not restrict access; upload
 only media that is safe at a public URL.
 
+Same filename under the same PR/issue overwrites in place (no prompt) so the
+URL and every embed hot-swap. Human mode prints ">> replaced existing object
+(same URL)" when that happens.
+
 Still images are optimized to WebP by default (same as put). Use --no-optimize
 to upload originals. Optional --frame wraps images in device/browser chrome.
 
@@ -273,11 +311,11 @@ Examples:
 export async function runAttach(ctx, args, help = false, run = execRunner) {
     const parsed = parseCommandArgs(args);
     if (help || parsed.help) {
-        process.stderr.write(ATTACH_HELP);
+        writeCommandHelp(ATTACH_HELP);
         return 0;
     }
     if (parsed.positionals.length === 0) {
-        process.stderr.write(ATTACH_HELP);
+        writeCommandHelp(ATTACH_HELP);
         return 2;
     }
     if (parsed.flags.has("--no-comment") && typeof parsed.flags.get("--no-comment") === "string") {
@@ -328,6 +366,7 @@ export async function runAttach(ctx, args, help = false, run = execRunner) {
             }),
             metadata,
         });
+        writeReplacedNote(result.replaced, ctx.quiet || ctx.json);
         const embedSrc = urlForGithubEmbed(result.url, result.embedUrl);
         results.push({
             ...result,
@@ -363,22 +402,27 @@ export async function runAttach(ctx, args, help = false, run = execRunner) {
         }
         if (!ctx.quiet && comment)
             process.stderr.write(`>> attachments comment ${comment.action}\n`);
+        // attach auto-writes gh.* metadata; point the user at how to find it later.
+        if (!ctx.quiet) {
+            const ref = ghMetadataFromTarget(target)["gh.ref"];
+            process.stderr.write(`>> find these later: uploads find gh.ref=${ref}\n`);
+        }
     }
     return 0;
 }
 export async function runPut(ctx, args, help = false, run = execRunner) {
     if (help) {
-        process.stderr.write(PUT_HELP);
+        writeCommandHelp(PUT_HELP);
         return 0;
     }
     const parsed = parseCommandArgs(args);
     if (parsed.help) {
-        process.stderr.write(PUT_HELP);
+        writeCommandHelp(PUT_HELP);
         return 0;
     }
     const fileArg = parsed.positionals[0];
     if (!fileArg) {
-        process.stderr.write(PUT_HELP);
+        writeCommandHelp(PUT_HELP);
         return 2;
     }
     const keyHint = flagString(parsed.flags, "--key");
@@ -390,13 +434,19 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
     const nameFlag = flagString(parsed.flags, "--name");
     const dryRun = flagBool(parsed.flags, "--dry-run");
     // Validate --meta up front (fail fast, before reading/optimizing the file).
-    const metadata = (() => {
+    const userMeta = (() => {
         const pairs = flagValues(parsed.flags, "--meta");
         return pairs.length > 0 ? parseMetaFlags(pairs) : undefined;
     })();
     if (wantComment && typeof parsed.flags.get("--comment") === "string") {
         throw new UsageError("--comment takes no value — place it after the file argument");
     }
+    if (parsed.flags.has("--auto") && typeof parsed.flags.get("--auto") === "string") {
+        throw new UsageError("--auto takes no value");
+    }
+    if (parsed.flags.has("--no-auto") && typeof parsed.flags.get("--no-auto") === "string") {
+        throw new UsageError("--no-auto takes no value");
+    }
     if (wantComment && !ghTarget)
         throw new UsageError("--comment requires --pr or --issue");
     if (ghTarget) {
@@ -474,6 +524,43 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
             process.stderr.write(`>> ${note}\n`);
     }
     const noGit = flagBool(parsed.flags, "--no-git") || defaults.noGit === true;
+    // gh.* metadata: explicit --pr/--issue target wins over --meta; otherwise
+    // best-effort auto resolution (on by default) where --meta wins. --no-git,
+    // --no-auto, or UPLOADS_NO_AUTO_META disable auto; --auto forces past the
+    // config default but never past --no-git (no repo to resolve).
+    let metadata = userMeta;
+    let attachedRef;
+    if (ghTarget) {
+        const merged = { ...userMeta, ...ghMetadataFromTarget(ghTarget) };
+        validateMetaMap(merged); // enforce 24-key/8KB caps on the merged map (matches attach)
+        metadata = merged;
+        attachedRef = merged["gh.ref"];
+    }
+    else {
+        const autoEnabled = !noGit &&
+            !flagBool(parsed.flags, "--no-auto") &&
+            (flagBool(parsed.flags, "--auto") || defaults.noAutoMeta !== true);
+        if (autoEnabled) {
+            const autoTarget = resolveAutoGhTarget(flagString(parsed.flags, "--repo") ?? defaults.repo, flagString(parsed.flags, "--ref") ?? defaults.ref, run);
+            if (autoTarget) {
+                const autoMeta = ghMetadataFromTarget(autoTarget);
+                const merged = { ...autoMeta, ...userMeta };
+                // Auto resolution must never fail the upload: if merging the gh.* pairs
+                // would exceed the metadata caps, drop them and upload with --meta only.
+                try {
+                    validateMetaMap(merged);
+                    metadata = merged;
+                    attachedRef = merged["gh.ref"];
+                }
+                catch {
+                    // keep metadata = userMeta (already validated); skip auto gh.*
+                }
+            }
+        }
+    }
+    if (attachedRef && !ctx.quiet && format === "human") {
+        process.stderr.write(`>> attached to ${attachedRef}\n`);
+    }
     let key = ghTarget ? ghAttachmentKey(ghTarget, filename) : keyHint;
     if (key && prepared.optimized)
         key = rewriteKeyExtension(key, filename);
@@ -494,6 +581,8 @@ export async function runPut(ctx, args, help = false, run = execRunner) {
         }),
         metadata,
     });
+    if (format === "human")
+        writeReplacedNote(result.replaced, ctx.quiet, dryRun);
     const embedSrc = urlForGithubEmbed(result.url, result.embedUrl);
     const markdown = buildMarkdown(embedSrc, { alt, width });
     let gallery;
@@ -605,7 +694,7 @@ export async function runGallery(ctx, args, help = false) {
     const parsed = parseCommandArgs(args);
     const action = parsed.positionals[0];
     if (help || parsed.help || !action) {
-        process.stderr.write(GALLERY_HELP);
+        writeCommandHelp(GALLERY_HELP);
         return help || parsed.help ? 0 : 2;
     }
     switch (action) {
@@ -805,14 +894,21 @@ async function runFindFiles(ctx, filters, flags) {
     if (ctx.json)
         await writeJson(result);
     else
-        for (const item of result.items)
-            await writeStdout(`${item.key}${item.url ? `  ${item.url}` : ""}\n`);
+        for (const item of result.items) {
+            // LIST_HELP promises matched metadata in the output; render it inline
+            // (sorted for stable output) so human mode honors that, not just --json.
+            const meta = Object.entries(item.metadata)
+                .toSorted(([a], [b]) => a.localeCompare(b))
+                .map(([k, v]) => `${k}=${v}`)
+                .join(" ");
+            await writeStdout(`${item.key}${item.url ? `  ${item.url}` : ""}${meta ? `  ${meta}` : ""}\n`);
+        }
     return 0;
 }
 export async function runList(ctx, args, help = false, run = execRunner) {
     const parsed = parseCommandArgs(args);
     if (help || parsed.help) {
-        process.stderr.write(LIST_HELP);
+        writeCommandHelp(LIST_HELP);
         return 0;
     }
     const metaPairs = flagValues(parsed.flags, "--meta");
@@ -870,11 +966,11 @@ Examples:
 export async function runFind(ctx, args, help = false) {
     const parsed = parseCommandArgs(args);
     if (help || parsed.help) {
-        process.stderr.write(FIND_HELP);
+        writeCommandHelp(FIND_HELP);
         return 0;
     }
     if (parsed.positionals.length === 0) {
-        process.stderr.write(FIND_HELP);
+        writeCommandHelp(FIND_HELP);
         return 2;
     }
     const filters = parseMetaFlags(parsed.positionals);
@@ -899,7 +995,7 @@ export async function runMeta(ctx, args, help = false) {
     const parsed = parseCommandArgs(args);
     const action = parsed.positionals[0];
     if (help || parsed.help || !action) {
-        process.stderr.write(META_HELP);
+        writeCommandHelp(META_HELP);
         return help || parsed.help ? 0 : 2;
     }
     switch (action) {
@@ -910,6 +1006,11 @@ export async function runMeta(ctx, args, help = false) {
             const result = await ctx.client.getMetadata(key);
             if (ctx.json)
                 await writeJson(result);
+            else if (Object.keys(result.metadata).length === 0) {
+                // Empty stdout reads as failure; a stderr note keeps stdout parseable.
+                if (!ctx.quiet)
+                    process.stderr.write("(no metadata)\n");
+            }
             else
                 for (const [k, v] of Object.entries(result.metadata))
                     await writeStdout(`${k}=${v}\n`);
@@ -954,12 +1055,12 @@ Examples:
 export async function runDelete(ctx, args, help = false) {
     const parsed = parseCommandArgs(args);
     if (help || parsed.help) {
-        process.stderr.write(DELETE_HELP);
+        writeCommandHelp(DELETE_HELP);
         return 0;
     }
     const key = parsed.positionals[0];
     if (!key) {
-        process.stderr.write(DELETE_HELP);
+        writeCommandHelp(DELETE_HELP);
         return 2;
     }
     if (flagBool(parsed.flags, "--dry-run")) {
@@ -991,7 +1092,7 @@ Examples:
 export async function runComment(ctx, args, help = false, run = execRunner) {
     const parsed = parseCommandArgs(args);
     if (help || parsed.help) {
-        process.stderr.write(COMMENT_HELP);
+        writeCommandHelp(COMMENT_HELP);
         return 0;
     }
     const target = ghTargetFromFlags(parsed.flags, run);
@@ -1019,7 +1120,7 @@ Examples:
 `;
 export async function runUsage(ctx, args, help = false) {
     if (help || parseCommandArgs(args).help) {
-        process.stderr.write(USAGE_HELP);
+        writeCommandHelp(USAGE_HELP);
         return 0;
     }
     const result = await ctx.client.usage();
@@ -1047,7 +1148,7 @@ Examples:
 `;
 export async function runReconcile(ctx, args, help = false) {
     if (help || parseCommandArgs(args).help) {
-        process.stderr.write(RECONCILE_HELP);
+        writeCommandHelp(RECONCILE_HELP);
         return 0;
     }
     const result = await ctx.client.reconcile();
@@ -1070,7 +1171,7 @@ Examples:
 `;
 export async function runPurgeExpired(ctx, args, help = false) {
     if (help || parseCommandArgs(args).help) {
-        process.stderr.write(PURGE_HELP);
+        writeCommandHelp(PURGE_HELP);
         return 0;
     }
     const result = await ctx.client.purgeExpired();
@@ -1096,7 +1197,7 @@ Examples:
 `;
 export async function runHealth(ctx, args, help = false) {
     if (help || parseCommandArgs(args).help) {
-        process.stderr.write(HEALTH_HELP);
+        writeCommandHelp(HEALTH_HELP);
         return 0;
     }
     const result = await createUploadsClient({
@@ -1180,7 +1281,7 @@ export async function buildDoctorReport(config, client) {
 }
 export async function runDoctor(ctx, args, help = false) {
     if (help || parseCommandArgs(args).help) {
-        process.stderr.write(DOCTOR_HELP);
+        writeCommandHelp(DOCTOR_HELP);
         return 0;
     }
     const report = await buildDoctorReport(ctx.config, ctx.client);

package/dist/config-file.d.ts

@@ -1,5 +1,5 @@
 import type { UploadsClientConfig } from "./config.js";
-export declare const UPLOADS_CONFIG_KEYS: readonly ["UPLOADS_API_URL", "UPLOADS_WORKSPACE", "UPLOADS_TOKEN", "UPLOADS_DEFAULT_PREFIX", "UPLOADS_DEFAULT_REPO", "UPLOADS_DEFAULT_REF", "UPLOADS_DEFAULT_WIDTH", "UPLOADS_NO_GIT", "UPLOADS_NO_OPTIMIZE", "UPLOADS_KEEP_EXIF"];
+export declare const UPLOADS_CONFIG_KEYS: readonly ["UPLOADS_API_URL", "UPLOADS_WORKSPACE", "UPLOADS_TOKEN", "UPLOADS_DEFAULT_PREFIX", "UPLOADS_DEFAULT_REPO", "UPLOADS_DEFAULT_REF", "UPLOADS_DEFAULT_WIDTH", "UPLOADS_NO_GIT", "UPLOADS_NO_OPTIMIZE", "UPLOADS_KEEP_EXIF", "UPLOADS_NO_AUTO_META"];
 export type UploadsConfigKey = (typeof UPLOADS_CONFIG_KEYS)[number];
 export type UploadsConfigValues = Partial<Record<UploadsConfigKey, string>>;
 export interface PutDefaults {
@@ -12,6 +12,8 @@ export interface PutDefaults {
     noOptimize?: boolean;
     /** When true, optimize keeps EXIF/XMP/ICC (default strips). */
     keepExif?: boolean;
+    /** When true, `put` does NOT auto-resolve/stamp gh.* on the default path. */
+    noAutoMeta?: boolean;
 }
 declare const PUT_DEFAULT_KEY_MAP: Record<keyof PutDefaults, UploadsConfigKey>;
 export declare function putDefaultsToConfigValues(defaults: PutDefaults): UploadsConfigValues;
@@ -38,4 +40,13 @@ export declare function writeConfigKeys(path: string, keys: UploadsConfigValues,
     updated: string[];
 };
 export declare function configValuesFromClient(config: Partial<UploadsClientConfig>, defaults?: PutDefaults): UploadsConfigValues;
+/**
+ * Remove keys from the shared config file (e.g. logout clears UPLOADS_TOKEN).
+ * No-op for missing file/keys. Preserves other lines and comments.
+ */
+export declare function removeConfigKeys(path: string, keys: readonly string[]): {
+    path: string;
+    removed: string[];
+    existed: boolean;
+};
 export { PUT_DEFAULT_KEY_MAP };

package/dist/config-file.js

@@ -12,6 +12,7 @@ export const UPLOADS_CONFIG_KEYS = [
     "UPLOADS_NO_GIT",
     "UPLOADS_NO_OPTIMIZE",
     "UPLOADS_KEEP_EXIF",
+    "UPLOADS_NO_AUTO_META",
 ];
 const PUT_DEFAULT_KEY_MAP = {
     prefix: "UPLOADS_DEFAULT_PREFIX",
@@ -21,6 +22,7 @@ const PUT_DEFAULT_KEY_MAP = {
     noGit: "UPLOADS_NO_GIT",
     noOptimize: "UPLOADS_NO_OPTIMIZE",
     keepExif: "UPLOADS_KEEP_EXIF",
+    noAutoMeta: "UPLOADS_NO_AUTO_META",
 };
 function isTruthyConfigFlag(value) {
     if (!value)
@@ -44,6 +46,8 @@ export function putDefaultsToConfigValues(defaults) {
         out.UPLOADS_NO_OPTIMIZE = "1";
     if (defaults.keepExif)
         out.UPLOADS_KEEP_EXIF = "1";
+    if (defaults.noAutoMeta)
+        out.UPLOADS_NO_AUTO_META = "1";
     return out;
 }
 function parsePutDefaultsFromRaw(raw) {
@@ -65,6 +69,8 @@ function parsePutDefaultsFromRaw(raw) {
         out.noOptimize = true;
     if (isTruthyConfigFlag(raw.UPLOADS_KEEP_EXIF))
         out.keepExif = true;
+    if (isTruthyConfigFlag(raw.UPLOADS_NO_AUTO_META))
+        out.noAutoMeta = true;
     return out;
 }
 function parsePutDefaultsFromEnv() {
@@ -83,6 +89,8 @@ function parsePutDefaultsFromEnv() {
         raw.UPLOADS_NO_OPTIMIZE = process.env.UPLOADS_NO_OPTIMIZE;
     if (process.env.UPLOADS_KEEP_EXIF)
         raw.UPLOADS_KEEP_EXIF = process.env.UPLOADS_KEEP_EXIF;
+    if (process.env.UPLOADS_NO_AUTO_META)
+        raw.UPLOADS_NO_AUTO_META = process.env.UPLOADS_NO_AUTO_META;
     return parsePutDefaultsFromRaw(raw);
 }
 /** XDG default shared across buildinternet skills (github-screenshots, uploads, …). */
@@ -152,6 +160,8 @@ export function mergePutDefaults(...layers) {
             out.noOptimize = layer.noOptimize;
         if (layer.keepExif != null)
             out.keepExif = layer.keepExif;
+        if (layer.noAutoMeta != null)
+            out.noAutoMeta = layer.noAutoMeta;
     }
     return out;
 }
@@ -216,15 +226,7 @@ export function writeConfigKeys(path, keys, opts) {
             updated.push(key);
         }
     }
-    const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
-    writeFileSync(tmp, lines.join("\n").replace(/\n*$/, "\n"), { encoding: "utf8", mode: 0o600 });
-    renameSync(tmp, path);
-    try {
-        chmodSync(path, 0o600);
-    }
-    catch {
-        /* Windows/filesystems may not support modes. */
-    }
+    writeConfigFileAtomic(path, lines.join("\n"));
     return { path, created: !existed, updated };
 }
 export function configValuesFromClient(config, defaults) {
@@ -238,4 +240,42 @@ export function configValuesFromClient(config, defaults) {
     Object.assign(out, putDefaultsToConfigValues(defaults ?? {}));
     return out;
 }
+/**
+ * Remove keys from the shared config file (e.g. logout clears UPLOADS_TOKEN).
+ * No-op for missing file/keys. Preserves other lines and comments.
+ */
+export function removeConfigKeys(path, keys) {
+    if (!existsSync(path))
+        return { path, removed: [], existed: false };
+    const keySet = new Set(keys);
+    const removed = [];
+    const kept = [];
+    for (const line of readFileSync(path, "utf8").split("\n")) {
+        const parsed = parseEnvLine(line);
+        if (parsed && keySet.has(parsed.key)) {
+            if (!removed.includes(parsed.key))
+                removed.push(parsed.key);
+            continue;
+        }
+        kept.push(line);
+    }
+    if (removed.length === 0)
+        return { path, removed: [], existed: true };
+    // Drop consecutive blank lines left by removals
+    const collapsed = kept.filter((line, i) => !(line === "" && i > 0 && kept[i - 1] === ""));
+    writeConfigFileAtomic(path, collapsed.join("\n"));
+    return { path, removed, existed: true };
+}
+/** Atomic write + mode 0o600 (best-effort on platforms without chmod). */
+function writeConfigFileAtomic(path, body) {
+    const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
+    writeFileSync(tmp, body.replace(/\n*$/, "\n"), { encoding: "utf8", mode: 0o600 });
+    renameSync(tmp, path);
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        /* Windows/filesystems may not support modes. */
+    }
+}
 export { PUT_DEFAULT_KEY_MAP };

package/dist/config.d.ts

@@ -1,4 +1,4 @@
-export { defaultConfigPath, resolveConfigPath, loadConfigFile, redactToken, writeConfigKeys, configValuesFromClient, putDefaultsToConfigValues, resolvePutDefaults, mergePutDefaults, UPLOADS_CONFIG_KEYS, type UploadsConfigKey, type UploadsConfigValues, type PutDefaults, } from "./config-file.js";
+export { defaultConfigPath, resolveConfigPath, loadConfigFile, redactToken, writeConfigKeys, removeConfigKeys, configValuesFromClient, putDefaultsToConfigValues, resolvePutDefaults, mergePutDefaults, UPLOADS_CONFIG_KEYS, type UploadsConfigKey, type UploadsConfigValues, type PutDefaults, } from "./config-file.js";
 export interface UploadsClientConfig {
     apiUrl: string;
     workspace: string;

package/dist/config.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { loadConfigFile, resolveConfigPath } from "./config-file.js";
 import { UploadsError } from "./errors.js";
-export { defaultConfigPath, resolveConfigPath, loadConfigFile, redactToken, writeConfigKeys, configValuesFromClient, putDefaultsToConfigValues, resolvePutDefaults, mergePutDefaults, UPLOADS_CONFIG_KEYS, } from "./config-file.js";
+export { defaultConfigPath, resolveConfigPath, loadConfigFile, redactToken, writeConfigKeys, removeConfigKeys, configValuesFromClient, putDefaultsToConfigValues, resolvePutDefaults, mergePutDefaults, UPLOADS_CONFIG_KEYS, } from "./config-file.js";
 export const DEFAULT_API_URL = "https://api.uploads.sh";
 export const DEFAULT_WORKSPACE = "default";
 const TOKEN_WORKSPACE_RE = /^up_([a-z0-9][a-z0-9-]{1,62})_/;