@olonjs/cli 3.0.88 → 3.0.90

package/assets/src_tenant_alpha.sh

@@ -1641,7 +1641,7 @@ cat << 'END_OF_FILE_CONTENT' > "package.json"
     "@tiptap/extension-link": "^2.11.5",
     "@tiptap/react": "^2.11.5",
     "@tiptap/starter-kit": "^2.11.5",
-    "@olonjs/core": "^1.0.76",
+    "@olonjs/core": "^1.0.78",
     "clsx": "^2.1.1",
     "lucide-react": "^0.474.0",
     "react": "^19.0.0",
@@ -2612,6 +2612,9 @@ const TENANT_ID = 'alpha';
 const filePages = getFilePages();
 const fileSiteConfig = siteData as unknown as SiteConfig;
 const MAX_UPLOAD_SIZE_BYTES = 5 * 1024 * 1024;
+const ASSET_UPLOAD_MAX_RETRIES = 2;
+const ASSET_UPLOAD_TIMEOUT_MS = 20_000;
+const ALLOWED_IMAGE_MIME_TYPES = new Set(['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif']);
 
 interface CloudSaveUiState {
   isOpen: boolean;
@@ -2918,14 +2921,39 @@ function App() {
     [isCloudMode, CLOUD_API_URL]
   );
 
-  useEffect(() => {
-    // In Cloud mode, listing assets might be different or disabled for MVP
-    // For now, we keep the local fetch which will fail gracefully on Vercel (404)
+  const loadAssetsManifest = useCallback(async (): Promise<void> => {
+    if (isCloudMode && CLOUD_API_URL && CLOUD_API_KEY) {
+      const apiBases = cloudApiCandidates.length > 0 ? cloudApiCandidates : [normalizeApiBase(CLOUD_API_URL)];
+      for (const apiBase of apiBases) {
+        try {
+          const res = await fetch(`${apiBase}/assets/list?limit=200`, {
+            method: 'GET',
+            headers: {
+              Authorization: `Bearer ${CLOUD_API_KEY}`,
+            },
+          });
+          const body = (await res.json().catch(() => ({}))) as { items?: LibraryImageEntry[] };
+          if (!res.ok) continue;
+          const items = Array.isArray(body.items) ? body.items : [];
+          setAssetsManifest(items);
+          return;
+        } catch {
+          // try next candidate
+        }
+      }
+      setAssetsManifest([]);
+      return;
+    }
+
     fetch('/api/list-assets')
       .then((r) => (r.ok ? r.json() : []))
       .then((list: LibraryImageEntry[]) => setAssetsManifest(Array.isArray(list) ? list : []))
       .catch(() => setAssetsManifest([]));
-  }, []);
+  }, [isCloudMode, CLOUD_API_URL, CLOUD_API_KEY, cloudApiCandidates]);
+
+  useEffect(() => {
+    void loadAssetsManifest();
+  }, [loadAssetsManifest]);
 
   useEffect(() => {
     return () => {
@@ -3278,14 +3306,60 @@ function App() {
       assetsBaseUrl: '/assets',
       assetsManifest,
       async onAssetUpload(file: File): Promise<string> {
-        // Note: Asset upload in Cloud Mode requires the R2 Bridge (Next Step in Roadmap)
-        // For now, this works in Local Mode.
         if (!file.type.startsWith('image/')) throw new Error('Invalid file type.');
+        if (!ALLOWED_IMAGE_MIME_TYPES.has(file.type)) {
+          throw new Error('Unsupported image format. Allowed: jpeg, png, webp, gif, avif.');
+        }
         if (file.size > MAX_UPLOAD_SIZE_BYTES) throw new Error(`File too large. Max ${MAX_UPLOAD_SIZE_BYTES / 1024 / 1024}MB.`);
-        
+
+        if (isCloudMode && CLOUD_API_URL && CLOUD_API_KEY) {
+          const apiBases = cloudApiCandidates.length > 0 ? cloudApiCandidates : [normalizeApiBase(CLOUD_API_URL)];
+          let lastError: Error | null = null;
+          for (const apiBase of apiBases) {
+            for (let attempt = 0; attempt <= ASSET_UPLOAD_MAX_RETRIES; attempt += 1) {
+              try {
+                const formData = new FormData();
+                formData.append('file', file);
+                formData.append('filename', file.name);
+                const controller = new AbortController();
+                const timeout = window.setTimeout(() => controller.abort(), ASSET_UPLOAD_TIMEOUT_MS);
+                const res = await fetch(`${apiBase}/assets/upload`, {
+                  method: 'POST',
+                  headers: {
+                    Authorization: `Bearer ${CLOUD_API_KEY}`,
+                    'X-Correlation-Id': crypto.randomUUID(),
+                  },
+                  body: formData,
+                  signal: controller.signal,
+                }).finally(() => window.clearTimeout(timeout));
+                const body = (await res.json().catch(() => ({}))) as { url?: string; error?: string; code?: string };
+                if (res.ok && typeof body.url === 'string') {
+                  await loadAssetsManifest().catch(() => undefined);
+                  return body.url;
+                }
+                lastError = new Error(body.error || body.code || `Cloud upload failed: ${res.status}`);
+                if (isRetryableStatus(res.status) && attempt < ASSET_UPLOAD_MAX_RETRIES) {
+                  await sleep(backoffDelayMs(attempt));
+                  continue;
+                }
+                break;
+              } catch (error: unknown) {
+                const message = error instanceof Error ? error.message : 'Cloud upload failed.';
+                lastError = new Error(message);
+                if (attempt < ASSET_UPLOAD_MAX_RETRIES) {
+                  await sleep(backoffDelayMs(attempt));
+                  continue;
+                }
+                break;
+              }
+            }
+          }
+          throw lastError ?? new Error('Cloud upload failed.');
+        }
+
         const base64 = await new Promise<string>((resolve, reject) => {
           const reader = new FileReader();
-          reader.onload  = () => resolve((reader.result as string).split(',')[1] ?? '');
+          reader.onload = () => resolve((reader.result as string).split(',')[1] ?? '');
           reader.onerror = () => reject(reader.error);
           reader.readAsDataURL(file);
         });
@@ -3295,10 +3369,10 @@ function App() {
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ filename: file.name, mimeType: file.type || undefined, data: base64 }),
         });
-        
         const body = (await res.json().catch(() => ({}))) as { url?: string; error?: string };
         if (!res.ok) throw new Error(body.error || `Upload failed: ${res.status}`);
         if (typeof body.url !== 'string') throw new Error('Invalid server response: missing url');
+        await loadAssetsManifest().catch(() => undefined);
         return body.url;
       },
     },
@@ -7743,19 +7817,19 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/config/menu.json"
 {
   "main": [
     {
-      "label": "Architecture",
-      "href": "#architecture"
+      "label": "The Problem",
+      "href": "#problem"
     },
     {
-      "label": "CMS",
-      "href": "#cms"
+      "label": "Architecture",
+      "href": "#architecture"
     },
     {
-      "label": "Versioning",
-      "href": "#git"
+      "label": "Why",
+      "href": "#why"
     },
     {
-      "label": "Developer",
+      "label": "DX",
       "href": "#devex"
     }
   ]
@@ -7796,19 +7870,19 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/config/site.json"
       "badge": "v1.4.0",
       "links": [
         {
-          "label": "Architecture",
-          "href": "#architecture"
+          "label": "The Problem",
+          "href": "#problem"
         },
         {
-          "label": "CMS",
-          "href": "#cms"
+          "label": "Architecture",
+          "href": "#architecture"
         },
         {
-          "label": "Versioning",
-          "href": "#git"
+          "label": "Why",
+          "href": "#why"
         },
         {
-          "label": "Developer",
+          "label": "DX",
           "href": "#devex"
         }
       ]
@@ -7917,8 +7991,18 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/pages/home.json"
         "titleHighlight": "Agentic Web",
         "description": "AI agents are becoming operational actors in commerce, marketing, and support. OlonJS introduces a deterministic machine contract for websites — so agents can reliably read and operate any site, without custom glue.",
         "ctas": [
-          { "id": "cta-1", "label": "Read the Spec",    "href": "/docs",                                          "variant": "primary"    },
-          { "id": "cta-2", "label": "View on GitHub",   "href": "https://github.com/olonjs/npm-jpcore",           "variant": "secondary"  }
+          {
+            "id": "cta-1",
+            "label": "Read the Spec",
+            "href": "/docs",
+            "variant": "primary"
+          },
+          {
+            "id": "cta-2",
+            "label": "View on GitHub",
+            "href": "https://github.com/olonjs/npm-jpcore",
+            "variant": "secondary"
+          }
         ],
         "metrics": []
       },
@@ -7933,16 +8017,35 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/pages/home.json"
         "problemTag": "The problem",
         "problemTitle": "Websites aren't built for agents",
         "problemItems": [
-          { "id": "pi-1", "text": "Agentic workflows are growing, but integration is mostly custom glue — rebuilt tenant by tenant" },
-          { "id": "pi-2", "text": "Every site has a different content structure, routing assumptions, and edge cases" },
-          { "id": "pi-3", "text": "HTML-heavy, CMS-fragmented, inconsistent across properties — slow, brittle, expensive" }
+          {
+            "id": "pi-1",
+            "text": "Agentic workflows are growing, but integration is mostly custom glue — rebuilt tenant by tenant"
+          },
+          {
+            "id": "pi-2",
+            "text": "Every site has a different content structure, routing assumptions, and edge cases"
+          },
+          {
+            "id": "pi-3",
+            "text": "HTML-heavy, CMS-fragmented, inconsistent across properties — slow, brittle, expensive"
+          }
         ],
         "solutionTag": "Our solution",
         "solutionTitle": "A standard machine contract across tenants",
         "solutionItems": [
-          { "id": "si-1", "text": "Predictable page endpoints for agents —", "code": "/{slug}.json" },
-          { "id": "si-2", "text": "Typed, schema-driven content contracts — validated, versioned, auditable" },
-          { "id": "si-3", "text": "Repeatable governance and deployment patterns across every tenant" }
+          {
+            "id": "si-1",
+            "text": "Predictable page endpoints for agents —",
+            "code": "/{slug}.json"
+          },
+          {
+            "id": "si-2",
+            "text": "Typed, schema-driven content contracts — validated, versioned, auditable"
+          },
+          {
+            "id": "si-3",
+            "text": "Repeatable governance and deployment patterns across every tenant"
+          }
         ]
       },
       "settings": {}
@@ -7956,15 +8059,47 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/pages/home.json"
         "sectionTitle": "Built for enterprise scale",
         "sectionLead": "Every layer is designed for determinism — from file system layout to component contracts to Studio UX.",
         "cards": [
-          { "id": "fc-1", "emoji": "📐", "title": "Modular Type Registry",      "description": "Core defines empty registries; tenants inject types via module augmentation. Full TypeScript safety, zero Core changes." },
-          { "id": "fc-2", "emoji": "🧱", "title": "Tenant Block Protocol",      "description": "Self-contained capsules (View + schema + types) enable automated ingestion and consistent editor generation." },
-          { "id": "fc-3", "emoji": "⚙️", "title": "Deterministic CLI",          "description": "@olonjs/cli projects new tenants from a canonical script — reproducible across every environment." },
-          { "id": "fc-4", "emoji": "🎯", "title": "ICE Data Contract",          "description": "Mandatory DOM attributes bind the Studio canvas to Inspector fields without coupling to tenant DOM structure." },
-          { "id": "fc-5", "emoji": "📦", "title": "Base Schema Fragments",      "description": "Shared BaseSectionData and BaseArrayItem enforce anchor IDs and stable React keys across all capsules." },
-          { "id": "fc-6", "emoji": "🔗", "title": "Path-Based Selection",       "description": "v1.4 strict path semantics eliminate nested array ambiguity. Studio selection is root-to-leaf, always deterministic." }
+          {
+            "id": "fc-1",
+            "emoji": "📐",
+            "title": "Modular Type Registry",
+            "description": "Core defines empty registries; tenants inject types via module augmentation. Full TypeScript safety, zero Core changes."
+          },
+          {
+            "id": "fc-2",
+            "emoji": "🧱",
+            "title": "Tenant Block Protocol",
+            "description": "Self-contained capsules (View + schema + types) enable automated ingestion and consistent editor generation."
+          },
+          {
+            "id": "fc-3",
+            "emoji": "⚙️",
+            "title": "Deterministic CLI",
+            "description": "@olonjs/cli projects new tenants from a canonical script — reproducible across every environment."
+          },
+          {
+            "id": "fc-4",
+            "emoji": "🎯",
+            "title": "ICE Data Contract",
+            "description": "Mandatory DOM attributes bind the Studio canvas to Inspector fields without coupling to tenant DOM structure."
+          },
+          {
+            "id": "fc-5",
+            "emoji": "📦",
+            "title": "Base Schema Fragments",
+            "description": "Shared BaseSectionData and BaseArrayItem enforce anchor IDs and stable React keys across all capsules."
+          },
+          {
+            "id": "fc-6",
+            "emoji": "🔗",
+            "title": "Path-Based Selection",
+            "description": "v1.4 strict path semantics eliminate nested array ambiguity. Studio selection is root-to-leaf, always deterministic."
+          }
         ]
       },
-      "settings": { "columns": 3 }
+      "settings": {
+        "columns": 3
+      }
     },
     {
       "id": "why-now",
@@ -7975,10 +8110,26 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/pages/home.json"
         "title": "Why this matters",
         "titleAccent": "now",
         "cards": [
-          { "id": "wc-1", "title": "Agentic commerce is live",      "description": "Operational standards are missing. Without a contract layer, teams face high integration cost and low reliability." },
-          { "id": "wc-2", "title": "Enterprises need governance",   "description": "A contract layer you can audit, version, and scale — not a one-off adapter for every new agent workflow." },
-          { "id": "wc-3", "title": "AI tooling is ready",           "description": "Deterministic structure means AI can scaffold, validate, and evolve tenants with less prompt ambiguity." },
-          { "id": "wc-4", "title": "Speed compounds",               "description": "Teams that standardize now ship new experiences in hours while others rebuild integration logic repeatedly." }
+          {
+            "id": "wc-1",
+            "title": "Agentic commerce is live",
+            "description": "Operational standards are missing. Without a contract layer, teams face high integration cost and low reliability."
+          },
+          {
+            "id": "wc-2",
+            "title": "Enterprises need governance",
+            "description": "A contract layer you can audit, version, and scale — not a one-off adapter for every new agent workflow."
+          },
+          {
+            "id": "wc-3",
+            "title": "AI tooling is ready",
+            "description": "Deterministic structure means AI can scaffold, validate, and evolve tenants with less prompt ambiguity."
+          },
+          {
+            "id": "wc-4",
+            "title": "Speed compounds",
+            "description": "Teams that standardize now ship new experiences in hours while others rebuild integration logic repeatedly."
+          }
         ]
       },
       "settings": {}
@@ -7987,19 +8138,40 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/pages/home.json"
       "id": "dx-section",
       "type": "devex",
       "data": {
-        "anchorId": "developer-velocity",
+        "anchorId": "devex",
         "label": "Developer Velocity",
         "title": "AI-native advantage,\nfrom day one",
         "description": "OlonJS dramatically increases AI-assisted development speed. Because structure is deterministic, agents scaffold and evolve tenants faster — with lower regression risk.",
         "features": [
-          { "id": "df-1", "text": "AI scaffolds and evolves tenants faster because structure is deterministic" },
-          { "id": "df-2", "text": "Shared conventions reduce prompt ambiguity and implementation drift" },
-          { "id": "df-3", "text": "Ship new tenant experiences in hours, not weeks" }
+          {
+            "id": "df-1",
+            "text": "AI scaffolds and evolves tenants faster because structure is deterministic"
+          },
+          {
+            "id": "df-2",
+            "text": "Shared conventions reduce prompt ambiguity and implementation drift"
+          },
+          {
+            "id": "df-3",
+            "text": "Ship new tenant experiences in hours, not weeks"
+          }
         ],
         "stats": [
-          { "id": "ds-1", "value": "10×",  "label": "Faster scaffolding" },
-          { "id": "ds-2", "value": "∅",    "label": "Glue per tenant"    },
-          { "id": "ds-3", "value": "100%", "label": "Type-safe contracts" }
+          {
+            "id": "ds-1",
+            "value": "10×",
+            "label": "Faster scaffolding"
+          },
+          {
+            "id": "ds-2",
+            "value": "∅",
+            "label": "Glue per tenant"
+          },
+          {
+            "id": "ds-3",
+            "value": "100%",
+            "label": "Type-safe contracts"
+          }
         ]
       },
       "settings": {}
@@ -8013,15 +8185,24 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/pages/home.json"
         "description": "Read the full specification or explore the source on GitHub. Zero dependencies to start — one JSON endpoint per page.",
         "cliCommand": "npx @olonjs/cli@latest new tenant",
         "ctas": [
-          { "id": "cta-docs", "label": "Read the Specification", "href": "/docs",                                     "variant": "primary"   },
-          { "id": "cta-gh",   "label": "View on GitHub",         "href": "https://github.com/olonjs/npm-jpcore",      "variant": "secondary" }
+          {
+            "id": "cta-docs",
+            "label": "Read the Specification",
+            "href": "/docs",
+            "variant": "primary"
+          },
+          {
+            "id": "cta-gh",
+            "label": "View on GitHub",
+            "href": "https://github.com/olonjs/npm-jpcore",
+            "variant": "secondary"
+          }
         ]
       },
       "settings": {}
     }
   ]
 }
-
 END_OF_FILE_CONTENT
 echo "Creating src/data/pages/post.json..."
 cat << 'END_OF_FILE_CONTENT' > "src/data/pages/post.json"

package/assets/templates/agritourism/src_tenant.sh

@@ -596,7 +596,7 @@ cat << 'END_OF_FILE_CONTENT' > "package.json"
     "@tiptap/extension-link": "^2.11.5",
     "@tiptap/react": "^2.11.5",
     "@tiptap/starter-kit": "^2.11.5",
-    "@olonjs/core": "^1.0.76",
+    "@olonjs/core": "^1.0.78",
     "clsx": "^2.1.1",
     "lucide-react": "^0.474.0",
     "react": "^19.0.0",
@@ -957,6 +957,9 @@ const TENANT_ID   = 'santamamma';   // 🌿 SantaMamma Agriturismo
 const filePages     = getFilePages();
 const fileSiteConfig = siteData as unknown as SiteConfig;
 const MAX_UPLOAD_SIZE_BYTES = 5 * 1024 * 1024;
+const ASSET_UPLOAD_MAX_RETRIES = 2;
+const ASSET_UPLOAD_TIMEOUT_MS = 20_000;
+const ALLOWED_IMAGE_MIME_TYPES = new Set(['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif']);
 
 interface CloudSaveUiState {
   isOpen: boolean;
@@ -980,6 +983,30 @@ function stepProgress(doneSteps: StepId[]): number {
   return Math.round((doneSteps.length / DEPLOY_STEPS.length) * 100);
 }
 
+function normalizeApiBase(raw: string): string {
+  return raw.trim().replace(/\/+$/, '');
+}
+
+function buildUploadEndpoint(raw: string): string {
+  const base = normalizeApiBase(raw);
+  const withApi = /\/api\/v1$/i.test(base) ? base : `${base}/api/v1`;
+  return `${withApi}/assets/upload`;
+}
+
+function isRetryableStatus(status: number): boolean {
+  return status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
+}
+
+function backoffDelayMs(attempt: number): number {
+  const base = 250 * Math.pow(2, attempt);
+  const jitter = Math.floor(Math.random() * 120);
+  return base + jitter;
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
 function App() {
   const [{ pages, siteConfig }] = useState(getInitialData);
   const [assetsManifest, setAssetsManifest] = useState<LibraryImageEntry[]>([]);
@@ -988,12 +1015,36 @@ function App() {
   const pendingCloudSave          = useRef<{ state: ProjectState; slug: string } | null>(null);
   const isCloudMode = Boolean(CLOUD_API_URL && CLOUD_API_KEY);
 
-  useEffect(() => {
+  const loadAssetsManifest = useCallback(async (): Promise<void> => {
+    if (isCloudMode && CLOUD_API_URL && CLOUD_API_KEY) {
+      try {
+        const res = await fetch(`${buildUploadEndpoint(CLOUD_API_URL).replace(/\/upload$/, '/list')}?limit=200`, {
+          method: 'GET',
+          headers: {
+            Authorization: `Bearer ${CLOUD_API_KEY}`,
+          },
+        });
+        const body = (await res.json().catch(() => ({}))) as { items?: LibraryImageEntry[] };
+        if (res.ok) {
+          setAssetsManifest(Array.isArray(body.items) ? body.items : []);
+          return;
+        }
+      } catch {
+        // fallback to empty
+      }
+      setAssetsManifest([]);
+      return;
+    }
+
     fetch('/api/list-assets')
       .then((r) => (r.ok ? r.json() : []))
       .then((list: LibraryImageEntry[]) => setAssetsManifest(Array.isArray(list) ? list : []))
       .catch(() => setAssetsManifest([]));
-  }, []);
+  }, [isCloudMode, CLOUD_API_URL, CLOUD_API_KEY]);
+
+  useEffect(() => {
+    void loadAssetsManifest();
+  }, [loadAssetsManifest]);
 
   useEffect(() => {
     return () => { activeCloudSaveController.current?.abort(); };
@@ -1104,7 +1155,53 @@ function App() {
       assetsManifest,
       async onAssetUpload(file: File): Promise<string> {
         if (!file.type.startsWith('image/')) throw new Error('Invalid file type.');
+        if (!ALLOWED_IMAGE_MIME_TYPES.has(file.type)) {
+          throw new Error('Unsupported image format. Allowed: jpeg, png, webp, gif, avif.');
+        }
         if (file.size > MAX_UPLOAD_SIZE_BYTES) throw new Error(`File too large. Max ${MAX_UPLOAD_SIZE_BYTES / 1024 / 1024}MB.`);
+
+        if (isCloudMode && CLOUD_API_URL && CLOUD_API_KEY) {
+          let lastError: Error | null = null;
+          for (let attempt = 0; attempt <= ASSET_UPLOAD_MAX_RETRIES; attempt += 1) {
+            try {
+              const formData = new FormData();
+              formData.append('file', file);
+              formData.append('filename', file.name);
+              const controller = new AbortController();
+              const timeout = window.setTimeout(() => controller.abort(), ASSET_UPLOAD_TIMEOUT_MS);
+              const res = await fetch(buildUploadEndpoint(CLOUD_API_URL), {
+                method: 'POST',
+                headers: {
+                  Authorization: `Bearer ${CLOUD_API_KEY}`,
+                  'X-Correlation-Id': crypto.randomUUID(),
+                },
+                body: formData,
+                signal: controller.signal,
+              }).finally(() => window.clearTimeout(timeout));
+              const body = (await res.json().catch(() => ({}))) as { url?: string; error?: string; code?: string };
+              if (res.ok && typeof body.url === 'string') {
+                await loadAssetsManifest().catch(() => undefined);
+                return body.url;
+              }
+              lastError = new Error(body.error || body.code || `Upload failed: ${res.status}`);
+              if (isRetryableStatus(res.status) && attempt < ASSET_UPLOAD_MAX_RETRIES) {
+                await sleep(backoffDelayMs(attempt));
+                continue;
+              }
+              break;
+            } catch (error: unknown) {
+              const message = error instanceof Error ? error.message : 'Cloud upload failed.';
+              lastError = new Error(message);
+              if (attempt < ASSET_UPLOAD_MAX_RETRIES) {
+                await sleep(backoffDelayMs(attempt));
+                continue;
+              }
+              break;
+            }
+          }
+          throw lastError ?? new Error('Cloud upload failed.');
+        }
+
         const base64 = await new Promise<string>((resolve, reject) => {
           const reader = new FileReader();
           reader.onload  = () => resolve((reader.result as string).split(',')[1] ?? '');
@@ -1119,6 +1216,7 @@ function App() {
         const body = (await res.json().catch(() => ({}))) as { url?: string; error?: string };
         if (!res.ok) throw new Error(body.error || `Upload failed: ${res.status}`);
         if (typeof body.url !== 'string') throw new Error('Invalid server response: missing url');
+        await loadAssetsManifest().catch(() => undefined);
         return body.url;
       },
     },

package/assets/templates/alpha/src_tenant.sh

@@ -1641,7 +1641,7 @@ cat << 'END_OF_FILE_CONTENT' > "package.json"
     "@tiptap/extension-link": "^2.11.5",
     "@tiptap/react": "^2.11.5",
     "@tiptap/starter-kit": "^2.11.5",
-    "@olonjs/core": "^1.0.76",
+    "@olonjs/core": "^1.0.78",
     "clsx": "^2.1.1",
     "lucide-react": "^0.474.0",
     "react": "^19.0.0",
@@ -2612,6 +2612,9 @@ const TENANT_ID = 'alpha';
 const filePages = getFilePages();
 const fileSiteConfig = siteData as unknown as SiteConfig;
 const MAX_UPLOAD_SIZE_BYTES = 5 * 1024 * 1024;
+const ASSET_UPLOAD_MAX_RETRIES = 2;
+const ASSET_UPLOAD_TIMEOUT_MS = 20_000;
+const ALLOWED_IMAGE_MIME_TYPES = new Set(['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif']);
 
 interface CloudSaveUiState {
   isOpen: boolean;
@@ -2918,14 +2921,39 @@ function App() {
     [isCloudMode, CLOUD_API_URL]
   );
 
-  useEffect(() => {
-    // In Cloud mode, listing assets might be different or disabled for MVP
-    // For now, we keep the local fetch which will fail gracefully on Vercel (404)
+  const loadAssetsManifest = useCallback(async (): Promise<void> => {
+    if (isCloudMode && CLOUD_API_URL && CLOUD_API_KEY) {
+      const apiBases = cloudApiCandidates.length > 0 ? cloudApiCandidates : [normalizeApiBase(CLOUD_API_URL)];
+      for (const apiBase of apiBases) {
+        try {
+          const res = await fetch(`${apiBase}/assets/list?limit=200`, {
+            method: 'GET',
+            headers: {
+              Authorization: `Bearer ${CLOUD_API_KEY}`,
+            },
+          });
+          const body = (await res.json().catch(() => ({}))) as { items?: LibraryImageEntry[] };
+          if (!res.ok) continue;
+          const items = Array.isArray(body.items) ? body.items : [];
+          setAssetsManifest(items);
+          return;
+        } catch {
+          // try next candidate
+        }
+      }
+      setAssetsManifest([]);
+      return;
+    }
+
     fetch('/api/list-assets')
       .then((r) => (r.ok ? r.json() : []))
       .then((list: LibraryImageEntry[]) => setAssetsManifest(Array.isArray(list) ? list : []))
       .catch(() => setAssetsManifest([]));
-  }, []);
+  }, [isCloudMode, CLOUD_API_URL, CLOUD_API_KEY, cloudApiCandidates]);
+
+  useEffect(() => {
+    void loadAssetsManifest();
+  }, [loadAssetsManifest]);
 
   useEffect(() => {
     return () => {
@@ -3278,14 +3306,60 @@ function App() {
       assetsBaseUrl: '/assets',
       assetsManifest,
       async onAssetUpload(file: File): Promise<string> {
-        // Note: Asset upload in Cloud Mode requires the R2 Bridge (Next Step in Roadmap)
-        // For now, this works in Local Mode.
         if (!file.type.startsWith('image/')) throw new Error('Invalid file type.');
+        if (!ALLOWED_IMAGE_MIME_TYPES.has(file.type)) {
+          throw new Error('Unsupported image format. Allowed: jpeg, png, webp, gif, avif.');
+        }
         if (file.size > MAX_UPLOAD_SIZE_BYTES) throw new Error(`File too large. Max ${MAX_UPLOAD_SIZE_BYTES / 1024 / 1024}MB.`);
-        
+
+        if (isCloudMode && CLOUD_API_URL && CLOUD_API_KEY) {
+          const apiBases = cloudApiCandidates.length > 0 ? cloudApiCandidates : [normalizeApiBase(CLOUD_API_URL)];
+          let lastError: Error | null = null;
+          for (const apiBase of apiBases) {
+            for (let attempt = 0; attempt <= ASSET_UPLOAD_MAX_RETRIES; attempt += 1) {
+              try {
+                const formData = new FormData();
+                formData.append('file', file);
+                formData.append('filename', file.name);
+                const controller = new AbortController();
+                const timeout = window.setTimeout(() => controller.abort(), ASSET_UPLOAD_TIMEOUT_MS);
+                const res = await fetch(`${apiBase}/assets/upload`, {
+                  method: 'POST',
+                  headers: {
+                    Authorization: `Bearer ${CLOUD_API_KEY}`,
+                    'X-Correlation-Id': crypto.randomUUID(),
+                  },
+                  body: formData,
+                  signal: controller.signal,
+                }).finally(() => window.clearTimeout(timeout));
+                const body = (await res.json().catch(() => ({}))) as { url?: string; error?: string; code?: string };
+                if (res.ok && typeof body.url === 'string') {
+                  await loadAssetsManifest().catch(() => undefined);
+                  return body.url;
+                }
+                lastError = new Error(body.error || body.code || `Cloud upload failed: ${res.status}`);
+                if (isRetryableStatus(res.status) && attempt < ASSET_UPLOAD_MAX_RETRIES) {
+                  await sleep(backoffDelayMs(attempt));
+                  continue;
+                }
+                break;
+              } catch (error: unknown) {
+                const message = error instanceof Error ? error.message : 'Cloud upload failed.';
+                lastError = new Error(message);
+                if (attempt < ASSET_UPLOAD_MAX_RETRIES) {
+                  await sleep(backoffDelayMs(attempt));
+                  continue;
+                }
+                break;
+              }
+            }
+          }
+          throw lastError ?? new Error('Cloud upload failed.');
+        }
+
         const base64 = await new Promise<string>((resolve, reject) => {
           const reader = new FileReader();
-          reader.onload  = () => resolve((reader.result as string).split(',')[1] ?? '');
+          reader.onload = () => resolve((reader.result as string).split(',')[1] ?? '');
           reader.onerror = () => reject(reader.error);
           reader.readAsDataURL(file);
         });
@@ -3295,10 +3369,10 @@ function App() {
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ filename: file.name, mimeType: file.type || undefined, data: base64 }),
         });
-        
         const body = (await res.json().catch(() => ({}))) as { url?: string; error?: string };
         if (!res.ok) throw new Error(body.error || `Upload failed: ${res.status}`);
         if (typeof body.url !== 'string') throw new Error('Invalid server response: missing url');
+        await loadAssetsManifest().catch(() => undefined);
         return body.url;
       },
     },
@@ -7743,19 +7817,19 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/config/menu.json"
 {
   "main": [
     {
-      "label": "Architecture",
-      "href": "#architecture"
+      "label": "The Problem",
+      "href": "#problem"
     },
     {
-      "label": "CMS",
-      "href": "#cms"
+      "label": "Architecture",
+      "href": "#architecture"
     },
     {
-      "label": "Versioning",
-      "href": "#git"
+      "label": "Why",
+      "href": "#why"
     },
     {
-      "label": "Developer",
+      "label": "DX",
       "href": "#devex"
     }
   ]
@@ -7796,19 +7870,19 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/config/site.json"
       "badge": "v1.4.0",
       "links": [
         {
-          "label": "Architecture",
-          "href": "#architecture"
+          "label": "The Problem",
+          "href": "#problem"
         },
         {
-          "label": "CMS",
-          "href": "#cms"
+          "label": "Architecture",
+          "href": "#architecture"
         },
         {
-          "label": "Versioning",
-          "href": "#git"
+          "label": "Why",
+          "href": "#why"
         },
         {
-          "label": "Developer",
+          "label": "DX",
           "href": "#devex"
         }
       ]
@@ -7917,8 +7991,18 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/pages/home.json"
         "titleHighlight": "Agentic Web",
         "description": "AI agents are becoming operational actors in commerce, marketing, and support. OlonJS introduces a deterministic machine contract for websites — so agents can reliably read and operate any site, without custom glue.",
         "ctas": [
-          { "id": "cta-1", "label": "Read the Spec",    "href": "/docs",                                          "variant": "primary"    },
-          { "id": "cta-2", "label": "View on GitHub",   "href": "https://github.com/olonjs/npm-jpcore",           "variant": "secondary"  }
+          {
+            "id": "cta-1",
+            "label": "Read the Spec",
+            "href": "/docs",
+            "variant": "primary"
+          },
+          {
+            "id": "cta-2",
+            "label": "View on GitHub",
+            "href": "https://github.com/olonjs/npm-jpcore",
+            "variant": "secondary"
+          }
         ],
         "metrics": []
       },
@@ -7933,16 +8017,35 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/pages/home.json"
         "problemTag": "The problem",
         "problemTitle": "Websites aren't built for agents",
         "problemItems": [
-          { "id": "pi-1", "text": "Agentic workflows are growing, but integration is mostly custom glue — rebuilt tenant by tenant" },
-          { "id": "pi-2", "text": "Every site has a different content structure, routing assumptions, and edge cases" },
-          { "id": "pi-3", "text": "HTML-heavy, CMS-fragmented, inconsistent across properties — slow, brittle, expensive" }
+          {
+            "id": "pi-1",
+            "text": "Agentic workflows are growing, but integration is mostly custom glue — rebuilt tenant by tenant"
+          },
+          {
+            "id": "pi-2",
+            "text": "Every site has a different content structure, routing assumptions, and edge cases"
+          },
+          {
+            "id": "pi-3",
+            "text": "HTML-heavy, CMS-fragmented, inconsistent across properties — slow, brittle, expensive"
+          }
         ],
         "solutionTag": "Our solution",
         "solutionTitle": "A standard machine contract across tenants",
         "solutionItems": [
-          { "id": "si-1", "text": "Predictable page endpoints for agents —", "code": "/{slug}.json" },
-          { "id": "si-2", "text": "Typed, schema-driven content contracts — validated, versioned, auditable" },
-          { "id": "si-3", "text": "Repeatable governance and deployment patterns across every tenant" }
+          {
+            "id": "si-1",
+            "text": "Predictable page endpoints for agents —",
+            "code": "/{slug}.json"
+          },
+          {
+            "id": "si-2",
+            "text": "Typed, schema-driven content contracts — validated, versioned, auditable"
+          },
+          {
+            "id": "si-3",
+            "text": "Repeatable governance and deployment patterns across every tenant"
+          }
         ]
       },
       "settings": {}
@@ -7956,15 +8059,47 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/pages/home.json"
         "sectionTitle": "Built for enterprise scale",
         "sectionLead": "Every layer is designed for determinism — from file system layout to component contracts to Studio UX.",
         "cards": [
-          { "id": "fc-1", "emoji": "📐", "title": "Modular Type Registry",      "description": "Core defines empty registries; tenants inject types via module augmentation. Full TypeScript safety, zero Core changes." },
-          { "id": "fc-2", "emoji": "🧱", "title": "Tenant Block Protocol",      "description": "Self-contained capsules (View + schema + types) enable automated ingestion and consistent editor generation." },
-          { "id": "fc-3", "emoji": "⚙️", "title": "Deterministic CLI",          "description": "@olonjs/cli projects new tenants from a canonical script — reproducible across every environment." },
-          { "id": "fc-4", "emoji": "🎯", "title": "ICE Data Contract",          "description": "Mandatory DOM attributes bind the Studio canvas to Inspector fields without coupling to tenant DOM structure." },
-          { "id": "fc-5", "emoji": "📦", "title": "Base Schema Fragments",      "description": "Shared BaseSectionData and BaseArrayItem enforce anchor IDs and stable React keys across all capsules." },
-          { "id": "fc-6", "emoji": "🔗", "title": "Path-Based Selection",       "description": "v1.4 strict path semantics eliminate nested array ambiguity. Studio selection is root-to-leaf, always deterministic." }
+          {
+            "id": "fc-1",
+            "emoji": "📐",
+            "title": "Modular Type Registry",
+            "description": "Core defines empty registries; tenants inject types via module augmentation. Full TypeScript safety, zero Core changes."
+          },
+          {
+            "id": "fc-2",
+            "emoji": "🧱",
+            "title": "Tenant Block Protocol",
+            "description": "Self-contained capsules (View + schema + types) enable automated ingestion and consistent editor generation."
+          },
+          {
+            "id": "fc-3",
+            "emoji": "⚙️",
+            "title": "Deterministic CLI",
+            "description": "@olonjs/cli projects new tenants from a canonical script — reproducible across every environment."
+          },
+          {
+            "id": "fc-4",
+            "emoji": "🎯",
+            "title": "ICE Data Contract",
+            "description": "Mandatory DOM attributes bind the Studio canvas to Inspector fields without coupling to tenant DOM structure."
+          },
+          {
+            "id": "fc-5",
+            "emoji": "📦",
+            "title": "Base Schema Fragments",
+            "description": "Shared BaseSectionData and BaseArrayItem enforce anchor IDs and stable React keys across all capsules."
+          },
+          {
+            "id": "fc-6",
+            "emoji": "🔗",
+            "title": "Path-Based Selection",
+            "description": "v1.4 strict path semantics eliminate nested array ambiguity. Studio selection is root-to-leaf, always deterministic."
+          }
         ]
       },
-      "settings": { "columns": 3 }
+      "settings": {
+        "columns": 3
+      }
     },
     {
       "id": "why-now",
@@ -7975,10 +8110,26 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/pages/home.json"
         "title": "Why this matters",
         "titleAccent": "now",
         "cards": [
-          { "id": "wc-1", "title": "Agentic commerce is live",      "description": "Operational standards are missing. Without a contract layer, teams face high integration cost and low reliability." },
-          { "id": "wc-2", "title": "Enterprises need governance",   "description": "A contract layer you can audit, version, and scale — not a one-off adapter for every new agent workflow." },
-          { "id": "wc-3", "title": "AI tooling is ready",           "description": "Deterministic structure means AI can scaffold, validate, and evolve tenants with less prompt ambiguity." },
-          { "id": "wc-4", "title": "Speed compounds",               "description": "Teams that standardize now ship new experiences in hours while others rebuild integration logic repeatedly." }
+          {
+            "id": "wc-1",
+            "title": "Agentic commerce is live",
+            "description": "Operational standards are missing. Without a contract layer, teams face high integration cost and low reliability."
+          },
+          {
+            "id": "wc-2",
+            "title": "Enterprises need governance",
+            "description": "A contract layer you can audit, version, and scale — not a one-off adapter for every new agent workflow."
+          },
+          {
+            "id": "wc-3",
+            "title": "AI tooling is ready",
+            "description": "Deterministic structure means AI can scaffold, validate, and evolve tenants with less prompt ambiguity."
+          },
+          {
+            "id": "wc-4",
+            "title": "Speed compounds",
+            "description": "Teams that standardize now ship new experiences in hours while others rebuild integration logic repeatedly."
+          }
         ]
       },
       "settings": {}
@@ -7987,19 +8138,40 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/pages/home.json"
       "id": "dx-section",
       "type": "devex",
       "data": {
-        "anchorId": "developer-velocity",
+        "anchorId": "devex",
         "label": "Developer Velocity",
         "title": "AI-native advantage,\nfrom day one",
         "description": "OlonJS dramatically increases AI-assisted development speed. Because structure is deterministic, agents scaffold and evolve tenants faster — with lower regression risk.",
         "features": [
-          { "id": "df-1", "text": "AI scaffolds and evolves tenants faster because structure is deterministic" },
-          { "id": "df-2", "text": "Shared conventions reduce prompt ambiguity and implementation drift" },
-          { "id": "df-3", "text": "Ship new tenant experiences in hours, not weeks" }
+          {
+            "id": "df-1",
+            "text": "AI scaffolds and evolves tenants faster because structure is deterministic"
+          },
+          {
+            "id": "df-2",
+            "text": "Shared conventions reduce prompt ambiguity and implementation drift"
+          },
+          {
+            "id": "df-3",
+            "text": "Ship new tenant experiences in hours, not weeks"
+          }
         ],
         "stats": [
-          { "id": "ds-1", "value": "10×",  "label": "Faster scaffolding" },
-          { "id": "ds-2", "value": "∅",    "label": "Glue per tenant"    },
-          { "id": "ds-3", "value": "100%", "label": "Type-safe contracts" }
+          {
+            "id": "ds-1",
+            "value": "10×",
+            "label": "Faster scaffolding"
+          },
+          {
+            "id": "ds-2",
+            "value": "∅",
+            "label": "Glue per tenant"
+          },
+          {
+            "id": "ds-3",
+            "value": "100%",
+            "label": "Type-safe contracts"
+          }
         ]
       },
       "settings": {}
@@ -8013,15 +8185,24 @@ cat << 'END_OF_FILE_CONTENT' > "src/data/pages/home.json"
         "description": "Read the full specification or explore the source on GitHub. Zero dependencies to start — one JSON endpoint per page.",
         "cliCommand": "npx @olonjs/cli@latest new tenant",
         "ctas": [
-          { "id": "cta-docs", "label": "Read the Specification", "href": "/docs",                                     "variant": "primary"   },
-          { "id": "cta-gh",   "label": "View on GitHub",         "href": "https://github.com/olonjs/npm-jpcore",      "variant": "secondary" }
+          {
+            "id": "cta-docs",
+            "label": "Read the Specification",
+            "href": "/docs",
+            "variant": "primary"
+          },
+          {
+            "id": "cta-gh",
+            "label": "View on GitHub",
+            "href": "https://github.com/olonjs/npm-jpcore",
+            "variant": "secondary"
+          }
         ]
       },
       "settings": {}
     }
   ]
 }
-
 END_OF_FILE_CONTENT
 echo "Creating src/data/pages/post.json..."
 cat << 'END_OF_FILE_CONTENT' > "src/data/pages/post.json"

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@olonjs/cli",
-    "version": "3.0.88",
+    "version": "3.0.90",
     "description": "The Sovereign CLI Engine for OlonJS.",
     "type": "module",
     "bin": {