run402 1.45.0 → 1.47.0

package/cli.mjs

@@ -28,9 +28,9 @@ Commands:
   deploy      Deploy a full-stack app or static site (requires active tier)
   functions   Manage serverless functions (deploy, invoke, logs, list, delete)
   secrets     Manage project secrets (set, list, delete)
-  blob        Direct-to-S3 blob storage (put, get, ls, rm, sign) — up to 5 TiB
-  storage     Legacy file storage (deprecated — sunset 2026-06-01, use 'blob')
+  blob        Direct-to-S3 blob storage (put, get, ls, rm, sign, diagnose) — up to 5 TiB
   sites       Deploy static sites
+  cdn         CloudFront CDN diagnostics (wait-fresh) for public blob URLs
   subdomains  Manage custom subdomains (claim, list, delete)
   domains     Manage custom domains (add, list, status, delete)
   apps        Browse and manage the app marketplace
@@ -115,17 +115,13 @@ switch (cmd) {
     await run(sub, rest);
     break;
   }
-  case "storage": {
-    process.stderr.write(
-      "run402 storage is deprecated — sunset 2026-06-01. Use `run402 blob` instead.\n" +
-      "See https://run402.com/docs/blob#migration\n\n",
-    );
-    const { run } = await import("./lib/storage.mjs");
+  case "blob": {
+    const { run } = await import("./lib/blob.mjs");
     await run(sub, rest);
     break;
   }
-  case "blob": {
-    const { run } = await import("./lib/blob.mjs");
+  case "cdn": {
+    const { run } = await import("./lib/cdn.mjs");
     await run(sub, rest);
     break;
   }

package/lib/blob.mjs

@@ -46,6 +46,7 @@ Usage:
   run402 blob ls [options]
   run402 blob rm <key> [options]
   run402 blob sign <key> [options]
+  run402 blob diagnose <url> [options]
 
 Options:
   --project <id>      Project ID (defaults to active project from 'run402 projects use')
@@ -150,6 +151,32 @@ Options:
 
 Examples:
   run402 blob sign reports/2025-q4.pdf --project abc123 --ttl 600
+`,
+  diagnose: `run402 blob diagnose — Inspect the live CDN state for a public blob URL
+
+Usage:
+  run402 blob diagnose <url> [options]
+
+Arguments:
+  <url>               Full blob URL (e.g. https://app.run402.com/_blob/avatar.png)
+
+Options:
+  --project <id>      Project ID (defaults to active project)
+
+Output:
+  - Prints the JSON envelope on stdout (parseable by agent shell loops).
+  - Vantage caveat ("# probed once from gateway-us-east-1; not a global view")
+    on stderr — visible to TTY operators, ignored by piped consumers.
+
+Exit codes:
+  0   observed SHA matches the gateway's expected SHA
+  1   observed SHA does not match (or probe returned no SHA)
+
+Agent loop pattern:
+  until run402 blob diagnose <url>; do sleep 1; done
+
+Examples:
+  run402 blob diagnose https://app.run402.com/_blob/avatar.png
 `,
 };
 
@@ -445,6 +472,33 @@ async function rm(projectId, argv) {
 // sign
 // ---------------------------------------------------------------------------
 
+async function diagnose(projectId, argv) {
+  const opts = parseArgs(argv);
+  opts.project = opts.project || projectId;
+  const resolvedId = resolveProjectId(opts.project);
+  if (opts.positional.length === 0) die("URL required");
+  const url = opts.positional[0];
+
+  try {
+    const env = await getSdk().blobs.diagnoseUrl(resolvedId, url);
+    // Always print the JSON envelope for agent consumption (parseable).
+    console.log(JSON.stringify(env, null, 2));
+    // Vantage caveat to stderr so a TTY operator sees it; agent shell loops
+    // that pipe stdout into another tool aren't affected.
+    process.stderr.write(
+      `\n# probed once from ${env.vantage}; not a global view\n`,
+    );
+    // Exit code: 0 if observed === expected, 1 otherwise. Lets agents
+    // shell-script `until run402 blob diagnose <url>; do sleep 1; done`.
+    if (env.observedSha256 && env.observedSha256 === env.expectedSha256) {
+      process.exit(0);
+    }
+    process.exit(1);
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
 async function sign(projectId, argv) {
   const opts = parseArgs(argv);
   opts.project = opts.project || projectId;
@@ -518,11 +572,12 @@ export async function run(sub, args) {
   }
   const defaultProject = process.env.RUN402_PROJECT ?? null;
   switch (sub) {
-    case "put":   await put(defaultProject, args); break;
-    case "get":   await get(defaultProject, args); break;
-    case "ls":    await ls(defaultProject, args); break;
-    case "rm":    await rm(defaultProject, args); break;
-    case "sign":  await sign(defaultProject, args); break;
+    case "put":      await put(defaultProject, args); break;
+    case "get":      await get(defaultProject, args); break;
+    case "ls":       await ls(defaultProject, args); break;
+    case "rm":       await rm(defaultProject, args); break;
+    case "sign":     await sign(defaultProject, args); break;
+    case "diagnose": await diagnose(defaultProject, args); break;
     default:
       console.error(`Unknown subcommand: ${sub}`);
       console.log(HELP);

package/lib/cdn.mjs

@@ -0,0 +1,130 @@
+/**
+ * run402 cdn — CloudFront CDN diagnostics for public blob URLs.
+ *
+ * Usage:
+ *   run402 cdn wait-fresh <url> --sha <sha256> [--timeout <seconds>] [--project <id>]
+ *
+ * Wraps the SDK's `client.blobs.waitFresh(...)`. Polls the gateway diagnose
+ * endpoint until the URL serves the expected SHA, then exits 0. On timeout,
+ * exits 1 (agent shell loops can chain a fallback action).
+ *
+ * **Mutable URLs only.** For immutable URLs (the `immutableUrl` field
+ * returned by `run402 blob put --immutable`), no waiting is needed — they
+ * are bound to a SHA at upload time and never previously cached.
+ */
+
+import { resolveProjectId } from "./config.mjs";
+import { getSdk } from "./sdk.mjs";
+import { reportSdkError } from "./sdk-errors.mjs";
+
+const HELP = `run402 cdn — CloudFront CDN diagnostics for public blob URLs
+
+Usage:
+  run402 cdn wait-fresh <url> --sha <sha256> [options]
+
+Subcommands:
+  wait-fresh    Poll the CDN until a mutable URL serves the expected SHA-256
+
+Examples:
+  run402 cdn wait-fresh https://app.run402.com/_blob/avatar.png --sha abc...
+
+For details: run402 cdn wait-fresh --help
+`;
+
+const SUB_HELP = {
+  "wait-fresh": `run402 cdn wait-fresh — Poll the CDN for an expected SHA on a mutable URL
+
+Usage:
+  run402 cdn wait-fresh <url> --sha <sha256> [options]
+
+Arguments:
+  <url>               Full mutable blob URL to poll (e.g.
+                      https://app.run402.com/_blob/avatar.png)
+
+Options:
+  --sha <hex>         Expected hex SHA-256. Required.
+  --timeout <secs>    Max wait in seconds. Default 60.
+  --project <id>      Project ID (defaults to active project)
+
+Output:
+  Prints a JSON result on stdout when polling ends:
+    { "fresh": true|false, "observedSha256": "...", "attempts": N,
+      "elapsedMs": ..., "vantage": "gateway-us-east-1" }
+
+Exit codes:
+  0   the URL served the expected SHA before the timeout
+  1   the URL did NOT match within the timeout (or the project resolution failed)
+
+Notes:
+  - For IMMUTABLE URLs (returned as 'immutableUrl' from 'run402 blob put
+    --immutable'), no waiting is needed. Use this command only for the
+    mutable 'url' field, after a re-upload to an existing public key.
+  - The probe is single-vantage (us-east-1). Other CloudFront PoPs may
+    serve different cached states until invalidation propagates.
+
+Examples:
+  run402 cdn wait-fresh https://app.run402.com/_blob/avatar.png --sha ba78...
+  run402 cdn wait-fresh https://app.run402.com/_blob/avatar.png --sha ba78... --timeout 120
+`,
+};
+
+function die(msg, code = 1) {
+  console.error(JSON.stringify({ status: "error", message: msg }));
+  process.exit(code);
+}
+
+function parseArgs(args) {
+  const opts = { positional: [] };
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--sha") opts.sha = args[++i];
+    else if (a === "--timeout") opts.timeout = Number(args[++i]);
+    else if (a === "--project") opts.project = args[++i];
+    else if (a.startsWith("--")) die(`Unknown option: ${a}`);
+    else opts.positional.push(a);
+  }
+  return opts;
+}
+
+async function waitFresh(projectId, argv) {
+  const opts = parseArgs(argv);
+  opts.project = opts.project || projectId;
+  const resolvedId = resolveProjectId(opts.project);
+  if (opts.positional.length === 0) die("URL required");
+  const url = opts.positional[0];
+  if (!opts.sha) die("--sha is required");
+
+  const timeoutMs = (opts.timeout ?? 60) * 1000;
+  try {
+    const result = await getSdk().blobs.waitFresh(resolvedId, {
+      url,
+      sha256: opts.sha.toLowerCase(),
+      timeoutMs,
+    });
+    console.log(JSON.stringify(result, null, 2));
+    process.exit(result.fresh ? 0 : 1);
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
+export async function run(sub, args) {
+  if (!sub || sub === "--help" || sub === "-h") {
+    console.log(HELP);
+    process.exit(0);
+  }
+  if (Array.isArray(args) && (args.includes("--help") || args.includes("-h"))) {
+    console.log(SUB_HELP[sub] || HELP);
+    process.exit(0);
+  }
+  const defaultProject = process.env.RUN402_PROJECT ?? null;
+  switch (sub) {
+    case "wait-fresh":
+      await waitFresh(defaultProject, args);
+      break;
+    default:
+      console.error(`Unknown subcommand: ${sub}`);
+      console.log(HELP);
+      process.exit(1);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "1.45.0",
+  "version": "1.47.0",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {

package/sdk/dist/namespaces/blobs.d.ts

@@ -7,7 +7,7 @@
  * configured fetch still flows through any wrappers (e.g. test mocks).
  */
 import type { Client } from "../kernel.js";
-import type { BlobLsOptions, BlobLsResult, BlobPutOptions, BlobPutResult, BlobPutSource, BlobSignOptions, BlobSignResult } from "./blobs.types.js";
+import type { BlobDiagnoseEnvelope, BlobLsOptions, BlobLsResult, BlobPutOptions, BlobPutResult, BlobPutSource, BlobSignOptions, BlobSignResult, BlobWaitFreshOptions, BlobWaitFreshResult } from "./blobs.types.js";
 export declare class Blobs {
     private readonly client;
     constructor(client: Client);
@@ -22,6 +22,46 @@ export declare class Blobs {
      * @throws {ProjectNotFound} if `projectId` is not in the provider.
      */
     put(projectId: string, key: string, source: BlobPutSource, opts?: BlobPutOptions): Promise<BlobPutResult>;
+    /**
+     * Diagnose a public blob URL. Returns a JSON envelope describing the live
+     * CDN state (expected vs observed SHA, cache headers, recent invalidation
+     * status, vantage). The gateway probes the URL once from us-east-1 with
+     * `Range: bytes=0-0` and returns within 5 s even if the inner probe is
+     * slow.
+     *
+     * **Vantage caveat:** the result reflects ONE CloudFront PoP at the time
+     * of the call. Other PoPs may serve different cached states. The
+     * `probeMayHaveWarmedCache: true` field reminds the agent that the probe
+     * itself populates the cache, so a subsequent read may differ.
+     *
+     * The URL must belong to the requesting project — cross-project URLs are
+     * rejected by the gateway with `403`. SSRF is enforced gateway-side: only
+     * `*.run402.com` and the project's active custom domains are accepted.
+     *
+     * @example
+     *   const diag = await client.blobs.diagnoseUrl("prj_abc", "https://app.run402.com/_blob/avatar.png");
+     *   if (diag.observedSha256 !== diag.expectedSha256) console.log(diag.hint);
+     */
+    diagnoseUrl(projectId: string, url: string): Promise<BlobDiagnoseEnvelope>;
+    /**
+     * Poll the CDN until a mutable URL serves the expected SHA-256, or the
+     * timeout elapses. **For mutable URLs only** — for immutable URLs (the
+     * `immutableUrl` returned by `put`) no waiting is needed; they're bound
+     * at upload time and never previously cached.
+     *
+     * Default `timeoutMs` is 60_000 (60 s). The helper polls the gateway's
+     * diagnose endpoint with exponential backoff bounded by 1 s; each poll
+     * may itself warm the cache for the probed PoP, so subsequent reads from
+     * other PoPs may still be stale until invalidation propagation completes.
+     *
+     * @example
+     *   await client.blobs.waitFresh("prj_abc", {
+     *     url: result.url,           // the mutable URL from blobs.put
+     *     sha256: result.contentSha256,
+     *     timeoutMs: 30_000,
+     *   });
+     */
+    waitFresh(projectId: string, opts: BlobWaitFreshOptions): Promise<BlobWaitFreshResult>;
     /**
      * Download a blob. Returns the raw `Response` so callers can stream to
      * disk, pipe to another sink, or buffer with `.bytes()` / `.arrayBuffer()`.

package/sdk/dist/namespaces/blobs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blobs.d.ts","sourceRoot":"","sources":["../../src/namespaces/blobs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EACZ,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACf,MAAM,kBAAkB,CAAC;AA6C1B,qBAAa,KAAK;IACJ,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;;;;;;OASG;IACG,GAAG,CACP,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA+EzB;;;;;;;OAOG;IACG,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAuB5D,oDAAoD;IAC9C,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAoB5E,+DAA+D;IACzD,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcvD,6FAA6F;IACvF,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;CAoBhG"}
+{"version":3,"file":"blobs.d.ts","sourceRoot":"","sources":["../../src/namespaces/blobs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAGV,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAsO1B,qBAAa,KAAK;IACJ,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;;;;;;OASG;IACG,GAAG,CACP,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2FzB;;;;;;;;;;;;;;;;;;;OAmBG;IACG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAchF;;;;;;;;;;;;;;;;;OAiBG;IACG,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC;IA2C/B;;;;;;;OAOG;IACG,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAuB5D,oDAAoD;IAC9C,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAoB5E,+DAA+D;IACzD,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcvD,6FAA6F;IACvF,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;CAoBhG"}

package/sdk/dist/namespaces/blobs.js

@@ -40,6 +40,152 @@ async function sha256Hex(bytes) {
         .map((b) => b.toString(16).padStart(2, "0"))
         .join("");
 }
+function escapeHtmlAttr(s) {
+    return s
+        .replace(/&/g, "&")
+        .replace(/"/g, """)
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;");
+}
+/**
+ * Convert hex (e.g. `"abcd…"`) to base64 in environments that have either
+ * Buffer (Node) or `btoa` (browsers). The helper is here because Browser SDK
+ * builds may run without `Buffer`.
+ */
+function hexToBase64(hex) {
+    const len = hex.length;
+    const bytes = new Uint8Array(len / 2);
+    for (let i = 0; i < len; i += 2) {
+        bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16);
+    }
+    // Prefer Buffer when available (faster on Node).
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const g = globalThis;
+    if (g.Buffer)
+        return g.Buffer.from(bytes).toString("base64");
+    let s = "";
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return g.btoa ? g.btoa(s) : "";
+}
+/**
+ * Widen the gateway's snake_case completion response into the AssetRef
+ * shape (which adds camelCase aliases + locally-derived integrity fields
+ * for any URL the consumer is about to embed in code). For non-immutable
+ * uploads where the SHA is null, the integrity fields are null and the
+ * agent guidance steers them to use `--immutable` before linking.
+ */
+function buildAssetRef(resp, contentType) {
+    const sha = resp.sha256;
+    const immutable = !!resp.immutable_url;
+    const cacheKind = resp.visibility === "private"
+        ? "private"
+        : immutable
+            ? "immutable"
+            : "mutable";
+    const etag = sha ? `"sha256-${sha}"` : null;
+    const sri = sha ? `sha256-${hexToBase64(sha)}` : null;
+    const contentDigest = sha ? `sha-256=:${hexToBase64(sha)}:` : null;
+    // v1.45 agent-DX URLs — guaranteed CDN-reachable on the auto-subdomain.
+    // Older gateway versions don't emit them; null in that case (callers fall
+    // back to the preferred-host `url` / `immutableUrl`).
+    const cdnUrl = resp.cdn_immutable_url ?? null;
+    const cdnMutableUrl = resp.cdn_url ?? null;
+    // The cdn envelope: prefer what the gateway returns; fall back to
+    // best-effort defaults so older gateway versions don't break the SDK
+    // surface. immutable URLs are always-ready by definition.
+    const cdnFromGw = resp.cdn ?? {};
+    const cdn = {
+        version: cdnFromGw.version ?? "blob-gateway-v2",
+        invalidationId: cdnFromGw.invalidationId ?? null,
+        invalidationStatus: cdnFromGw.invalidationStatus ?? null,
+        ready: cdnFromGw.ready ?? immutable,
+        hint: cdnFromGw.hint ??
+            (immutable
+                ? "Use cdnUrl + scriptTag()/linkTag()/imgTag() — paste-and-go."
+                : "For mutable URLs, propagation is asynchronous. Prefer cdnUrl (immutable, content-hashed) for generated HTML/CSS/JS, or call wait_for_cdn_freshness."),
+    };
+    // Emitter helpers. Throw with an actionable hint when the SHA is null
+    // (non-immutable upload) — the agent should re-upload with `immutable:
+    // true` to get content-hashed URLs that pair with SRI.
+    function requireImmutable(name) {
+        if (!cdnUrl || !sri) {
+            throw new Error(`${name}() requires an immutable upload (pass { immutable: true } to blobs.put). ` +
+                `Without immutable, there is no SHA to bind for SRI and the URL would change on re-upload.`);
+        }
+        return { url: cdnUrl, sri };
+    }
+    return {
+        key: resp.key,
+        size_bytes: resp.size_bytes,
+        sha256: sha,
+        visibility: resp.visibility,
+        url: resp.url,
+        immutable_url: resp.immutable_url,
+        size: resp.size_bytes,
+        contentSha256: sha,
+        contentType,
+        immutableUrl: resp.immutable_url,
+        cdnUrl,
+        cdnMutableUrl,
+        etag,
+        sri,
+        contentDigest,
+        cacheKind,
+        cdn,
+        scriptTag(opts) {
+            // Default `defer: true` — modern best practice. Defer prevents
+            // render-blocking when placed in <head> and is a no-op when placed
+            // at the end of <body> (the script runs after DOMContentLoaded
+            // either way). Pass `{ defer: false }` to opt out for the rare
+            // case requiring synchronous execution. `async` and `defer` are
+            // mutually exclusive; passing async overrides defer.
+            const { url, sri } = requireImmutable("scriptTag");
+            const attrs = [`src="${escapeHtmlAttr(url)}"`];
+            if (opts?.type === "module")
+                attrs.push(`type="module"`);
+            const wantsAsync = opts?.async === true;
+            const wantsDefer = opts?.defer ?? !wantsAsync;
+            if (wantsAsync)
+                attrs.push("async");
+            else if (wantsDefer)
+                attrs.push("defer");
+            attrs.push(`integrity="${escapeHtmlAttr(sri)}"`);
+            attrs.push("crossorigin");
+            return `<script ${attrs.join(" ")}></script>`;
+        },
+        linkTag(opts) {
+            // Always emit crossorigin — required for SRI to actually be
+            // enforced. Without crossorigin the browser silently ignores the
+            // integrity attribute (HTML spec). This applies to rel="preload"
+            // too: matching crossorigin on the preload + the eventual fetch is
+            // what lets the browser dedupe instead of double-fetching.
+            const { url, sri } = requireImmutable("linkTag");
+            const rel = opts?.rel ?? "stylesheet";
+            const attrs = [`rel="${escapeHtmlAttr(rel)}"`];
+            attrs.push(`href="${escapeHtmlAttr(url)}"`);
+            if (opts?.as)
+                attrs.push(`as="${escapeHtmlAttr(opts.as)}"`);
+            attrs.push(`integrity="${escapeHtmlAttr(sri)}"`);
+            attrs.push("crossorigin");
+            return `<link ${attrs.join(" ")}>`;
+        },
+        imgTag(alt) {
+            // Defaults: loading="lazy" + decoding="async" — modern best
+            // practice. Lazy is harmless for above-fold images (browsers
+            // handle the heuristic) and a flat win for the much more common
+            // below-fold case. Async decoding moves the decode off the main
+            // thread. Both are baseline-supported in all major browsers.
+            // <img> doesn't accept SRI per HTML5; the URL is content-hashed
+            // so it's still stable across re-deploys. Agents who need
+            // byte-level integrity for images should verify Content-Digest
+            // server-side.
+            const { url } = requireImmutable("imgTag");
+            const a = alt ?? "";
+            return `<img src="${escapeHtmlAttr(url)}" alt="${escapeHtmlAttr(a)}" loading="lazy" decoding="async">`;
+        },
+    };
+}
 export class Blobs {
     client;
     constructor(client) {
@@ -71,7 +217,13 @@ export class Blobs {
             throw new Error("`content` is limited to 1 MB. Use `bytes` for larger uploads.");
         }
         const contentType = opts.contentType ?? guessContentType(key);
-        const sha256 = opts.immutable ? await sha256Hex(bytes) : undefined;
+        // v1.45 default: `immutable: true`. The agent-DX surface (cdnUrl, sri,
+        // scriptTag/linkTag/imgTag) only works for content-addressed uploads,
+        // so the default reaches for the best path. Pass `{ immutable: false }`
+        // explicitly when you specifically want a non-content-hashed URL
+        // (e.g. very large file where you want to skip the SHA pass).
+        const immutable = opts.immutable ?? true;
+        const sha256 = immutable ? await sha256Hex(bytes) : undefined;
         // 1. Init upload — gateway returns presigned S3 URLs for each part.
         const init = await this.client.request("/storage/v1/uploads", {
             method: "POST",
@@ -84,7 +236,7 @@ export class Blobs {
                 size_bytes: sizeBytes,
                 content_type: contentType,
                 visibility: opts.visibility ?? "public",
-                immutable: opts.immutable ?? false,
+                immutable,
                 sha256,
             },
             context: "initializing upload",
@@ -109,7 +261,7 @@ export class Blobs {
         const completeBody = init.mode === "multipart"
             ? { parts: partEtags.map((e, i) => ({ part_number: i + 1, etag: `"${e.etag}"` })) }
             : {};
-        return this.client.request(`/storage/v1/uploads/${init.upload_id}/complete`, {
+        const completion = await this.client.request(`/storage/v1/uploads/${init.upload_id}/complete`, {
             method: "POST",
             headers: {
                 apikey: project.anon_key,
@@ -118,6 +270,105 @@ export class Blobs {
             body: completeBody,
             context: "completing upload",
         });
+        // Widen the gateway response into the v1.45 AssetRef return type. Older
+        // gateway versions don't emit the `cdn` envelope; `buildAssetRef` fills
+        // safe defaults derived from the SHA + visibility so the SDK surface is
+        // stable across gateway versions.
+        return buildAssetRef(completion, contentType);
+    }
+    /**
+     * Diagnose a public blob URL. Returns a JSON envelope describing the live
+     * CDN state (expected vs observed SHA, cache headers, recent invalidation
+     * status, vantage). The gateway probes the URL once from us-east-1 with
+     * `Range: bytes=0-0` and returns within 5 s even if the inner probe is
+     * slow.
+     *
+     * **Vantage caveat:** the result reflects ONE CloudFront PoP at the time
+     * of the call. Other PoPs may serve different cached states. The
+     * `probeMayHaveWarmedCache: true` field reminds the agent that the probe
+     * itself populates the cache, so a subsequent read may differ.
+     *
+     * The URL must belong to the requesting project — cross-project URLs are
+     * rejected by the gateway with `403`. SSRF is enforced gateway-side: only
+     * `*.run402.com` and the project's active custom domains are accepted.
+     *
+     * @example
+     *   const diag = await client.blobs.diagnoseUrl("prj_abc", "https://app.run402.com/_blob/avatar.png");
+     *   if (diag.observedSha256 !== diag.expectedSha256) console.log(diag.hint);
+     */
+    async diagnoseUrl(projectId, url) {
+        const project = await this.client.getProject(projectId);
+        if (!project)
+            throw new ProjectNotFound(projectId, "diagnosing blob URL");
+        const path = `/storage/v1/blobs/diagnose?url=${encodeURIComponent(url)}`;
+        return this.client.request(path, {
+            headers: {
+                apikey: project.anon_key,
+                Authorization: `Bearer ${project.anon_key}`,
+            },
+            context: "diagnosing blob URL",
+        });
+    }
+    /**
+     * Poll the CDN until a mutable URL serves the expected SHA-256, or the
+     * timeout elapses. **For mutable URLs only** — for immutable URLs (the
+     * `immutableUrl` returned by `put`) no waiting is needed; they're bound
+     * at upload time and never previously cached.
+     *
+     * Default `timeoutMs` is 60_000 (60 s). The helper polls the gateway's
+     * diagnose endpoint with exponential backoff bounded by 1 s; each poll
+     * may itself warm the cache for the probed PoP, so subsequent reads from
+     * other PoPs may still be stale until invalidation propagation completes.
+     *
+     * @example
+     *   await client.blobs.waitFresh("prj_abc", {
+     *     url: result.url,           // the mutable URL from blobs.put
+     *     sha256: result.contentSha256,
+     *     timeoutMs: 30_000,
+     *   });
+     */
+    async waitFresh(projectId, opts) {
+        const project = await this.client.getProject(projectId);
+        if (!project)
+            throw new ProjectNotFound(projectId, "waiting for CDN freshness");
+        const expected = opts.sha256.toLowerCase();
+        const timeoutMs = opts.timeoutMs ?? 60_000;
+        const start = Date.now();
+        let attempts = 0;
+        let observed = null;
+        let delay = 100;
+        while (Date.now() - start < timeoutMs) {
+            attempts++;
+            try {
+                const envelope = await this.diagnoseUrl(projectId, opts.url);
+                observed = envelope.observedSha256;
+                if (observed && observed.toLowerCase() === expected) {
+                    return {
+                        fresh: true,
+                        observedSha256: observed,
+                        attempts,
+                        elapsedMs: Date.now() - start,
+                        vantage: "gateway-us-east-1",
+                    };
+                }
+            }
+            catch {
+                // Swallow & retry — `diagnoseUrl` can fail on transient gateway
+                // hiccups (e.g. ALB cycling). The next poll re-attempts.
+            }
+            const remaining = timeoutMs - (Date.now() - start);
+            if (remaining <= 0)
+                break;
+            await new Promise((r) => setTimeout(r, Math.min(delay, remaining)));
+            delay = Math.min(delay * 2, 1000);
+        }
+        return {
+            fresh: false,
+            observedSha256: observed,
+            attempts,
+            elapsedMs: Date.now() - start,
+            vantage: "gateway-us-east-1",
+        };
     }
     /**
      * Download a blob. Returns the raw `Response` so callers can stream to

package/sdk/dist/namespaces/blobs.js.map

@@ -1 +1 @@
-{"version":3,"file":"blobs.js","sourceRoot":"","sources":["../../src/namespaces/blobs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAWzD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,MAAM,GAAG,GAA2B;QAClC,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,YAAY;QACjB,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,eAAe;QACpB,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,UAAU;QACf,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,kBAAkB;QACxB,GAAG,EAAE,YAAY;QACjB,EAAE,EAAE,eAAe;QACnB,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,kBAAkB;QACvB,EAAE,EAAE,kBAAkB;KACvB,CAAC;IACF,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAiB;IACxC,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAgC,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AASD,MAAM,OAAO,KAAK;IACa;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,CACP,SAAiB,EACjB,GAAW,EACX,MAAqB,EACrB,OAAuB,EAAE;QAEzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAErE,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC;YAC5D,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,KAAK,GAAe,MAAM,CAAC,KAAK;YACpC,CAAC,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAQ,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;QAEnC,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,GAAG,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnE,oEAAoE;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAqB,qBAAqB,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,IAAI,EAAE;gBACJ,GAAG;gBACH,UAAU,EAAE,SAAS;gBACrB,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;gBACvC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK;gBAClC,MAAM;aACP;YACD,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CAAC;QAEH,yDAAyD;QACzD,MAAM,SAAS,GAA4B,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC/C,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,SAAqB;aAC5B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACpD,MAAM,IAAI,QAAQ,CAChB,QAAQ,IAAI,CAAC,WAAW,qBAAqB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAChI,MAAM,CAAC,MAAM,EACb,OAAO,EACP,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG;gBAChC,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,KAAK,WAAW;YAC5C,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE;YACnF,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,uBAAuB,IAAI,CAAC,SAAS,WAAW,EAChD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,mBAAmB;SAC7B,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,GAAW;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAEvE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,oBAAoB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YACvC,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;SACF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,IAAI,QAAQ,CAChB,iCAAiC,GAAG,CAAC,MAAM,GAAG,EAC9C,GAAG,CAAC,MAAM,EACV,OAAO,EACP,kBAAkB,CACnB,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,EAAE,CAAC,SAAiB,EAAE,OAAsB,EAAE;QAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAEpE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,oBAAoB,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAE5D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAe,IAAI,EAAE;YAC7C,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,SAAiB,EAAE,GAAW;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAEpE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,oBAAoB,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE;YACvE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;IACL,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,GAAW,EAAE,OAAwB,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAEvE,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAExE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,oBAAoB,SAAS,CAAC,GAAG,CAAC,OAAO,EACzC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,IAAI;YACJ,OAAO,EAAE,kBAAkB;SAC5B,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"blobs.js","sourceRoot":"","sources":["../../src/namespaces/blobs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAgBzD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,MAAM,GAAG,GAA2B;QAClC,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,YAAY;QACjB,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,eAAe;QACpB,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,UAAU;QACf,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,kBAAkB;QACxB,GAAG,EAAE,YAAY;QACjB,EAAE,EAAE,eAAe;QACnB,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,kBAAkB;QACvB,EAAE,EAAE,kBAAkB;KACvB,CAAC;IACF,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAiB;IACxC,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAgC,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAqCD,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,iDAAiD;IACjD,8DAA8D;IAC9D,MAAM,CAAC,GAAG,UAAuE,CAAC;IAClF,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,IAA4B,EAC5B,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;IACvC,MAAM,SAAS,GACb,IAAI,CAAC,UAAU,KAAK,SAAS;QAC3B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,MAAM,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,YAAY,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,wEAAwE;IACxE,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IAE3C,kEAAkE;IAClE,qEAAqE;IACrE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;IACjC,MAAM,GAAG,GAAoB;QAC3B,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,iBAAiB;QAC/C,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,IAAI;QAChD,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,IAAI,IAAI;QACxD,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS;QACnC,IAAI,EACF,SAAS,CAAC,IAAI;YACd,CAAC,SAAS;gBACR,CAAC,CAAC,6DAA6D;gBAC/D,CAAC,CAAC,qJAAqJ,CAAC;KAC7J,CAAC;IAEF,sEAAsE;IACtE,uEAAuE;IACvE,uDAAuD;IACvD,SAAS,gBAAgB,CAAC,IAAY;QACpC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,2EAA2E;gBAChF,2FAA2F,CAC9F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,GAAG;QACX,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,UAAU;QACrB,aAAa,EAAE,GAAG;QAClB,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,MAAM;QACN,aAAa;QACb,IAAI;QACJ,GAAG;QACH,aAAa;QACb,SAAS;QACT,GAAG;QAEH,SAAS,CAAC,IAAI;YACZ,+DAA+D;YAC/D,mEAAmE;YACnE,+DAA+D;YAC/D,+DAA+D;YAC/D,gEAAgE;YAChE,qDAAqD;YACrD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACnD,MAAM,KAAK,GAAa,CAAC,QAAQ,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzD,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC;YACxC,MAAM,UAAU,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,UAAU,CAAC;YAC9C,IAAI,UAAU;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBAC/B,IAAI,UAAU;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,cAAc,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,OAAO,WAAW,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;QAChD,CAAC;QAED,OAAO,CAAC,IAAI;YACV,4DAA4D;YAC5D,iEAAiE;YACjE,iEAAiE;YACjE,mEAAmE;YACnE,2DAA2D;YAC3D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,YAAY,CAAC;YACtC,MAAM,KAAK,GAAa,CAAC,QAAQ,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,SAAS,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,IAAI,EAAE,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YAC5D,KAAK,CAAC,IAAI,CAAC,cAAc,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,OAAO,SAAS,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACrC,CAAC;QAED,MAAM,CAAC,GAAG;YACR,4DAA4D;YAC5D,6DAA6D;YAC7D,gEAAgE;YAChE,gEAAgE;YAChE,6DAA6D;YAC7D,gEAAgE;YAChE,0DAA0D;YAC1D,+DAA+D;YAC/D,eAAe;YACf,MAAM,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;YACpB,OAAO,aAAa,cAAc,CAAC,GAAG,CAAC,UAAU,cAAc,CAAC,CAAC,CAAC,oCAAoC,CAAC;QACzG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,KAAK;IACa;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,CACP,SAAiB,EACjB,GAAW,EACX,MAAqB,EACrB,OAAuB,EAAE;QAEzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAErE,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC;YAC5D,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,KAAK,GAAe,MAAM,CAAC,KAAK;YACpC,CAAC,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAQ,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;QAEnC,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,GAAG,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9D,uEAAuE;QACvE,sEAAsE;QACtE,wEAAwE;QACxE,iEAAiE;QACjE,8DAA8D;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QACzC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9D,oEAAoE;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAqB,qBAAqB,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,IAAI,EAAE;gBACJ,GAAG;gBACH,UAAU,EAAE,SAAS;gBACrB,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;gBACvC,SAAS;gBACT,MAAM;aACP;YACD,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CAAC;QAEH,yDAAyD;QACzD,MAAM,SAAS,GAA4B,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC/C,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,SAAqB;aAC5B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACpD,MAAM,IAAI,QAAQ,CAChB,QAAQ,IAAI,CAAC,WAAW,qBAAqB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAChI,MAAM,CAAC,MAAM,EACb,OAAO,EACP,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG;gBAChC,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,KAAK,WAAW;YAC5C,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE;YACnF,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAC1C,uBAAuB,IAAI,CAAC,SAAS,WAAW,EAChD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,mBAAmB;SAC7B,CACF,CAAC;QAEF,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,kCAAkC;QAClC,OAAO,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,GAAW;QAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QAE1E,MAAM,IAAI,GAAG,kCAAkC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAuB,IAAI,EAAE;YACrD,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,SAAS,CACb,SAAiB,EACjB,IAA0B;QAE1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;QAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,KAAK,GAAG,GAAG,CAAC;QAChB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,SAAS,EAAE,CAAC;YACtC,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7D,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC;gBACnC,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACpD,OAAO;wBACL,KAAK,EAAE,IAAI;wBACX,cAAc,EAAE,QAAQ;wBACxB,QAAQ;wBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;wBAC7B,OAAO,EAAE,mBAAmB;qBAC7B,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;gBAChE,yDAAyD;YAC3D,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;YACnD,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAM;YAC1B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;YACpE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,QAAQ;YACxB,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,OAAO,EAAE,mBAAmB;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,GAAW;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAEvE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,oBAAoB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YACvC,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;SACF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,IAAI,QAAQ,CAChB,iCAAiC,GAAG,CAAC,MAAM,GAAG,EAC9C,GAAG,CAAC,MAAM,EACV,OAAO,EACP,kBAAkB,CACnB,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,EAAE,CAAC,SAAiB,EAAE,OAAsB,EAAE;QAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAEpE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,oBAAoB,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAE5D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAe,IAAI,EAAE;YAC7C,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,SAAiB,EAAE,GAAW;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAEpE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,oBAAoB,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE;YACvE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;IACL,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,GAAW,EAAE,OAAwB,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAEvE,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAExE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,oBAAoB,SAAS,CAAC,GAAG,CAAC,OAAO,EACzC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,IAAI;YACJ,OAAO,EAAE,kBAAkB;SAC5B,CACF,CAAC;IACJ,CAAC;CACF"}

package/sdk/dist/namespaces/blobs.types.d.ts

@@ -16,16 +16,240 @@ export interface BlobPutOptions {
     contentType?: string;
     /** Default: `"public"`. Public blobs get a CDN URL; private requires auth. */
     visibility?: BlobVisibility;
-    /** When true, the returned URL includes a content-hash suffix — overwrites produce distinct URLs. Forces sha256 computation. */
+    /**
+     * Default (v1.45+): `true`. Returns an `AssetRef` with `cdnUrl` populated
+     * and the `scriptTag()` / `linkTag()` / `imgTag()` emitters working —
+     * this is the agent-DX flow (paste-and-go HTML with SRI baked in).
+     *
+     * Cost: one SHA-256 pass over the bytes on the client side. For small
+     * assets (the typical case — images, JS, CSS, fonts, JSON < 1 MB) it's
+     * a few ms dominated by network. Pass `false` to skip the SHA pass for
+     * very large uploads where you specifically don't need a content-hashed
+     * URL or SRI.
+     *
+     * When `false`, the returned `AssetRef` has `cdnUrl: null`, `sri: null`,
+     * and the tag emitters throw with an "immutable: true required" hint.
+     */
     immutable?: boolean;
 }
-export interface BlobPutResult {
+/**
+ * Cache-kind hint for a blob URL. Mirrors the gateway's
+ * `X-Run402-Blob-Cache-Kind` response header. Agents key on this when
+ * deciding whether they need to wait for CDN freshness after an upload.
+ */
+export type BlobCacheKind = "immutable" | "mutable" | "private";
+/**
+ * CloudFront invalidation status for a mutable URL. Returned by the gateway's
+ * upload-completion response when an invalidation was triggered (e.g. a
+ * re-upload to an existing public mutable key). `ready: true` is the
+ * immutable-URL signal — no waiting needed.
+ */
+export interface BlobCdnEnvelope {
+    /** Blob CDN config version. Currently `"blob-gateway-v2"`. */
+    version: string;
+    /** CloudFront invalidation ID for the mutable URL, when one was triggered. */
+    invalidationId: string | null;
+    /** Status of the invalidation at the time of the upload response. */
+    invalidationStatus: "InProgress" | "Completed" | "Failed" | null;
+    /** `true` for immutable URLs (always ready); omitted/false for mutable. */
+    ready?: boolean;
+    /** Human-readable nudge ("Use immutableUrl or call wait_for_cdn_freshness."). */
+    hint: string | null;
+}
+/**
+ * Stable URL reference returned by `client.blobs.put`.
+ *
+ * **The recommended agent-DX fields are `cdnUrl` + the tag emitters
+ * (`scriptTag`, `linkTag`, `imgTag`).** These give you a paste-and-go HTML
+ * tag with content-addressed URL + SRI + `crossorigin` already wired. No
+ * decisions about mutable vs. immutable, no `wait_for_cdn_freshness` polls,
+ * no manual integrity attribute construction — the URL is bound to a SHA at
+ * upload time, served from `pr-<public_id>.run402.com` (the host that
+ * always works through the v1.33 CDN), and never invalidated.
+ *
+ * The other fields are present for compatibility / advanced use:
+ *   - `url` / `immutable_url` (snake_case): legacy v1.0+ fields. May be on
+ *     a claimed-subdomain or custom-domain host (which is "prettier" but
+ *     currently can NOT serve `/_blob/*` through the CDN — those subdomains'
+ *     KVS values lack a `project_id`. Fix tracked separately).
+ *   - `immutableUrl`: same value as `immutable_url`, camelCase.
+ *   - `cdnMutableUrl`: mutable form of the auto-subdomain URL — useful only
+ *     when you need a stable URL that always reflects the latest content.
+ *     Comes with eventual-consistency caveats (CloudFront invalidation is
+ *     async); prefer `cdnUrl` for generated code.
+ *   - `etag`, `sri`, `contentDigest`: integrity values derived from the
+ *     SHA-256.
+ *   - `cdn`: CloudFront invalidation envelope.
+ *
+ * Tag emitters require the SHA-256 (only computed when uploaded with
+ * `immutable: true`). On non-immutable uploads, calling them throws.
+ */
+export interface AssetRef {
     key: string;
     size_bytes: number;
     sha256: string | null;
     visibility: BlobVisibility;
     url: string | null;
     immutable_url: string | null;
+    /** Same value as `size_bytes`, camelCase form. */
+    size: number;
+    /** Hex SHA-256 of the bytes. Same as `sha256` (camelCase alias). */
+    contentSha256: string | null;
+    /** Effective Content-Type (auto-detected from the key extension when not
+     *  set explicitly via `BlobPutOptions.contentType`). */
+    contentType: string;
+    /** Same value as `immutable_url` (preferred-host form), camelCase. */
+    immutableUrl: string | null;
+    /** **The recommended URL for generated HTML/CSS/JS.** Content-addressed
+     *  (immutable), served from the auto-subdomain
+     *  (`pr-<public_id>.run402.com/_blob/<key-with-suffix>.<ext>`) which is
+     *  guaranteed to work through the v1.33 CDN path. Pair with `sri` for
+     *  Subresource Integrity. Null on non-immutable uploads (the SHA isn't
+     *  computed) and on private uploads. */
+    cdnUrl: string | null;
+    /** Mutable form of the auto-subdomain URL. Use only when a stable URL
+     *  must always reflect the latest content (eventual consistency on
+     *  re-upload). Prefer `cdnUrl` for generated code. */
+    cdnMutableUrl: string | null;
+    /** Strong ETag of the form `"sha256-<hex>"`. Null when `sha256` is null. */
+    etag: string | null;
+    /** Browser SRI form: `sha256-<base64>`. Use as the `integrity` attribute
+     *  value in `<script>`/`<link>` tags. */
+    sri: string | null;
+    /** RFC 9530 `Content-Digest` value, `sha-256=:<base64>:`. */
+    contentDigest: string | null;
+    /** Semantic cache-kind hint matching the gateway's response header. */
+    cacheKind: BlobCacheKind;
+    /** CloudFront invalidation envelope. For immutable uploads `cdn.ready ===
+     *  true` and no further action is needed. */
+    cdn: BlobCdnEnvelope;
+    /**
+     * Returns a ready-to-paste `<script>` tag with the content-addressed
+     * URL + Subresource Integrity + `crossorigin`. The browser will refuse
+     * to execute the script if the bytes don't match the SHA.
+     *
+     * **Defaults:** `defer: true`. Modern best practice — non-render-
+     * blocking when placed in `<head>` and a no-op at end of `<body>`.
+     * Pass `{ defer: false }` for the rare case requiring sync execution.
+     * `async: true` overrides defer (the two are mutually exclusive).
+     *
+     * @example
+     *   const asset = await client.blobs.put(p, "app.js", { content });
+     *   html += asset.scriptTag();
+     *   // → <script src="https://pr-abc.run402.com/_blob/app-3a7fc02e.js" defer integrity="sha256-…" crossorigin></script>
+     *
+     *   asset.scriptTag({ type: "module" });
+     *   // → <script src="…" type="module" defer integrity="…" crossorigin></script>
+     */
+    scriptTag(opts?: {
+        type?: "module" | "text/javascript";
+        defer?: boolean;
+        async?: boolean;
+    }): string;
+    /**
+     * Returns a ready-to-paste `<link>` tag (default `rel="stylesheet"`)
+     * with content-addressed URL + SRI + `crossorigin`. `crossorigin` is
+     * always emitted — required for SRI to actually be enforced (also
+     * required for rel="preload" to dedupe with the matching fetch).
+     *
+     * @example
+     *   asset.linkTag();                            // stylesheet
+     *   asset.linkTag({ rel: "preload", as: "font" });
+     *   asset.linkTag({ rel: "modulepreload" });
+     */
+    linkTag(opts?: {
+        rel?: string;
+        as?: string;
+    }): string;
+    /**
+     * Returns a ready-to-paste `<img>` tag with the content-addressed URL.
+     *
+     * **Defaults:** `loading="lazy"` + `decoding="async"`. Modern best
+     * practice — lazy loads below-fold images on demand, async decoding
+     * moves the decode off the main thread. Both are baseline-supported
+     * in all major browsers. Agents who specifically need an above-fold
+     * eager image can wrap the result and override.
+     *
+     * Browsers don't support SRI on `<img>`, so no `integrity` attribute
+     * is emitted. The URL is content-hashed so it's still stable across
+     * re-deploys; for byte-level verification, read `Content-Digest`
+     * server-side.
+     *
+     * `alt` is the image's accessibility text (default `""` for decorative
+     * images). Pass a description when the image conveys information.
+     *
+     * @example
+     *   asset.imgTag("Company logo")
+     *   // → <img src="https://pr-abc.run402.com/_blob/logo-a1b2c3d4.png" alt="Company logo" loading="lazy" decoding="async">
+     */
+    imgTag(alt?: string): string;
+}
+/**
+ * Return type of `client.blobs.put`. v1.45 widens this to AssetRef; the
+ * legacy fields stay for back-compat.
+ */
+export type BlobPutResult = AssetRef;
+/** Response envelope from `client.blobs.diagnoseUrl(...)`. */
+export interface BlobDiagnoseEnvelope {
+    projectId: string;
+    key: string;
+    /** SHA the gateway DB believes is current for `(projectId, key)`. */
+    expectedSha256: string | null;
+    /** SHA actually returned by the probe (`X-Run402-Content-Sha256` header). */
+    observedSha256: string | null;
+    /** Probe vantage. The agent is told the probe is single-region. */
+    vantage: "gateway-us-east-1";
+    /** Probe method — `"GET_RANGE_0_0"` (NOT HEAD; HEAD can hit a different
+     *  cached variant). */
+    probeMethod: "GET_RANGE_0_0";
+    /** Accept-Encoding used by the probe. */
+    acceptEncoding: string;
+    /** ISO timestamp of the probe. */
+    observedAt: string;
+    /** Always `true` — the probe itself populates the cache, so subsequent
+     *  reads may differ. Agents are told this explicitly. */
+    probeMayHaveWarmedCache: true;
+    /** The URL the probe actually fetched (after URL normalization). */
+    canonicalUrl: string;
+    /** Which URL kind we resolved against (`'blob-immutable'` or
+     *  `'blob-mutable'`). `/_cas/<sha>` is deferred from this change. */
+    pathKind: "blob-mutable" | "blob-immutable";
+    cache: {
+        xCache: string | null;
+        ageSeconds: number | null;
+        cacheKind: BlobCacheKind | null;
+    };
+    invalidation: {
+        id: string | null;
+        status: "InProgress" | "Completed" | "Failed" | null;
+    };
+    /** Human-readable hint with actionable next-steps for the agent. */
+    hint: string;
+}
+/**
+ * Options for `client.blobs.waitFresh(projectId, opts)`. The URL is the
+ * mutable public URL you want to wait on (typically `result.url` from a
+ * preceding `blobs.put` call).
+ *
+ * **Mutable URLs only.** For immutable URLs (`immutableUrl`) no waiting is
+ * needed — they are bound to a SHA at upload time and were never previously
+ * cached.
+ */
+export interface BlobWaitFreshOptions {
+    /** The mutable URL to poll (e.g. `https://app.run402.com/_blob/avatar.png`). */
+    url: string;
+    /** Expected hex SHA-256. Polling exits when `observedSha256 === sha256`. */
+    sha256: string;
+    /** Default 60_000 ms. */
+    timeoutMs?: number;
+}
+/** Result of `client.blobs.waitFresh(...)`. */
+export interface BlobWaitFreshResult {
+    fresh: boolean;
+    observedSha256: string | null;
+    attempts: number;
+    elapsedMs: number;
+    vantage: "gateway-us-east-1";
 }
 export interface BlobLsOptions {
     /** Filter: only return blobs whose key starts with this prefix. */

package/sdk/dist/namespaces/blobs.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blobs.types.d.ts","sourceRoot":"","sources":["../../src/namespaces/blobs.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElD,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,gIAAgI;IAChI,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,cAAc,CAAC;IAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"blobs.types.d.ts","sourceRoot":"","sources":["../../src/namespaces/blobs.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElD,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qEAAqE;IACrE,kBAAkB,EAAE,YAAY,GAAG,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC;IACjE,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,QAAQ;IAEvB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,cAAc,CAAC;IAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;4DACwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;4CAKwC;IACxC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;0DAEsD;IACtD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;6CACyC;IACzC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,6DAA6D;IAC7D,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,uEAAuE;IACvE,SAAS,EAAE,aAAa,CAAC;IACzB;iDAC6C;IAC7C,GAAG,EAAE,eAAe,CAAC;IAQrB;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,iBAAiB,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC;IAEpG;;;;;;;;;;OAUG;IACH,OAAO,CAAC,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IAEtD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC;AAErC,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,6EAA6E;IAC7E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mEAAmE;IACnE,OAAO,EAAE,mBAAmB,CAAC;IAC7B;2BACuB;IACvB,WAAW,EAAE,eAAe,CAAC;IAC7B,yCAAyC;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB;6DACyD;IACzD,uBAAuB,EAAE,IAAI,CAAC;IAC9B,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB;yEACqE;IACrE,QAAQ,EAAE,cAAc,GAAG,gBAAgB,CAAC;IAC5C,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC;KACjC,CAAC;IACF,YAAY,EAAE;QACZ,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAClB,MAAM,EAAE,YAAY,GAAG,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC;KACtD,CAAC;IACF,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/lib/storage.mjs

@@ -1,125 +0,0 @@
-import { readFileSync } from "fs";
-import { findProject, API } from "./config.mjs";
-
-const HELP = `run402 storage — Manage project file storage
-
-Usage:
-  run402 storage <subcommand> [args...]
-
-Subcommands:
-  upload   <id> <bucket> <path> [--file <local>] [--content-type <mime>]
-                                       Upload a file to storage
-  download <id> <bucket> <path>        Download a file from storage
-  delete   <id> <bucket> <path>        Delete a file from storage
-  list     <id> <bucket>               List files in a bucket
-
-Examples:
-  run402 storage upload abc123 assets logo.png --file ./logo.png --content-type image/png
-  echo "hello" | run402 storage upload abc123 data notes.txt
-  run402 storage download abc123 assets logo.png
-  run402 storage list abc123 assets
-  run402 storage delete abc123 assets logo.png
-
-Notes:
-  - <id> is the project_id from 'run402 projects list'
-  - Upload reads from --file or stdin if no --file is given
-`;
-
-const SUB_HELP = {
-  upload: `run402 storage upload — Upload a file to a project's storage bucket
-
-Usage:
-  run402 storage upload <id> <bucket> <path> [--file <local>] [--content-type <mime>]
-  echo "..." | run402 storage upload <id> <bucket> <path> [--content-type <mime>]
-
-Arguments:
-  <id>                Project ID (from 'run402 projects list')
-  <bucket>            Target bucket name
-  <path>              Destination path within the bucket
-
-Options:
-  --file <local>      Local file to upload; if omitted, content is read from stdin
-  --content-type <mime>  MIME type of the upload (default: text/plain)
-
-Examples:
-  run402 storage upload abc123 assets logo.png --file ./logo.png \\
-    --content-type image/png
-  echo "hello" | run402 storage upload abc123 data notes.txt
-`,
-};
-
-async function readStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf-8");
-}
-
-async function upload(projectId, bucket, path, args) {
-  const p = findProject(projectId);
-  const opts = { file: null, contentType: "text/plain" };
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--file" && args[i + 1]) opts.file = args[++i];
-    if (args[i] === "--content-type" && args[i + 1]) opts.contentType = args[++i];
-  }
-  const content = opts.file ? readFileSync(opts.file, "utf-8") : await readStdin();
-  const res = await fetch(`${API}/storage/v1/object/${bucket}/${path}`, {
-    method: "POST",
-    headers: { "Content-Type": opts.contentType, "apikey": p.anon_key, "Authorization": `Bearer ${p.anon_key}` },
-    body: content,
-  });
-  const data = await res.json();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-  console.log(JSON.stringify(data, null, 2));
-}
-
-async function download(projectId, bucket, path) {
-  const p = findProject(projectId);
-  const res = await fetch(`${API}/storage/v1/object/${bucket}/${path}`, {
-    headers: { "apikey": p.anon_key, "Authorization": `Bearer ${p.anon_key}` },
-  });
-  if (!res.ok) {
-    const data = await res.json().catch(() => ({}));
-    console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1);
-  }
-  const text = await res.text();
-  process.stdout.write(text);
-}
-
-async function deleteFile(projectId, bucket, path) {
-  const p = findProject(projectId);
-  const res = await fetch(`${API}/storage/v1/object/${bucket}/${path}`, {
-    method: "DELETE",
-    headers: { "apikey": p.anon_key, "Authorization": `Bearer ${p.anon_key}` },
-  });
-  if (res.status === 204 || res.ok) {
-    console.log(JSON.stringify({ status: "ok", message: `File '${bucket}/${path}' deleted.` }));
-  } else {
-    const data = await res.json().catch(() => ({}));
-    console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1);
-  }
-}
-
-async function list(projectId, bucket) {
-  const p = findProject(projectId);
-  const res = await fetch(`${API}/storage/v1/object/list/${bucket}`, {
-    headers: { "apikey": p.anon_key, "Authorization": `Bearer ${p.anon_key}` },
-  });
-  const data = await res.json();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-  console.log(JSON.stringify(data, null, 2));
-}
-
-export async function run(sub, args) {
-  if (!sub || sub === '--help' || sub === '-h') { console.log(HELP); process.exit(0); }
-  if (Array.isArray(args) && (args.includes("--help") || args.includes("-h"))) { console.log(SUB_HELP[sub] || HELP); process.exit(0); }
-  switch (sub) {
-    case "upload":   await upload(args[0], args[1], args[2], args.slice(3)); break;
-    case "download": await download(args[0], args[1], args[2]); break;
-    case "delete":   await deleteFile(args[0], args[1], args[2]); break;
-    case "list":     await list(args[0], args[1]); break;
-    default:
-      console.error(`Unknown subcommand: ${sub}\n`);
-      console.log(HELP);
-      process.exit(1);
-  }
-}