run402 1.57.1 → 1.57.2

package/README.md

@@ -97,11 +97,13 @@ CI deploys can ship `site`, `functions`, and `database` changes. Keep secrets, d
 
 ```bash
 run402 blob put ./logo.png        # → AssetRef with cdn_url, sri, etag
+run402 blob put ./asset --key assets/logo --content-type image/svg+xml
 run402 blob get <key> --output /tmp/logo.png
 run402 blob diagnose <url>        # exit 0 if fresh, 1 if stale
 ```
 
 The returned `cdn_url` is content-addressed (`pr-<public_id>.run402.com/_blob/<key>-<8hex>.<ext>`) — paste it straight into HTML. SRI is bundled in `sri`.
+`blob put` infers MIME type from the destination key; use `--content-type <mime>` when the key has no useful extension or needs an explicit override.
 
 ### Functions
 

package/lib/blob.mjs

@@ -2,7 +2,7 @@
  * run402 blob — direct-to-S3 storage CLI.
  *
  * Usage:
- *   run402 blob put <file> [files...] [--project <id>] [--key <dest>] [--private] [--immutable] [--concurrency N] [--no-resume]
+ *   run402 blob put <file> [files...] [--project <id>] [--key <dest>] [--content-type <mime>] [--private] [--immutable] [--concurrency N] [--no-resume]
  *   run402 blob get <key> --output <file> [--project <id>]
  *   run402 blob ls [--project <id>] [--prefix <p>] [--limit <n>]
  *   run402 blob rm <key> [--project <id>]
@@ -52,6 +52,7 @@ Usage:
 Options:
   --project <id>      Project ID (defaults to active project from 'run402 projects use')
   --key <dest>        Destination key (put only; defaults to file basename)
+  --content-type <mime>  MIME override for blob put (defaults to extension inference)
   --private           Upload as private (not served by CDN; apikey required to read)
   --immutable         Adds a content-hash suffix to the URL so overwrites produce distinct URLs.
                       Requires computing SHA-256 over the file (CLI does this automatically).
@@ -84,6 +85,7 @@ Arguments:
 Options:
   --project <id>      Project ID (defaults to active project from 'run402 projects use')
   --key <dest>        Destination key; defaults to file basename. Use trailing '/' as prefix.
+  --content-type <mime>  MIME override; defaults to inferring from the destination key extension
   --private           Upload as private (not served by CDN; apikey required to read)
   --immutable         Append content-hash suffix so overwrites produce distinct URLs
   --concurrency N     Concurrent part PUTs for multipart uploads (default 4)
@@ -93,6 +95,7 @@ Options:
 Examples:
   run402 blob put ./artifact.tgz --project prj_abc123
   run402 blob put ./dist/**/*.png --project prj_abc123 --key assets/
+  run402 blob put ./asset --project prj_abc123 --key assets/logo --content-type image/svg+xml
   run402 blob put huge.bin --project prj_abc123 --immutable --concurrency 8
 `,
   get: `run402 blob get — Download a blob by key
@@ -202,10 +205,11 @@ function dieApiFailure(prefix, http, body) {
 
 function parseArgs(rawArgs) {
   const args = normalizeArgv(rawArgs);
-  const valueFlags = ["--project", "--key", "--concurrency", "--prefix", "--limit", "--output", "-o", "--ttl"];
+  const valueFlags = ["--project", "--key", "--content-type", "--concurrency", "--prefix", "--limit", "--output", "-o", "--ttl"];
   assertKnownFlags(args, [
     "--project",
     "--key",
+    "--content-type",
     "--private",
     "--immutable",
     "--concurrency",
@@ -221,11 +225,12 @@ function parseArgs(rawArgs) {
   ], valueFlags);
   const out = { positional: [], project: null, key: null, private: false, immutable: false,
                  concurrency: 4, resume: true, json: false, prefix: null, limit: null,
-                 output: null, ttl: null };
+                 output: null, ttl: null, contentType: null };
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
     if (a === "--project") out.project = args[++i];
     else if (a === "--key") out.key = args[++i];
+    else if (a === "--content-type") out.contentType = parseContentTypeFlag("--content-type", args[++i]);
     else if (a === "--private") out.private = true;
     else if (a === "--immutable") out.immutable = true;
     else if (a === "--concurrency") out.concurrency = parseIntegerFlag("--concurrency", args[++i], { min: 1 });
@@ -240,6 +245,26 @@ function parseArgs(rawArgs) {
   return out;
 }
 
+function parseContentTypeFlag(name, value) {
+  if (value === undefined || value === null) {
+    fail({
+      code: "BAD_FLAG",
+      message: `${name} requires a MIME type value`,
+      details: { flag: name },
+    });
+  }
+  const raw = String(value).trim();
+  const base = raw.split(";", 1)[0].trim();
+  if (!/^[^\s/]+\/[^\s/]+$/.test(base)) {
+    fail({
+      code: "BAD_FLAG",
+      message: `${name} must be a non-empty type/subtype MIME value, got: ${String(value)}`,
+      details: { flag: name, value: String(value) },
+    });
+  }
+  return raw;
+}
+
 async function sha256File(filePath) {
   const h = createHash("sha256");
   const stream = createReadStream(filePath);
@@ -311,7 +336,7 @@ async function putOne(project, filePath, opts) {
     const init = await apiFetch(`${API}/storage/v1/uploads`, "POST", project, {
       key: destKey,
       size_bytes: size,
-      content_type: guessContentType(destKey),
+      content_type: opts.contentType ?? guessContentType(destKey),
       visibility: opts.private ? "private" : "public",
       immutable: opts.immutable,
       sha256,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "1.57.1",
+  "version": "1.57.2",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {

package/core-dist/wallet-auth.js

@@ -1,62 +0,0 @@
-/**
- * Wallet auth helper — generates EIP-191 signature headers for Run402 API.
- * Uses @noble/curves (lighter than viem) for signing.
- */
-import { secp256k1 } from "@noble/curves/secp256k1.js";
-import { keccak_256 } from "@noble/hashes/sha3.js";
-import { bytesToHex } from "@noble/hashes/utils.js";
-import { readWallet } from "./wallet.js";
-/**
- * EIP-191 personal_sign: sign a message with the wallet's private key.
- */
-function personalSign(privateKeyHex, address, message) {
-    const msgBytes = new TextEncoder().encode(message);
-    const prefix = new TextEncoder().encode(`\x19Ethereum Signed Message:\n${msgBytes.length}`);
-    const prefixed = new Uint8Array(prefix.length + msgBytes.length);
-    prefixed.set(prefix);
-    prefixed.set(msgBytes, prefix.length);
-    const hash = keccak_256(prefixed);
-    const pkHex = privateKeyHex.startsWith("0x")
-        ? privateKeyHex.slice(2)
-        : privateKeyHex;
-    const pkBytes = Uint8Array.from(Buffer.from(pkHex, "hex"));
-    const rawSig = secp256k1.sign(hash, pkBytes);
-    const sig = secp256k1.Signature.fromBytes(rawSig);
-    // Determine recovery bit by trying both and matching the address
-    let recovery = 0;
-    for (const v of [0, 1]) {
-        try {
-            const recovered = sig.addRecoveryBit(v).recoverPublicKey(hash);
-            const pubBytes = recovered.toBytes(false).slice(1); // uncompressed, drop 04 prefix
-            const addrBytes = keccak_256(pubBytes).slice(-20);
-            if ("0x" + bytesToHex(addrBytes) === address.toLowerCase()) {
-                recovery = v;
-                break;
-            }
-        }
-        catch {
-            continue;
-        }
-    }
-    const r = sig.r.toString(16).padStart(64, "0");
-    const s = sig.s.toString(16).padStart(64, "0");
-    const vHex = (recovery + 27).toString(16).padStart(2, "0");
-    return "0x" + r + s + vHex;
-}
-/**
- * Get wallet auth headers for the Run402 API.
- * Returns null if no wallet is configured.
- */
-export function getWalletAuthHeaders(walletPath) {
-    const wallet = readWallet(walletPath);
-    if (!wallet || !wallet.address || !wallet.privateKey)
-        return null;
-    const timestamp = Math.floor(Date.now() / 1000).toString();
-    const signature = personalSign(wallet.privateKey, wallet.address, `run402:${timestamp}`);
-    return {
-        "X-Run402-Wallet": wallet.address,
-        "X-Run402-Signature": signature,
-        "X-Run402-Timestamp": timestamp,
-    };
-}
-//# sourceMappingURL=wallet-auth.js.map

package/core-dist/wallet.js

@@ -1,25 +0,0 @@
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, renameSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { randomBytes } from "node:crypto";
-import { getWalletPath } from "./config.js";
-export function readWallet(path) {
-    const p = path ?? getWalletPath();
-    if (!existsSync(p))
-        return null;
-    try {
-        return JSON.parse(readFileSync(p, "utf-8"));
-    }
-    catch {
-        return null;
-    }
-}
-export function saveWallet(data, path) {
-    const p = path ?? getWalletPath();
-    const dir = dirname(p);
-    mkdirSync(dir, { recursive: true });
-    const tmp = join(dir, `.wallet.${randomBytes(4).toString("hex")}.tmp`);
-    writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
-    renameSync(tmp, p);
-    chmodSync(p, 0o600);
-}
-//# sourceMappingURL=wallet.js.map

package/sdk/core-dist/wallet-auth.js

@@ -1,62 +0,0 @@
-/**
- * Wallet auth helper — generates EIP-191 signature headers for Run402 API.
- * Uses @noble/curves (lighter than viem) for signing.
- */
-import { secp256k1 } from "@noble/curves/secp256k1.js";
-import { keccak_256 } from "@noble/hashes/sha3.js";
-import { bytesToHex } from "@noble/hashes/utils.js";
-import { readWallet } from "./wallet.js";
-/**
- * EIP-191 personal_sign: sign a message with the wallet's private key.
- */
-function personalSign(privateKeyHex, address, message) {
-    const msgBytes = new TextEncoder().encode(message);
-    const prefix = new TextEncoder().encode(`\x19Ethereum Signed Message:\n${msgBytes.length}`);
-    const prefixed = new Uint8Array(prefix.length + msgBytes.length);
-    prefixed.set(prefix);
-    prefixed.set(msgBytes, prefix.length);
-    const hash = keccak_256(prefixed);
-    const pkHex = privateKeyHex.startsWith("0x")
-        ? privateKeyHex.slice(2)
-        : privateKeyHex;
-    const pkBytes = Uint8Array.from(Buffer.from(pkHex, "hex"));
-    const rawSig = secp256k1.sign(hash, pkBytes);
-    const sig = secp256k1.Signature.fromBytes(rawSig);
-    // Determine recovery bit by trying both and matching the address
-    let recovery = 0;
-    for (const v of [0, 1]) {
-        try {
-            const recovered = sig.addRecoveryBit(v).recoverPublicKey(hash);
-            const pubBytes = recovered.toBytes(false).slice(1); // uncompressed, drop 04 prefix
-            const addrBytes = keccak_256(pubBytes).slice(-20);
-            if ("0x" + bytesToHex(addrBytes) === address.toLowerCase()) {
-                recovery = v;
-                break;
-            }
-        }
-        catch {
-            continue;
-        }
-    }
-    const r = sig.r.toString(16).padStart(64, "0");
-    const s = sig.s.toString(16).padStart(64, "0");
-    const vHex = (recovery + 27).toString(16).padStart(2, "0");
-    return "0x" + r + s + vHex;
-}
-/**
- * Get wallet auth headers for the Run402 API.
- * Returns null if no wallet is configured.
- */
-export function getWalletAuthHeaders(walletPath) {
-    const wallet = readWallet(walletPath);
-    if (!wallet || !wallet.address || !wallet.privateKey)
-        return null;
-    const timestamp = Math.floor(Date.now() / 1000).toString();
-    const signature = personalSign(wallet.privateKey, wallet.address, `run402:${timestamp}`);
-    return {
-        "X-Run402-Wallet": wallet.address,
-        "X-Run402-Signature": signature,
-        "X-Run402-Timestamp": timestamp,
-    };
-}
-//# sourceMappingURL=wallet-auth.js.map

package/sdk/core-dist/wallet.js

@@ -1,25 +0,0 @@
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, renameSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { randomBytes } from "node:crypto";
-import { getWalletPath } from "./config.js";
-export function readWallet(path) {
-    const p = path ?? getWalletPath();
-    if (!existsSync(p))
-        return null;
-    try {
-        return JSON.parse(readFileSync(p, "utf-8"));
-    }
-    catch {
-        return null;
-    }
-}
-export function saveWallet(data, path) {
-    const p = path ?? getWalletPath();
-    const dir = dirname(p);
-    mkdirSync(dir, { recursive: true });
-    const tmp = join(dir, `.wallet.${randomBytes(4).toString("hex")}.tmp`);
-    writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
-    renameSync(tmp, p);
-    chmodSync(p, 0o600);
-}
-//# sourceMappingURL=wallet.js.map