Store files in your Nukez locker. ALWAYS BATCH: pass ALL the files you want to upload in a SINGLE call, as a list under `files`. Do NOT loop over your file list and call nukez_store once per file — that triggers one on-chain attestation per file (slow + costs SOL fees per push). One nukez_store call with N files triggers exactly ONE attestation for the whole batch. Each list item: {name, <data_source>, content_type?, expected_size_bytes?, expected_sha256?, large?}. UPLOAD PATH PRIORITY: 1. source_url — if the file is available at a public HTTPS URL, pass it and the server fetches directly (fastest, zero token cost). 2. sandbox_path — if you have compute/bash access and the file is on disk, pass the absolute path. 3. local_path — if the file exists on local disk (desktop/CLI environments). 4. data_b64 — LAST RESORT for small content only (<4KB). Sends bytes through your context window. Accepts both base64-encoded binary and plain UTF-8 text. 5. nukez_upload_chunk — if sandbox_path curl failed (HTTP 000 / network blocked), upload in 4KB chunks with sha256 verification. Run the prep script from the response, then call nukez_upload_chunk for each chunk. NEVER base64-encode files >4KB in one call. Upload path is auto-selected based on size and runtime environment. HARD SIZE LIMITS per path: the sandbox curl proxies through the gateway and is capped at 32 MiB (the platform rejects larger request bodies); the chunked ingest pipeline caps at 20 MiB per file. LARGE FILES (>= 32 MiB, any size up to terabytes): pass expected_size_bytes (and ideally the file's expected_sha256) with sandbox_path, or set large=true — the response then returns a resumable direct-to-provider upload session (action_required='execute_upload') with a session-open command and a stdlib-only transfer script that uploads in 8 MiB chunks and resumes after interruptions. Bytes go straight to the storage provider, so the sandbox needs outbound access to the session URI's host. After the transfer, confirm with nukez_confirm(use_job=true). KEYLESS (hosted) SERVER: this server holds no signing key. A call without `envelope` returns action_required='sign_envelopes' with the exact spec to sign (method, path, ops, body); sign it with your wallet and re-call with envelope=<signed result>. One file per call in envelope mode.
