v4.135.0

Private assets come from a CDN

• SDK r.assets.sign / r.assets.signMany and CLI run402 assets sign return CDN links. A private blob's signed URL is now a CloudFront link signed for one object (it was an S3 presigned GET). Any web page can read it (Access-Control-Allow-Origin: *, so WebGL and canvas can use a private photo), it answers Range with 206, and viewers of the same blob share the edge cache. Calls, options and result shapes are unchanged; BlobSignResult.signed_url documents the link. An original over 50 GB is still signed as an S3 presigned GET.
• r.assets.rm / run402 assets rm report the revocation of signed URLs. Deleting or overwriting a blob revokes its outstanding signed URLs within a minute; BlobRmResult gains signed_url_revocation ({ status: "submitted" | "queued" }, or null when none was outstanding).
• Docs: the SDK reference, the CLI assets and functions references, and run402 assets sign --help describe the CDN link.