@lambdacurry/arbor 0.24.9 → 0.24.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +4 -3
  2. package/dist/arbor.js +15658 -15534
  3. package/package.json +1 -1
package/README.md CHANGED
@@ -82,7 +82,7 @@ arbor attachment get --attachment-id att_…
82
82
  arbor attachment list --thread-id thr_…
83
83
  ```
84
84
 
85
- Requires **Node**: js-exec coerces binary fetch bodies to strings, so upload fails early
85
+ Requires **Node or Bun**: js-exec coerces binary fetch bodies to strings, so upload fails early
86
86
  there with a Node requirement; metadata/get/list/upload-url/attach commands remain portable.
87
87
  The CLI computes SHA-256, requests a five-minute `upload_url`, and PUTs the file directly
88
88
  to R2 with the exact signed headers and no Arbor Authorization header, then calls `attach` with its token.
@@ -95,8 +95,9 @@ larger JSON receives UTF-8/control-byte checks only, so validate its syntax loca
95
95
 
96
96
  The receipt contains uploader/time, SHA-256, `attachmentId`, `attachmentIds`, and
97
97
  `attachments[].markdown`. Bind the ids and place the Markdown in `contribute`/`respond`.
98
- `mediaUrl` and `downloadUrl` require an Arbor credential (401 otherwise); read URLs are
99
- private, never signed/public. `attachment get` (aliases `attachment_get`, `get_attachment`)
98
+ `mediaUrl` and `downloadUrl` require an Arbor credential (401 otherwise).
99
+ MCP image delivery is links-only for viewing/downloading; a link may not give the model pixels in every client. CLI arbor attachment download defaults to authenticated GET; --signed uses a 5-minute, single-Attachment signedRead link. Never paste signedRead links into permanent posts; use permanent markdown.
100
+ Downloads refuse existing files unless `--force` is explicit. `attachment get` (aliases `attachment_get`, `get_attachment`)
100
101
  and `attachment list` (`attachment_list`, `list_attachments`) recover receipts; the latter
101
102
  pages with `--cursor`. Finalized receipts replay with the same authentic token even after expiry.
102
103
  Duplicate SHA-256 warnings on the same Thread are best-effort; concurrent uploads may not warn.