@lunora/cli 1.0.0-alpha.320 → 1.0.0-alpha.321
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@lunora/cli",
|
|
3
|
-
"version": "1.0.0-alpha.
|
|
3
|
+
"version": "1.0.0-alpha.321",
|
|
4
4
|
"description": "The Lunora CLI: init, dev, deploy, codegen, migrate, seed, doctor, insights, logs, registry, and the rest of the project commands",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"agent-skills",
|
|
@@ -52,16 +52,16 @@
|
|
|
52
52
|
},
|
|
53
53
|
"dependencies": {
|
|
54
54
|
"@bomb.sh/tab": "0.0.22",
|
|
55
|
-
"@lunora/advisor": "1.0.0-alpha.
|
|
56
|
-
"@lunora/bindings": "1.0.0-alpha.
|
|
57
|
-
"@lunora/codegen": "1.0.0-alpha.
|
|
58
|
-
"@lunora/config": "1.0.0-alpha.
|
|
55
|
+
"@lunora/advisor": "1.0.0-alpha.169",
|
|
56
|
+
"@lunora/bindings": "1.0.0-alpha.82",
|
|
57
|
+
"@lunora/codegen": "1.0.0-alpha.235",
|
|
58
|
+
"@lunora/config": "1.0.0-alpha.279",
|
|
59
59
|
"@lunora/container": "1.0.0-alpha.63",
|
|
60
|
-
"@lunora/d1": "1.0.0-alpha.
|
|
60
|
+
"@lunora/d1": "1.0.0-alpha.149",
|
|
61
61
|
"@lunora/errors": "1.0.0-alpha.47",
|
|
62
|
-
"@lunora/mcp": "1.0.0-alpha.
|
|
63
|
-
"@lunora/runtime": "1.0.0-alpha.
|
|
64
|
-
"@lunora/seed": "1.0.0-alpha.
|
|
62
|
+
"@lunora/mcp": "1.0.0-alpha.195",
|
|
63
|
+
"@lunora/runtime": "1.0.0-alpha.161",
|
|
64
|
+
"@lunora/seed": "1.0.0-alpha.167",
|
|
65
65
|
"@visulima/cerebro": "3.1.1",
|
|
66
66
|
"@visulima/error": "6.1.0",
|
|
67
67
|
"@visulima/fs": "6.0.7",
|
|
@@ -11,7 +11,9 @@ and exposes idiomatic Lunora functions for browser uploads, gated downloads,
|
|
|
11
11
|
delete, and list — with no bucket credential in the client.
|
|
12
12
|
|
|
13
13
|
A worker-signed URL points at **your Worker**, not at R2:
|
|
14
|
-
|
|
14
|
+
`<base>/<key>?exp&method&bucket&sig`, where the base is the origin the request
|
|
15
|
+
reached your Worker on (`ctx.origin`) unless `STORAGE_PUBLIC_BASE_URL` overrides
|
|
16
|
+
it. The `/storage/*` route
|
|
15
17
|
you add in step 4 is what verifies the signature and moves the bytes, for both
|
|
16
18
|
the upload and the download. (The no-Worker-in-the-path variant is
|
|
17
19
|
`@lunora/storage`'s S3 presigned URL, `getPresignedUrl` — it needs S3 credentials
|
|
@@ -51,21 +53,21 @@ This:
|
|
|
51
53
|
2. Adds an R2 bucket binding to `wrangler.jsonc` (`r2_buckets`, binding
|
|
52
54
|
**`UPLOADS`**, `bucket_name: "replace-me-uploads"` — rename it to a real
|
|
53
55
|
bucket). It **merges** into any existing `r2_buckets`.
|
|
54
|
-
3. Scaffolds `STORAGE_SIGNING_SECRET` (a secret) and
|
|
55
|
-
into `.dev.vars`.
|
|
56
|
+
3. Scaffolds `STORAGE_SIGNING_SECRET` (a secret) and an empty, optional
|
|
57
|
+
`STORAGE_PUBLIC_BASE_URL` into `.dev.vars`.
|
|
56
58
|
4. Copies `lunora/storage/index.ts` (the `generateUploadUrl` /
|
|
57
59
|
`getDownloadUrl` / `deleteObject` / `listObjects` functions) into your
|
|
58
60
|
project — it is **yours** to edit.
|
|
59
61
|
|
|
60
62
|
## Step 2: Configure the binding + secrets
|
|
61
63
|
|
|
62
|
-
| Name | Where
|
|
63
|
-
| ------------------------- |
|
|
64
|
-
| `UPLOADS` | `wrangler.jsonc` → `r2_buckets[]`
|
|
65
|
-
| `STORAGE_SIGNING_SECRET` | secret (`.dev.vars` / `secret put`)
|
|
66
|
-
| `STORAGE_PUBLIC_BASE_URL` | var (`.dev.vars` /
|
|
64
|
+
| Name | Where | Notes |
|
|
65
|
+
| ------------------------- | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
66
|
+
| `UPLOADS` | `wrangler.jsonc` → `r2_buckets[]` | The R2 bucket binding. Point `bucket_name` at a real bucket. |
|
|
67
|
+
| `STORAGE_SIGNING_SECRET` | secret (`.dev.vars` / `secret put`) | HMAC secret for signed URLs. Min 32 chars, enforced — a shorter one throws on the first call. Never share across tenants. |
|
|
68
|
+
| `STORAGE_PUBLIC_BASE_URL` | optional var (`.dev.vars` / Worker variable) | Leave it **empty** and URLs are signed against the origin the request reached your Worker on (`ctx.origin`), right in dev, previews and production alike. Set a **bare origin** only when another host (a CDN) serves `/storage/*`, or to sign where no request is behind the call: a query, a scheduled job, a workflow step have no `ctx.origin`, so signing there without it throws. A base carrying a path is rejected by the signer. |
|
|
67
69
|
|
|
68
|
-
`STORAGE_PUBLIC_BASE_URL` must be `https://` anywhere but local dev. A signed URL
|
|
70
|
+
A configured `STORAGE_PUBLIC_BASE_URL` must be `https://` anywhere but local dev. A signed URL
|
|
69
71
|
_is_ a bearer credential and the object bytes stream through it, so a plaintext
|
|
70
72
|
origin hands both to anyone on the path. Only `http://localhost` /
|
|
71
73
|
`http://127.0.0.1` belong in `.dev.vars`.
|
|
@@ -309,7 +311,8 @@ bare key back in — the component re-scopes it.
|
|
|
309
311
|
|
|
310
312
|
- [ ] `lunora registry add storage` run, `pnpm install` done.
|
|
311
313
|
- [ ] `UPLOADS` bucket bound to a real bucket; `STORAGE_SIGNING_SECRET` (≥32
|
|
312
|
-
chars)
|
|
314
|
+
chars) set; `STORAGE_PUBLIC_BASE_URL` left empty unless another host
|
|
315
|
+
serves `/storage/*` or you sign URLs in a query or a scheduled job.
|
|
313
316
|
- [ ] `lunora codegen` run so `api.storage.*` is generated.
|
|
314
317
|
- [ ] `/storage/*` route added, verifying signed URLs on both `PUT` and `GET`.
|
|
315
318
|
- [ ] Verified a client upload → signed download round-trip.
|