devflare 1.0.0-next.14 → 1.0.0-next.16

package/R2.md

@@ -1,200 +0,0 @@
-# R2
-
-A short guide for handling uploads and file delivery with Cloudflare R2.
-
----
-
-## Quick rules
-
-- Use **presigned `PUT` URLs** for direct user uploads to R2
-- Use a **public bucket on a custom domain** for truly public assets
-- Use a **private bucket + Worker authorization** for authenticated/private assets
-- Use **Cloudflare Access** for teammate/org-only buckets
-- Use **WAF token auth / HMAC validation** or a **Worker** for expiring custom-domain media links
-- Do **not** use `r2.dev` for production delivery
-- If you protect a custom-domain bucket with Access or WAF, **disable `r2.dev`** or the bucket may still be reachable there
-
----
-
-## Uploads
-
-The usual safe upload flow is:
-
-1. frontend asks your app for upload permission
-2. your Worker/app authenticates the user and validates file type, size, and target key
-3. your backend returns a short-lived **presigned `PUT` URL**
-4. the browser uploads **directly to R2**
-5. your app stores the **object key + metadata**, not the presigned URL
-
-Good practice:
-
-- generate keys server-side, for example `users/<userId>/<uuid>.jpg`
-- restrict `Content-Type` when signing uploads
-- keep upload URLs short-lived
-- configure bucket **CORS** if the browser uploads directly
-
-Cloudflare docs:
-
-- [Presigned URLs](https://developers.cloudflare.com/r2/api/s3/presigned-urls/)
-- [Configure CORS](https://developers.cloudflare.com/r2/buckets/cors/)
-- [Storing user generated content](https://developers.cloudflare.com/reference-architecture/diagrams/storage/storing-user-generated-content/)
-
----
-
-## Viewing / serving files
-
-### Public files
-
-For public images, media, and assets:
-
-- use a **public bucket**
-- attach a **custom domain**
-- serve stable URLs from that domain
-- let Cloudflare cache them
-
-This is the best fit for avatars, product images, blog images, and other content that anyone may view.
-
-Cloudflare docs:
-
-- [Public buckets](https://developers.cloudflare.com/r2/buckets/public-buckets/)
-
-### Private or authenticated files
-
-For invoices, receipts, private user uploads, paid content, or tenant-scoped assets:
-
-- keep the bucket **private**
-- store only the object key in your database
-- serve through a **Worker** that checks session/JWT/permissions before reading from R2
-
-This is usually the best default when access depends on the current user.
-
-Cloudflare docs:
-
-- [Use R2 from Workers](https://developers.cloudflare.com/r2/api/workers/workers-api-usage/)
-
-### Time-limited direct access
-
-You can also mint a **presigned `GET` URL** for temporary direct viewing or download.
-
-Important caveat:
-
-- presigned URLs work on the **R2 S3 endpoint**
-- they **do not work with custom domains**
-- treat them as **bearer tokens**
-
-So they are good for short-lived direct access, but not for polished custom-domain media delivery.
-
-Cloudflare docs:
-
-- [Presigned URLs](https://developers.cloudflare.com/r2/api/s3/presigned-urls/)
-
-### Team-only / org-only files
-
-If access should be limited to employees or teammates, protect the R2 custom domain with **Cloudflare Access**.
-
-Cloudflare docs:
-
-- [Protect an R2 Bucket with Cloudflare Access](https://developers.cloudflare.com/r2/tutorials/cloudflare-access/)
-
-### Signed links on a custom domain
-
-If you want expiring links on `https://cdn.example.com/...`, R2 presigned URLs are not the right tool.
-
-Instead use:
-
-- a **Worker** that signs and verifies access tokens, or
-- **Cloudflare WAF token authentication / HMAC validation** on the custom domain
-
-Cloudflare docs:
-
-- [Configure token authentication](https://developers.cloudflare.com/waf/custom-rules/use-cases/configure-token-authentication/)
-- [HMAC validation function](https://developers.cloudflare.com/ruleset-engine/rules-language/functions/#hmac-validation)
-- [Workers request signing example](https://developers.cloudflare.com/workers/examples/signing-requests/)
-
----
-
-## Development vs production
-
-### Development
-
-By default, local Worker development uses **local simulated bindings**, including local R2-style storage.
-
-Use this for normal development.
-
-Devflare-specific local note:
-
-- local R2 bindings are available to your Worker code, tests, and bridge helpers
-- Devflare does **not** currently publish a stable browser-facing local bucket URL contract
-- do **not** build frontend code around an assumed local bucket origin
-- for browser-visible local flows, serve objects through your Worker or app routes instead
-
-Practical local-serving example:
-
-```ts
-// src/routes/files/[...key].ts
-import type { FetchEvent } from 'devflare/runtime'
-
-export async function GET({ env, params }: FetchEvent<DevflareEnv>): Promise<Response> {
-	const object = await env.FILES.get(params.key)
-	if (!object) {
-		return new Response('Not Found', { status: 404 })
-	}
-
-	return new Response(object.body, {
-		headers: {
-			'Content-Type': object.httpMetadata?.contentType ?? 'application/octet-stream',
-			'Cache-Control': 'private, max-age=0'
-		}
-	})
-}
-```
-
-With that pattern, your browser talks to your app URL, not to an assumed local bucket URL. That keeps local behavior aligned with the Worker-auth or custom-domain patterns you are likely to use in production.
-
-Only connect to real remote buckets when you intentionally need integration testing, and prefer **separate dev/staging buckets** instead of production buckets.
-
-Important remote-dev reality:
-
-- remote bindings touch **real data**
-- remote bindings incur **real costs**
-- avoid pointing local development at production uploads unless absolutely necessary
-
-Cloudflare docs:
-
-- [Workers development & testing](https://developers.cloudflare.com/workers/development-testing/)
-- [Remote bindings](https://developers.cloudflare.com/workers/development-testing/#remote-bindings)
-
-### Production
-
-For production:
-
-- use a **custom domain**, not `r2.dev`
-- choose public vs private intentionally per bucket or per content class
-- keep sensitive content private behind a Worker, Access, or token validation
-- configure **CORS** intentionally for browser upload/download flows
-- use separate **dev**, **staging**, and **prod** buckets
-
-Optional performance feature:
-
-- if users upload from many regions, consider **Local Uploads** for better upload performance
-
-Cloudflare docs:
-
-- [Public buckets](https://developers.cloudflare.com/r2/buckets/public-buckets/)
-- [Local uploads](https://developers.cloudflare.com/r2/buckets/local-uploads/)
-
----
-
-## Recommended defaults
-
-If you need a sane default architecture:
-
-- **public assets** → public bucket + custom domain
-- **user uploads** → presigned `PUT` upload + object key stored in DB
-- **private assets** → private bucket + Worker-gated reads
-- **internal assets** → custom domain + Cloudflare Access
-- **custom-domain expiring links** → Worker token auth or WAF HMAC validation
-
-If you only remember one rule, remember this:
-
-> Use **presigned URLs** for short-lived direct R2 access, but use a **Worker/custom domain auth layer** for polished private media delivery.

package/dist/account-8psavtg6.js

@@ -1,420 +0,0 @@
-import {
-  BOLD,
-  CYAN,
-  CYAN_BOLD,
-  DIM,
-  RESET
-} from "./index-3t6rypgc.js";
-import {
-  account
-} from "./index-n7rs26ft.js";
-import {
-  AuthenticationError,
-  CloudflareAPIError,
-  getGlobalDefaultAccountId,
-  getWorkspaceAccountId,
-  setGlobalDefaultAccountId,
-  setWorkspaceAccountId
-} from "./index-tfyxa77h.js";
-import"./index-37x76zdn.js";
-
-// src/cli/commands/account.ts
-var ACCOUNT_SUBCOMMANDS = [
-  "info",
-  "workers",
-  "kv",
-  "d1",
-  "r2",
-  "vectorize",
-  "limits",
-  "usage",
-  "global",
-  "workspace"
-];
-function isAccountSubcommand(value) {
-  return ACCOUNT_SUBCOMMANDS.includes(value);
-}
-var CLI_API_OPTIONS = { timeout: 1e4 };
-function formatDate(date) {
-  if (!date)
-    return "N/A";
-  return date.toLocaleDateString("en-US", {
-    year: "numeric",
-    month: "short",
-    day: "numeric"
-  });
-}
-function formatPercent(value) {
-  if (value === undefined)
-    return "N/A";
-  return `${value.toFixed(1)}%`;
-}
-async function runAccountCommand(parsed, logger, _options) {
-  const isAuth = await account.isAuthenticated();
-  if (!isAuth) {
-    logger.error("Not authenticated with Cloudflare");
-    logger.info("Run: bunx wrangler login");
-    return { exitCode: 1 };
-  }
-  const subcommand = parsed.args[0];
-  const rawSubcommand = parsed.args[0];
-  if (rawSubcommand && !isAccountSubcommand(rawSubcommand)) {
-    logger.error(`Unknown account subcommand: ${rawSubcommand}`);
-    logger.info(`Available account subcommands: ${ACCOUNT_SUBCOMMANDS.join(", ")}`);
-    return { exitCode: 1 };
-  }
-  if (subcommand === "global") {
-    return await selectGlobalAccount(logger);
-  }
-  if (subcommand === "workspace") {
-    return await selectWorkspaceAccount(logger);
-  }
-  try {
-    let accountId = parsed.options.account;
-    if (!accountId) {
-      const primary = await account.getPrimaryAccount();
-      if (!primary) {
-        logger.error("No Cloudflare accounts found");
-        return { exitCode: 1 };
-      }
-      accountId = primary.id;
-    }
-    switch (subcommand) {
-      case "workers":
-        return await showWorkers(accountId, logger);
-      case "kv":
-        return await showKV(accountId, logger);
-      case "d1":
-        return await showD1(accountId, logger);
-      case "r2":
-        return await showR2(accountId, logger);
-      case "vectorize":
-        return await showVectorize(accountId, logger);
-      case "limits":
-        return await handleLimits(accountId, parsed, logger);
-      case "usage":
-        return await showUsage(accountId, logger);
-      case "info":
-      default:
-        return await showAccountOverview(accountId, logger);
-    }
-  } catch (error) {
-    if (error instanceof AuthenticationError) {
-      logger.error(error.message);
-      return { exitCode: 1 };
-    }
-    if (error instanceof CloudflareAPIError) {
-      logger.error(`API Error: ${error.message}`);
-      return { exitCode: 1 };
-    }
-    if (error instanceof Error) {
-      if (error.name === "AbortError" || error.message.includes("timed out")) {
-        logger.error("Request timed out. The Cloudflare API is slow or unavailable.");
-        return { exitCode: 1 };
-      }
-      logger.error(`Error: ${error.message}`);
-      return { exitCode: 1 };
-    }
-    throw error;
-  }
-}
-async function showAccountOverview(accountId, logger) {
-  logger.info(`\uD83D\uDCCA Cloudflare Account Overview
-`);
-  const accounts = await account.getAccounts();
-  if (accounts.length === 0) {
-    logger.error("No Cloudflare accounts found");
-    return { exitCode: 1 };
-  }
-  const workspaceId = getWorkspaceAccountId();
-  const globalId = await getGlobalDefaultAccountId(accountId);
-  for (let i = 0;i < accounts.length; i++) {
-    const acc = accounts[i];
-    const isWorkspace = acc.id === workspaceId;
-    const isGlobal = acc.id === globalId;
-    let badge = "";
-    if (isWorkspace) {
-      badge = ` ${CYAN_BOLD}(workspace)${RESET}`;
-    } else if (isGlobal) {
-      badge = workspaceId ? ` ${DIM}(global)${RESET}` : ` ${CYAN}(global)${RESET}`;
-    }
-    if (i > 0)
-      logger.info("");
-    logger.info(`${BOLD}Account${RESET}   ${acc.name}${badge}`);
-    logger.info(`${BOLD}ID${RESET}        ${acc.id}`);
-    logger.info(`${BOLD}Type${RESET}      ${acc.type}`);
-  }
-  logger.info("");
-  logger.info(`${BOLD}Commands${RESET}`);
-  logger.info("   devflare account global     — Set global default account");
-  logger.info("   devflare account workspace  — Set workspace account");
-  logger.info("   devflare account workers    — List Workers");
-  logger.info("   devflare account kv         — List KV namespaces");
-  logger.info("   devflare account d1         — List D1 databases");
-  logger.info("   devflare account r2         — List R2 buckets");
-  logger.info("   devflare account vectorize  — List Vectorize indexes");
-  logger.info("   devflare account limits     — View/set usage limits");
-  logger.info("   devflare account usage      — View detailed usage");
-  logger.info("");
-  logger.info("   devflare ai                 — View AI models and pricing");
-  return { exitCode: 0 };
-}
-async function selectGlobalAccount(logger) {
-  const accounts = await account.getAccounts();
-  if (accounts.length === 0) {
-    logger.error("No Cloudflare accounts found");
-    return { exitCode: 1 };
-  }
-  if (accounts.length === 1) {
-    await setGlobalDefaultAccountId(accounts[0].id);
-    logger.success(`Global default set to: ${accounts[0].name}`);
-    return { exitCode: 0 };
-  }
-  const currentGlobal = await getGlobalDefaultAccountId(accounts[0].id);
-  const options = accounts.map((acc) => {
-    const isCurrent = acc.id === currentGlobal;
-    return {
-      label: isCurrent ? `${acc.name} ${CYAN}(default)${RESET}` : acc.name,
-      value: acc.id,
-      hint: acc.id.substring(0, 8) + "..."
-    };
-  });
-  const selected = await logger.prompt("Select global default account:", {
-    type: "select",
-    options,
-    initial: currentGlobal ?? accounts[0].id
-  });
-  if (!selected || typeof selected === "symbol") {
-    logger.info("Cancelled");
-    return { exitCode: 0 };
-  }
-  await setGlobalDefaultAccountId(selected, accounts[0].id);
-  const selectedAccount = accounts.find((a) => a.id === selected);
-  logger.success(`Global default set to: ${selectedAccount?.name}`);
-  logger.info(`Saved to: ~/.devflare/preferences.json + cloud KV`);
-  return { exitCode: 0 };
-}
-async function selectWorkspaceAccount(logger) {
-  const accounts = await account.getAccounts();
-  if (accounts.length === 0) {
-    logger.error("No Cloudflare accounts found");
-    return { exitCode: 1 };
-  }
-  if (accounts.length === 1) {
-    const pkgPath2 = setWorkspaceAccountId(accounts[0].id);
-    logger.success(`Workspace account set to: ${accounts[0].name}`);
-    logger.info(`Saved to: ${pkgPath2}`);
-    return { exitCode: 0 };
-  }
-  const currentWorkspace = getWorkspaceAccountId();
-  const options = accounts.map((acc) => {
-    const isCurrent = acc.id === currentWorkspace;
-    return {
-      label: isCurrent ? `${acc.name} ${CYAN}(workspace)${RESET}` : acc.name,
-      value: acc.id,
-      hint: acc.id.substring(0, 8) + "..."
-    };
-  });
-  const selected = await logger.prompt("Select workspace account:", {
-    type: "select",
-    options,
-    initial: currentWorkspace ?? accounts[0].id
-  });
-  if (!selected || typeof selected === "symbol") {
-    logger.info("Cancelled");
-    return { exitCode: 0 };
-  }
-  const pkgPath = setWorkspaceAccountId(selected);
-  const selectedAccount = accounts.find((a) => a.id === selected);
-  logger.success(`Workspace account set to: ${selectedAccount?.name}`);
-  logger.info(`Saved to: ${pkgPath}`);
-  return { exitCode: 0 };
-}
-async function showWorkers(accountId, logger) {
-  logger.info(`\uD83D\uDC77 Workers Scripts
-`);
-  const workers = await account.workers(accountId, CLI_API_OPTIONS);
-  if (workers.length === 0) {
-    logger.info("No Workers found");
-    return { exitCode: 0 };
-  }
-  logger.info("─".repeat(60));
-  logger.info(`${"Name".padEnd(30)} ${"Modified".padEnd(20)}`);
-  logger.info("─".repeat(60));
-  for (const worker of workers) {
-    logger.info(`${worker.name.padEnd(30)} ${formatDate(worker.modifiedOn).padEnd(20)}`);
-  }
-  logger.info("─".repeat(60));
-  logger.info(`Total: ${workers.length} worker(s)`);
-  return { exitCode: 0 };
-}
-async function showKV(accountId, logger) {
-  logger.info(`\uD83D\uDDC4️ KV Namespaces
-`);
-  const namespaces = await account.kv(accountId, CLI_API_OPTIONS);
-  if (namespaces.length === 0) {
-    logger.info("No KV namespaces found");
-    return { exitCode: 0 };
-  }
-  logger.info("─".repeat(70));
-  logger.info(`${"Name".padEnd(35)} ${"ID".padEnd(35)}`);
-  logger.info("─".repeat(70));
-  for (const ns of namespaces) {
-    logger.info(`${ns.name.padEnd(35)} ${ns.id.padEnd(35)}`);
-  }
-  logger.info("─".repeat(70));
-  logger.info(`Total: ${namespaces.length} namespace(s)`);
-  return { exitCode: 0 };
-}
-async function showD1(accountId, logger) {
-  logger.info(`\uD83D\uDDC3️ D1 Databases
-`);
-  const databases = await account.d1(accountId, CLI_API_OPTIONS);
-  if (databases.length === 0) {
-    logger.info("No D1 databases found");
-    return { exitCode: 0 };
-  }
-  logger.info("─".repeat(80));
-  logger.info(`${"Name".padEnd(25)} ${"ID".padEnd(40)} ${"Tables".padEnd(8)}`);
-  logger.info("─".repeat(80));
-  for (const db of databases) {
-    const tables = db.tableCount !== undefined ? db.tableCount.toString() : "N/A";
-    logger.info(`${db.name.padEnd(25)} ${db.id.padEnd(40)} ${tables.padEnd(8)}`);
-  }
-  logger.info("─".repeat(80));
-  logger.info(`Total: ${databases.length} database(s)`);
-  return { exitCode: 0 };
-}
-async function showR2(accountId, logger) {
-  logger.info(`\uD83D\uDCE6 R2 Buckets
-`);
-  const buckets = await account.r2(accountId, CLI_API_OPTIONS);
-  if (buckets.length === 0) {
-    logger.info("No R2 buckets found");
-    return { exitCode: 0 };
-  }
-  logger.info("─".repeat(60));
-  logger.info(`${"Name".padEnd(30)} ${"Created".padEnd(20)} ${"Location".padEnd(10)}`);
-  logger.info("─".repeat(60));
-  for (const bucket of buckets) {
-    const location = bucket.location ?? "auto";
-    logger.info(`${bucket.name.padEnd(30)} ${formatDate(bucket.createdOn).padEnd(20)} ${location.padEnd(10)}`);
-  }
-  logger.info("─".repeat(60));
-  logger.info(`Total: ${buckets.length} bucket(s)`);
-  return { exitCode: 0 };
-}
-async function showVectorize(accountId, logger) {
-  logger.info(`\uD83D\uDD0D Vectorize Indexes
-`);
-  const indexes = await account.vectorize(accountId, CLI_API_OPTIONS);
-  if (indexes.length === 0) {
-    logger.info("No Vectorize indexes found");
-    return { exitCode: 0 };
-  }
-  logger.info("─".repeat(70));
-  logger.info(`${"Name".padEnd(25)} ${"Dimensions".padEnd(12)} ${"Metric".padEnd(15)}`);
-  logger.info("─".repeat(70));
-  for (const idx of indexes) {
-    logger.info(`${idx.name.padEnd(25)} ${idx.dimensions.toString().padEnd(12)} ${idx.metric.padEnd(15)}`);
-  }
-  logger.info("─".repeat(70));
-  logger.info(`Total: ${indexes.length} index(es)`);
-  return { exitCode: 0 };
-}
-async function showUsage(accountId, logger) {
-  logger.info(`\uD83D\uDCC8 Usage Report
-`);
-  const usages = await account.getAllUsageSummaries(accountId);
-  const limits = await account.getLimits(accountId);
-  logger.info(`Limits Enabled: ${limits.enabled ? "Yes" : "No"}`);
-  logger.info("");
-  if (usages.length === 0) {
-    logger.info("No usage tracked yet");
-    return { exitCode: 0 };
-  }
-  logger.info("─".repeat(60));
-  logger.info(`${"Service".padEnd(15)} ${"Today".padEnd(10)} ${"Limit".padEnd(10)} ${"%".padEnd(10)} ${"Status".padEnd(10)}`);
-  logger.info("─".repeat(60));
-  for (const usage of usages) {
-    const limitStr = usage.limit?.toString() ?? "∞";
-    const percentStr = formatPercent(usage.percentUsed);
-    const status = usage.withinLimit ? "✅ OK" : "⛔ LIMIT";
-    logger.info(`${usage.service.padEnd(15)} ${usage.today.toString().padEnd(10)} ${limitStr.padEnd(10)} ${percentStr.padEnd(10)} ${status.padEnd(10)}`);
-  }
-  logger.info("─".repeat(60));
-  return { exitCode: 0 };
-}
-async function handleLimits(accountId, parsed, logger) {
-  const action = parsed.args[1];
-  switch (action) {
-    case "set":
-      return await setLimit(accountId, parsed, logger);
-    case "enable":
-      await account.setLimitsEnabled(accountId, true);
-      logger.success("Usage limits enabled");
-      return { exitCode: 0 };
-    case "disable":
-      await account.setLimitsEnabled(accountId, false);
-      logger.success("Usage limits disabled");
-      return { exitCode: 0 };
-    default:
-      return await showLimits(accountId, logger);
-  }
-}
-async function showLimits(accountId, logger) {
-  logger.info(`⚙️ Usage Limits
-`);
-  const limits = await account.getLimits(accountId);
-  logger.info(`Status: ${limits.enabled ? "✅ Enabled" : "❌ Disabled"}`);
-  logger.info("");
-  logger.info("Current Limits:");
-  logger.info("─".repeat(40));
-  logger.info(`  AI Requests/Day:    ${limits.aiRequestsPerDay ?? "Unlimited"}`);
-  logger.info(`  AI Tokens/Day:      ${limits.aiTokensPerDay ?? "Unlimited"}`);
-  logger.info(`  Vectorize Ops/Day:  ${limits.vectorizeOpsPerDay ?? "Unlimited"}`);
-  logger.info("");
-  logger.info("Commands:");
-  logger.info("  devflare account limits set ai-requests 50");
-  logger.info("  devflare account limits set ai-tokens 5000");
-  logger.info("  devflare account limits set vectorize-ops 500");
-  logger.info("  devflare account limits enable");
-  logger.info("  devflare account limits disable");
-  return { exitCode: 0 };
-}
-async function setLimit(accountId, parsed, logger) {
-  const limitName = parsed.args[2];
-  const limitValue = parsed.args[3];
-  if (!limitName || !limitValue) {
-    logger.error("Usage: devflare account limits set <limit-name> <value>");
-    logger.info("Limit names: ai-requests, ai-tokens, vectorize-ops");
-    return { exitCode: 1 };
-  }
-  const value = parseInt(limitValue, 10);
-  if (isNaN(value) || value < 0) {
-    logger.error("Limit value must be a positive number");
-    return { exitCode: 1 };
-  }
-  switch (limitName) {
-    case "ai-requests":
-      await account.setLimits(accountId, { aiRequestsPerDay: value });
-      logger.success(`AI requests limit set to ${value}/day`);
-      break;
-    case "ai-tokens":
-      await account.setLimits(accountId, { aiTokensPerDay: value });
-      logger.success(`AI tokens limit set to ${value}/day`);
-      break;
-    case "vectorize-ops":
-      await account.setLimits(accountId, { vectorizeOpsPerDay: value });
-      logger.success(`Vectorize ops limit set to ${value}/day`);
-      break;
-    default:
-      logger.error(`Unknown limit: ${limitName}`);
-      logger.info("Valid limits: ai-requests, ai-tokens, vectorize-ops");
-      return { exitCode: 1 };
-  }
-  return { exitCode: 0 };
-}
-export {
-  runAccountCommand
-};