lakebed 0.0.5 → 0.0.7

package/README.md

@@ -86,6 +86,26 @@ mutations: {
 }
 ```
 
+## Server Env
+
+Server handlers can read capsule-specific environment variables through `ctx.env`.
+
+```txt
+# .env.lakebed.server
+OPENAI_API_KEY=sk-...
+STRIPE_WEBHOOK_SECRET=whsec_...
+```
+
+```ts
+queries: {
+  settings: query((ctx) => ({
+    hasOpenAiKey: Boolean(ctx.env.OPENAI_API_KEY)
+  }));
+}
+```
+
+`lakebed dev` loads `.env.lakebed.server` locally. For hosted apps, claim the deploy, then run `lakebed deploy` to replace the deploy's server env with the file contents. Env values are not included in anonymous artifacts or source manifests.
+
 ## Commands
 
 ```sh
@@ -109,6 +129,7 @@ lakebed logs [deploy-id-or-url] [--port 3000]
 - Tailwind classes in JSX are the only styling path in v0.
 - Guest auth works by default. Google sign-in is built in through Shoo and exposes verified identity on `ctx.auth`.
 - Anonymous deploys disable outbound `fetch`.
+- Non-empty `.env.lakebed.server` files require a claimed deploy before they can sync to hosted server code.
 
 ## Hosted Deploys
 
@@ -142,10 +163,11 @@ Deploy responses include a claim URL. Configure GitHub OAuth on the runner, then
 LAKEBED_GITHUB_CLIENT_ID=...
 LAKEBED_GITHUB_CLIENT_SECRET=...
 LAKEBED_SESSION_SECRET=...
+LAKEBED_SERVER_ENV_SECRET=...
 ```
 
-Claimed deploys are listed at `/deploys` on the deploy API origin. They keep the same resource limits as anonymous deploys. Anonymous deploys cannot use outbound `fetch`; after a deploy is claimed, `lakebed deploy` can update it with a source-backed server artifact that supports async handlers and server-side fetch. If the first deploy already needs server-side `fetch`, `lakebed deploy` creates a claim-required preview, saves its claim metadata, and prints the claim URL. Open that URL, then run `lakebed deploy` again to publish the real source-backed app.
+Claimed deploys are listed at `/deploys` on the deploy API origin. They keep the same resource limits as anonymous deploys. Anonymous deploys cannot use outbound `fetch` or hosted server env; after a deploy is claimed, `lakebed deploy` can update it with a source-backed server artifact that supports async handlers, server-side fetch, and `.env.lakebed.server` sync. If the first deploy already needs server-side `fetch` or server env, `lakebed deploy` creates a claim-required preview, saves its claim metadata, and prints the claim URL. Open that URL, then run `lakebed deploy` again to publish the real source-backed app. Set `LAKEBED_SERVER_ENV_SECRET` on Postgres-backed runners to encrypt stored server env values.
 
 ## Admin Dashboard
 
-Set `LAKEBED_ADMIN_PASSWORD` on the anonymous deploy runner, then open `/admin` on the runner origin. The password is exchanged for an HttpOnly cookie so the dashboard stays unlocked until the cookie expires or the password changes. The resource table can terminate active deploys while preserving their resource history.
+Set `LAKEBED_ADMIN_PASSWORD` on the anonymous deploy runner, then open `/admin` on the runner origin. The password is exchanged for an HttpOnly cookie so the dashboard stays unlocked until the cookie expires or the password changes. The resource table can terminate active deploys while preserving their resource history, and the users table can set per-user request and mutation limit overrides for claimed deploys.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lakebed",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "description": "Agent-native CLI and runtime for building and deploying Lakebed capsules.",
   "license": "UNLICENSED",
   "type": "module",