LuaRN v1.5.2 — API and protection quick start

SERVER-SIDE PROCESSING
- POST https://luarn.pages.dev/v1/obfuscate
- GET  https://luarn.pages.dev/v1/health
- Lua source is transmitted over HTTPS for processing in memory; the Worker does not save source into D1 or static assets. Request metadata, quota counters, and request IDs are logged.
- Default remote source limit: 256 KiB (MAX_SERVER_SOURCE_BYTES). Daily quotas are per API key and UTC day.

WEBSITE KEY vs PRIVATE BOT KEY
- lrn_pub_... is a public browser key. It requires the exact configured HTTPS Origin and may be visible in HTML.
- lrn_srv_... is a private server-to-server key. Create it only after authenticating in /admin.html. It bypasses browser Origin checks and is restricted to POST /v1/obfuscate, but still obeys revocation, expiry, and daily quotas. Treat it as a secret.
- Never put ADMIN_TOKEN or an lrn_srv_ key into HTML, JavaScript delivered to browsers, or a public repository. Store bot keys in environment variables or your platform's secret manager.

PYTHON BOT
1. Deploy this package to the existing LuaRN Pages project and verify /v1/health says status=ready.
2. Open /admin.html, authenticate with ADMIN_TOKEN, select “Python / backend bot (private server key)”, then create and copy the key.
3. Set the key on the bot host: `export LUARN_API_KEY='lrn_srv_...'` (PowerShell: `$env:LUARN_API_KEY='lrn_srv_...'`).
4. Run: `python bot.py script.lua -o script.luarn.lua`
5. Optional base URL override: `LUARN_API_URL=https://luarn.pages.dev`. No third-party Python package is needed.

To call it from an existing Python bot instead of using the CLI, import the helper:
```python
import os
from bot import obfuscate

result = obfuscate(lua_source, "script.lua", os.environ["LUARN_API_KEY"])
protected_lua = result["code"]
```

RAW HTTP REQUEST
POST /v1/obfuscate
Authorization: Bearer lrn_srv_<64 hex chars>
Content-Type: application/json

{
  "source": "print(\"Hello from LuaRN!\")",
  "filename": "script.lua",
  "includeAntiTamper": true,
  "branding": "LuaRN Obfuscator"
}

SUCCESS RESPONSE FIELDS
- ok: true
- code: generated Lua output
- filename: suggested output filename
- requestId: request identifier
- remaining / dailyLimit: quota information
- processing: "server-side"
- sourcePersisted: false

SECURITY REALITY
The output hides the original source from casual inspection through token transformation, identifier renaming where deemed safe, string escaping, compression, per-build reversible arithmetic byte transforms, shuffled payload slices, and redundant integrity checks. This is not cryptographic secrecy: the loader reconstructs executable Lua and a determined dumper can capture it. Anti-tamper checks are defensive tripwires, not proof that a client cannot be patched. Test output in the exact Luau/runtime version you target, especially code using reflection, metaprogramming, dynamic load, or unusual Luau syntax.