@lumerahq/cli 0.19.21 → 0.19.23

package/dist/{chunk-ML7XB7Z2.js → chunk-JMRD5WIY.js}

@@ -7,6 +7,55 @@ import {
   fetchWithRetry
 } from "./chunk-FJFIWC7G.js";
 
+// src/lib/name-limits.ts
+var MAX_PROJECT_NAME_LENGTH = 30;
+var MAX_COLLECTION_NAME_LENGTH = 30;
+var MAX_POSTGRES_IDENTIFIER_BYTES = 63;
+var PROJECT_EXTERNAL_ID_REGEX = /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/;
+var RESERVED_PROJECT_EXTERNAL_IDS = /* @__PURE__ */ new Set([
+  "collection",
+  "collections",
+  "default",
+  "admin",
+  "api",
+  "system",
+  "internal",
+  "platform",
+  "lumera",
+  "lm"
+]);
+function lengthOf(value) {
+  return Array.from(value).length;
+}
+function validateProjectNameLength(name, label = "App name") {
+  if (lengthOf(name.trim()) > MAX_PROJECT_NAME_LENGTH) {
+    return `${label} must be ${MAX_PROJECT_NAME_LENGTH} characters or less`;
+  }
+  return null;
+}
+function validateProjectExternalId(externalId) {
+  const trimmed = externalId.trim();
+  const lengthError = validateProjectNameLength(trimmed, "App ID");
+  if (lengthError) return lengthError;
+  if (!PROJECT_EXTERNAL_ID_REGEX.test(trimmed)) {
+    return "App ID must use lowercase letters, numbers, and hyphens only";
+  }
+  if (RESERVED_PROJECT_EXTERNAL_IDS.has(trimmed)) {
+    return `App ID "${trimmed}" is a reserved name`;
+  }
+  return null;
+}
+function validateCollectionNameLength(name) {
+  const trimmed = name.trim();
+  if (lengthOf(trimmed) > MAX_COLLECTION_NAME_LENGTH) {
+    return `collection name must be ${MAX_COLLECTION_NAME_LENGTH} characters or less`;
+  }
+  if (new TextEncoder().encode(trimmed).byteLength > MAX_POSTGRES_IDENTIFIER_BYTES) {
+    return `collection name must be ${MAX_POSTGRES_IDENTIFIER_BYTES} bytes or less`;
+  }
+  return null;
+}
+
 // src/lib/api.ts
 init_auth();
 import { readFileSync } from "fs";
@@ -282,6 +331,10 @@ var ApiClient = class {
   // Projects — register/lookup via PocketBase records API
   async registerProject(name, externalId) {
     const extId = externalId || name;
+    const nameError = validateProjectNameLength(name, "App name");
+    if (nameError) throw new Error(nameError);
+    const externalIdError = validateProjectExternalId(extId);
+    if (externalIdError) throw new Error(externalIdError);
     const existing = await this.getProjectByExternalId(extId);
     if (existing) {
       return existing;
@@ -364,6 +417,9 @@ function createApiClient(token, baseUrl, projectExternalId) {
 }
 
 export {
+  validateProjectNameLength,
+  validateProjectExternalId,
+  validateCollectionNameLength,
   userContextHeaders,
   ApiError,
   isApiErrorStatus,

package/dist/{chunk-S7FJU4GM.js → chunk-RH4FQF6O.js}

@@ -4,7 +4,7 @@ import {
 import {
   createApiClient,
   isApiErrorStatus
-} from "./chunk-ML7XB7Z2.js";
+} from "./chunk-JMRD5WIY.js";
 import {
   findProjectRoot,
   getAppName

package/dist/{chunk-PY4J2U2M.js → chunk-XT4EGGK7.js}

@@ -1,6 +1,8 @@
 import {
-  userContextHeaders
-} from "./chunk-ML7XB7Z2.js";
+  userContextHeaders,
+  validateProjectExternalId,
+  validateProjectNameLength
+} from "./chunk-JMRD5WIY.js";
 import {
   fetchWithRetry
 } from "./chunk-FJFIWC7G.js";
@@ -63,6 +65,10 @@ async function createTarball(distDir) {
   });
 }
 async function ensureAppRecord(apiBase, token, appName, appTitle) {
+  const appIdError = validateProjectExternalId(appName);
+  if (appIdError) throw new Error(appIdError);
+  const appNameError = validateProjectNameLength(appTitle, "App name");
+  if (appNameError) throw new Error(appNameError);
   const filterParam = encodeURIComponent(JSON.stringify({ external_id: appName }));
   const searchRes = await fetchWithRetry(
     `${apiBase}/pb/collections/lm_custom_apps/records?filter=${filterParam}`,

package/dist/{deps-H4QYLGM7.js → deps-VTLXKCQ7.js}

@@ -1,9 +1,9 @@
 import {
   deps,
   syncDeps
-} from "./chunk-S7FJU4GM.js";
+} from "./chunk-RH4FQF6O.js";
 import "./chunk-2CR762KB.js";
-import "./chunk-ML7XB7Z2.js";
+import "./chunk-JMRD5WIY.js";
 import "./chunk-ZH3NVYEQ.js";
 import "./chunk-FJFIWC7G.js";
 import "./chunk-PNKVD2UK.js";

package/dist/{dev-O6TXHGAK.js → dev-EQK27BUM.js}

@@ -1,15 +1,15 @@
 import {
   dev
-} from "./chunk-PY4J2U2M.js";
+} from "./chunk-XT4EGGK7.js";
 import {
   syncDeps
-} from "./chunk-S7FJU4GM.js";
+} from "./chunk-RH4FQF6O.js";
 import {
   loadEnv
 } from "./chunk-2CR762KB.js";
 import {
   createApiClient
-} from "./chunk-ML7XB7Z2.js";
+} from "./chunk-JMRD5WIY.js";
 import {
   findProjectRoot,
   getApiUrl,

package/dist/index.js

@@ -219,39 +219,39 @@ async function main() {
     switch (command) {
       // Resource commands
       case "plan":
-        await import("./resources-FLFD64X2.js").then((m) => m.plan(args.slice(1)));
+        await import("./resources-Z5ZMPWTK.js").then((m) => m.plan(args.slice(1)));
         break;
       case "apply":
-        await import("./resources-FLFD64X2.js").then((m) => m.apply(args.slice(1)));
+        await import("./resources-Z5ZMPWTK.js").then((m) => m.apply(args.slice(1)));
         break;
       case "pull":
-        await import("./resources-FLFD64X2.js").then((m) => m.pull(args.slice(1)));
+        await import("./resources-Z5ZMPWTK.js").then((m) => m.pull(args.slice(1)));
         break;
       case "destroy":
-        await import("./resources-FLFD64X2.js").then((m) => m.destroy(args.slice(1)));
+        await import("./resources-Z5ZMPWTK.js").then((m) => m.destroy(args.slice(1)));
         break;
       case "list":
-        await import("./resources-FLFD64X2.js").then((m) => m.list(args.slice(1)));
+        await import("./resources-Z5ZMPWTK.js").then((m) => m.list(args.slice(1)));
         break;
       case "show":
-        await import("./resources-FLFD64X2.js").then((m) => m.show(args.slice(1)));
+        await import("./resources-Z5ZMPWTK.js").then((m) => m.show(args.slice(1)));
         break;
       case "diff":
-        await import("./resources-FLFD64X2.js").then((m) => m.diff(args.slice(1)));
+        await import("./resources-Z5ZMPWTK.js").then((m) => m.diff(args.slice(1)));
         break;
       // Development
       case "dev":
-        await import("./dev-O6TXHGAK.js").then((m) => m.dev(args.slice(1)));
+        await import("./dev-EQK27BUM.js").then((m) => m.dev(args.slice(1)));
         break;
       case "run":
-        await import("./run-NR3725J2.js").then((m) => m.run(args.slice(1)));
+        await import("./run-LHHX7UBN.js").then((m) => m.run(args.slice(1)));
         break;
       // Project
       case "init":
-        await import("./init-HUV5ZJAE.js").then((m) => m.init(args.slice(1)));
+        await import("./init-FTDMPFR3.js").then((m) => m.init(args.slice(1)));
         break;
       case "register":
-        await import("./register-OZDOFUPF.js").then((m) => m.register(args.slice(1)));
+        await import("./register-BQCVUPWS.js").then((m) => m.register(args.slice(1)));
         break;
       case "templates":
         await import("./templates-LNUOTNLN.js").then((m) => m.templates(subcommand, args.slice(2)));
@@ -268,7 +268,7 @@ async function main() {
         break;
       // Dependencies
       case "deps":
-        await import("./deps-H4QYLGM7.js").then((m) => m.deps(args.slice(1)));
+        await import("./deps-VTLXKCQ7.js").then((m) => m.deps(args.slice(1)));
         break;
       // Auth
       case "login":

package/dist/{init-HUV5ZJAE.js → init-FTDMPFR3.js}

@@ -6,8 +6,9 @@ import {
   spinner
 } from "./chunk-BHYDYR75.js";
 import {
-  createApiClient
-} from "./chunk-ML7XB7Z2.js";
+  createApiClient,
+  validateProjectNameLength
+} from "./chunk-JMRD5WIY.js";
 import {
   getToken,
   init_auth,
@@ -26,7 +27,7 @@ import pc from "picocolors";
 import prompts from "prompts";
 import { execSync } from "child_process";
 import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, rmSync, readlinkSync, symlinkSync } from "fs";
-import { join, resolve } from "path";
+import { dirname, join, resolve } from "path";
 function toTitleCase(str) {
   return str.split(/[-_]/).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
 }
@@ -42,6 +43,84 @@ function processTemplate(content, replacements) {
 var TEMPLATE_EXCLUDE = /* @__PURE__ */ new Set(["template.json"]);
 var TEMPLATE_RENAMES = /* @__PURE__ */ new Map([["_gitignore", ".gitignore"]]);
 var TEMPLATE_RAW_COPY = /* @__PURE__ */ new Set(["pnpm-lock.yaml"]);
+var STUDIO_PROBLEM_FIRST_FLAG = "studio_problem_first";
+var MEMORY_AGENTS_SECTION = `## Project Memory
+
+This project may use repo-backed memory in \`memory/\`.
+
+Before substantial work, read \`memory/README.md\` if it exists, then any
+relevant memory files.
+
+Update memory when the user confirms a durable project decision, workflow
+rule, data contract, naming convention, recurring assumption, or correction
+that should survive future sessions.
+
+Do not store secrets, credentials, tokens, private keys, or raw sensitive
+source files in memory.
+
+If a memory item affects app behavior, do not rely only on repo memory.
+Persist it to the app's runtime source of truth, such as collections or config,
+and expose it in the app UI or a clear review/edit path.
+
+Summarize memory updates in your final response.
+`;
+var MEMORY_FILES = /* @__PURE__ */ new Map([
+  ["README.md", `# Project Memory
+
+Repo-backed memory keeps durable project context available across agent
+sessions. Keep it concise and reviewable.
+
+Use this folder for:
+- confirmed project decisions
+- durable workflow rules and mappings
+- data contracts and source-file assumptions
+- runbooks for recurring work
+- open questions that should carry forward
+
+Do not store secrets, credentials, tokens, private keys, or raw sensitive source
+files here.
+
+If a memory item affects app behavior, also persist it to the app's runtime
+source of truth, such as collections or config, and expose it in the app UI or a
+clear review/edit path.
+`],
+  ["project-context.md", `# Project Context
+
+Summarize what this app does, who uses it, and the recurring workflow it
+supports.
+`],
+  ["decisions.md", `# Decisions
+
+Record durable decisions that future sessions should preserve.
+
+| Date | Decision | Reason |
+| --- | --- | --- |
+`],
+  ["open-questions.md", `# Open Questions
+
+Track unresolved questions that should be answered before durable workflow
+behavior is finalized.
+`],
+  ["rules/README.md", `# Rules
+
+Document durable business rules, validation rules, thresholds, and exception
+handling expectations.
+`],
+  ["mappings/README.md", `# Mappings
+
+Document source-to-target mappings, normalization rules, and user-approved
+corrections.
+`],
+  ["data-contracts/README.md", `# Data Contracts
+
+Document expected source files, required columns, data types, and known source
+system assumptions.
+`],
+  ["runbooks/README.md", `# Runbooks
+
+Document repeatable operating steps for recurring workflows.
+`]
+]);
 function copyDir(src, dest, replacements, isRoot = true) {
   if (!existsSync(dest)) {
     mkdirSync(dest, { recursive: true });
@@ -81,6 +160,35 @@ function ensureClaudeInstructionsLink(projectRoot) {
     writeFileSync(claudeMdPath, readFileSync(agentsMdPath, "utf-8"));
   }
 }
+async function isStudioProblemFirstScaffoldEnabled(targetDir) {
+  try {
+    const token = getToken(targetDir);
+    const api = createApiClient(token);
+    const me = await api.getMe();
+    return me.user?.feature_flags?.[STUDIO_PROBLEM_FIRST_FLAG] === true;
+  } catch {
+    return false;
+  }
+}
+function writeFileIfMissing(path, content) {
+  if (existsSync(path)) return;
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, content);
+}
+function applyProblemFirstMemoryScaffold(projectRoot) {
+  const agentsMdPath = join(projectRoot, "AGENTS.md");
+  if (existsSync(agentsMdPath)) {
+    const agentsMd = readFileSync(agentsMdPath, "utf-8");
+    if (!agentsMd.includes("## Project Memory")) {
+      writeFileSync(agentsMdPath, `${agentsMd.trimEnd()}
+
+${MEMORY_AGENTS_SECTION}`);
+    }
+  }
+  for (const [relativePath, content] of MEMORY_FILES) {
+    writeFileIfMissing(join(projectRoot, "memory", relativePath), content);
+  }
+}
 function isGitInstalled() {
   try {
     execSync("git --version", { stdio: "ignore" });
@@ -280,6 +388,8 @@ async function init(args) {
       initial: "my-app",
       validate: (value) => {
         if (!value) return "Project name is required";
+        const lengthError = validateProjectNameLength(value, "Project name");
+        if (lengthError) return lengthError;
         if (!/^[a-z0-9-]+$/.test(value)) {
           return "Use lowercase letters, numbers, and hyphens only";
         }
@@ -301,6 +411,11 @@ async function init(args) {
     console.log(pc.red("  Error: Project name must use lowercase letters, numbers, and hyphens only"));
     process.exit(1);
   }
+  const projectNameLengthError = validateProjectNameLength(finalProjectName, "Project name");
+  if (projectNameLengthError) {
+    console.log(pc.red(`  Error: ${projectNameLengthError}`));
+    process.exit(1);
+  }
   if (!directory) {
     if (nonInteractive) {
       directory = finalProjectName;
@@ -366,7 +481,11 @@ async function init(args) {
     [sourceName, finalProjectName],
     [sourceTitle, projectTitle]
   ];
+  const problemFirstScaffold = await isStudioProblemFirstScaffoldEnabled(targetDir);
   copyDir(templateDir, targetDir, replacements);
+  if (problemFirstScaffold) {
+    applyProblemFirstMemoryScaffold(targetDir);
+  }
   ensureClaudeInstructionsLink(targetDir);
   const installCommand = existsSync(join(targetDir, "pnpm-lock.yaml")) ? "pnpm install --frozen-lockfile" : "pnpm install";
   function listFiles(dir, prefix = "") {

package/dist/{register-OZDOFUPF.js → register-BQCVUPWS.js}

@@ -5,8 +5,9 @@ import {
   spinner
 } from "./chunk-BHYDYR75.js";
 import {
-  createApiClient
-} from "./chunk-ML7XB7Z2.js";
+  createApiClient,
+  validateProjectExternalId
+} from "./chunk-JMRD5WIY.js";
 import {
   findProjectRoot,
   getAppName,
@@ -45,6 +46,11 @@ async function register(args) {
   const projectRoot = findProjectRoot();
   loadEnv(projectRoot);
   const appName = getAppName(projectRoot);
+  const appNameError = validateProjectExternalId(appName);
+  if (appNameError) {
+    console.error(pc.red(`  ${appNameError}`));
+    process.exit(1);
+  }
   const existingId = getProjectId(projectRoot);
   if (existingId && !force) {
     console.log();

package/dist/{resources-FLFD64X2.js → resources-Z5ZMPWTK.js}

@@ -1,16 +1,17 @@
 import {
   deploy
-} from "./chunk-PY4J2U2M.js";
+} from "./chunk-XT4EGGK7.js";
 import {
   syncDeps
-} from "./chunk-S7FJU4GM.js";
+} from "./chunk-RH4FQF6O.js";
 import {
   loadEnv
 } from "./chunk-2CR762KB.js";
 import {
   ApiError,
-  createApiClient
-} from "./chunk-ML7XB7Z2.js";
+  createApiClient,
+  validateCollectionNameLength
+} from "./chunk-JMRD5WIY.js";
 import {
   findProjectRoot,
   getApiUrl,
@@ -1261,6 +1262,11 @@ function loadLocalCollections(platformDir, filterName) {
         errors.push(`${file}: missing name field`);
         continue;
       }
+      const collectionNameError = validateCollectionNameLength(collection.name);
+      if (collectionNameError) {
+        errors.push(`${file}: ${collectionNameError}`);
+        continue;
+      }
       if (/\s/.test(collection.name)) {
         errors.push(`${file}: collection name "${collection.name}" contains spaces - use underscores instead`);
         continue;

package/dist/{run-NR3725J2.js → run-LHHX7UBN.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2CR762KB.js";
 import {
   createApiClient
-} from "./chunk-ML7XB7Z2.js";
+} from "./chunk-JMRD5WIY.js";
 import {
   findProjectRoot,
   getApiUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumerahq/cli",
-  "version": "0.19.21",
+  "version": "0.19.23",
   "description": "CLI for building and deploying Lumera apps",
   "type": "module",
   "engines": {