@lumerahq/cli 0.23.0-dev.3 → 0.23.0

package/dist/{chunk-WV5HOQNX.js → chunk-I7QEYKS7.js}

@@ -41,6 +41,24 @@ function resolveVersion(cwd) {
   }
   return formatTimestampVersion();
 }
+function resolveUIVersion(cwd) {
+  try {
+    const installed = JSON.parse(
+      readFileSync(resolve(cwd, "node_modules/@lumerahq/ui/package.json"), "utf-8")
+    );
+    if (installed?.version) return String(installed.version);
+  } catch {
+  }
+  try {
+    const pkg = JSON.parse(readFileSync(resolve(cwd, "package.json"), "utf-8"));
+    const spec = pkg?.dependencies?.["@lumerahq/ui"] ?? pkg?.devDependencies?.["@lumerahq/ui"];
+    if (!spec) return "none";
+    const cleaned = String(spec).replace(/^[\^~>=<\s]+/, "");
+    return /^\d+\.\d+/.test(cleaned) ? cleaned : "";
+  } catch {
+    return "";
+  }
+}
 function resolveGitSha(cwd) {
   try {
     return execSync("git rev-parse HEAD", {
@@ -62,11 +80,14 @@ async function createTarball(distDir) {
     archive.finalize();
   });
 }
-async function ensureAppRecord(apiBase, token, appName, appTitle) {
+async function ensureAppRecord(apiBase, token, appName, appTitle, accessLevel) {
   const appData = {
     name: appTitle,
     hosting_type: "s3"
   };
+  if (accessLevel) {
+    appData.access_level = accessLevel;
+  }
   const res = await fetchWithRetry(`${apiBase}/custom-apps/${encodeURIComponent(appName)}/registration`, {
     method: "PUT",
     headers: {
@@ -87,13 +108,14 @@ async function deploy(options) {
     appName,
     appTitle,
     distDir,
-    apiUrl
+    apiUrl,
+    accessLevel
   } = options;
   if (!existsSync(distDir)) {
     throw new Error(`dist directory not found: ${distDir}`);
   }
   console.log(pc.dim("Ensuring app record..."));
-  await ensureAppRecord(apiUrl, token, appName, appTitle);
+  await ensureAppRecord(apiUrl, token, appName, appTitle, accessLevel);
   console.log(pc.cyan(`Deploying ${appTitle}...`));
   const version = options.version || process.env.LUMERA_APP_VERSION?.trim() || resolveVersion(dirname(distDir));
   console.log(pc.dim(`Version: ${version}`));
@@ -104,6 +126,8 @@ async function deploy(options) {
   formData.append("version", version);
   const gitSha = resolveGitSha(dirname(distDir));
   if (gitSha) formData.append("git_sha", gitSha);
+  const uiVersion = resolveUIVersion(dirname(distDir));
+  if (uiVersion) formData.append("ui_version", uiVersion);
   const res = await fetchWithRetry(`${apiUrl}/custom-apps/${appName}/deploy`, {
     method: "POST",
     headers: {
@@ -118,9 +142,13 @@ async function deploy(options) {
   }
   const result = await res.json();
   const launchUrl = result.launch_url;
+  const appUrl = result.app_url;
   console.log(pc.green(`
 Deployed! ${launchUrl}`));
-  return { launchUrl, version };
+  if (appUrl) {
+    console.log(pc.green(`App URL:  ${appUrl}`));
+  }
+  return { launchUrl, appUrl, version };
 }
 async function registerDevApp(apiBase, token, appName, appTitle, appUrl) {
   const appData = {

package/dist/{dev-UTPD4MN5.js → dev-VWHFYKGC.js}

@@ -1,6 +1,6 @@
 import {
   dev
-} from "./chunk-WV5HOQNX.js";
+} from "./chunk-I7QEYKS7.js";
 import {
   syncDeps
 } from "./chunk-3ESHIPZH.js";

package/dist/index.js

@@ -226,29 +226,29 @@ async function main() {
     switch (command) {
       // Resource commands
       case "plan":
-        await import("./resources-QCCLRDOL.js").then((m) => m.plan(args.slice(1)));
+        await import("./resources-AMXL4A64.js").then((m) => m.plan(args.slice(1)));
         break;
       case "apply":
-        await import("./resources-QCCLRDOL.js").then((m) => m.apply(args.slice(1)));
+        await import("./resources-AMXL4A64.js").then((m) => m.apply(args.slice(1)));
         break;
       case "pull":
-        await import("./resources-QCCLRDOL.js").then((m) => m.pull(args.slice(1)));
+        await import("./resources-AMXL4A64.js").then((m) => m.pull(args.slice(1)));
         break;
       case "destroy":
-        await import("./resources-QCCLRDOL.js").then((m) => m.destroy(args.slice(1)));
+        await import("./resources-AMXL4A64.js").then((m) => m.destroy(args.slice(1)));
         break;
       case "list":
-        await import("./resources-QCCLRDOL.js").then((m) => m.list(args.slice(1)));
+        await import("./resources-AMXL4A64.js").then((m) => m.list(args.slice(1)));
         break;
       case "show":
-        await import("./resources-QCCLRDOL.js").then((m) => m.show(args.slice(1)));
+        await import("./resources-AMXL4A64.js").then((m) => m.show(args.slice(1)));
         break;
       case "diff":
-        await import("./resources-QCCLRDOL.js").then((m) => m.diff(args.slice(1)));
+        await import("./resources-AMXL4A64.js").then((m) => m.diff(args.slice(1)));
         break;
       // Development
       case "dev":
-        await import("./dev-UTPD4MN5.js").then((m) => m.dev(args.slice(1)));
+        await import("./dev-VWHFYKGC.js").then((m) => m.dev(args.slice(1)));
         break;
       case "run":
         await import("./run-DJXAXDD2.js").then((m) => m.run(args.slice(1)));

package/dist/{resources-QCCLRDOL.js → resources-AMXL4A64.js}

@@ -1,6 +1,6 @@
 import {
   deploy
-} from "./chunk-WV5HOQNX.js";
+} from "./chunk-I7QEYKS7.js";
 import {
   syncDeps
 } from "./chunk-3ESHIPZH.js";
@@ -126,7 +126,6 @@ var collectionSchemaRule = {
     const fields = parsed.fields;
     const indexes = parsed.indexes;
     const search = parsed.search;
-    const audit = parsed.audit;
     const localFieldTypes = /* @__PURE__ */ new Map();
     if (Array.isArray(fields)) {
       for (const field of fields) {
@@ -166,9 +165,6 @@ var collectionSchemaRule = {
         }
       }
     }
-    if (audit !== void 0 && typeof audit !== "boolean") {
-      issues.push(error(target, 'Optional field "audit" must be a boolean when present.'));
-    }
     if (indexes !== void 0) {
       if (!Array.isArray(indexes)) {
         issues.push(error(target, 'Optional field "indexes" must be an array when present.'));
@@ -1370,10 +1366,6 @@ function loadLocalCollections(platformDir, filterName) {
         errors.push(`${file}: missing fields array`);
         continue;
       }
-      if (collection.audit !== void 0 && typeof collection.audit !== "boolean") {
-        errors.push(`${file}: audit must be a boolean when present`);
-        continue;
-      }
       for (let i = 0; i < collection.fields.length; i++) {
         const field = collection.fields[i];
         if (!field || typeof field !== "object") {
@@ -1550,14 +1542,7 @@ function convertCollectionToApiFormat(local) {
     const indexName = `idx_${local.id}_${idx.fields.join("_")}`;
     return `CREATE ${unique}INDEX ${indexName} ON ${local.name} (${fields})`;
   });
-  return {
-    id: local.id,
-    name: local.name,
-    schema,
-    indexes,
-    search: local.search ?? null,
-    ...local.audit !== void 0 ? { audit: local.audit } : {}
-  };
+  return { id: local.id, name: local.name, schema, indexes, search: local.search ?? null };
 }
 function mapFieldType(type) {
   const typeMap = {
@@ -1679,10 +1664,7 @@ async function planCollections(api, localCollections) {
         resource: "collection",
         id: local.id,
         name: local.name,
-        details: [
-          `${local.fields.length} fields`,
-          ...local.audit !== void 0 ? [local.audit ? "audit enabled" : "audit disabled"] : []
-        ].join(", "),
+        details: `${local.fields.length} fields`,
         fieldDetails: local.fields.map((f) => ({
           action: "+",
           name: f.name,
@@ -1708,15 +1690,13 @@ async function planCollections(api, localCollections) {
       }
       const indexesChanged = indexesDiffer(local, remote.indexes || []);
       const searchChanged = normalizeCollectionSearch(local.search) !== normalizeCollectionSearch(remote.search);
-      const auditChanged = local.audit !== void 0 && local.audit !== remote.audit;
-      if (added.length > 0 || removed.length > 0 || modified.length > 0 || indexesChanged || searchChanged || auditChanged) {
+      if (added.length > 0 || removed.length > 0 || modified.length > 0 || indexesChanged || searchChanged) {
         const details = [];
         if (added.length > 0) details.push(`+${added.length} field${added.length > 1 ? "s" : ""}`);
         if (removed.length > 0) details.push(`-${removed.length} field${removed.length > 1 ? "s" : ""}`);
         if (modified.length > 0) details.push(`~${modified.length} field${modified.length > 1 ? "s" : ""} (${modified.join(", ")})`);
         if (indexesChanged) details.push("indexes changed");
         if (searchChanged) details.push("search changed");
-        if (auditChanged) details.push(local.audit ? "audit enabled" : "audit disabled");
         const fieldDetails = [];
         for (const name of added) {
           const f = localFieldMap.get(name);
@@ -2184,24 +2164,38 @@ async function applyApp(args) {
     }
   }
   const distDir = resolve(projectRoot, "dist");
-  await deploy({ token, appName, appTitle, distDir, apiUrl });
+  const accessLevel = getFlagValue(args, "access-level");
+  const validAccessLevels = [
+    "org_members_with_permission",
+    "org_members",
+    "invited",
+    "signed_in",
+    "public"
+  ];
+  if (accessLevel && !validAccessLevels.includes(accessLevel)) {
+    throw new Error(
+      `Invalid --access-level "${accessLevel}". Valid values: ${validAccessLevels.join(", ")}`
+    );
+  }
+  await deploy({ token, appName, appTitle, distDir, apiUrl, accessLevel });
 }
-async function pullCollections(api, platformDir, filterName, projectId) {
+async function pullCollections(api, platformDir, filterName, appName) {
   const collectionsDir = join2(platformDir, "collections");
   mkdirSync(collectionsDir, { recursive: true });
   const collections = await api.listCollections();
   for (const collection of collections) {
     if (collection.system || collection.managed) continue;
-    if (projectId && collection.project_id !== projectId) continue;
-    if (!projectId && collection.project_id) continue;
-    const localName = collection.name;
+    if (appName && collection.name.includes(NAMESPACE_SEPARATOR)) {
+      const prefix = collection.name.split(NAMESPACE_SEPARATOR)[0];
+      if (prefix !== sanitizeSlugForCollectionName(appName)) continue;
+    }
+    const localName = stripNamespacePrefix(collection.name, appName);
     if (filterName && localName !== filterName && collection.name !== filterName && collection.id !== filterName) {
       continue;
     }
     const localFormat = {
       id: collection.id,
       name: localName,
-      audit: collection.audit,
       fields: collection.schema.map((field) => {
         const localField = {
           name: field.name,
@@ -2605,11 +2599,7 @@ async function listResources(api, platformDir, filterType, appName, projectId) {
   if (!filterType || filterType === "collections") {
     const localCollections = loadLocalCollections(platformDir);
     const remoteCollections = await api.listCollections();
-    const projectCollections = remoteCollections.filter((collection) => {
-      if (collection.system || collection.managed) return false;
-      return projectId ? collection.project_id === projectId : !collection.project_id;
-    });
-    const remoteByName = new Map(projectCollections.map((collection) => [collection.name, collection]));
+    const remoteByName = new Map(remoteCollections.filter((c) => !c.system && !c.managed).map((c) => [stripNamespacePrefix(c.name, appName), c]));
     const localNames = new Set(localCollections.map((c) => c.name));
     for (const local of localCollections) {
       const remote = remoteByName.get(local.name);
@@ -2630,9 +2620,15 @@ async function listResources(api, platformDir, filterType, appName, projectId) {
         }
       }
     }
-    for (const remote of projectCollections) {
-      if (!localNames.has(remote.name)) {
-        results.push({ name: remote.name, type: "collections", status: "remote-only" });
+    for (const remote of remoteCollections) {
+      if (remote.system || remote.managed) continue;
+      if (appName && remote.name.includes(NAMESPACE_SEPARATOR)) {
+        const prefix = remote.name.split(NAMESPACE_SEPARATOR)[0];
+        if (prefix !== sanitizeSlugForCollectionName(appName)) continue;
+      }
+      const stripped = stripNamespacePrefix(remote.name, appName);
+      if (!localNames.has(stripped)) {
+        results.push({ name: stripped, type: "collections", status: "remote-only" });
       }
     }
   }
@@ -3593,7 +3589,7 @@ async function pull(args) {
   console.log();
   if (!type || type === "collections") {
     console.log(pc2.bold("  Collections:"));
-    await pullCollections(api, platformDir, name || void 0, projectId);
+    await pullCollections(api, platformDir, name || void 0, appName);
     console.log();
     if (!name) {
       console.log(pc2.bold("  Resource shares:"));
@@ -3921,15 +3917,10 @@ async function diff(args) {
 }
 export {
   apply,
-  applyCollections,
-  convertCollectionToApiFormat,
   destroy,
   diff,
   list,
-  loadLocalCollections,
   plan,
-  planCollections,
   pull,
-  pullCollections,
   show
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumerahq/cli",
-  "version": "0.23.0-dev.3",
+  "version": "0.23.0",
   "description": "CLI for building and deploying Lumera apps",
   "type": "module",
   "engines": {

package/templates/default/package.json

@@ -24,7 +24,7 @@
     "check:ci": "biome check . && tsr generate && tsc --noEmit"
   },
   "dependencies": {
-    "@lumerahq/ui": "^0.13.0-dev.2",
+    "@lumerahq/ui": "^0.13.0",
     "@tanstack/react-query": "^5.90.11",
     "@tanstack/react-router": "1.155.0",
     "clsx": "^2.1.1",

package/templates/default/src/main.tsx

@@ -1,4 +1,10 @@
-import { type HostPayload, isEmbedded, onInitMessage, postReadyMessage } from '@lumerahq/ui/lib';
+import {
+  type HostPayload,
+  isEmbedded,
+  onInitMessage,
+  postReadyMessage,
+  redirectToLogin,
+} from '@lumerahq/ui/lib';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { createHashHistory, createRouter, RouterProvider } from '@tanstack/react-router';
 import { StrictMode, useEffect, useRef, useState } from 'react';
@@ -60,24 +66,27 @@ function RouteRestorer() {
 
 const App = () => {
   const [hostContext, setHostContext] = useState<AuthContextValue | null>(null);
-  const [status, setStatus] = useState<'pending' | 'ready' | 'denied'>('pending');
+  const [status, setStatus] = useState<'pending' | 'ready' | 'unauthenticated'>('pending');
 
   useEffect(() => {
     if (typeof window === 'undefined') return;
 
-    const standaloneDevMode =
-      import.meta.env.DEV && !isEmbedded() && !!import.meta.env.VITE_DEV_API_BASE_URL;
-
-    if (!isEmbedded() && !standaloneDevMode) {
-      setStatus('denied');
-      return;
-    }
-
+    // The bridge picks the transport automatically: postMessage when embedded
+    // in the Lumera shell, same-origin /api with the app-session cookie when
+    // served standalone on the app's own hostname, and direct dev fetch when
+    // VITE_DEV_API_BASE_URL is set.
     const cleanup = onInitMessage((payload?: HostPayload) => {
+      if (!payload) {
+        // No identity and no app context: authentication is required
+        // (payload.user alone being undefined means an anonymous visitor on
+        // a public app — that still counts as ready).
+        setStatus('unauthenticated');
+        return;
+      }
       setHostContext({
-        company: payload?.company,
-        user: payload?.user,
-        sessionToken: payload?.session?.token,
+        company: payload.company,
+        user: payload.user,
+        sessionToken: payload.session?.token,
       });
       setStatus('ready');
     });
@@ -99,16 +108,23 @@ const App = () => {
     );
   }
 
-  if (status === 'denied' || !hostContext) {
+  if (status === 'unauthenticated' || !hostContext) {
     return (
       <main className="flex min-h-screen items-center justify-center bg-background">
         <div className="text-center space-y-3">
           <div className="inline-flex size-12 rounded-xl bg-muted items-center justify-center mb-2">
-            <span className="text-2xl font-semibold text-muted-foreground">403</span>
+            <span className="text-2xl font-semibold text-muted-foreground">401</span>
           </div>
-          <p className="text-sm text-muted-foreground">
-            Access denied, this app can only be accessed from within Lumera.
-          </p>
+          <p className="text-sm text-muted-foreground">Sign in to access this app.</p>
+          {!isEmbedded() && (
+            <button
+              type="button"
+              className="text-sm font-medium text-primary underline underline-offset-4"
+              onClick={() => redirectToLogin()}
+            >
+              Sign in with Lumera
+            </button>
+          )}
         </div>
       </main>
     );

package/templates/default/vite.config.ts

@@ -20,6 +20,8 @@ export default defineConfig({
     dedupe: ['react', 'react-dom'],
   },
   server: {
-    allowedHosts: ['mac.lumerahq.com'],
+    // Local platform host plus standalone app hostnames
+    // (<project>--<company>.<env-suffix> on lumerahq.app).
+    allowedHosts: ['mac.lumerahq.com', '.lumerahq.app'],
   },
 });