@lumerahq/cli 0.23.0-dev.3 → 0.24.0

package/dist/{chunk-WV5HOQNX.js → chunk-I7QEYKS7.js}

@@ -41,6 +41,24 @@ function resolveVersion(cwd) {
   }
   return formatTimestampVersion();
 }
+function resolveUIVersion(cwd) {
+  try {
+    const installed = JSON.parse(
+      readFileSync(resolve(cwd, "node_modules/@lumerahq/ui/package.json"), "utf-8")
+    );
+    if (installed?.version) return String(installed.version);
+  } catch {
+  }
+  try {
+    const pkg = JSON.parse(readFileSync(resolve(cwd, "package.json"), "utf-8"));
+    const spec = pkg?.dependencies?.["@lumerahq/ui"] ?? pkg?.devDependencies?.["@lumerahq/ui"];
+    if (!spec) return "none";
+    const cleaned = String(spec).replace(/^[\^~>=<\s]+/, "");
+    return /^\d+\.\d+/.test(cleaned) ? cleaned : "";
+  } catch {
+    return "";
+  }
+}
 function resolveGitSha(cwd) {
   try {
     return execSync("git rev-parse HEAD", {
@@ -62,11 +80,14 @@ async function createTarball(distDir) {
     archive.finalize();
   });
 }
-async function ensureAppRecord(apiBase, token, appName, appTitle) {
+async function ensureAppRecord(apiBase, token, appName, appTitle, accessLevel) {
   const appData = {
     name: appTitle,
     hosting_type: "s3"
   };
+  if (accessLevel) {
+    appData.access_level = accessLevel;
+  }
   const res = await fetchWithRetry(`${apiBase}/custom-apps/${encodeURIComponent(appName)}/registration`, {
     method: "PUT",
     headers: {
@@ -87,13 +108,14 @@ async function deploy(options) {
     appName,
     appTitle,
     distDir,
-    apiUrl
+    apiUrl,
+    accessLevel
   } = options;
   if (!existsSync(distDir)) {
     throw new Error(`dist directory not found: ${distDir}`);
   }
   console.log(pc.dim("Ensuring app record..."));
-  await ensureAppRecord(apiUrl, token, appName, appTitle);
+  await ensureAppRecord(apiUrl, token, appName, appTitle, accessLevel);
   console.log(pc.cyan(`Deploying ${appTitle}...`));
   const version = options.version || process.env.LUMERA_APP_VERSION?.trim() || resolveVersion(dirname(distDir));
   console.log(pc.dim(`Version: ${version}`));
@@ -104,6 +126,8 @@ async function deploy(options) {
   formData.append("version", version);
   const gitSha = resolveGitSha(dirname(distDir));
   if (gitSha) formData.append("git_sha", gitSha);
+  const uiVersion = resolveUIVersion(dirname(distDir));
+  if (uiVersion) formData.append("ui_version", uiVersion);
   const res = await fetchWithRetry(`${apiUrl}/custom-apps/${appName}/deploy`, {
     method: "POST",
     headers: {
@@ -118,9 +142,13 @@ async function deploy(options) {
   }
   const result = await res.json();
   const launchUrl = result.launch_url;
+  const appUrl = result.app_url;
   console.log(pc.green(`
 Deployed! ${launchUrl}`));
-  return { launchUrl, version };
+  if (appUrl) {
+    console.log(pc.green(`App URL:  ${appUrl}`));
+  }
+  return { launchUrl, appUrl, version };
 }
 async function registerDevApp(apiBase, token, appName, appTitle, appUrl) {
   const appData = {

package/dist/{dev-UTPD4MN5.js → dev-VWHFYKGC.js}

@@ -1,6 +1,6 @@
 import {
   dev
-} from "./chunk-WV5HOQNX.js";
+} from "./chunk-I7QEYKS7.js";
 import {
   syncDeps
 } from "./chunk-3ESHIPZH.js";

package/dist/index.js

@@ -226,29 +226,29 @@ async function main() {
     switch (command) {
       // Resource commands
       case "plan":
-        await import("./resources-QCCLRDOL.js").then((m) => m.plan(args.slice(1)));
+        await import("./resources-CGMBV3T6.js").then((m) => m.plan(args.slice(1)));
         break;
       case "apply":
-        await import("./resources-QCCLRDOL.js").then((m) => m.apply(args.slice(1)));
+        await import("./resources-CGMBV3T6.js").then((m) => m.apply(args.slice(1)));
         break;
       case "pull":
-        await import("./resources-QCCLRDOL.js").then((m) => m.pull(args.slice(1)));
+        await import("./resources-CGMBV3T6.js").then((m) => m.pull(args.slice(1)));
         break;
       case "destroy":
-        await import("./resources-QCCLRDOL.js").then((m) => m.destroy(args.slice(1)));
+        await import("./resources-CGMBV3T6.js").then((m) => m.destroy(args.slice(1)));
         break;
       case "list":
-        await import("./resources-QCCLRDOL.js").then((m) => m.list(args.slice(1)));
+        await import("./resources-CGMBV3T6.js").then((m) => m.list(args.slice(1)));
         break;
       case "show":
-        await import("./resources-QCCLRDOL.js").then((m) => m.show(args.slice(1)));
+        await import("./resources-CGMBV3T6.js").then((m) => m.show(args.slice(1)));
         break;
       case "diff":
-        await import("./resources-QCCLRDOL.js").then((m) => m.diff(args.slice(1)));
+        await import("./resources-CGMBV3T6.js").then((m) => m.diff(args.slice(1)));
         break;
       // Development
       case "dev":
-        await import("./dev-UTPD4MN5.js").then((m) => m.dev(args.slice(1)));
+        await import("./dev-VWHFYKGC.js").then((m) => m.dev(args.slice(1)));
         break;
       case "run":
         await import("./run-DJXAXDD2.js").then((m) => m.run(args.slice(1)));

package/dist/{resources-QCCLRDOL.js → resources-CGMBV3T6.js}

@@ -1,6 +1,6 @@
 import {
   deploy
-} from "./chunk-WV5HOQNX.js";
+} from "./chunk-I7QEYKS7.js";
 import {
   syncDeps
 } from "./chunk-3ESHIPZH.js";
@@ -2184,7 +2184,20 @@ async function applyApp(args) {
     }
   }
   const distDir = resolve(projectRoot, "dist");
-  await deploy({ token, appName, appTitle, distDir, apiUrl });
+  const accessLevel = getFlagValue(args, "access-level");
+  const validAccessLevels = [
+    "org_members_with_permission",
+    "org_members",
+    "invited",
+    "signed_in",
+    "public"
+  ];
+  if (accessLevel && !validAccessLevels.includes(accessLevel)) {
+    throw new Error(
+      `Invalid --access-level "${accessLevel}". Valid values: ${validAccessLevels.join(", ")}`
+    );
+  }
+  await deploy({ token, appName, appTitle, distDir, apiUrl, accessLevel });
 }
 async function pullCollections(api, platformDir, filterName, projectId) {
   const collectionsDir = join2(platformDir, "collections");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumerahq/cli",
-  "version": "0.23.0-dev.3",
+  "version": "0.24.0",
   "description": "CLI for building and deploying Lumera apps",
   "type": "module",
   "engines": {

package/templates/default/package.json

@@ -24,7 +24,7 @@
     "check:ci": "biome check . && tsr generate && tsc --noEmit"
   },
   "dependencies": {
-    "@lumerahq/ui": "^0.13.0-dev.2",
+    "@lumerahq/ui": "^0.14.0",
     "@tanstack/react-query": "^5.90.11",
     "@tanstack/react-router": "1.155.0",
     "clsx": "^2.1.1",

package/templates/default/src/main.tsx

@@ -1,4 +1,10 @@
-import { type HostPayload, isEmbedded, onInitMessage, postReadyMessage } from '@lumerahq/ui/lib';
+import {
+  type HostPayload,
+  isEmbedded,
+  onInitMessage,
+  postReadyMessage,
+  redirectToLogin,
+} from '@lumerahq/ui/lib';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { createHashHistory, createRouter, RouterProvider } from '@tanstack/react-router';
 import { StrictMode, useEffect, useRef, useState } from 'react';
@@ -60,24 +66,27 @@ function RouteRestorer() {
 
 const App = () => {
   const [hostContext, setHostContext] = useState<AuthContextValue | null>(null);
-  const [status, setStatus] = useState<'pending' | 'ready' | 'denied'>('pending');
+  const [status, setStatus] = useState<'pending' | 'ready' | 'unauthenticated'>('pending');
 
   useEffect(() => {
     if (typeof window === 'undefined') return;
 
-    const standaloneDevMode =
-      import.meta.env.DEV && !isEmbedded() && !!import.meta.env.VITE_DEV_API_BASE_URL;
-
-    if (!isEmbedded() && !standaloneDevMode) {
-      setStatus('denied');
-      return;
-    }
-
+    // The bridge picks the transport automatically: postMessage when embedded
+    // in the Lumera shell, same-origin /api with the app-session cookie when
+    // served standalone on the app's own hostname, and direct dev fetch when
+    // VITE_DEV_API_BASE_URL is set.
     const cleanup = onInitMessage((payload?: HostPayload) => {
+      if (!payload) {
+        // No identity and no app context: authentication is required
+        // (payload.user alone being undefined means an anonymous visitor on
+        // a public app — that still counts as ready).
+        setStatus('unauthenticated');
+        return;
+      }
       setHostContext({
-        company: payload?.company,
-        user: payload?.user,
-        sessionToken: payload?.session?.token,
+        company: payload.company,
+        user: payload.user,
+        sessionToken: payload.session?.token,
       });
       setStatus('ready');
     });
@@ -99,16 +108,23 @@ const App = () => {
     );
   }
 
-  if (status === 'denied' || !hostContext) {
+  if (status === 'unauthenticated' || !hostContext) {
     return (
       <main className="flex min-h-screen items-center justify-center bg-background">
         <div className="text-center space-y-3">
           <div className="inline-flex size-12 rounded-xl bg-muted items-center justify-center mb-2">
-            <span className="text-2xl font-semibold text-muted-foreground">403</span>
+            <span className="text-2xl font-semibold text-muted-foreground">401</span>
           </div>
-          <p className="text-sm text-muted-foreground">
-            Access denied, this app can only be accessed from within Lumera.
-          </p>
+          <p className="text-sm text-muted-foreground">Sign in to access this app.</p>
+          {!isEmbedded() && (
+            <button
+              type="button"
+              className="text-sm font-medium text-primary underline underline-offset-4"
+              onClick={() => redirectToLogin()}
+            >
+              Sign in with Lumera
+            </button>
+          )}
         </div>
       </main>
     );

package/templates/default/vite.config.ts

@@ -20,6 +20,8 @@ export default defineConfig({
     dedupe: ['react', 'react-dom'],
   },
   server: {
-    allowedHosts: ['mac.lumerahq.com'],
+    // Local platform host plus standalone app hostnames
+    // (<project>--<company>.<env-suffix> on lumerahq.app).
+    allowedHosts: ['mac.lumerahq.com', '.lumerahq.app'],
   },
 });