@stage5/lumine 0.2.46 → 0.2.48

package/lib/admin.js

@@ -1151,6 +1151,11 @@ export function parseAdminOperation(options) {
   }
 
   if (namespace === "bot-output" && !action) {
+    if (options.adminDays && options.adminCursor) {
+      throw cliValidationError(
+        "Continue a bot-output --cursor without changing its --days window.",
+      );
+    }
     if (options.adminDays) {
       const days = Number(options.adminDays);
       if (!Number.isInteger(days) || days < 1 || days > 30) {
@@ -1159,7 +1164,10 @@ export function parseAdminOperation(options) {
     }
     return readOperation(
       "bot.output",
-      withQuery("/cli/admin/bot-output", { days: options.adminDays }),
+      withQuery("/cli/admin/bot-output", {
+        days: options.adminDays,
+        cursor: options.adminCursor,
+      }),
     );
   }
 

package/lib/commands.js

@@ -2767,7 +2767,7 @@ export function printHelp() {
   lumine admin comment post --draft-id <id> [--json]
   lumine admin comment edit <comment-id> --file <comment.md> [--json]
   lumine admin brief [--days <1..30>] [--json]
-  lumine admin bot-output [--days <1..30>] [--json]
+  lumine admin bot-output [--days <1..30>|--cursor <cursor>] [--json]
   lumine admin announcement post --file <announcement.md> [--json]
   lumine admin chat send <user-id|username> --file <message.md> [--json]
   lumine admin news claim [--date YYYY-MM-DD] [--output <claim.json>] [--scaffold <editorial.json>] [--json]

package/lib/sdk.js

@@ -38,9 +38,12 @@ export const SDK_CLI_METHODS = {
   "sharedDb.getTopics": { path: "api/shared-db/topics", scopes: ["sharedDb:read"] },
   "sharedDb.createTopic": { path: "api/shared-db/topic", scopes: ["sharedDb:write"], write: true },
   "sharedDb.getEntries": { path: "api/shared-db/entries", scopes: ["sharedDb:read"] },
+  "sharedDb.getEntriesByIds": { path: "api/shared-db/entries/by-ids", scopes: ["sharedDb:read"] },
   "sharedDb.addEntry": { path: "api/shared-db/entry", scopes: ["sharedDb:write"], write: true },
+  "sharedDb.addEntries": { path: "api/shared-db/entries/batch", scopes: ["sharedDb:write"], write: true },
   "sharedDb.updateEntry": { path: "api/shared-db/entry/update", scopes: ["sharedDb:write"], write: true },
   "sharedDb.deleteEntry": { path: "api/shared-db/entry/delete", scopes: ["sharedDb:write"], write: true },
+  "sharedDb.deleteEntries": { path: "api/shared-db/entries/delete", scopes: ["sharedDb:write"], write: true },
   "sharedDb.kv.get": { path: "api/shared-db/kv/get", scopes: ["sharedDb:read"] },
   "sharedDb.kv.list": { path: "api/shared-db/kv/list", scopes: ["sharedDb:read"] },
   // The kv/set endpoint is batch-shaped ({ namespace, items }); kv.set keeps

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage5/lumine",
-  "version": "0.2.46",
+  "version": "0.2.48",
   "description": "Command line tools for launching Lumine builds on Twinkle.",
   "type": "module",
   "bin": {

package/sdk/BUILD_SDK_INDEX.md

@@ -1,8 +1,8 @@
 # Build SDK Index
 
-Version: 1.35.0
-Updated: 2026-08-18
-Generated: 2026-08-18T06:06:02.345Z
+Version: 1.36.0
+Updated: 2026-08-19
+Generated: 2026-08-19T05:45:14.858Z
 
 ## Notes
 - This SDK is injected into Build iframes via the Build preview/runtime.
@@ -645,6 +645,12 @@ const result = await Twinkle.characters.chat({ character: 'zero', thinkingMode:
   - Fetch the next sharedDb page.
   - Convenience alias for getEntries used by Load more buttons.
   - Pass the previous response cursor to fetch the next page using the same order and page size.
+- async getEntriesByIds(entryIds) | scopes: sharedDb:read
+  - Returns: { entries: [{ id, topicId, userId, username, profilePicUrl, data, createdAt, updatedAt }] }
+  - Read up to 100 shared rows by their app-scoped entry ids.
+  - Accepts 1-100 unique positive entry ids and returns the rows that still exist in the same order as requested.
+  - Ids from another Build app are never returned.
+  - Use this for bounded manifest references; use getEntries for browseable topic feeds.
 - async addEntry(topicName, data, { notify } = {}) | scopes: sharedDb:write
   - Returns: { entry: { id, topicId, userId, username, profilePicUrl, data, createdAt, updatedAt } }
   - Append a shared JSON row, optionally creating a Twinkle notification from the canonical write.
@@ -653,6 +659,14 @@ const result = await Twinkle.characters.chat({ character: 'zero', thinkingMode:
   - notify may include eventKey, label, summary, recipients, and target. Supported recipients start with { kind: 'buildOwner' }.
   - Use target.focus, such as { kind: 'sharedDbEntry', entryId: '$createdEntryId' }, so Twinkle.notifications can focus the item when opened.
   - Use Twinkle.leaderboards for standard top-score rankings and personal-best scoreboards.
+- async addEntries(topicName, items) | scopes: sharedDb:write
+  - Returns: { entries: [{ id, topicId, userId, username, profilePicUrl, data, createdAt, updatedAt }] }
+  - Atomically append up to 100 owner-controlled JSON rows for one low-frequency user action.
+  - items must contain 1-100 JSON objects; each object remains capped at 10 KB.
+  - All rows are created atomically in one topic and returned as canonical server entries.
+  - Batch rows remain controlled by their creator or the Build owner, just like addEntry rows.
+  - This method intentionally does not support subjectRef or notifications; use addEntry when either is needed.
+  - Use for one bounded durable action, not per-frame or per-tick logging.
 - async updateEntry(entryId, data, { notify } = {}) | scopes: sharedDb:write
   - Returns: { entry: { id, topicId, userId, username, profilePicUrl, data, createdAt, updatedAt } }
   - Update a viewer-owned shared row, optionally notifying safe recipients from the canonical write.
@@ -662,6 +676,12 @@ const result = await Twinkle.characters.chat({ character: 'zero', thinkingMode:
 - async deleteEntry(entryId) | scopes: sharedDb:write
   - Returns: { success: true }
   - Deletes an entry. Only the entry creator or the build owner can delete.
+- async deleteEntries(entryIds) | scopes: sharedDb:write
+  - Returns: { success: true, deletedEntryIds: number[], missingEntryIds: number[] }
+  - Atomically delete up to 100 owned shared rows.
+  - Accepts 1-100 unique positive entry ids.
+  - Every existing target must be writable by the viewer or Build owner; otherwise the whole request rejects without deleting anything.
+  - Missing rows are reported and ignored, making cleanup idempotent.
 - async kv.get(namespace, key) | scopes: sharedDb:read
   - Returns: { item: { id, key, value, version, changeSeq, deleted, updatedBy, createdAt, updatedAt } | null }
   - Read one key from the keyed shared store (shared mutable state). Deleted keys read as null.

package/sdk/LUMINE_ADMIN.md

@@ -802,11 +802,13 @@ type BuildCandidates = Success<{
 }>;
 ```
 
-Subject cursors freeze a primary-key high-water mark and traverse descending
-IDs. Bounded recommendation cursors freeze both the feed-ID high-water mark and
-the server timestamp, then traverse the indexed `(timeStamp, id)` order; this
-also catches a Daily Reflection whose old feed row moved forward when it was
-reshared. Explicit legacy scans retain the descending primary-key walk. A page
+Subject cursors freeze a primary-key high-water mark plus the server snapshot
+timestamp and traverse descending IDs; bounded scans keep creation timestamps
+inside that confirmed interval. Bounded recommendation cursors freeze both the
+feed-ID high-water mark and the server timestamp, then traverse the indexed
+`(timeStamp, id)` order; this also catches a Daily Reflection whose old feed
+row moved forward when it was reshared. Explicit legacy scans retain the
+descending primary-key walk. A page
 can be empty while `hasMore` remains true; continue until `exhausted`. `--all`
 does that automatically and writes a private checkpoint after every
 server-confirmed page; `--resume` continues only when the checkpoint belongs to
@@ -1449,6 +1451,7 @@ type NewsSubmit = NewsStatus; // "success"; newspaper includes revisionNumber
 ```bash
 lumine admin bot-output --json
 lumine admin bot-output --days 3 --json
+lumine admin bot-output --cursor '<pagination.nextCursor>' --json
 ```
 
 **Every run reviews what Zero and Ciel themselves said since the last run.**
@@ -1463,26 +1466,72 @@ Reflections — and it surfaced only because the kid showed Mikey).
 (`--days 1..30` overrides): `chatMessages` (every stored Zero/Ciel chat and
 reflection reply, with full text and recipient metadata when its best-effort
 prompt audit exists) and `comments`
-(every public bot comment/reply). Truncation flags mark anything beyond 400
-rows per source — retry with a narrower `--days` window, and do not complete
-the run while either flag remains true. Run it right after the
-brief, and **read every row** — the tool deliberately does no filtering,
-scoring, or keyword matching, because the judgment is the reviewing agent's.
-
-**Privacy boundary:** this is an audit of how Twinkle's bots treated members,
-not a moderation queue for members' private use of the tool. Treat private
-human messages and creative work as confidential context. Read every
-bot-authored row, but inspect adjacent human messages only when the minimum
-necessary context is needed to judge the bot's response; never browse the rest
-of a private conversation out of curiosity. Do not characterize or escalate a
-member's lawful private creative writing — including a teenager's romance
-fiction — merely because its subject is intimate or romantic. An escalation
-must identify what **Zero or Ciel** did (for example, an invented premise,
-pressure, sexualization, abuse, or a failed boundary), include only the narrow
-context needed for Mikey to decide a remedy, and never reuse private material
-for public editorial judgment, Notable User selection, or unrelated identity
-investigation. A separate concrete risk to a member may still be escalated,
-but it does not authorize a broader review of their private activity.
+(every public bot comment/reply). Individual utterances are returned in full;
+the API never clips their tails. The first response freezes a canonical
+high-water mark for both sources. Truncation flags mark another page beyond
+the 400-row or bounded-response-size budget; continue with the exact
+`pagination.nextCursor` until
+`pagination.exhausted` is true and both flags are false. A cursor retains the
+original time window and cannot be combined with `--days`. Do not complete the
+run while either flag remains true. The default window deliberately overlaps
+from the previous completed run's start, so output created after its review
+snapshot but before completion is reviewed again instead of being lost. Run it
+right after the brief, and **read every row** — the tool deliberately does no
+filtering, scoring, or keyword matching, because the judgment is the reviewing
+agent's.
+
+**Purpose and privacy boundary:** this audits how Twinkle's bots treated
+members; it is not thought-policing or a moderation queue for members' private
+use of the tool. The question is whether Zero or Ciel inflicted, encouraged,
+or operationally facilitated potential harm — not whether a member's private
+idea is taboo, upsetting, sexual, violent, or angry. Treat private human
+messages and creative work as confidential context. Read every bot-authored
+row, but inspect adjacent human messages only when the minimum necessary
+context is needed to judge what the bot did; never browse the rest of a private
+conversation out of curiosity. Never reuse private material for public
+editorial judgment, Notable User selection, or unrelated identity
+investigation.
+
+**Private creative-expression rule (Mikey's direction, 2026-08-19):** Zero and
+Ciel are tools members may use to express lawful private fiction already in
+their imagination. A high-school member writing romantic or sexual fiction
+about fictional peers around their own age is not an escalation merely because
+the prose is explicit or set at a school. Sexual fantasy is not inherently a
+dangerous thought, just as violent or angry fantasy alone is not evidence of
+real-world intent. If the member requested the fictional content and the bot
+helped put it into words, that assistance is not by itself the bot encouraging
+the member to think or act that way. Do not characterize, flag, notify anyone
+about, or intervene in that private creative endeavor absent a separate
+concrete harm signal.
+
+**Real-world-harm boundary:** actionable assistance for poisoning someone,
+covertly hurting or tormenting a real target, evading detection, grooming,
+abuse, or another actual crime is categorically different from fantasy. A bot
+that supplies such operational instructions commits an urgent conduct
+violation. A bot that refuses and redirects safely has behaved correctly; the
+member's request becomes a separate private safety escalation only when the
+available context shows a concrete, credible bridge to real-world harm — such
+as an identifiable target, expressed intent, means, planning, or concealment —
+not merely because a disturbing thought or fictional premise exists.
+
+**Position-of-trust safeguarding rule (Mikey's direction, 2026-08-19):** an
+adult teacher, or another adult in a comparable position of authority and
+direct access to children, creating or requesting sexual content about an
+underage child is always a private safeguarding escalation, even when framed
+as fiction. The mandatory flag follows from the adult's power, duty of care,
+and access to students — not from treating sex as uniquely taboo. Preserve only
+the minimum necessary evidence and report it privately to Mikey so he can tell
+Andrew and decide the response. A flag is not a public accusation or automatic
+finding of guilt; do not contact the teacher, students, or families without
+Mikey's direction. An identifiable real student, grooming, planning,
+concealment, or actionable abuse makes the escalation urgent.
+
+Every escalation must state which rule was triggered and identify either what
+**Zero or Ciel** did (for example, an invented premise, pressure,
+sexualization of the member, actionable facilitation, abuse, or a failed
+boundary) or the concrete safeguarding signal. Include only the narrow context
+needed for Mikey to decide a remedy. A separate concrete risk may justify this
+minimal review, but it never authorizes browsing unrelated private activity.
 
 Judge against the same values the editorial priorities encode:
 
@@ -1510,11 +1559,12 @@ Judge against the same values the editorial priorities encode:
   enforce. Even a genuinely excessive routine warrants a question ("is this
   still helping you, or would a break feel better?"), never a decree.
 
-Anything over the line goes on the escalation list with the message text and
-the child's username — top of the list, alongside child-safety. Do not
-apologize as the bot, edit, or otherwise clean up without Mikey's direction;
-he decides the remedy. When he explicitly directs a private correction, use
-the composed-only existing-DM path (no model and no AI Energy):
+A bot-conduct violation or mandatory safeguarding signal goes on the
+escalation list with the smallest excerpt and identity needed to evaluate it —
+top of the list when urgent. Do not apologize as the bot, edit, contact the
+member, or otherwise clean up without Mikey's direction; he decides the
+remedy. When he explicitly directs a private correction, use the composed-only
+existing-DM path (no model and no AI Energy):
 
 ```bash
 lumine admin chat send <userId|username> --file message.md --json