@zaflun/lumio-agent-skill 0.2.0 → 0.5.0

package/dist/bin/lumio-skills.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   installSkillFiles
-} from "../chunk-5NNQDQNL.js";
+} from "../chunk-QXQNAYHN.js";
 
 // src/bin/lumio-skills.ts
 import { resolve } from "path";

package/dist/{chunk-5NNQDQNL.js → chunk-QXQNAYHN.js}

@@ -13,7 +13,7 @@ Lumio Extensions are sandboxed React apps that run inside a 3-layer iframe sandb
 
 \`\`\`
 3-Layer Sandbox:
-  Host (lumio.vision / OBS browser source)
+  Host (lumio.vision / browser source)
     \u2514\u2500\u2500 Supervisor iframe (supervisor.extension.lumio.vision)
           \u2514\u2500\u2500 Extension Runtime iframe (ext.lumio.vision)
                 \u2514\u2500\u2500 Web Worker (server function execution)
@@ -23,7 +23,7 @@ Lumio Extensions are sandboxed React apps that run inside a 3-layer iframe sandb
 Extension Project:
   lumio.config.json          <- Extension manifest (ID, name, category, permissions, targets, config_schema)
   src/editor.tsx             <- Dashboard editor panel (sidebar in overlay editor)
-  src/layer.tsx              <- OBS overlay surface (transparent, read-only inputs)
+  src/layer.tsx              <- Stream overlay surface (transparent, read-only inputs)
   src/interactive.tsx        <- Audience interaction page (optional)
   server/schema.ts           <- DB schema (defineTable + validators)
   server/functions.ts        <- Server functions (queries, mutations, actions)
@@ -52,7 +52,7 @@ Extension Project:
 | Target | Where | Purpose |
 |--------|-------|---------|
 | \`editor\` | Dashboard overlay editor sidebar | Config UI, settings, content management |
-| \`layer\` | OBS Browser Source (transparent) | Visual overlay in stream |
+| \`layer\` | Browser Source (transparent) | Visual overlay in stream |
 | \`interactive\` | Standalone page (\`/ext/{slug}\`) | Viewer interaction (votes, games) |
 
 All three surfaces share storage via \`useExtensionStorage()\` \u2014 changes in editor propagate to layer in real-time.
@@ -77,7 +77,8 @@ All three surfaces share storage via \`useExtensionStorage()\` \u2014 changes in
   "visibility": "public",
   "pricing": { "type": "free" },
   "config_schema": [
-    { "key": "title", "type": "string", "label": "Widget Title", "default_value": "My Widget", "required": true },
+    { "key": "title", "type": "string", "label": "Widget Title", "default_value": "My Widget", "required": true, "placeholder": "Enter title..." },
+    { "key": "fontSize", "type": "number", "label": "Font Size", "default_value": 16, "required": false, "min": 8, "max": 200, "unit": "px" },
     { "key": "showBorder", "type": "boolean", "label": "Show Border", "default_value": true, "required": false }
   ]
 }
@@ -136,21 +137,21 @@ lumio deploy
 
 ## Components
 
-15 SDK components (all accept \`style: VisionStyle\`):
+17 SDK components (all accept \`style: VisionStyle\`):
 
 **Layout:** \`Box\`, \`VStack\`, \`HStack\`, \`CompactView\`, \`List\`
-**Display:** \`Text\` (variant: heading/muted/default), \`Image\` (objectFit), \`Animated\`
-**Input:** \`Button\` (variant: default/destructive), \`Toggle\`, \`TextField\`, \`TextArea\`, \`NumberField\`, \`Dropdown\`, \`Slider\`
+**Display:** \`Text\` (variant: heading/muted/default), \`Image\` (objectFit), \`Animated\`, \`IconDisplay\`
+**Input:** \`Button\` (variant: default/destructive), \`Toggle\`, \`TextField\`, \`TextArea\`, \`NumberField\`, \`Dropdown\`, \`Slider\`, \`IconPicker\`
 
 **VisionStyle** is a typed CSS subset (allowed: flexbox, grid, \`position: relative\` / \`absolute\`, sizing, spacing, colors, border, typography, transitions; blocked: \`fixed\`, \`sticky\`, CSS expressions).
 
-On OBS layer: input components become read-only (buttons hidden, toggles show on/off text).
+On the layer surface: input components become read-only (buttons hidden, toggles show on/off text).
 
 See \`components.md\` for full props and examples.
 
 ## Hooks
 
-11 SDK hooks:
+12 SDK hooks:
 
 | Hook | Returns | Purpose |
 |------|---------|---------|
@@ -165,6 +166,7 @@ See \`components.md\` for full props and examples.
 | \`useQuery(fn, params?)\` | \`{ data, isLoading, error, refetch }\` | Call server query |
 | \`useMutation(fn)\` | \`{ mutate, mutateAsync, data, isLoading, error }\` | Call server mutation/action |
 | \`useAnimation(preset, options?)\` | \`animationProps\` | SDK animation presets for \`Animated\` component |
+| \`useIconPicker(options?)\` | \`{ isOpen, selected, open, close, select, clear, sources }\` | Headless state for custom icon picker UIs |
 
 **Important:** \`setStorage\` must always spread: \`setStorage({ ...storage, key: value })\`
 
@@ -218,6 +220,101 @@ const { execute: spotifyQueueAdd } = useLumioAction("spotify:queue_add");
 
 See \`server-functions.md\` for schema definition, storage scoping, and advanced patterns.
 
+## Bot Modules
+
+Extensions with category \`bot_module\` register handler-based server functions that respond to chat messages and platform events. Bot module handlers use six trigger types.
+
+### Handler Types
+
+| Handler | Trigger | Description |
+|---------|---------|-------------|
+| \`command(prefix, handler)\` | Chat command (e.g. \`!rank\`) | Fires when a message starts with the prefix |
+| \`keyword(words, handler)\` | Keyword match | Fires when a message contains any listed keyword |
+| \`pattern(regex, handler)\` | Regex match | Fires when a message matches the regex |
+| \`event(type, handler)\` | Platform event | Fires on a specific event (e.g. \`twitch:follower\`) |
+| \`timer(name, intervalSecs, handler)\` | Recurring timer | Fires every N seconds. Name must be unique per extension. |
+| \`moderate(handler)\` | Every message | Runs on every chat message for moderation decisions |
+
+### Handler Context
+
+Bot module handlers receive an extended \`ctx\` with chat-specific properties:
+
+\`\`\`typescript
+import { command } from "@zaflun/lumio-sdk/server";
+
+export const rankCmd = command("!rank", {
+  handler: async (ctx, message) => {
+    // ctx.user \u2014 chat user who sent the message
+    //   { platform, platform_user_id, display_name, roles }
+    //   roles: { moderator, vip, subscriber, broadcaster }
+
+    // ctx.auth \u2014 extension identity
+    //   { userId, accountId, extensionId, installId }
+
+    // ctx.cache \u2014 in-memory KV cache scoped to install (TTL-based)
+    await ctx.cache.set("last_rank_user", ctx.user.display_name, { ttl: 300 });
+    const cached = await ctx.cache.get("last_rank_user");
+
+    // ctx.defer() \u2014 schedule a follow-up after handler returns
+    ctx.defer(async () => {
+      await ctx.db.insert("rank_log", { user: ctx.user.display_name });
+    });
+
+    return { action: "send_message", message: \`@\${ctx.user.display_name} your rank is Gold!\` };
+  },
+});
+\`\`\`
+
+### \`ctx.user\` vs \`ctx.auth\`
+
+- \`ctx.user\` is the **chat user** who triggered the handler (their platform identity, display name, and role flags). Only available in bot module handlers.
+- \`ctx.auth\` is the **extension identity** (which extension, which install, which account). Available in all server functions.
+
+### Timer Naming
+
+Timer names must be unique within the extension. The name is used as the timer's identity for scheduling and deduplication. Use descriptive names:
+
+\`\`\`typescript
+timer("ad_reminder", 900, { handler: async (ctx) => { ... } });    // Good
+timer("t1", 900, { handler: async (ctx) => { ... } });             // Bad \u2014 unclear
+\`\`\`
+
+### \`ctx.cache\`
+
+The cache is an in-memory key-value store scoped to the extension install. Use it for rate limiting, cooldowns, and short-lived state that does not need to survive Worker restarts.
+
+\`\`\`typescript
+// Set with TTL (seconds)
+await ctx.cache.set("cooldown:ban:" + userId, "1", { ttl: 60 });
+
+// Get (returns null if expired or missing)
+const val = await ctx.cache.get("cooldown:ban:" + userId);
+
+// Delete
+await ctx.cache.delete("cooldown:ban:" + userId);
+\`\`\`
+
+### \`ctx.defer()\`
+
+Schedule work to run after the handler returns its response. Useful for logging, analytics, or secondary actions that should not delay the primary response.
+
+\`\`\`typescript
+export const modCheck = moderate({
+  handler: async (ctx, message) => {
+    if (isToxic(message.text)) {
+      ctx.defer(async () => {
+        await ctx.db.insert("mod_log", {
+          user: ctx.user.platform_user_id,
+          action: "timeout",
+          reason: "toxic message",
+        });
+      });
+      return { action: "timeout", duration: 300, message: "Please be respectful." };
+    }
+    return { action: "none" };
+  },
+});\`\`\`
+
 ## CLI Commands
 
 12 commands provided by \`@zaflun/lumio-cli\`:
@@ -334,7 +431,59 @@ See \`troubleshooting.md\` for the full error reference.
 // src/content/components.ts
 var componentsContent = `# Lumio SDK Components
 
-All 15 components available in \`@zaflun/lumio-sdk\`. Every component accepts an optional \`style: VisionStyle\` prop.
+All 31 components available in \`@zaflun/lumio-sdk\`. Every component accepts an optional \`style: VisionStyle\` prop.
+
+## Editor Components
+
+14 components for building settings UIs in \`editor.tsx\` and \`designer.tsx\`. They serialize via the Reconciler and render as \`@lumio/ui\` components on the host \u2014 matching the dashboard design system.
+
+\`\`\`tsx
+import {
+  EditorInput, EditorTextarea, EditorSelect, EditorCheckbox,
+  EditorSlider, EditorColorPicker, EditorGroup, EditorLabel,
+  EditorDivider, EditorInfo, EditorFontRow, EditorButton,
+  EditorFontPicker, EditorChannelRow, useEditorAction,
+} from "@zaflun/lumio-sdk";
+
+// Text/number input with label, placeholder, min/max, unit
+<EditorInput label="Font Size" type="number" value="16" onChange={setSize} min={8} max={200} unit="px" />
+
+// Select dropdown
+<EditorSelect label="Theme" value={theme} onChange={setTheme} options={[{ value: "dark", label: "Dark" }]} />
+
+// Checkbox toggle
+<EditorCheckbox label="Show Badges" checked={show} onChange={setShow} />
+
+// Slider with range
+<EditorSlider label="Opacity" value={100} onChange={setOpacity} min={0} max={100} unit="%" />
+
+// Color picker (HSV canvas + hex input)
+<EditorColorPicker label="Background" value="#000000" onChange={setColor} />
+
+// Compact font row: [B] [size px] [color]
+<EditorFontRow bold={isBold} onBoldChange={setBold} fontSize={16} onFontSizeChange={setSize} fontColor="#fff" onFontColorChange={setColor} />
+
+// Full-width button (primary/default/destructive)
+<EditorButton label="Open Designer" variant="primary" onClick={openDesigner} />
+
+// Collapsible section
+<EditorGroup label="Advanced"><EditorCheckbox ... /></EditorGroup>
+
+// Font picker with weight dropdown (opens NavigationStack page)
+<EditorFontPicker label="Font Family" value="Lexend" onChange={setFont} weight="400" onWeightChange={setWeight} />
+
+// Channel row: platform + name + color + delete in one line
+<EditorChannelRow platform="twitch" onPlatformChange={setPlatform} channel="username" onChannelChange={setChannel} color="#9146FF" onColorChange={setColor} onRemove={remove} />
+
+// Dispatch UI actions (e.g. open designer)
+const { dispatch } = useEditorAction();
+<EditorButton label="Open Designer" variant="primary" onClick={() => dispatch("open-designer")} />
+
+// Section label, divider, info text
+<EditorLabel text="Settings" />
+<EditorDivider />
+<EditorInfo content="Configure your widget here." />
+\`\`\`
 
 > **Note:** There is no direct DOM access from extension code. The custom React reconciler serializes component trees to \`LumioComponentNode[]\` via postMessage \u2014 you must use SDK components exclusively.
 
@@ -472,7 +621,7 @@ import { Image } from "@zaflun/lumio-sdk";
 
 ## Input Components
 
-**Important:** On OBS layer surface, all input components become read-only. Buttons are hidden, toggles show "On"/"Off" text, dropdowns show the selected value.
+**Important:** On the layer surface, all input components become read-only. Buttons are hidden, toggles show "On"/"Off" text, dropdowns show the selected value.
 
 ### Button
 
@@ -652,9 +801,72 @@ const exitAnim = useAnimation("fade-out", { duration: 200 });
 
 **Best practices:**
 - Always use SDK presets instead of raw CSS animations for entrance/exit effects \u2014 the reconciler maps them to allowed VisionStyle \`animation\` properties
-- Keep animation durations short on the OBS layer surface (< 500ms) to avoid frame drops
+- Keep animation durations short on the layer surface (< 500ms) to avoid frame drops
 - Avoid animating layout-affecting properties (\`width\`, \`height\`) on the layer; prefer \`opacity\` and \`transform\`
 
+## Picker Components
+
+### IconPicker
+
+Universal icon/emoji/emote picker with 4 tabs: Lucide icons (1960), Unicode emojis (1584), platform emotes (via API), and file upload. **Editor-only** \u2014 use \`IconDisplay\` to render the selected icon on the layer surface.
+
+\`\`\`tsx
+import { IconPicker, IconDisplay } from "@zaflun/lumio-sdk";
+import type { IconValue } from "@zaflun/lumio-sdk";
+
+// In editor.tsx \u2014 let the user pick an icon
+const [storage, setStorage] = useExtensionStorage();
+
+<IconPicker
+  value={storage.icon ?? null}
+  onChange={(icon) => setStorage({ ...storage, icon })}
+  sources={["lucide", "emoji", "emote", "upload"]}
+  size="md"
+  placeholder="Choose an icon..."
+/>
+
+// In layer.tsx \u2014 render the selected icon
+<IconDisplay icon={storage.icon ?? null} size={32} />
+\`\`\`
+
+**IconPickerProps:**
+- \`value: IconValue | null\` \u2014 currently selected icon
+- \`onChange: (icon: IconValue | null) => void\` \u2014 selection callback
+- \`sources?: IconSource[]\` \u2014 tabs to show (default: all four: \`["lucide", "emoji", "emote", "upload"]\`)
+- \`size?: "sm" | "md" | "lg"\` \u2014 picker trigger button size
+- \`placeholder?: string\` \u2014 placeholder text when no icon selected
+
+**IconDisplayProps:**
+- \`icon: IconValue | null\` \u2014 icon to render (null renders nothing)
+- \`size?: number\` \u2014 pixel size
+- \`className?: string\`
+
+**IconValue type:**
+\`\`\`typescript
+type IconSource = "lucide" | "emoji" | "emote" | "upload";
+
+interface IconValue {
+  type: IconSource;  // which tab/source the icon came from
+  value: string;     // icon name (lucide), Unicode char (emoji), CDN URL (emote), upload URL (upload)
+  label?: string;    // human-readable label
+  platform?: string; // platform identifier for emotes (e.g. "twitch", "7tv")
+}
+\`\`\`
+
+**\`useIconPicker()\` hook** \u2014 headless state management for custom picker UIs:
+\`\`\`tsx
+import { useIconPicker } from "@zaflun/lumio-sdk";
+
+const { isOpen, selected, open, close, select, clear, sources } = useIconPicker({
+  sources: ["lucide", "emoji"],
+  onSelect: (icon) => console.log("Selected:", icon),
+});
+\`\`\`
+
+Returns: \`{ isOpen, selected, open, close, select, clear, sources }\`
+
+**Upload tab** requires the extension to declare \`egress.allowHosts\` including the Lumio API. Uploaded files are stored per-extension with quota tracking via the \`extension_uploads\` table.
+
 ## VisionStyle
 
 Typed CSS subset accepted by all components. Sanitized by the host \u2014 only safe properties are allowed.
@@ -893,6 +1105,242 @@ updateLayer({ layerId: "uuid", visible: true });
 | \`spotify:queue_add\` | \`spotify:control\` | Add track to Spotify queue |
 
 Actions are proxied through the Lumio API \u2014 the extension never accesses OAuth tokens or platform credentials directly.
+
+## Automation Node Handlers
+
+Extensions with category \`automation_node\` export a single handler in \`server/handler.ts\`. The handler type depends on the \`node_type\` declared in \`lumio.config.json\`.
+
+### \`defineAutomationAction(handler)\`
+
+Action nodes execute when triggered by an upstream node in the automation workflow. They receive input data from the previous node and can perform side effects (HTTP calls, DB writes).
+
+\`\`\`typescript
+import { defineAutomationAction } from "@zaflun/lumio-sdk/server";
+
+export default defineAutomationAction({
+  handler: async (ctx) => {
+    const webhookUrl = ctx.nodeConfig.webhook_url;
+    const res = await ctx.fetch(webhookUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(ctx.inputData),
+    });
+    return { status: res.status, body: await res.json() };
+  },
+});
+\`\`\`
+
+### \`defineAutomationTrigger({ onWebhook?, onPoll? })\`
+
+Trigger nodes start automation workflows. They support two modes: webhook (receives external HTTP calls) and poll (periodic checks for new data).
+
+\`\`\`typescript
+import { defineAutomationTrigger } from "@zaflun/lumio-sdk/server";
+
+export default defineAutomationTrigger({
+  onWebhook: async (ctx, request) => {
+    const body = await request.json();
+    if (body.event === "order.created") {
+      return { trigger: true, outputData: { orderId: body.id, total: body.total } };
+    }
+    return { trigger: false };
+  },
+  onPoll: async (ctx) => {
+    const lastCheck = await ctx.cache.get("last_check") ?? "1970-01-01T00:00:00Z";
+    const res = await ctx.fetch(
+      \`https://api.example.com/events?since=\${lastCheck}\`,
+      { headers: { "Authorization": \`Bearer \${ctx.secrets.get("API_KEY")}\` } }
+    );
+    const events = await res.json();
+    await ctx.cache.set("last_check", new Date().toISOString());
+    return events.map((e: any) => ({ trigger: true, outputData: e }));
+  },
+});
+\`\`\`
+
+### \`defineAutomationLogic(handler)\`
+
+Logic nodes evaluate conditions and route the workflow to different branches. They return a branch key that determines which downstream path executes.
+
+\`\`\`typescript
+import { defineAutomationLogic } from "@zaflun/lumio-sdk/server";
+
+export default defineAutomationLogic({
+  handler: async (ctx) => {
+    const amount = ctx.inputData.total;
+    if (amount >= 100) return { branch: "high_value" };
+    if (amount >= 25) return { branch: "medium_value" };
+    return { branch: "low_value" };
+  },
+});
+\`\`\`
+
+### Automation Handler Context (\`ctx\`)
+
+| Property | Available in | Description |
+|----------|-------------|-------------|
+| \`ctx.nodeConfig\` | All | Node configuration from the user's config panel |
+| \`ctx.inputData\` | Action, Logic | Data from the upstream node |
+| \`ctx.fetch(url, options?)\` | All | HTTP request (egress allowlist enforced) |
+| \`ctx.cache.get(key)\` / \`ctx.cache.set(key, value, ttl?)\` | All | Per-installation KV cache (Redis, 1h default TTL) |
+| \`ctx.secrets.get(key)\` | All | Server-side secret |
+| \`ctx.db\` | All | Extension DB schema access |
+| \`ctx.auth\` | All | \`{ accountId }\` \u2014 account identity |
+| \`ctx.defer()\` | Action | Mark execution as async (returns 202, completes in background) |
+
+## Bot Module Handlers
+
+Extensions with category \`bot_module\` export handler wrappers that register triggers. Each wrapper defines when the handler fires and what context it receives.
+
+### \`command(prefix, options)\`
+
+Fires when a chat message starts with the given prefix.
+
+\`\`\`typescript
+import { command } from "@zaflun/lumio-sdk/server";
+
+export const hello = command("!hello", {
+  handler: async (ctx, message) => {
+    return { action: "send_message", message: \`Hello @\${ctx.user.display_name}!\` };
+  },
+});
+\`\`\`
+
+### \`keyword(words, options)\`
+
+Fires when a chat message contains any of the listed keywords (case-insensitive).
+
+\`\`\`typescript
+import { keyword } from "@zaflun/lumio-sdk/server";
+
+export const giveaway = keyword(["giveaway", "enter", "join"], {
+  handler: async (ctx, message) => {
+    await ctx.db.insert("entries", { user_id: ctx.user.platform_user_id });
+    return { action: "send_message", message: \`@\${ctx.user.display_name} you are entered!\` };
+  },
+});
+\`\`\`
+
+### \`pattern(regex, options)\`
+
+Fires when a chat message matches the given regex.
+
+\`\`\`typescript
+import { pattern } from "@zaflun/lumio-sdk/server";
+
+export const scoreParser = pattern(/^!score\\s+(\\w+)\\s+(\\d+)$/, {
+  handler: async (ctx, message, matches) => {
+    const [, game, score] = matches;
+    await ctx.db.insert("scores", { game, score: parseInt(score, 10), user: ctx.user.display_name });
+    return { action: "send_message", message: \`Score recorded: \${game} = \${score}\` };
+  },
+});
+\`\`\`
+
+### \`event(eventType, options)\`
+
+Fires on a platform event. The \`eventType\` is a \`LumioEventType\` string.
+
+\`\`\`typescript
+import { event } from "@zaflun/lumio-sdk/server";
+
+export const welcomeFollower = event("twitch:follower", {
+  handler: async (ctx, eventData) => {
+    return { action: "send_message", message: \`Welcome @\${eventData.user_name}! Thanks for the follow!\` };
+  },
+});
+\`\`\`
+
+### \`timer(name, intervalSecs, options)\`
+
+Fires on a recurring interval. The name must be unique within the extension.
+
+\`\`\`typescript
+import { timer } from "@zaflun/lumio-sdk/server";
+
+export const reminder = timer("social_reminder", 900, {
+  handler: async (ctx) => {
+    return { action: "send_message", message: "Follow us on Twitter! twitter.com/example" };
+  },
+});
+\`\`\`
+
+### \`moderate(options)\`
+
+Runs on every incoming chat message. Used for moderation decisions.
+
+\`\`\`typescript
+import { moderate } from "@zaflun/lumio-sdk/server";
+
+export const toxicFilter = moderate({
+  handler: async (ctx, message) => {
+    const toxicScore = await analyzeToxicity(message.text);
+    if (toxicScore > 0.9) {
+      return { action: "timeout", duration: 600, message: "Please keep chat respectful." };
+    }
+    if (toxicScore > 0.7) {
+      return { action: "delete", message: "Message removed by auto-mod." };
+    }
+    return { action: "none" };
+  },
+});
+\`\`\`
+
+### \`defineModerate(handler)\`
+
+Convenience wrapper for system-style moderation handlers. The handler receives a unified context with the chat message and returns a moderation action.
+
+\`\`\`typescript
+import { defineModerate } from "@zaflun/lumio-sdk/server";
+
+export default defineModerate(async (ctx) => {
+  if (ctx.message.text.includes("spam")) {
+    return { action: "delete" };
+  }
+  return { action: "allow" };
+});
+\`\`\`
+
+### \`defineTimer(handler)\`
+
+Convenience wrapper for timer-based handlers (e.g., timed messages). Fires on a recurring interval configured in the extension's install config.
+
+\`\`\`typescript
+import { defineTimer } from "@zaflun/lumio-sdk/server";
+
+export default defineTimer(async (ctx) => {
+  const messages = (ctx.installConfig.messages as string || "").split("\\n").filter(Boolean);
+  if (messages.length === 0) return null;
+  const idx = parseInt(await ctx.cache.get("idx") || "0", 10);
+  await ctx.cache.set("idx", String((idx + 1) % messages.length));
+  return { reply: messages[idx] };
+});
+\`\`\`
+
+### Handler Return Actions
+
+All bot module handlers return an action object:
+
+| Action | Fields | Description | Permission required |
+|--------|--------|-------------|---------------------|
+| \`send_message\` | \`message\` | Send a chat message | \`chat:send\` |
+| \`delete\` | \`message?\` | Delete the triggering message | \`chat:delete\` |
+| \`timeout\` | \`duration\`, \`message?\` | Timeout the user (seconds) | \`chat:ban\` |
+| \`ban\` | \`message?\` | Ban the user | \`chat:ban\` |
+| \`none\` | \u2014 | Take no action | \u2014 |
+
+The extension must declare the matching permission in \`lumio.config.json\`. For example, a moderation module that bans users needs \`"permissions": ["chat:ban"]\`.
+
+### Bot Module Permission Table
+
+| Permission | Grants | Review level |
+|-----------|--------|--------------|
+| \`chat:send\` | Send chat messages | Standard |
+| \`chat:read\` | Read incoming chat messages | Standard |
+| \`chat:delete\` | Delete chat messages | Enhanced |
+| \`chat:ban\` | Ban, unban, and timeout users | Enhanced |
+| \`events:read\` | Subscribe to platform events | Standard |
+| \`events:write\` | Emit custom events | Standard |
 `;
 
 // src/content/cli-workflows.ts
@@ -952,15 +1400,14 @@ lumio init my-widget
 # ? Category: widget
 # ? Targets: editor, layer
 # ? Server functions: yes
-# ? Template: Widget (editor + layer + storage)
+# ? How should the editor UI be built? config_schema only / editor.tsx only / Both
 # ? Owner: My Stream (personal) / Awesome Team  <- team selection if applicable
 #
 # Creating extension on Lumio...
 # Extension-ID: 88b2478a-39c7-468e-bebd-14e52fd97ac0
 # Slug: k8f2x-my-widget
 #
-# Writing lumio.config.json...
-# Writing src/editor.tsx...
+# Writing lumio.config.json (with config_schema)...
 # Writing src/layer.tsx...
 # Writing server/schema.ts...
 # Writing server/functions.ts...
@@ -968,6 +1415,32 @@ lumio init my-widget
 # Done! Run \`lumio dev\` to start developing.
 \`\`\`
 
+### Automation Node Example
+
+\`\`\`bash
+lumio init my-webhook-action
+
+# Interactive prompts:
+# ? Extension name: My Webhook Action
+# ? Description: Posts data to a webhook
+# ? Category: automation_node
+# ? Node type: action
+# ? Server functions: yes (required for automation nodes)
+# ? Owner: My Stream (personal) / Awesome Team
+#
+# Creating extension on Lumio...
+# Extension-ID: a1b2c3d4-...
+# Slug: x9k1z-my-webhook-action
+#
+# Writing lumio.config.json...
+# Writing src/editor.tsx...
+# Writing server/handler.ts...
+#
+# Done! Run \`lumio dev\` to start developing.
+\`\`\`
+
+Automation nodes always generate \`server/handler.ts\` (not \`server/functions.ts\`) and \`src/editor.tsx\` for the config panel. The \`node_type\` can be \`action\`, \`trigger\`, or \`logic\`.
+
 ### Templates
 
 | Template | Targets | Server | Description |
@@ -977,6 +1450,9 @@ lumio init my-widget
 | Full-Stack | editor + layer | Yes | Complete extension with server functions |
 | Interactive Game | editor + layer + interactive | Yes | Viewer interaction game |
 | Bot Module | server-only | Yes | Chat command module |
+| Automation Action | server + editor | Yes | Automation workflow action node |
+| Automation Trigger | server + editor | Yes | Automation workflow trigger node |
+| Automation Logic | server + editor | Yes | Automation workflow logic/branching node |
 | Integration | server | Yes | External API integration |
 | Theme | editor | No | Style variables only |
 
@@ -997,11 +1473,33 @@ lumio dev
 # Press 'q' to quit.
 \`\`\`
 
+### Automation Node Development
+
+For automation node extensions, the dev server auto-detects \`category: "automation_node"\` and launches the automation simulator:
+
+\`\`\`bash
+lumio dev
+# or explicitly:
+lumio dev --automation-node
+
+# Output:
+# Lumio Dev Server running at http://localhost:5173
+# Config Panel: http://localhost:5173/editor
+#
+# Automation Simulator ready. Commands:
+#   /execute [JSON]     \u2014 Run the action handler with input data
+#   /webhook [JSON]     \u2014 Simulate an incoming webhook (trigger nodes)
+#   /poll               \u2014 Trigger a poll cycle (trigger nodes)
+#   /config [JSON]      \u2014 Update node config
+#   /quit               \u2014 Stop the dev server
+\`\`\`
+
 Features:
 - Hot reload on file changes
 - Mock event system (simulated chat, follows, subs)
 - Sandbox environment matching production constraints
 - Server function execution with local DB
+- Automation simulator with /execute, /webhook, /poll, /config commands
 
 ## lumio build
 
@@ -1175,7 +1673,7 @@ The Lumio auth system has 9 token types:
 | 2 | \`lm_usr_\` | User API Key | Permanent | External API access for users |
 | 3 | _(JWT)_ | JWT | Session | OAuth login session |
 | 4 | \`lm_pop_\` | Popout Token | Non-expiring | Overlay access for non-session viewers |
-| 5 | \`lm_overlay_\` | Overlay Token | Permanent | Per-overlay OBS browser source access |
+| 5 | \`lm_overlay_\` | Overlay Token | Permanent | Per-overlay browser source access |
 | 6 | \`lm_share_\` | Shared Overlay Token | Time-limited | Temporary shared overlay links |
 | 7 | \`lm_ext_\` | Extension Token | 15 min | Scoped to one extension installation |
 | 8 | \`lm_widget_\` | Widget Token | Permanent | Widget Gallery standalone embeds |
@@ -1285,7 +1783,7 @@ var runtimeScopesContent = `# Runtime Scopes
 Extensions run inside a 3-layer iframe sandbox. Understanding the layers is important for debugging messaging and storage issues:
 
 \`\`\`
-Host (lumio.vision / OBS browser source)
+Host (lumio.vision / browser source)
   \u2514\u2500\u2500 Supervisor iframe (supervisor.extension.lumio.vision)
         Purpose: validates postMessage traffic, enforces egress allowlist,
                  mediates token refresh, proxies LumioComponentNode[] to host
@@ -1418,7 +1916,7 @@ var bestPracticesContent = `# Best Practices
 
 ### Layer surface
 - Use CSS animations via \`VisionStyle\` instead of JS-driven animations
-- Keep the layer surface minimal \u2014 it runs in OBS at 30/60 fps
+- Keep the layer surface minimal \u2014 it runs in an Browser Source at 30/60 fps
 - Return \`null\` from components when they should be invisible (do not use \`display: none\`)
 
 ## UX Patterns
@@ -1469,7 +1967,7 @@ Wrap editor settings in \`CompactView\` for consistent styling with the Lumio da
 \`\`\`
 
 ### Transparent backgrounds on layer
-The layer surface should have a transparent background so it composites correctly over the stream in OBS:
+The layer surface should have a transparent background so it composites correctly over the stream:
 
 \`\`\`tsx
 // layer.tsx \u2014 no background, content floats over stream
@@ -1479,22 +1977,46 @@ Lumio.render(<Overlay />, { target: "layer" });
 
 ## Config Schema
 
-Use \`config_schema\` in \`lumio.config.json\` for user-customizable settings. The Lumio dashboard renders these as a form in the Widget Gallery install flow \u2014 the user fills them in without needing to open the editor surface.
+Use \`config_schema\` in \`lumio.config.json\` for user-customizable settings. The widget editor auto-generates form fields from the schema \u2014 no custom \`editor.tsx\` needed for simple settings. For advanced UIs, use \`editor.tsx\` alongside (or instead of) config_schema.
+
+**Three valid combos:**
+- **config_schema only** \u2014 auto-generated editor form, \`targets: ["layer"]\`
+- **editor.tsx only** \u2014 fully custom React editor UI, \`targets: ["layer", "editor"]\`
+- **Both** \u2014 schema fields render first, editor.tsx renders below for advanced controls
+
+**Supported field types:** \`string\`, \`number\`, \`boolean\`, \`color\`, \`select\`, \`textarea\`, \`slider\`, \`font\`, \`icon\`, \`image\`, \`sound\`, \`multiselect\`, \`group\`, \`divider\`, \`info\`, \`channel\`, \`designer\`, \`presets\`
 
 \`\`\`json
 {
   "config_schema": [
-    { "key": "title", "type": "string", "label": "Widget Title", "default_value": "My Widget", "required": true },
-    { "key": "maxItems", "type": "number", "label": "Max Items", "default_value": 10, "required": false },
+    { "key": "title", "type": "string", "label": "Widget Title", "default_value": "My Widget", "required": true, "placeholder": "Enter title..." },
+    { "key": "fontSize", "type": "number", "label": "Font Size", "default_value": 16, "required": false, "min": 8, "max": 200, "unit": "px" },
+    { "key": "volume", "type": "slider", "label": "Volume", "default_value": 50, "required": false, "min": 0, "max": 100, "unit": "%" },
+    { "key": "theme", "type": "select", "label": "Color Theme", "options": ["dark", "light"], "default_value": "dark", "required": false },
+    { "key": "primaryColor", "type": "color", "label": "Primary Color", "default_value": "#43F7CD", "required": false },
     { "key": "showBorder", "type": "boolean", "label": "Show Border", "default_value": true, "required": false },
+    { "key": "targetDate", "type": "string", "label": "Target Date", "default_value": "", "required": false, "visible_when": { "key": "mode", "equals": "countdown" } },
     {
-      "key": "theme",
-      "type": "select",
-      "label": "Color Theme",
-      "options": ["dark", "light"],
-      "default_value": "dark",
-      "required": false
-    }
+      "key": "twitch_events", "type": "group", "label": "Twitch Events", "required": false, "collapsed": true,
+      "fields": [
+        { "key": "includeFollowers", "type": "boolean", "label": "Followers", "default_value": true, "required": false },
+        { "key": "includeSubs", "type": "boolean", "label": "Subscriptions", "default_value": true, "required": false }
+      ]
+    },
+    { "key": "separator", "type": "divider", "label": "", "required": false },
+    { "key": "help_text", "type": "info", "label": "", "required": false, "content": "Configure the events you want to display." }
+  ]
+}
+\`\`\`
+
+**Designer Schema:** Extensions can define a \`designer_schema\` alongside \`config_schema\` for a fullpage visual design editor. The designer opens as a fullpage overlay with the schema fields on the left and a live preview on the right. Designer values are stored under \`config.design\`.
+
+\`\`\`json
+{
+  "designer_schema": [
+    { "key": "bubbleColor", "type": "color", "label": "Chat Bubble Color", "default_value": "#9146FF", "required": false },
+    { "key": "nameFont", "type": "font", "label": "Username Font", "default_value": "Inter", "required": false },
+    { "key": "badgeSize", "type": "slider", "label": "Badge Size", "default_value": 18, "required": false, "min": 12, "max": 32, "unit": "px" }
   ]
 }
 \`\`\`
@@ -1504,7 +2026,7 @@ Read config values via \`useLumioConfig()\`:
 \`\`\`tsx
 const [config] = useLumioConfig();
 const title = config.title ?? "My Widget";
-const maxItems = config.maxItems ?? 10;
+const fontSize = config.fontSize ?? 16;
 \`\`\`
 
 **When to use config_schema vs storage:**
@@ -1515,7 +2037,7 @@ const maxItems = config.maxItems ?? 10;
 
 - Always use SDK presets via \`useAnimation()\` + \`<Animated>\` for entrance/exit effects \u2014 never write raw CSS keyframe \`@keyframes\` rules
 - The reconciler maps animation preset names to allowed \`VisionStyle\` \`animation\` properties; raw keyframe strings are stripped by the Supervisor
-- Keep durations short on OBS layer (< 400ms). Longer animations cause visible frame drops in OBS at 30/60 fps
+- Keep durations short on the layer (< 400ms). Longer animations cause visible frame drops in the Browser Source at 30/60 fps
 - Prefer animating \`opacity\` and \`transform\` (GPU-composited) over \`width\`, \`height\`, \`margin\`, \`padding\` (layout-triggering)
 
 \`\`\`tsx
@@ -1554,6 +2076,120 @@ For beta testing before public launch:
 | Hardcoded strings | Use \`config_schema\` fields for user-customizable text |
 | Using localStorage directly | Use \`useExtensionStorage()\` (localStorage blocked at ext.lumio.vision) |
 | Raw CSS \`@keyframes\` animations | Use \`useAnimation()\` + \`<Animated>\` SDK presets |
+
+## Bot Module Security
+
+### Rate Limiting Awareness
+
+Bot module handlers are subject to the same rate limits as other server functions. Plan for these limits in moderation logic:
+
+- Actions (with fetch): 20/min per installation
+- Mutations: 50/min per installation
+- Storage writes: 200/min per installation
+
+If your module processes high-volume chat, avoid issuing a moderation action on every message. Use \`ctx.cache\` for cooldowns:
+
+\`\`\`tsx
+export const spamGuard = moderate({
+  handler: async (ctx, message) => {
+    const key = \`cooldown:\${ctx.user.platform_user_id}\`;
+    if (await ctx.cache.get(key)) return { action: "none" };
+
+    if (isSpam(message.text)) {
+      await ctx.cache.set(key, "1", { ttl: 30 });
+      return { action: "timeout", duration: 60, message: "Spam detected." };
+    }
+    return { action: "none" };
+  },
+});
+\`\`\`
+
+### Moderation Escalation Pattern
+
+For moderation modules, escalate actions progressively rather than jumping to bans. Track offense counts in the extension database:
+
+\`\`\`tsx
+export const escalatingMod = moderate({
+  handler: async (ctx, message) => {
+    if (!isViolation(message.text)) return { action: "none" };
+
+    const offenses = await ctx.db.get("offenses", ctx.user.platform_user_id);
+    const count = (offenses?.count ?? 0) + 1;
+    await ctx.db.patch("offenses", ctx.user.platform_user_id, { count });
+
+    if (count >= 3) return { action: "ban", message: "Repeated violations." };
+    if (count === 2) return { action: "timeout", duration: 600, message: "Second warning." };
+    return { action: "delete", message: "First warning: message removed." };
+  },
+});
+\`\`\`
+
+### User Override Preservation
+
+Account owners can override trigger configuration (command prefixes, keywords, regex patterns) via the dashboard. Always read trigger config from the handler context rather than hardcoding values:
+
+\`\`\`tsx
+// Good: reads overridable config
+export const customCmd = command("!points", {
+  handler: async (ctx, message) => {
+    // The prefix "!points" is the default \u2014 users can override it in dashboard
+    // Handler logic stays the same regardless of the configured prefix
+    return { action: "send_message", message: "You have 100 points!" };
+  },
+});
+\`\`\`
+
+Extension developers should document which triggers are overridable in the extension's description so account owners know what they can customize.
+
+### Cache-First + Defer Pattern
+
+For handlers that need fast responses but also need to persist data, use \`ctx.cache\` for the immediate check and \`ctx.defer()\` to write to the database asynchronously:
+
+\`\`\`tsx
+export const rateLimitedGreet = command("!greet", {
+  handler: async (ctx, message) => {
+    const cacheKey = \`greeted:\${ctx.user.platform_user_id}\`;
+
+    // Fast path: check cache
+    if (await ctx.cache.get(cacheKey)) {
+      return { action: "send_message", message: "You already greeted today!" };
+    }
+
+    // Set cache immediately (fast)
+    await ctx.cache.set(cacheKey, "1", { ttl: 86400 });
+
+    // Defer the DB write (does not block response)
+    ctx.defer(async () => {
+      await ctx.db.insert("greet_log", {
+        user_id: ctx.user.platform_user_id,
+        greeted_at: new Date().toISOString(),
+      });
+    });
+
+    return { action: "send_message", message: \`Hello @\${ctx.user.display_name}!\` };
+  },
+});
+\`\`\`
+
+### Exempt Role Support
+
+Moderation modules should respect the account's exempt role configuration. The exempt roles (moderator, VIP, subscriber) are passed to the handler via \`ctx.user.roles\`. Check them before taking action:
+
+\`\`\`tsx
+export const linkFilter = moderate({
+  handler: async (ctx, message) => {
+    // Respect exempt roles \u2014 do not moderate mods/VIPs
+    if (ctx.user.roles.moderator || ctx.user.roles.vip) {
+      return { action: "none" };
+    }
+
+    if (containsLink(message.text)) {
+      return { action: "delete", message: "Links are not allowed." };
+    }
+    return { action: "none" };
+  },
+});
+\`\`\`
 `;
 
 // src/content/troubleshooting.ts

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   ROOT_FILES,
   SKILL_FILES,
   installSkillFiles
-} from "./chunk-5NNQDQNL.js";
+} from "./chunk-QXQNAYHN.js";
 export {
   ROOT_FILES,
   SKILL_FILES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaflun/lumio-agent-skill",
-  "version": "0.2.0",
+  "version": "0.5.0",
   "description": "AI agent skill files for building Lumio Extensions",
   "type": "module",
   "main": "dist/index.js",