@zaflun/lumio-agent-skill 0.5.0 → 0.6.2

package/README.md

@@ -21,7 +21,7 @@ This creates `.lumio/skills/` in your project with reference docs, plus agent co
 | `server-functions.md` | Server function patterns, ctx API |
 | `cli-workflows.md` | All 12 CLI commands |
 | `auth.md` | Token types, permissions |
-| `runtime-scopes.md` | Editor/layer/interactive surfaces |
+| `runtime-scopes.md` | Storage scopes (instance/overlay/account/global) |
 | `best-practices.md` | Performance, security, UX |
 | `troubleshooting.md` | Common errors and fixes |
 

package/dist/bin/lumio-skills.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   installSkillFiles
-} from "../chunk-QXQNAYHN.js";
+} from "../chunk-XJZ7H56F.js";
 
 // src/bin/lumio-skills.ts
 import { resolve } from "path";

package/dist/{chunk-QXQNAYHN.js → chunk-XJZ7H56F.js}

@@ -14,9 +14,9 @@ Lumio Extensions are sandboxed React apps that run inside a 3-layer iframe sandb
 \`\`\`
 3-Layer Sandbox:
   Host (lumio.vision / browser source)
-    \u2514\u2500\u2500 Supervisor iframe (supervisor.extension.lumio.vision)
-          \u2514\u2500\u2500 Extension Runtime iframe (ext.lumio.vision)
-                \u2514\u2500\u2500 Web Worker (server function execution)
+    \u2514\u2500\u2500 Supervisor iframe (supervisor.ext.lumio.vision)
+          \u2514\u2500\u2500 Extension Runtime iframe (<label>.runtime.ext.lumio.vision)
+                \u2514\u2500\u2500 Web Worker (the extension's UI code)
 \`\`\`
 
 \`\`\`
@@ -24,17 +24,16 @@ Extension Project:
   lumio.config.json          <- Extension manifest (ID, name, category, permissions, targets, config_schema)
   src/editor.tsx             <- Dashboard editor panel (sidebar in overlay editor)
   src/layer.tsx              <- Stream overlay surface (transparent, read-only inputs)
-  src/interactive.tsx        <- Audience interaction page (optional)
   server/schema.ts           <- DB schema (defineTable + validators)
   server/functions.ts        <- Server functions (queries, mutations, actions)
 \`\`\`
 
 **Runtime flow:**
-1. Extension Runtime iframe loads from \`ext.lumio.vision/ext/{slug}/layer?token=lm_ext_xxx&install_id=uuid\`
+1. Extension Runtime iframe loads on the extension's own origin \`<label>.runtime.ext.lumio.vision\` (\`<label>\` = extension UUID as 32 lowercase hex)
 2. \`Lumio.render(<Component />, { target: "layer" })\` must be called within 10 seconds
 3. The custom React reconciler serializes the tree to \`LumioComponentNode[]\` via postMessage to the Supervisor
 4. The Supervisor validates and forwards the node tree to the Host for rendering
-5. Server functions execute inside a Web Worker in a V8 isolate sandbox (256 MB memory, 10s CPU timeout)
+5. Server functions run on the Lumio backend (Bot Module Worker) in a V8 isolate (256 MB memory, 5 s per call); a handler's \`ctx.realtime.push(topic, payload)\` reaches every surface of the install through \`useRealtime(topic, cb)\`
 6. Cross-frame messaging uses \`WorkerBridge\` (exported from \`@zaflun/lumio-sdk\`; replaces the legacy \`PostMessageBridge\`)
 
 **Key constraints:**
@@ -47,15 +46,16 @@ Extension Project:
 
 ## Core Concepts
 
-### Three Surfaces
+### Two Surfaces
 
 | Target | Where | Purpose |
 |--------|-------|---------|
 | \`editor\` | Dashboard overlay editor sidebar | Config UI, settings, content management |
 | \`layer\` | Browser Source (transparent) | Visual overlay in stream |
-| \`interactive\` | Standalone page (\`/ext/{slug}\`) | Viewer interaction (votes, games) |
 
-All three surfaces share storage via \`useExtensionStorage()\` \u2014 changes in editor propagate to layer in real-time.
+Both surfaces share storage via \`useExtensionStorage()\` \u2014 changes in editor propagate to layer in real-time.
+
+**Viewer input** (votes, games) has no page of its own: viewers act through chat commands and channel point rewards. A bot-module handler \u2014 \`command("!vote", \u2026)\` or \`event("twitch:reward" | "kick:reward", \u2026)\` \u2014 writes \`ctx.db\` and calls \`ctx.realtime.push(topic, payload)\`; the layer and editor receive it with \`useRealtime(topic, cb)\`.
 
 ### lumio.config.json
 
@@ -76,6 +76,10 @@ All three surfaces share storage via \`useExtensionStorage()\` \u2014 changes in
   },
   "visibility": "public",
   "pricing": { "type": "free" },
+  "sounds": [
+    { "file": "alert.mp3", "name": "Alert" },
+    { "file": "chime.wav", "name": "Chime", "default_volume": 0.8 }
+  ],
   "config_schema": [
     { "key": "title", "type": "string", "label": "Widget Title", "default_value": "My Widget", "required": true, "placeholder": "Enter title..." },
     { "key": "fontSize", "type": "number", "label": "Font Size", "default_value": 16, "required": false, "min": 8, "max": 200, "unit": "px" },
@@ -95,6 +99,8 @@ All three surfaces share storage via \`useExtensionStorage()\` \u2014 changes in
 - \`"visibility": "unlisted"\` \u2014 accessible by direct link only
 - Private invite: grant \`free_access\` to specific accounts via dashboard
 
+**Bundled sounds:** Place audio files in \`dist/sounds/\` and declare them in the \`sounds\` array. Supported: MP3, WAV, OGG, WebM, M4A, AAC, FLAC. Default limits: 50 sounds per extension, 10 MB per file, 200 MB total storage (all admin-configurable). Developers can view limits at \`/dashboard/settings/developer/limits\` and request increases via a 4-step wizard. Requests are reviewed by admins in the admin app. Users cannot delete bundled sounds \u2014 uninstalling the extension removes them.
+
 **Revenue split:** Configurable per developer (default 70/30 developer/Lumio).
 
 **Feature gates:** The following Lumio plan features must be enabled for extension functionality:
@@ -155,9 +161,9 @@ See \`components.md\` for full props and examples.
 
 | Hook | Returns | Purpose |
 |------|---------|---------|
-| \`useExtensionStorage()\` | \`[storage, setStorage]\` | Persistent KV store, synced across targets |
-| \`useVisionState(key, default)\` | \`[value, setValue]\` | useState for single keys |
-| \`useExtensionContext()\` | \`{ extensionId, target, overlayId, interactiveUrl }\` | Extension metadata |
+| \`useExtensionStorage(key, initialValue)\` | \`[value, setValue]\` | Persistent KV store, one key per call, synced across targets |
+| \`useVisionState(key, default)\` | \`[value, setValue]\` | Same contract as \`useExtensionStorage\` |
+| \`useExtensionContext()\` | \`{ extensionId, target, overlayId }\` | Extension metadata |
 | \`useLumioEvent(eventType)\` | \`event\` | Live events (chat, alerts, spotify) \u2014 type-safe: \`eventType\` is \`LumioEventType\` |
 | \`useLumioConfig()\` | \`[config, setConfig]\` | Extension config read/write (uses config_schema fields) |
 | \`useLumioTheme()\` | \`theme\` | Current theme (dark/light/custom) |
@@ -165,10 +171,11 @@ See \`components.md\` for full props and examples.
 | \`useLumioAction(action)\` | \`{ execute, data, isLoading, error }\` | Trigger Lumio actions \u2014 type-safe: \`action\` is \`LumioActionType\` |
 | \`useQuery(fn, params?)\` | \`{ data, isLoading, error, refetch }\` | Call server query |
 | \`useMutation(fn)\` | \`{ mutate, mutateAsync, data, isLoading, error }\` | Call server mutation/action |
+| \`useRealtime(topic, cb)\` | \`void\` | Receive \`ctx.realtime.push(topic, payload)\` messages of this install |
 | \`useAnimation(preset, options?)\` | \`animationProps\` | SDK animation presets for \`Animated\` component |
 | \`useIconPicker(options?)\` | \`{ isOpen, selected, open, close, select, clear, sources }\` | Headless state for custom icon picker UIs |
 
-**Important:** \`setStorage\` must always spread: \`setStorage({ ...storage, key: value })\`
+**Important:** \`useExtensionStorage\` always takes a key and an initial value \u2014 call it once per key. A setter replaces only its own key; spread only when you store an object under one key: \`setScore({ ...score, home: 2 })\`
 
 ## Server Functions
 
@@ -183,7 +190,7 @@ export const updateItem = patchRow("items", arg("id"), { done: arg("done") });
 export const removeItem = deleteRow("items", arg("id"), { editorOnly: true });
 \`\`\`
 
-**Handler-based** (V8 isolate Web Worker, full control):
+**Handler-based** (V8 isolate on the Bot Module Worker, full control):
 \`\`\`typescript
 import { action, arg, v } from "@zaflun/lumio-sdk/server";
 export const fetchScores = action({
@@ -196,26 +203,17 @@ export const fetchScores = action({
 });
 \`\`\`
 
-**Extension Actions** via \`useLumioAction()\` (21 total, \`action\` is \`LumioActionType\`):
+**Extension Actions** via \`useLumioAction()\` (dispatched by the Lumio API; \`action\` is \`LumioActionType\`):
 \`\`\`tsx
 // Trigger platform actions (requires matching permission in lumio.config.json)
 const { execute: sendChat } = useLumioAction("chat:send");
-const { execute: banUser } = useLumioAction("chat:ban");
-const { execute: unbanUser } = useLumioAction("chat:unban");
-const { execute: timeoutUser } = useLumioAction("chat:timeout");
+const { execute: deleteChat } = useLumioAction("chat:delete");
 const { execute: setScene } = useLumioAction("obs:set_scene");
-const { execute: startRecording } = useLumioAction("obs:start_recording");
-const { execute: stopRecording } = useLumioAction("obs:stop_recording");
+const { execute: setSourceVisible } = useLumioAction("obs:set_source_visible");
+const { execute: startStream } = useLumioAction("obs:start_stream");
+const { execute: stopStream } = useLumioAction("obs:stop_stream");
 const { execute: emitEvent } = useLumioAction("events:emit");
 const { execute: updateLayer } = useLumioAction("overlay:update_layer");
-const { execute: spotifyPlay } = useLumioAction("spotify:play");
-const { execute: spotifyPause } = useLumioAction("spotify:pause");
-const { execute: spotifySkip } = useLumioAction("spotify:skip");
-const { execute: spotifySeek } = useLumioAction("spotify:seek");
-const { execute: spotifyVolume } = useLumioAction("spotify:volume");
-const { execute: spotifyShuffle } = useLumioAction("spotify:shuffle");
-const { execute: spotifyRepeat } = useLumioAction("spotify:repeat");
-const { execute: spotifyQueueAdd } = useLumioAction("spotify:queue_add");
 \`\`\`
 
 See \`server-functions.md\` for schema definition, storage scoping, and advanced patterns.
@@ -330,7 +328,7 @@ export const modCheck = moderate({
 | \`lumio deploy\` | Upload to Lumio (status: draft). Flags: \`-v\`, \`-d\`, \`--breaking\`, \`--draft\` |
 | \`lumio status\` | Check review status of latest version |
 | \`lumio logs\` | Stream server function logs |
-| \`lumio secrets\` | Manage server-side secrets |
+| \`lumio env\` | Manage extension secrets (\`set\` / \`list\` / \`delete\`) |
 | \`lumio team\` | Manage developer team members |
 | \`lumio config\` | Show/set CLI configuration |
 
@@ -345,7 +343,7 @@ See \`cli-workflows.md\` for detailed usage and examples.
 
 Extension tokens have no RBAC permissions (\`has_permission()\` always returns false) and can only access \`ext_{extension_id}.*\` DB tables via server functions.
 
-**\`editorOnly: true\`** on server functions restricts mutations to editor surface only (layer/interactive cannot call them).
+**\`editorOnly: true\`** on server functions restricts mutations to editor surface only (the layer cannot call them).
 
 See \`auth.md\` for all 9 token types and the full token lifecycle.
 
@@ -363,34 +361,39 @@ lumio deploy -> draft -> [Submit via dashboard] -> pending_review
 ### Editor + Layer sync
 \`\`\`tsx
 // editor.tsx
-const [storage, setStorage] = useExtensionStorage();
-<Toggle label="Show" checked={storage.visible ?? false}
-  onChange={(v) => setStorage({ ...storage, visible: v })} />
+const [visible, setVisible] = useExtensionStorage("visible", false);
+<Toggle label="Show" checked={visible} onChange={setVisible} />
 
 // layer.tsx
-const [storage] = useExtensionStorage();
-if (!storage.visible) return null;
-return <Text content={storage.text} />;
+const [visible] = useExtensionStorage("visible", false);
+const [text] = useExtensionStorage("text", "");
+if (!visible) return null;
+return <Text content={text} />;
 \`\`\`
 
 ### Live events
 \`\`\`tsx
-// eventType is LumioEventType \u2014 autocomplete shows all 49 valid event strings
-const event = useLumioEvent("twitch:follower");
-// event updates automatically when a new follower event arrives
+// eventType is LumioEventType \u2014 autocomplete shows all 62 valid event strings
+const event = useLumioEvent("twitch:cheer");
+// event updates automatically when a new cheer arrives; it is typed
+// LumioEventPayloadMap["twitch:cheer"] | null, so event?.bits is a number
 \`\`\`
 
-**All 49 event types** (\`LumioEventType\`):
+**All 62 event types** (\`LumioEventType\`):
+
+Twitch (27): \`twitch:follower\`, \`twitch:subscribe\`, \`twitch:gift\`, \`twitch:resub\`, \`twitch:cheer\`, \`twitch:raid\`, \`twitch:reward\`, \`twitch:reward_status\`, \`twitch:reward_add\`, \`twitch:reward_update\`, \`twitch:reward_remove\`, \`twitch:hype_train\`, \`twitch:hype_train_end\`, \`twitch:poll\`, \`twitch:poll_end\`, \`twitch:prediction\`, \`twitch:prediction_lock\`, \`twitch:prediction_end\`, \`twitch:goal\`, \`twitch:goal_end\`, \`twitch:ad_break\`, \`twitch:ban\`, \`twitch:unban\`, \`twitch:stream_online\`, \`twitch:stream_offline\`, \`twitch:stream_update\`, \`twitch:chat\`
 
-Twitch (22): \`twitch:follower\`, \`twitch:subscriber\`, \`twitch:subscribe\`, \`twitch:gift_sub\`, \`twitch:resub\`, \`twitch:cheer\`, \`twitch:raid\`, \`twitch:redemption\`, \`twitch:ban\`, \`twitch:unban\`, \`twitch:hype_train\`, \`twitch:poll\`, \`twitch:prediction\`, \`twitch:goal\`, \`twitch:ad_break\`, \`twitch:stream_update\`, \`twitch:chat\`
+YouTube (10): \`youtube:subscribe\`, \`youtube:member\`, \`youtube:superchat\`, \`youtube:supersticker\`, \`youtube:gift_membership\`, \`youtube:gift_membership_received\`, \`youtube:poll\`, \`youtube:stream_online\`, \`youtube:stream_offline\`, \`youtube:chat\`
 
-YouTube (7): \`youtube:subscriber\`, \`youtube:superchat\`, \`youtube:supersticker\`, \`youtube:gift_membership\`, \`youtube:gift_membership_received\`, \`youtube:poll\`, \`youtube:chat\`
+Kick (11): \`kick:follower\`, \`kick:subscribe\`, \`kick:resub\`, \`kick:gift\`, \`kick:kicks\`, \`kick:reward\`, \`kick:reward_status\`, \`kick:stream_online\`, \`kick:stream_offline\`, \`kick:stream_update\`, \`kick:chat\`
 
-Kick (6): \`kick:follower\`, \`kick:subscribe\`, \`kick:gift\`, \`kick:stream_online\`, \`kick:stream_offline\`, \`kick:chat\`
+Spotify (12): \`spotify:track\`, \`spotify:play\`, \`spotify:pause\`, \`spotify:skip\`, \`spotify:volume\`, \`spotify:queue_add\`, \`spotify:device\`, \`spotify:playlist_add\`, \`spotify:playlist_remove\`, \`spotify:playlist_create\`, \`spotify:playlist_edit\`, \`spotify:playlist_delete\`
 
-Trovo (3): \`trovo:subscribe\`, \`trovo:spell\`, \`trovo:chat\`
+StreamElements (1): \`streamelements:tip\`
 
-Spotify (11): \`spotify:track\`, \`spotify:play\`, \`spotify:pause\`, \`spotify:skip\`, \`spotify:volume\`, \`spotify:queue_add\`, \`spotify:device\`, \`spotify:playlist_add\`, \`spotify:playlist_remove\`, \`spotify:playlist_create\`, \`spotify:playlist_delete\`
+Cross-platform chat (1, fires for every platform): \`chat:message\`
+
+Kick events carry canonical top-level fields (\`user_id\`, \`user_login\`, \`user_name\`, \`avatarUrl\`, \`is_anonymous\`) plus the original Kick payload. \`kick:kicks\` has \`kicks\` (amount, like Twitch \`bits\`) and \`message\`; \`kick:reward\` / \`kick:reward_status\` have \`status\`, \`user_input\` and \`reward { id, title, cost, prompt }\`; \`kick:resub\` has \`cumulative_months\`. \`twitch:reward_status\` has the \`twitch:reward\` shape with \`status\` \`fulfilled\` / \`canceled\`. \`twitch:reward_add\` / \`_update\` / \`_remove\` carry the Twitch reward (\`id\`, \`title\`, \`cost\`, \`prompt\`, \`is_enabled\`, \`is_paused\`, \u2026); these three arrive live only (\`broadcast_only\`), never from the event history.
 
 ### Server queries
 \`\`\`tsx
@@ -420,8 +423,8 @@ const anim = useAnimation("slide-in", { duration: 300 });
 | \`EXTENSION_NOT_FOUND\` | Invalid extensionId in config | Run \`lumio init\` or create via dashboard |
 | \`EGRESS_BLOCKED\` | Fetch to undeclared host | Add host to \`egress.allowHosts\` in config |
 | \`STORAGE_QUOTA\` | Exceeded storage limit | Reduce data or request limit increase |
-| \`EDITOR_ONLY\` | Mutation called from layer/interactive | Remove \`editorOnly\` or restrict to editor |
-| \`SUPERVISOR_BLOCKED\` | Supervisor rejected a postMessage | Check message origin matches ext.lumio.vision |
+| \`EDITOR_ONLY\` | Mutation called from the layer | Remove \`editorOnly\` or restrict to editor |
+| \`SUPERVISOR_BLOCKED\` | Supervisor rejected a postMessage | Check message origin matches the extension's runtime origin (\`<label>.runtime.ext.lumio.vision\`) |
 | \`WORKER_CREATION_FAILED\` | Web Worker could not be created | Verify server functions bundle is valid JS |
 | \`STORAGE_DOM_EXCEPTION\` | localStorage/sessionStorage access | Use \`useExtensionStorage()\` instead (storage blocked) |
 
@@ -815,18 +818,18 @@ import { IconPicker, IconDisplay } from "@zaflun/lumio-sdk";
 import type { IconValue } from "@zaflun/lumio-sdk";
 
 // In editor.tsx \u2014 let the user pick an icon
-const [storage, setStorage] = useExtensionStorage();
+const [icon, setIcon] = useExtensionStorage<IconValue | null>("icon", null);
 
 <IconPicker
-  value={storage.icon ?? null}
-  onChange={(icon) => setStorage({ ...storage, icon })}
+  value={icon}
+  onChange={setIcon}
   sources={["lucide", "emoji", "emote", "upload"]}
   size="md"
   placeholder="Choose an icon..."
 />
 
 // In layer.tsx \u2014 render the selected icon
-<IconDisplay icon={storage.icon ?? null} size={32} />
+<IconDisplay icon={icon} size={32} />
 \`\`\`
 
 **IconPickerProps:**
@@ -949,9 +952,12 @@ import { queryRows, insertRow, patchRow, deleteRow, arg, filter } from "@zaflun/
 // Read all rows
 export const getItems = queryRows("items");
 
-// Read with filter
+// Read with filter, order and paging
 export const getDoneItems = queryRows("items", {
   filter: filter("done", "=", true),
+  orderBy: "created_at",
+  orderDir: "desc",
+  limit: arg("limit"),
 });
 
 // Insert a row (editorOnly: only callable from editor surface)
@@ -974,8 +980,10 @@ export const removeItem = deleteRow("items", arg("id"), { editorOnly: true });
 
 - \`arg("name")\` \u2014 reads from the client-provided arguments
 - \`identity()\` \u2014 returns \`{ userId, accountId }\` of the caller
-- \`secret("KEY")\` \u2014 reads a server-side secret (never exposed to client)
-- \`filter(field, op, value)\` \u2014 query filter (=, !=, >, <, >=, <=, LIKE, IN)
+- \`secret("KEY")\` \u2014 reads a server-side secret in \`action()\` handlers only; \`lumio build\` rejects it in declarative functions
+- \`filter(field, op, value)\` \u2014 query filter, \`op\` one of \`=\`, \`!=\`, \`>\`, \`>=\`, \`<\`, \`<=\`, \`like\`, \`in\`; pass a list for AND
+- \`queryRows\` options: \`filter\`, \`orderBy\`, \`orderDir\` (\`asc\`/\`desc\`), \`limit\` / \`offset\` (integer or \`arg()\`)
+- Definitions must be plain JSON: \`lumio build\` serialises every export of \`server/functions.ts\` to \`dist/functions.json\` and fails on anything else (keep helpers in another module)
 
 ## Handler-Based Functions
 
@@ -1005,45 +1013,48 @@ export const submitScore = mutation({
   editorOnly: false,
 });
 
-// External API call (requires egress.allowHosts in config)
-// Egress allowlist is enforced by the Supervisor \u2014 requests to undeclared hosts are rejected before reaching the network
-export const fetchScores = action({
-  args: { sport: v.string(), league: v.string() },
+// Push a live update to every surface of the install (overlay, widget, editor)
+export const castVote = mutation({
+  args: { choice: v.string() },
   handler: async (ctx, args) => {
-    const apiKey = ctx.secrets.get("ESPN_API_KEY");
-    const res = await ctx.fetch(
-      \`https://site.api.espn.com/apis/v2/sports/\${args.sport}/\${args.league}/scoreboard\`,
-      { headers: { "Authorization": \`Bearer \${apiKey}\` } }
-    );
-    return res.json();
+    await ctx.db.insert("votes", { choice: args.choice });
+    const votes = await ctx.db.list("votes");
+    ctx.realtime.push("poll:votes", { total: votes.length });
   },
 });
 \`\`\`
 
+Receive the push in any surface with \`useRealtime\`:
+
+\`\`\`tsx
+import { useRealtime } from "@zaflun/lumio-sdk";
+
+useRealtime<{ total: number }>("poll:votes", (payload) => setTotal(payload.total));
+\`\`\`
+
 ### Handler Context (\`ctx\`)
 
-Handler-based functions run inside a V8 isolate Web Worker. The \`ctx\` object provides the full sandbox API:
+Handler-based functions run in a V8 isolate on the Bot Module Worker (never in the API process or the browser). The \`ctx\` object:
 
 | Property | Description |
 |----------|-------------|
-| \`ctx.db.get(table, id)\` | Read a single row by ID from extension DB schema |
-| \`ctx.db.insert(table, data)\` | Insert row |
-| \`ctx.db.patch(table, id, data)\` | Update row |
-| \`ctx.db.delete(table, id)\` | Delete row |
-| \`ctx.fetch(url, options?)\` | HTTP request (egress allowlist enforced by Supervisor) |
-| \`ctx.secrets.get(key)\` | Read server-side secret (set via dashboard or \`lumio secrets\`) |
-| \`ctx.auth\` | \`{ userId, accountId, target }\` \u2014 caller identity from extension token |
+| \`ctx.db.get(table, id)\` / \`list(table, filters?)\` | Read rows of the extension's tables (install's account only) |
+| \`ctx.db.insert(table, data)\` / \`patch\` / \`delete\` | Write rows |
+| \`ctx.realtime.push(topic, payload?)\` | Push \`{ topic, payload }\` to every rendered surface of the install (\`useRealtime\`). Topic: 1-64 chars of \`A-Z a-z 0-9 _ . : -\`; payload \u2264 16 KiB; \u2264 32 per call, 300 per install and minute. Sent after the handler returns, only if it did not throw |
+| \`ctx.cache\` / \`ctx.defer\` | Install-scoped cache and background jobs, as in bot modules |
+| \`ctx.secrets.get(key)\` | The extension's owner secret (\`lumio env set\`), or \`null\` |
+| \`ctx.fetch(url, options?)\` | Refuses every host in server functions (no egress allow-list yet); call external APIs from a bot module |
+| \`ctx.auth\` | \`{ userId, accountId, role }\` \u2014 \`userId\` is \`null\` for overlay, widget and extension tokens |
 
 ### Sandbox Limits
 
 | Limit | Value |
 |-------|-------|
 | Memory | 256 MB per invocation |
-| CPU timeout | 10 seconds |
+| Wall-clock timeout | 5 seconds per call |
 | Filesystem | No access |
-| Network | Only \`ctx.fetch()\` via egress allowlist (Supervisor-enforced) |
+| Network | None for server functions (\`ctx.fetch\` refuses every host) |
 | Dynamic code | Blocked (\`eval\`, \`Function\`, \`import()\`) |
-| Storage APIs | localStorage/sessionStorage blocked (separate origin) |
 
 ### Rate Limits
 
@@ -1063,46 +1074,41 @@ import { useLumioAction } from "@zaflun/lumio-sdk";
 
 // Send a chat message on the connected platform
 const { execute: sendChat, isLoading, error } = useLumioAction("chat:send");
-sendChat({ message: "Hello from the extension!" });
+sendChat({
+  platform: "twitch",
+  channel_id: "primary",
+  message: "Hello from the extension!"
+});
 
 // Switch OBS scene (requires OBS WebSocket integration)
 const { execute: setScene } = useLumioAction("obs:set_scene");
-setScene({ sceneName: "Main Scene" });
+setScene({ scene_name: "Main Scene" });
 
 // Emit a custom event into the Lumio event bus
 const { execute: emitEvent } = useLumioAction("events:emit");
-emitEvent({ type: "extension:custom", payload: { score: 42 } });
+emitEvent({ event_type: "extension:custom", data: { score: 42 } });
 
 // Update a specific layer in the overlay
 const { execute: updateLayer } = useLumioAction("overlay:update_layer");
-updateLayer({ layerId: "uuid", visible: true });
+updateLayer({
+  overlay_id: "overlay-uuid",
+  layer_id: "layer-uuid",
+  config: { visible: true }
+});
 \`\`\`
 
-**Available actions (21 total, \`action\` is \`LumioActionType\`):**
+**Available dispatched actions (\`action\` is \`LumioActionType\`):**
 
 | Action | Permission required | Description |
 |--------|--------------------|----|
 | \`chat:send\` | \`chat:send\` | Send chat message on connected platform |
 | \`chat:delete\` | \`chat:delete\` | Delete a chat message |
-| \`chat:ban\` | \`chat:ban\` | Ban a user from chat |
-| \`chat:unban\` | \`chat:ban\` | Unban a user from chat |
-| \`chat:timeout\` | \`chat:ban\` | Timeout a user from chat |
-| \`obs:set_scene\` | \`obs:control\` | Switch OBS scene |
-| \`obs:set_source_visible\` | \`obs:control\` | Show or hide an OBS source |
-| \`obs:start_stream\` | \`obs:control\` | Start OBS streaming |
-| \`obs:stop_stream\` | \`obs:control\` | Stop OBS streaming |
-| \`obs:start_recording\` | \`obs:control\` | Start OBS recording |
-| \`obs:stop_recording\` | \`obs:control\` | Stop OBS recording |
-| \`events:emit\` | \`events:write\` | Emit event into Lumio event bus |
-| \`overlay:update_layer\` | \`overlays:edit\` | Update overlay layer properties |
-| \`spotify:play\` | \`spotify:control\` | Resume Spotify playback |
-| \`spotify:pause\` | \`spotify:control\` | Pause Spotify playback |
-| \`spotify:skip\` | \`spotify:control\` | Skip to next track |
-| \`spotify:seek\` | \`spotify:control\` | Seek to position in current track |
-| \`spotify:volume\` | \`spotify:control\` | Set Spotify volume |
-| \`spotify:shuffle\` | \`spotify:control\` | Toggle shuffle mode |
-| \`spotify:repeat\` | \`spotify:control\` | Set repeat mode |
-| \`spotify:queue_add\` | \`spotify:control\` | Add track to Spotify queue |
+| \`obs:set_scene\` | \`obs:set_scene\` | Switch OBS scene |
+| \`obs:set_source_visible\` | \`obs:set_source_visible\` | Show or hide an OBS source |
+| \`obs:start_stream\` | \`obs:start_stream\` | Start OBS streaming |
+| \`obs:stop_stream\` | \`obs:stop_stream\` | Stop OBS streaming |
+| \`events:emit\` | \`events:emit\` | Emit event into Lumio event bus |
+| \`overlay:update_layer\` | \`overlay:update_layer\` | Update overlay layer properties |
 
 Actions are proxied through the Lumio API \u2014 the extension never accesses OAuth tokens or platform credentials directly.
 
@@ -1149,7 +1155,8 @@ export default defineAutomationTrigger({
     const lastCheck = await ctx.cache.get("last_check") ?? "1970-01-01T00:00:00Z";
     const res = await ctx.fetch(
       \`https://api.example.com/events?since=\${lastCheck}\`,
-      { headers: { "Authorization": \`Bearer \${ctx.secrets.get("API_KEY")}\` } }
+      // Automation nodes get no secrets yet: the token comes from the node config.
+      { headers: { "Authorization": \`Bearer \${ctx.nodeConfig.apiToken}\` } }
     );
     const events = await res.json();
     await ctx.cache.set("last_check", new Date().toISOString());
@@ -1183,7 +1190,7 @@ export default defineAutomationLogic({
 | \`ctx.inputData\` | Action, Logic | Data from the upstream node |
 | \`ctx.fetch(url, options?)\` | All | HTTP request (egress allowlist enforced) |
 | \`ctx.cache.get(key)\` / \`ctx.cache.set(key, value, ttl?)\` | All | Per-installation KV cache (Redis, 1h default TTL) |
-| \`ctx.secrets.get(key)\` | All | Server-side secret |
+| \`ctx.secrets.get(key)\` | All | Not wired for automation nodes yet: always \`null\` |
 | \`ctx.db\` | All | Extension DB schema access |
 | \`ctx.auth\` | All | \`{ accountId }\` \u2014 account identity |
 | \`ctx.defer()\` | Action | Mark execution as async (returns 202, completes in background) |
@@ -1340,7 +1347,7 @@ The extension must declare the matching permission in \`lumio.config.json\`. For
 | \`chat:delete\` | Delete chat messages | Enhanced |
 | \`chat:ban\` | Ban, unban, and timeout users | Enhanced |
 | \`events:read\` | Subscribe to platform events | Standard |
-| \`events:write\` | Emit custom events | Standard |
+| \`events:emit\` | Emit custom events | Standard |
 `;
 
 // src/content/cli-workflows.ts
@@ -1448,7 +1455,6 @@ Automation nodes always generate \`server/handler.ts\` (not \`server/functions.t
 | Blank | editor + layer | No | Minimal starting point |
 | Widget | editor + layer | Yes | Widget with storage |
 | Full-Stack | editor + layer | Yes | Complete extension with server functions |
-| Interactive Game | editor + layer + interactive | Yes | Viewer interaction game |
 | Bot Module | server-only | Yes | Chat command module |
 | Automation Action | server + editor | Yes | Automation workflow action node |
 | Automation Trigger | server + editor | Yes | Automation workflow trigger node |
@@ -1465,9 +1471,8 @@ lumio dev
 
 # Output:
 # Lumio Dev Server running at http://localhost:5173
-# Editor:      http://localhost:5173/editor
-# Layer:       http://localhost:5173/layer
-# Interactive: http://localhost:5173/interactive
+# Editor: http://localhost:5173/editor
+# Layer:  http://localhost:5173/layer
 #
 # Mock events available. Press 'e' to emit a test event.
 # Press 'q' to quit.
@@ -1503,19 +1508,31 @@ Features:
 
 ## lumio build
 
-Bundle the extension as standalone HTML and create source archive.
+Bundle the extension and create source archive.
 
 \`\`\`bash
 lumio build
 
-# Output:
-# Building extension...
-# Bundling editor.tsx -> dist/editor.html (42 KB)
-# Bundling layer.tsx -> dist/layer.html (38 KB)
-# Creating source archive -> dist/source.tar.gz
-# Build complete!
+# Output for widgets:
+#   Built: dist/editor.js
+#   Built: dist/layer.js
+#   Built: dist/server.js + dist/functions.json (if server: true)
+#   Compiled: dist/styles.css (if Tailwind detected)
+#   Archive: dist/source.tar.gz
+#
+# Output for bot modules (server: true):
+#   Bot module \u2014 no UI targets to bundle.
+#   Built: dist/server.js
+#   Archive: dist/source.tar.gz
 \`\`\`
 
+Build steps:
+1. UI targets (\`editor\`, \`layer\`, \`designer\`) \u2014 esbuild IIFE bundles
+2. Server handler (\`server: true\`) \u2014 compiles \`server/handler.ts\` (or \`server/index.ts\`, else \`server/functions.ts\`) to \`dist/server.js\` (ESM)
+3. Functions manifest (\`server: true\`, not bot modules / automation nodes) \u2014 evaluates \`server/functions.ts\` and writes every export to \`dist/functions.json\` (\`{ version: 1, functions: { name: { kind, category, editorOnly, table?, \u2026 } } }\`; handlers become \`{ kind: "handler", category }\` stubs). Fails on a non-definition export, a non-JSON value, \`secret()\` in a declarative function, a table missing from \`server/schema.ts\`, or names that differ only in case. \`lumio deploy\` uploads it with the version.
+4. CSS \u2014 Tailwind v4 auto-detected and compiled, or plain CSS copied
+5. Source archive \u2014 \`dist/source.tar.gz\`
+
 Warns if \`CHANGELOG.md\` is missing.
 
 ## lumio deploy
@@ -1539,6 +1556,11 @@ lumio deploy --breaking -v 2.0.0
 lumio deploy --draft
 \`\`\`
 
+Pre-flight checks before upload:
+- Sound files validated (format, existence in \`dist/sounds/\`, per-file size against limit)
+- Sound count, per-file size, and total storage checked against resolved limits from API
+- Manifest validated against schema
+
 After deploy:
 1. Version status = \`draft\`
 2. Submit for review via dashboard (\`/dashboard/extensions/{slug}/submit\`)
@@ -1606,25 +1628,27 @@ lumio logs --filter fetchScores
 lumio logs --level error
 \`\`\`
 
-## lumio secrets
+## lumio env
 
-Manage server-side secrets used by handler-based server functions via \`ctx.secrets.get("KEY")\`.
+Manage the extension's secrets. Bot-module handlers read them via \`await ctx.secrets.get("KEY")\` (\`null\` when unset). Server functions and automation nodes do not get secrets yet (\`ctx.secrets.get\` returns \`null\` there).
 
 \`\`\`bash
-# Set a secret
-lumio secrets set ESPN_API_KEY abc123xyz
+# Set a secret (prompts with hidden input when VALUE is omitted)
+lumio env set ESPN_API_KEY
+
+# Non-interactive (CI): value from LUMIO_SECRET, keeps it out of shell history
+LUMIO_SECRET="$ESPN_API_KEY" lumio env set ESPN_API_KEY
 
 # List secret keys (values are never shown)
-lumio secrets list
+lumio env list
 # Output:
-# ESPN_API_KEY   (set 2026-05-19)
-# WEATHER_TOKEN  (set 2026-04-01)
+#   ESPN_API_KEY  (created 2026-05-19T00:00:00Z)
 
 # Delete a secret
-lumio secrets delete ESPN_API_KEY
+lumio env delete ESPN_API_KEY
 \`\`\`
 
-Secrets are stored encrypted on the Lumio platform and injected into the V8 isolate at runtime. They are never exposed to the frontend or to other extensions.
+Keys match \`^[A-Z0-9_]{1,64}$\`; values are 1 to 4096 bytes. A developer API key (\`lm_dev_\`) may manage secrets, so this works in CI. Secrets are stored encrypted (AES-256-GCM), one set per extension shared by every install, and are never returned by the API or exposed to the frontend or other extensions.
 
 ## lumio team
 
@@ -1700,14 +1724,14 @@ AuthContext::ExtensionToken {
     extension_id: Uuid,
     install_id: Uuid,
     account_id: Uuid,
-    target: "editor" | "layer" | "interactive",
+    target: "editor" | "layer",
 }
 \`\`\`
 
 ### Token Lifecycle
 
 1. User opens extension in dashboard/overlay \u2014 Lumio server generates \`lm_ext_*\` token
-2. Token passed to Extension Runtime iframe: \`ext.lumio.vision/ext/{slug}/layer?token=lm_ext_xxx&install_id=uuid\` where \`slug\` includes the \`short_id\` prefix (e.g. \`k8f2x-my-extension\`); the store URL is \`/store/k8f2x-my-extension\`
+2. Token handed to the extension inside the sandbox; the Extension Runtime iframe runs on the extension's own origin \`<label>.runtime.ext.lumio.vision\` (\`<label>\` = extension UUID as 32 lowercase hex). The extension \`slug\` includes the \`short_id\` prefix (e.g. \`k8f2x-my-extension\`); the store URL is \`/store/k8f2x-my-extension\`
 3. SDK uses token for all API calls (server functions, storage, events)
 4. Token auto-refreshes via postMessage every 12 minutes (before 15-min expiry) \u2014 the Supervisor mediates the refresh
 5. On page reload, a new token is generated
@@ -1741,7 +1765,7 @@ Widget tokens are suitable for persistent, public-facing embeds where session re
 Server functions marked with \`editorOnly: true\` can only be called from the \`editor\` surface.
 
 \`\`\`typescript
-// Only callable from editor.tsx \u2014 layer.tsx and interactive.tsx get 403
+// Only callable from editor.tsx \u2014 layer.tsx gets 403
 export const addItem = insertRow("items", { text: arg("text") }, { editorOnly: true });
 
 // Callable from any surface
@@ -1784,11 +1808,11 @@ Extensions run inside a 3-layer iframe sandbox. Understanding the layers is impo
 
 \`\`\`
 Host (lumio.vision / browser source)
-  \u2514\u2500\u2500 Supervisor iframe (supervisor.extension.lumio.vision)
+  \u2514\u2500\u2500 Supervisor iframe (supervisor.ext.lumio.vision)
         Purpose: validates postMessage traffic, enforces egress allowlist,
                  mediates token refresh, proxies LumioComponentNode[] to host
-        \u2514\u2500\u2500 Extension Runtime iframe (ext.lumio.vision)
-              Purpose: runs extension code on a separate origin
+        \u2514\u2500\u2500 Extension Runtime iframe (<label>.runtime.ext.lumio.vision)
+              Purpose: runs extension code on its own origin (one per extension)
               Storage: localStorage/sessionStorage BLOCKED (cross-origin isolation)
               \u2514\u2500\u2500 Web Worker
                     Purpose: V8 isolate for server function execution
@@ -1801,8 +1825,9 @@ Host (lumio.vision / browser source)
 - Mediates \`lm_ext_*\` token refresh (12 min interval, before 15 min expiry)
 - Forwards serialized \`LumioComponentNode[]\` to the Host renderer
 
-**Extension Runtime (ext.lumio.vision) origin isolation:**
+**Extension Runtime (<label>.runtime.ext.lumio.vision) origin isolation:**
 - Runs on a separate origin from the Host \u2014 this prevents direct DOM access and localStorage sharing
+- Every extension gets its own origin (\`<label>\` = extension UUID as 32 lowercase hex), so two extensions never share browser state
 - \`localStorage\` and \`sessionStorage\` throw \`DOMException: Access is denied\` \u2014 use \`useExtensionStorage()\` instead
 - \`document.cookie\` is unavailable
 - Cross-origin postMessage to the Host goes through the Supervisor
@@ -1900,8 +1925,8 @@ var bestPracticesContent = `# Best Practices
 ## Performance
 
 ### Minimize renders
-- Use \`useVisionState()\` for individual values instead of \`useExtensionStorage()\` for everything
-- Avoid spreading entire storage on every keystroke \u2014 debounce text inputs
+- Call \`useExtensionStorage(key, initialValue)\` once per value \u2014 each key loads, syncs and re-renders on its own
+- Debounce text inputs \u2014 every setter call is one storage write
 - Use \`useMemo\` and \`useCallback\` to avoid unnecessary re-renders
 
 ### Optimize server function calls
@@ -1926,22 +1951,21 @@ Always use \`useExtensionStorage()\` for state that should be visible on both ed
 
 \`\`\`tsx
 // editor.tsx \u2014 user configures
-const [storage, setStorage] = useExtensionStorage();
-<TextField label="Title" value={storage.title ?? ""}
-  onChange={(v) => setStorage({ ...storage, title: v })} />
+const [title, setTitle] = useExtensionStorage("title", "Default Title");
+<TextField label="Title" value={title} onChange={setTitle} />
 
 // layer.tsx \u2014 displays result
-const [storage] = useExtensionStorage();
-<Text content={storage.title ?? "Default Title"} variant="heading" />
+const [title] = useExtensionStorage("title", "Default Title");
+<Text content={title} variant="heading" />
 \`\`\`
 
 ### Graceful defaults
-Always provide sensible defaults using \`??\` (nullish coalescing). Storage might be empty on first load.
+Pass a sensible \`initialValue\` for every key. The hook returns it until the stored value has loaded, and for a key that was never stored.
 
 \`\`\`tsx
-const visible = storage.visible ?? true;
-const maxItems = storage.maxItems ?? 10;
-const theme = storage.theme ?? "dark";
+const [visible] = useExtensionStorage("visible", true);
+const [maxItems] = useExtensionStorage("maxItems", 10);
+const [theme] = useExtensionStorage("theme", "dark");
 \`\`\`
 
 ### Loading states
@@ -2069,12 +2093,13 @@ For beta testing before public launch:
 | Mistake | Fix |
 |---------|-----|
 | Direct DOM manipulation | Use SDK components only \u2014 reconciler serializes to \`LumioComponentNode[]\` |
-| \`setStorage(newObj)\` without spread | \`setStorage({ ...storage, key: value })\` |
+| \`useExtensionStorage()\` without a key | \`useExtensionStorage(key, initialValue)\` \u2014 one call per key |
+| Object under one key set without spread | \`setScore({ ...score, home: 2 })\` \u2014 the setter replaces that key's value |
 | Polling with setInterval | Use \`useLumioEvent()\` for live data |
 | Large inline images | Use URL-based images via \`Image\` component |
 | Missing \`Lumio.render()\` | Must be called within 10s of page load |
 | Hardcoded strings | Use \`config_schema\` fields for user-customizable text |
-| Using localStorage directly | Use \`useExtensionStorage()\` (localStorage blocked at ext.lumio.vision) |
+| Using localStorage directly | Use \`useExtensionStorage()\` (localStorage blocked on the Extension Runtime origin) |
 | Raw CSS \`@keyframes\` animations | Use \`useAnimation()\` + \`<Animated>\` SDK presets |
 
 ## Bot Module Security
@@ -2205,7 +2230,7 @@ var troubleshootingContent = `# Troubleshooting
 | \`EGRESS_BLOCKED\` | Host not in allowlist | \`ctx.fetch()\` called with undeclared host | Add host to \`egress.allowHosts\` in \`lumio.config.json\` |
 | \`EGRESS_PRIVATE_IP\` | Private IP range blocked | Fetch targeting localhost or private network | Use public HTTPS endpoints only |
 | \`STORAGE_QUOTA\` | Storage quota exceeded | Extension data exceeds allocated storage | Reduce stored data or request limit increase |
-| \`EDITOR_ONLY\` | Function restricted to editor | Mutation with \`editorOnly: true\` called from layer/interactive | Remove \`editorOnly\` flag or call only from editor |
+| \`EDITOR_ONLY\` | Function restricted to editor | Mutation with \`editorOnly: true\` called from the layer | Remove \`editorOnly\` flag or call only from editor |
 | \`MEMORY_LIMIT\` | V8 isolate memory exceeded (128 MB) | Handler-based function using too much memory | Reduce data processing, stream large datasets |
 | \`CPU_TIMEOUT\` | V8 isolate CPU timeout (5s) | Handler-based function running too long | Optimize logic, break into smaller operations |
 | \`RATE_LIMITED\` | Too many requests (429) | Exceeded per-installation rate limit | Reduce call frequency, batch operations |
@@ -2213,12 +2238,13 @@ var troubleshootingContent = `# Troubleshooting
 | \`SCHEMA_VALIDATION\` | Invalid function arguments | Args do not match \`v.string()\`/\`v.number()\` validators | Check argument types match schema definition |
 | \`TABLE_NOT_FOUND\` | Table does not exist | Referenced table not defined in \`server/schema.ts\` | Add table to \`defineSchema()\` and redeploy |
 | \`PERMISSION_DENIED\` | Missing declared permission | Action requires undeclared permission | Add permission to \`lumio.config.json -> permissions\` |
-| \`SECRET_NOT_FOUND\` | Secret key not set | \`ctx.secrets.get("KEY")\` with unset secret | Set secret via dashboard (\`/dashboard/extensions/{slug}/secrets\`) |
+| \`ctx.secrets.get\` returns \`null\` | Secret key not set | Bot-module handler reads a key nobody set | \`lumio env set KEY\` or Dashboard \u2192 Extensions \u2192 your extension \u2192 Secrets |
+| \`ctx.secrets is unavailable\` | Secret store unreadable right now | Transient platform issue | Retry; handle the error instead of crashing the handler |
 | \`CHANGELOG_MISSING\` | No changelog entry for version | \`lumio deploy\` without matching CHANGELOG.md entry | Add entry for the version in CHANGELOG.md, or use \`-d\` flag |
 | \`BUNDLE_TOO_LARGE\` | Bundle exceeds size limit | Built bundle exceeds \`max_bundle_size_mb\` | Reduce bundle size or request limit increase |
 | \`SUPERVISOR_BLOCKED\` | Supervisor rejected postMessage | Message origin or schema invalid | Ensure you are in the correct iframe layer; do not post to Host directly |
 | \`WORKER_CREATION_FAILED\` | Web Worker could not start | Server functions bundle is invalid or too large | Check for syntax errors in server functions; run \`lumio build\` locally |
-| \`STORAGE_DOM_EXCEPTION\` | localStorage/sessionStorage access attempt | Extension Runtime (ext.lumio.vision) blocks storage APIs | Replace \`localStorage.setItem\` with \`useExtensionStorage()\` |
+| \`STORAGE_DOM_EXCEPTION\` | localStorage/sessionStorage access attempt | Extension Runtime (<label>.runtime.ext.lumio.vision) blocks storage APIs | Replace \`localStorage.setItem\` with \`useExtensionStorage()\` |
 | \`SLUG_FORMAT_INVALID\` | Slug does not match short-ID format | Manually edited slug in \`lumio.config.json\` | Use auto-generated slug (\`k8f2x-my-extension\` format) or run \`lumio init\` |
 
 ## Common Issues
@@ -2256,7 +2282,7 @@ The SDK auto-refreshes \`lm_ext_*\` tokens via postMessage. The Supervisor media
 ### Supervisor blocked messages (\`SUPERVISOR_BLOCKED\`)
 The Supervisor validates all postMessage traffic between Extension Runtime and Host. If you see this error:
 1. Do not post messages directly from extension code to \`window.parent.parent\` (Host) \u2014 always use SDK hooks
-2. Verify the extension iframe is loaded inside \`supervisor.extension.lumio.vision\`, not directly in the Host
+2. Verify the extension iframe is loaded inside \`supervisor.ext.lumio.vision\`, not directly in the Host
 3. Check that the message schema matches the \`@zaflun/lumio-protocol\` wire format (SDK handles this automatically)
 
 ### Worker creation failures (\`WORKER_CREATION_FAILED\`)
@@ -2266,7 +2292,7 @@ The V8 isolate Web Worker for server functions failed to start:
 3. Check \`lumio logs\` for the underlying JS error from the Worker initializer
 
 ### Storage DOMException errors (\`STORAGE_DOM_EXCEPTION\`)
-\`localStorage\` and \`sessionStorage\` are blocked on the Extension Runtime origin (\`ext.lumio.vision\`):
+\`localStorage\` and \`sessionStorage\` are blocked on the Extension Runtime origin (\`<label>.runtime.ext.lumio.vision\`):
 1. Replace all \`localStorage.setItem\` / \`localStorage.getItem\` calls with \`useExtensionStorage()\`
 2. Replace all \`sessionStorage\` usage with \`useVisionState()\` for transient values
 3. For server-side persistence, use \`ctx.db\` in server functions

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   ROOT_FILES,
   SKILL_FILES,
   installSkillFiles
-} from "./chunk-QXQNAYHN.js";
+} from "./chunk-XJZ7H56F.js";
 export {
   ROOT_FILES,
   SKILL_FILES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaflun/lumio-agent-skill",
-  "version": "0.5.0",
+  "version": "0.6.2",
   "description": "AI agent skill files for building Lumio Extensions",
   "type": "module",
   "main": "dist/index.js",
@@ -27,10 +27,10 @@
   },
   "license": "MIT",
   "devDependencies": {
-    "@types/node": "^22.0.0",
+    "@types/node": "^26.1.2",
     "tsup": "^8.4.0",
-    "typescript": "^5.8.3",
-    "vitest": "^3.1.4"
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.10"
   },
   "repository": {
     "type": "git",