@zaflun/lumio-agent-skill 0.6.2 → 0.6.5

package/CHANGELOG.md

@@ -0,0 +1,126 @@
+# Changelog
+
+All notable changes to `@zaflun/lumio-agent-skill` are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## 0.6.5
+
+### Added
+
+- **`CHANGELOG.md` in the package** — the npm tarball ships this changelog.
+- **Shopify events** — `SKILL.md` lists `shopify:order`,
+  `shopify:order_paid` and `shopify:product` (65 event types in total) and
+  describes their payloads: the store in `shop { domain, label }`, order
+  totals and line items only as the store's settings allow, and
+  `customer_display` only with the buyer's consent, to be rendered as text,
+  never as HTML.
+- **Which URLs the host loads** — `components.md` explains that `<Image>`,
+  `<img src>` and `<a href>` load only from an `https` host in
+  `egress.allowHosts`, a `data:image/*` URL, the Lumio page, the extension's
+  runtime origin, or a platform avatar or emote URL served by Lumio's image
+  proxy. Any other URL renders an empty placeholder, and `style` values with
+  `url()` are dropped.
+
+## 0.6.2
+
+### Changed
+
+- **No `interactive` surface** — the skill files describe two surfaces,
+  editor and layer. Viewer input (votes, games) goes through chat commands
+  and channel point rewards handled by a bot module, which writes `ctx.db`
+  and calls `ctx.realtime.push`; the layer and editor receive it with
+  `useRealtime(topic, cb)`. The `interactive` template and target are gone
+  from the CLI and auth docs.
+- **`useExtensionStorage(key, initialValue)`** — every example uses the
+  one-key-per-call signature instead of a whole-storage object with spread
+  updates.
+- **Server functions** — they run in a V8 isolate on the Bot Module Worker
+  with a 5-second limit per call. `ctx.realtime.push` and `useRealtime` are
+  documented, `ctx.fetch` refuses every host in server functions, and
+  `secret()` works only in `action()` handlers. `lumio build` writes
+  `dist/functions.json` from `server/functions.ts`; declarative queries take
+  `orderBy`, `orderDir`, `limit` and `offset`.
+- **`lumio env` replaces `lumio secrets`** — set, list and delete extension
+  secrets, with the key and value rules. Bot-module handlers read them with
+  `await ctx.secrets.get("KEY")`; server functions and automation nodes get
+  `null`.
+- **Event list** — 62 event types: `twitch:gift_sub` is `twitch:gift`, and
+  `twitch:reward_status`, `twitch:reward_add`, `twitch:reward_update` and
+  `twitch:reward_remove` are added. `useLumioEvent()` examples show the typed
+  payload.
+- **Developer limits link** — points to
+  `/dashboard/settings/developer/limits`.
+
+## 0.5.3
+
+### Added
+
+- **Bundled sounds** — the `sounds` array in `lumio.config.json`, supported
+  formats and default limits.
+
+### Changed
+
+- **Per-extension runtime origin** — the skill files describe the Extension
+  Runtime on `<label>.runtime.ext.lumio.vision` (one origin per extension)
+  and the Supervisor on `supervisor.ext.lumio.vision`.
+- **Extension actions** — the action list matches what the Lumio API
+  dispatches: chat send and delete, the OBS scene, source and stream
+  actions, `events:emit` and `overlay:update_layer`, each with its own
+  permission. Example parameters use the snake_case payloads
+  (`scene_name`, `event_type`, `layer_id`, …).
+- **Event list** — 58 event types, including Kick resubs, KICKs, rewards and
+  stream updates, Twitch end and lock events, `streamelements:tip` and
+  `chat:message`.
+- **`lumio build`** — documents the JS bundles, the bot-module server bundle,
+  Tailwind compilation and the pre-flight checks before upload.
+
+## 0.5.0
+
+### Added
+
+- **Automation nodes** — `defineAutomationAction`, `defineAutomationTrigger`
+  and `defineAutomationLogic` handlers, the `lumio init` automation templates
+  and the `lumio dev` automation simulator.
+- **Editor and picker components** — the 14 `Editor*` components with
+  `useEditorAction`, and `IconPicker`, `IconDisplay` and `useIconPicker`.
+- **Config schema field types** — the extended field types, `visible_when`,
+  groups, and `designer_schema` for the full-page designer.
+
+## 0.4.0
+
+### Added
+
+- **Bot modules** — the `command`, `keyword`, `pattern`, `event`, `timer`
+  and `moderate` handlers, their return actions and permissions, the handler
+  context (`ctx.user`, `ctx.cache`, `ctx.defer()`), and best practices for
+  rate limits, moderation escalation, overridable triggers and exempt roles.
+
+### Changed
+
+- **OBS wording** — the layer is described as running in a Browser Source,
+  not specifically OBS.
+
+## 0.2.0
+
+### Changed
+
+- **`config_schema` is an array** of fields with `default_value` and
+  `required` in every example, and the config example uses the
+  `https://lumio.vision/schemas/lumio.config.schema.json` schema URL.
+- **`useLumioAction(action)`** — examples drop the second argument; the
+  action list adds `chat:delete` and the OBS source and stream actions.
+- **`instance` storage scope** — filtered by install as well as account and
+  overlay.
+
+## 0.1.0
+
+### Added
+
+- **Initial release** — `npx lumio-skills add` writes eight skill files to
+  `.lumio/skills/` (`SKILL.md`, components, server functions, CLI workflows,
+  auth, runtime scopes, best practices, troubleshooting) and pointer files
+  for AI assistants (`AGENTS.md`, `GEMINI.md`, `.windsurfrules`,
+  `.github/copilot-instructions.md`). `installSkillFiles`, `SKILL_FILES` and
+  `ROOT_FILES` are exported for programmatic use.

package/dist/bin/lumio-skills.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   installSkillFiles
-} from "../chunk-XJZ7H56F.js";
+} from "../chunk-LKWF2Y7K.js";
 
 // src/bin/lumio-skills.ts
 import { resolve } from "path";

package/dist/{chunk-XJZ7H56F.js → chunk-LKWF2Y7K.js}

@@ -373,13 +373,13 @@ return <Text content={text} />;
 
 ### Live events
 \`\`\`tsx
-// eventType is LumioEventType \u2014 autocomplete shows all 62 valid event strings
+// eventType is LumioEventType \u2014 autocomplete shows all 65 valid event strings
 const event = useLumioEvent("twitch:cheer");
 // event updates automatically when a new cheer arrives; it is typed
 // LumioEventPayloadMap["twitch:cheer"] | null, so event?.bits is a number
 \`\`\`
 
-**All 62 event types** (\`LumioEventType\`):
+**All 65 event types** (\`LumioEventType\`):
 
 Twitch (27): \`twitch:follower\`, \`twitch:subscribe\`, \`twitch:gift\`, \`twitch:resub\`, \`twitch:cheer\`, \`twitch:raid\`, \`twitch:reward\`, \`twitch:reward_status\`, \`twitch:reward_add\`, \`twitch:reward_update\`, \`twitch:reward_remove\`, \`twitch:hype_train\`, \`twitch:hype_train_end\`, \`twitch:poll\`, \`twitch:poll_end\`, \`twitch:prediction\`, \`twitch:prediction_lock\`, \`twitch:prediction_end\`, \`twitch:goal\`, \`twitch:goal_end\`, \`twitch:ad_break\`, \`twitch:ban\`, \`twitch:unban\`, \`twitch:stream_online\`, \`twitch:stream_offline\`, \`twitch:stream_update\`, \`twitch:chat\`
 
@@ -391,9 +391,11 @@ Spotify (12): \`spotify:track\`, \`spotify:play\`, \`spotify:pause\`, \`spotify:
 
 StreamElements (1): \`streamelements:tip\`
 
+Shopify (3): \`shopify:order\`, \`shopify:order_paid\`, \`shopify:product\`
+
 Cross-platform chat (1, fires for every platform): \`chat:message\`
 
-Kick events carry canonical top-level fields (\`user_id\`, \`user_login\`, \`user_name\`, \`avatarUrl\`, \`is_anonymous\`) plus the original Kick payload. \`kick:kicks\` has \`kicks\` (amount, like Twitch \`bits\`) and \`message\`; \`kick:reward\` / \`kick:reward_status\` have \`status\`, \`user_input\` and \`reward { id, title, cost, prompt }\`; \`kick:resub\` has \`cumulative_months\`. \`twitch:reward_status\` has the \`twitch:reward\` shape with \`status\` \`fulfilled\` / \`canceled\`. \`twitch:reward_add\` / \`_update\` / \`_remove\` carry the Twitch reward (\`id\`, \`title\`, \`cost\`, \`prompt\`, \`is_enabled\`, \`is_paused\`, \u2026); these three arrive live only (\`broadcast_only\`), never from the event history.
+Kick events carry canonical top-level fields (\`user_id\`, \`user_login\`, \`user_name\`, \`avatarUrl\`, \`is_anonymous\`) plus the original Kick payload. \`kick:kicks\` has \`kicks\` (amount, like Twitch \`bits\`) and \`message\`; \`kick:reward\` / \`kick:reward_status\` have \`status\`, \`user_input\` and \`reward { id, title, cost, prompt }\`; \`kick:resub\` has \`cumulative_months\`. \`twitch:reward_status\` has the \`twitch:reward\` shape with \`status\` \`fulfilled\` / \`canceled\`. \`twitch:reward_add\` / \`_update\` / \`_remove\` carry the Twitch reward (\`id\`, \`title\`, \`cost\`, \`prompt\`, \`is_enabled\`, \`is_paused\`, \u2026); these three arrive live only (\`broadcast_only\`), never from the event history. Every \`shopify:*\` event names its store in \`shop { domain, label }\` (absent on events stored before stores carried it). \`shopify:order\` / \`shopify:order_paid\` carry \`order_number\`, \`name\`, \`financial_status\`, \`line_items\` and \`total_price\` / \`currency\` only as the store's settings allow, and \`customer_display\` only with the buyer's consent \u2014 untrusted buyer text, render it with \`<Text>\`, never as HTML. \`shopify:product\` has \`title\`, \`vendor\`, \`product_type\`, \`handle\`, \`image_url\`.
 
 ### Server queries
 \`\`\`tsx
@@ -622,6 +624,8 @@ import { Image } from "@zaflun/lumio-sdk";
 - \`height?: number | string\`
 - \`style?: VisionStyle\`
 
+The host loads \`src\` only from an \`https\` host listed in \`egress.allowHosts\` (default port), a \`data:image/*\` URL, the Lumio page itself, the extension's runtime origin, or a Twitch/7TV/BTTV/FFZ/YouTube/Discord/Kick avatar or emote URL that Lumio's image proxy serves. Any other URL renders an empty placeholder. The same applies to \`<img src>\` and \`<a href>\`; \`style\` values with \`url()\` are dropped.
+
 ## Input Components
 
 **Important:** On the layer surface, all input components become read-only. Buttons are hidden, toggles show "On"/"Off" text, dropdowns show the selected value.

package/dist/index.d.ts

@@ -13,4 +13,5 @@ declare const ROOT_FILES: SkillFile[];
  */
 declare function installSkillFiles(targetDir: string): void;
 
-export { ROOT_FILES, SKILL_FILES, type SkillFile, installSkillFiles };
+export { ROOT_FILES, SKILL_FILES, installSkillFiles };
+export type { SkillFile };

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   ROOT_FILES,
   SKILL_FILES,
   installSkillFiles
-} from "./chunk-XJZ7H56F.js";
+} from "./chunk-LKWF2Y7K.js";
 export {
   ROOT_FILES,
   SKILL_FILES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaflun/lumio-agent-skill",
-  "version": "0.6.2",
+  "version": "0.6.5",
   "description": "AI agent skill files for building Lumio Extensions",
   "type": "module",
   "main": "dist/index.js",
@@ -9,7 +9,8 @@
     "lumio-skills": "dist/bin/lumio-skills.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "CHANGELOG.md"
   ],
   "keywords": [
     "lumio",
@@ -28,9 +29,9 @@
   "license": "MIT",
   "devDependencies": {
     "@types/node": "^26.1.2",
-    "tsup": "^8.4.0",
+    "tsup": "^9.0.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^5.0.5"
   },
   "repository": {
     "type": "git",