@zaflun/lumio-cli 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -0,0 +1,205 @@
+# Changelog
+
+All notable changes to `@zaflun/lumio-cli` are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## 0.11.0
+
+### Removed
+
+- **`lumio deploy --system`** — the option uploaded to a system upload
+  endpoint the API does not have. Lumio's system extensions ship inside the API image and the API
+  uploads their bundles at startup, so the CLI has no system deploy path any
+  more. With it goes the changelog-entry requirement that only applied to
+  `--system`; the release-notes rule for `lumio deploy` is unchanged.
+
+### Changed
+
+- **`lumio dev` protocol check** — built against `@zaflun/lumio-protocol`
+  0.10.1 (`spotify:play` / `spotify:pause` can carry `source: "spotify_app"`).
+
+## 0.10.8
+
+### Added
+
+- **`CHANGELOG.md` ships in the package.**
+
+### Changed
+
+- **`lumio deploy --system` requires a changelog entry** — a system
+  extension deploy fails when `CHANGELOG.md` has no non-empty
+  `## [x.y.z]` section for the deployed version, in CI too, and `-d` does not
+  replace the entry. Third-party deploys keep their rule: a missing entry
+  stops the deploy only outside CI.
+- **`lumio dev` targets protocol 0.10.0** — the CLI warns when the project's
+  `@zaflun/lumio-sdk` or `@zaflun/lumio-devkit` speaks an older protocol, so
+  the Shopify event types (`shopify:order`, `shopify:order_paid`,
+  `shopify:product`) are not missing from the sandbox and `lumio trigger`.
+- **The sandbox preview follows the dashboard's URL rule** — images and links
+  in the extension UI load only from the sandbox page itself and the hosts in
+  `egress.allowHosts` of `lumio.config.json`. Anything else is dropped, as it
+  is on the dashboard.
+- **`lumio init` scaffolds React 19.3** — new projects get `react` and
+  `@types/react` `^19.3.0`, matching the SDK's renderer.
+- **Sandbox stylesheet rebuilt with Tailwind CSS 4.3.4.**
+- **Dependencies** — `inquirer` 14.2.5, `ora` 10 and `eventsource` 5.
+
+### Fixed
+
+- **`lumio deploy` from Windows** — bundle file paths are uploaded with `/`
+  separators instead of `\`, so the uploaded files are served under the
+  paths the extension references.
+- **`lumio logs` sends the token again** — the log stream authenticates with
+  the stored token through `eventsource` 5's `fetch` hook.
+
+## 0.10.0
+
+### Added
+
+- **A real `lumio dev`** — one session that builds the project with esbuild
+  in watch mode (the same pipeline as `lumio build`), serves a sandbox page on
+  `127.0.0.1:3100` and opens a REPL. The sandbox renders the editor and layer
+  surfaces and has panels for chat, events, channel point rewards, music,
+  scenarios, server functions, extension data and the log. Bot modules run
+  their chat, event, reward and timer handlers in the same session; the old
+  chat simulator is gone. New flags: `--platform`, `--role`, `--seed`,
+  `--no-cooldown`, `--view <target>` and `--open`; `--bot-module` now only
+  opens the chat first. Needs `@zaflun/lumio-devkit` in the project.
+- **`lumio trigger`** — sends an event, chat message, reward, music command,
+  timer, storage write or scenario to the running `lumio dev` from a second
+  terminal (`--field a.b=v`, `--tier`, `--data`, `--file`,
+  `--user` / `--role` / `--platform`, `--timer`, `--storage`). Load flags
+  `--count N`, `--rate 5/s` and `--random` send many at once.
+- **`dist/functions.json`** — `lumio build` writes a manifest of the named
+  functions in `server/functions.ts`, and bundles handler functions
+  (`query()` / `mutation()` / `action()`) into `dist/server.js`. Bot modules
+  can expose server functions too. `lumio deploy` refuses to upload when
+  `server/functions.ts` exists but the manifest was not built.
+- **Data schema upload** — `lumio deploy` sends `server/schema.ts` with the
+  version as its data schema (tables are provisioned on approval) and lists
+  schema errors the API rejects line by line.
+- **`lumio init` adds `@zaflun/lumio-devkit`** to new projects (except
+  automation nodes).
+
+### Changed
+
+- **The `interactive` target is gone** — `lumio.config.json` accepts only
+  `editor`, `layer` and `designer` and rejects any other target. Viewer input
+  comes through chat commands and channel point rewards handled by a bot
+  module. Breaking.
+- **`lumio env set`** stores a secret with `PUT …/secrets/{key}` and checks
+  the API's rules first: the key matches `^[A-Z0-9_]{1,64}$`, the value is
+  1 to 4096 bytes.
+- **Developer links** point to `/dashboard/settings/developer` (application)
+  and `/dashboard/settings/developer/limits` (limit increases).
+- **The `server/functions.ts` scaffold** orders `getItems` by `created_at`.
+
+## 0.6.2
+
+### Added
+
+- **Developer keys** — `lumio login --token` and `lumio deploy --token`
+  accept a developer key (`lm_dev_*`), the key to use for publishing. Without
+  `--token`, `lumio login` reads `LUMIO_TOKEN`.
+- **`lumio login` options** — `--id-url` and `--port` for the browser flow.
+- **Server bundle** — `lumio build` compiles `server/handler.ts` (or
+  `server/index.ts`) to `dist/server.js` for extensions with `"server": true`.
+- **Sound limit pre-flight** — `lumio deploy` checks the number, per-file size
+  and total size of declared sounds against your developer limits before it
+  uploads.
+- **`lumio env set <KEY> [VALUE]`** — without a value it reads `LUMIO_SECRET`
+  or prompts with hidden input, so the secret stays out of shell history.
+
+### Changed
+
+- **Browser login uses the ID app** — `lumio login` opens the Lumio login page
+  and exchanges the code at `/v1/auth/token/exchange`; it stores the session
+  and its refresh token. The callback server listens on `127.0.0.1` only and
+  exits as soon as the login finishes.
+- **Stricter config validation** — `extensionId` may contain only letters,
+  digits, `-` and `_` (max 64); bot-module platforms, automation `nodeType`
+  and `node.triggerMode` are checked against the shared lists.
+- **`lumio build` fails when Tailwind CSS fails** instead of shipping without
+  styles, and uses the project's own `@tailwindcss/cli` instead of `npx`.
+- **The source archive leaves out secrets** — `.env` files (except
+  `.env.example`), `.npmrc`, `.yarnrc` and `.lumio/`.
+- **Trovo is no longer a platform** — `lumio init` no longer offers it and the
+  config validator rejects it.
+- **`lumio --version`** prints the package version.
+- **Node.js 22.13 or newer is required.** Breaking.
+- **Dependencies** — `archiver` 8, `chalk` 6, `commander` 15, `esbuild` 0.28,
+  `eventsource` 4, `inquirer` 14, `open` 11.
+
+### Fixed
+
+- **`lumio deploy` error hints** — the HTTP status reaches the deploy command
+  again, so 409 / 413 / 401 failures print their guidance.
+- **`lumio run`** reports malformed JSON arguments instead of crashing.
+- **The credentials directory** is created readable by its owner only.
+
+## 0.5.2
+
+### Added
+
+- **Automation nodes** — `lumio init` scaffolds an `automation_node`
+  (action, trigger with webhook / polling, or logic), and `lumio dev` starts an
+  automation node simulator for it (`--automation-node`).
+- **`lumio init` wizard options** — editor approach (config schema, custom
+  `editor.tsx` or both), an optional visual designer for widgets and overlays,
+  and the styling (Tailwind CSS v4, plain CSS or inline). `lumio init` checks
+  for a developer profile first.
+- **CSS and assets in `lumio build`** — compiles `src/globals.css` (or
+  `style.css` / `index.css`) with Tailwind CSS v4 or copies it to
+  `dist/styles.css`, and emits imported images, media and fonts to
+  `dist/assets/`.
+- **`lumio deploy` options** — `--token` for CI and `--system` for system
+  extensions; `LUMIO_API_URL` overrides the API URL.
+- **Sound checks** — `lumio deploy` validates the sounds declared in
+  `lumio.config.json` (format, presence in `dist/sounds/`, size warning).
+
+### Changed
+
+- **`lumio deploy` uploads every file of `dist/`** individually (allowed
+  types only; max 200 files, 10 MB per file, 50 MB in total) instead of a
+  single bundle, and prints actionable hints for 409, 413 and 401 / 403.
+- **UI targets build as IIFE** with React and the SDK as runtime externals.
+- **The source archive** contains the whole project, minus `node_modules`,
+  `dist` and `.git`.
+
+## 0.3.0
+
+### Added
+
+- **Bot modules** — `lumio init` scaffolds a `bot_module` with platforms, a
+  `hello` command and `chat:read` / `chat:send`; `lumio dev` opens a chat
+  simulator for it (`--bot-module`); `lumio build` packs its `server/`.
+- **Bot handler types in `lumio run`** — `command`, `keyword`, `pattern`,
+  `event`, `timer` and `moderate`, with `--user`, `--role`, `--message` and
+  `--platform` for the mock chat user.
+- **`platforms` and `triggers`** in `lumio.config.json`; bot modules need at
+  least one platform.
+
+## 0.2.0
+
+### Added
+
+- **Browser login with PKCE** — `lumio login` without `--token` opens the
+  browser and waits for the callback on a local port.
+
+### Changed
+
+- **`lumio deploy`** writes the deployed version into the uploaded manifest.
+- **`lumio init`** points `$schema` at
+  `https://lumio.vision/schemas/lumio.config.schema.json`.
+
+## 0.1.0
+
+Initial release.
+
+### Added
+
+- **The `lumio` CLI** — `login`, `logout`, `whoami`, `init`, `dev`, `build`,
+  `deploy`, `status`, `logs`, `env`, `run` and `dashboard` for building,
+  testing and publishing Lumio extensions.

package/dist/index.js

@@ -591,13 +591,13 @@ function registerInit(program2) {
       },
       dependencies: {
         "@zaflun/lumio-sdk": "latest",
-        ...needsReact ? { "react": "^19.2.5" } : {}
+        ...needsReact ? { "react": "^19.3.0" } : {}
       },
       devDependencies: {
         "typescript": "^6.0.3",
         // `lumio dev` runs the extension on the devkit's mock host.
         ...!isAutomationNode ? { "@zaflun/lumio-devkit": "latest" } : {},
-        ...needsReact ? { "@types/react": "^19.1.0" } : {},
+        ...needsReact ? { "@types/react": "^19.3.0" } : {},
         ...useTailwind ? { "tailwindcss": "^4.3.0" } : {}
       }
     };
@@ -1655,7 +1655,7 @@ function compareVersions(a, b) {
 }
 
 // src/dev/version.ts
-var CLI_PROTOCOL_VERSION = "0.9.0";
+var CLI_PROTOCOL_VERSION = "0.10.1";
 
 // src/dev/project-modules.ts
 var MissingPackageError = class extends Error {
@@ -2607,6 +2607,7 @@ var DevSession = class {
       mounted: h.mounted,
       mountError: this.mountError,
       tree: h.tree,
+      egressHosts: egressHosts(cfg),
       themeMode: this.themeMode,
       cssVersion: this.cssVersion,
       build: this.buildStatus,
@@ -2989,6 +2990,10 @@ function describe(cmd) {
       return `/${cmd.kind}`;
   }
 }
+function egressHosts(cfg) {
+  const egress = cfg.egress;
+  return Array.isArray(egress?.allowHosts) ? egress.allowHosts.filter((h) => typeof h === "string") : [];
+}
 
 // src/dev/server.ts
 import * as fs8 from "fs";
@@ -3878,6 +3883,24 @@ function getVersionEntry(changelog, version) {
   return entries.find((e) => e.version === version) ?? null;
 }
 
+// src/changelog/release-notes.ts
+function resolveReleaseNotes(input) {
+  const { changelog, version, description, ci } = input;
+  const entry = changelog === null ? null : getVersionEntry(changelog, version);
+  if (description) return { ok: true, notes: description };
+  if (entry) return { ok: true, notes: entry.content };
+  if (changelog !== null && !ci) {
+    return {
+      ok: false,
+      error: [
+        `No changelog entry found for version ${version}.`,
+        "Add an entry to CHANGELOG.md or use -d to provide release notes."
+      ]
+    };
+  }
+  return { ok: true, notes: "" };
+}
+
 // src/commands/deploy.ts
 function collectFiles(dir, base = dir) {
   const entries = fs12.readdirSync(dir, { withFileTypes: true });
@@ -3887,7 +3910,7 @@ function collectFiles(dir, base = dir) {
     if (entry.isDirectory()) {
       files.push(...collectFiles(fullPath, base));
     } else if (entry.isFile()) {
-      files.push(path13.relative(base, fullPath));
+      files.push(path13.relative(base, fullPath).split(path13.sep).join("/"));
     }
   }
   return files;
@@ -3927,7 +3950,7 @@ var MAX_FILE_SIZE = 10 * 1024 * 1024;
 var MAX_TOTAL_SIZE = 50 * 1024 * 1024;
 var MAX_FILES = 200;
 function registerDeploy(program2) {
-  program2.command("deploy").description("Upload extension to Lumio (status: draft)").option("-v, --version <version>", "Version override").option("-d, --description <text>", "Release notes override").option("--breaking", "Mark as breaking change").option("--draft", "Explicitly mark as draft").option("--token <token>", "API token (for CI, skips login). Use a developer key (lm_dev_*) minted under Account \u2192 Developer for publishing.").option("--system", "Deploy as system extension (no developer profile required)").action(async (options) => {
+  program2.command("deploy").description("Upload extension to Lumio (status: draft)").option("-v, --version <version>", "Version override").option("-d, --description <text>", "Release notes override").option("--breaking", "Mark as breaking change").option("--draft", "Explicitly mark as draft").option("--token <token>", "API token (for CI, skips login). Use a developer key (lm_dev_*) minted under Account \u2192 Developer for publishing.").action(async (options) => {
     const store = new CredentialStore();
     const token = options.token ?? store.getToken();
     if (!token) {
@@ -4029,21 +4052,18 @@ function registerDeploy(program2) {
       }
     }
     const version = options.version ?? config.version;
-    let releaseNotes = options.description ?? "";
-    if (!releaseNotes) {
-      const changelogPath = path13.resolve("CHANGELOG.md");
-      if (fs12.existsSync(changelogPath)) {
-        const changelog = fs12.readFileSync(changelogPath, "utf-8");
-        const entry = getVersionEntry(changelog, version);
-        if (entry) {
-          releaseNotes = entry.content;
-        } else if (!LumioApiClient.isCI() && !options.system) {
-          console.error(`No changelog entry found for version ${version}.`);
-          console.error("Add an entry to CHANGELOG.md or use -d to provide release notes.");
-          process.exit(1);
-        }
-      }
+    const changelogPath = path13.resolve("CHANGELOG.md");
+    const notes = resolveReleaseNotes({
+      changelog: fs12.existsSync(changelogPath) ? fs12.readFileSync(changelogPath, "utf-8") : null,
+      version,
+      description: options.description,
+      ci: LumioApiClient.isCI()
+    });
+    if (!notes.ok) {
+      for (const line of notes.error) console.error(line);
+      process.exit(1);
     }
+    const releaseNotes = notes.notes;
     let dataSchema;
     try {
       dataSchema = await loadDataSchema(process.cwd());
@@ -4126,8 +4146,7 @@ function registerDeploy(program2) {
     console.log(`  Total: ${bundleFiles.length} files (${(totalSize / 1024).toFixed(1)} KB)`);
     console.log("  Uploading...");
     try {
-      const uploadPath = options.system ? `/v1/system/extensions/${config.extensionId}/versions/upload` : `/v1/developer/extensions/${config.extensionId}/versions/upload`;
-      await client.uploadFile(uploadPath, formData);
+      await client.uploadFile(`/v1/developer/extensions/${config.extensionId}/versions/upload`, formData);
       console.log("\n  Upload successful. Status: draft");
       console.log("  Submit for review via the dashboard or `lumio status`.");
       if (LumioApiClient.isCI()) {
@@ -4223,10 +4242,12 @@ function registerLogs(program2) {
     console.log(`Streaming logs for ${config.name}...`);
     console.log("Press Ctrl+C to stop.\n");
     try {
-      const eventsource = await import("eventsource");
-      const EventSource = "default" in eventsource ? eventsource.default : eventsource;
+      const { EventSource } = await import("eventsource");
       const es = new EventSource(logsUrl, {
-        headers: { "Authorization": `Bearer ${token}` }
+        fetch: (input, init) => fetch(input, {
+          ...init,
+          headers: { ...init.headers, Authorization: `Bearer ${token}` }
+        })
       });
       es.onmessage = (event) => {
         try {