@zaflun/lumio-cli 0.5.2 → 0.6.2

package/dist/index.d.ts

@@ -9,6 +9,17 @@ declare class CredentialStore {
     getApiUrl(): string;
     isAuthenticated(): boolean;
     saveToken(token: string, apiUrl?: string): void;
+    /**
+     * Persist a full session from the browser PKCE flow — the short-lived JWT plus
+     * the long-lived refresh token and the JWT's expiry — so a later refresh can
+     * mint a fresh JWT without re-opening the browser.
+     */
+    saveSession(session: {
+        token: string;
+        refreshToken?: string;
+        expiresAt?: string;
+        apiUrl?: string;
+    }): void;
     clear(): void;
     private readCredentials;
 }
@@ -20,6 +31,8 @@ declare class LumioApiClient {
     url(endpoint: string): string;
     authHeaders(): Record<string, string>;
     uploadHeaders(): Record<string, string>;
+    /** Throw an {@link ApiError} (with status) when the response is not ok. */
+    private ensureOk;
     get<T>(endpoint: string): Promise<T>;
     post<T>(endpoint: string, body?: unknown): Promise<T>;
     put<T>(endpoint: string, body?: unknown): Promise<T>;

package/dist/index.js

@@ -1,5 +1,6 @@
 // src/program.ts
 import { Command } from "commander";
+import { createRequire as createRequire2 } from "module";
 
 // src/commands/login.ts
 import * as http from "http";
@@ -28,7 +29,7 @@ var CredentialStore = class {
   }
   saveToken(token, apiUrl) {
     const dir = path.dirname(this.credentialsPath);
-    fs.mkdirSync(dir, { recursive: true });
+    fs.mkdirSync(dir, { recursive: true, mode: 448 });
     const credentials = {
       token,
       api_url: apiUrl ?? DEFAULT_API_URL
@@ -39,6 +40,26 @@ var CredentialStore = class {
       { mode: 384 }
     );
   }
+  /**
+   * Persist a full session from the browser PKCE flow — the short-lived JWT plus
+   * the long-lived refresh token and the JWT's expiry — so a later refresh can
+   * mint a fresh JWT without re-opening the browser.
+   */
+  saveSession(session) {
+    const dir = path.dirname(this.credentialsPath);
+    fs.mkdirSync(dir, { recursive: true, mode: 448 });
+    const credentials = {
+      token: session.token,
+      refresh_token: session.refreshToken,
+      expires_at: session.expiresAt,
+      api_url: session.apiUrl ?? DEFAULT_API_URL
+    };
+    fs.writeFileSync(
+      this.credentialsPath,
+      JSON.stringify(credentials, null, 2),
+      { mode: 384 }
+    );
+  }
   clear() {
     if (fs.existsSync(this.credentialsPath)) {
       fs.unlinkSync(this.credentialsPath);
@@ -58,48 +79,65 @@ var CredentialStore = class {
 };
 
 // src/commands/login.ts
+var DEFAULT_API_URL2 = "https://api.lumio.vision";
+var DEFAULT_ID_URL = "https://id.lumio.vision";
+var DEFAULT_CALLBACK_PORT = 9876;
 function generatePkceChallenge() {
   const verifier = crypto.randomBytes(32).toString("base64url");
   const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");
   return { verifier, challenge };
 }
 function registerLogin(program2) {
-  program2.command("login").description("Authenticate with Lumio via browser (PKCE) or token").option("--token <token>", "Authenticate with an API token (for CI/CD)").option("--api-url <url>", "Custom API URL", "https://api.lumio.vision").action(async (options) => {
+  program2.command("login").description("Authenticate with Lumio via browser (PKCE) or an API token").option("--token <token>", "Authenticate with a Lumio API key (for CI/CD). For extension publishing, mint a developer key (lm_dev_*) under Account \u2192 Developer. Prefer the LUMIO_TOKEN env var to avoid leaking the token into shell history / the process list.").option("--api-url <url>", "Custom API URL", DEFAULT_API_URL2).option("--id-url <url>", "Custom ID (login) app URL", DEFAULT_ID_URL).option("--port <port>", "Local callback port for the browser PKCE flow", String(DEFAULT_CALLBACK_PORT)).action(async (options) => {
     const store = new CredentialStore();
-    if (options.token) {
-      store.saveToken(options.token, options.apiUrl);
+    const token = options.token ?? process.env.LUMIO_TOKEN;
+    if (token) {
+      store.saveToken(token, options.apiUrl);
       console.log("Authenticated with token.");
       return;
     }
     const { verifier, challenge } = generatePkceChallenge();
     const state = crypto.randomBytes(16).toString("hex");
-    const port = 9876;
+    const port = Number.parseInt(options.port, 10);
+    if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+      console.error(`Invalid --port: ${options.port}`);
+      process.exitCode = 1;
+      return;
+    }
     const redirectUri = `http://localhost:${port}/callback`;
     await new Promise((resolve10, reject) => {
+      let timeout;
       const server = http.createServer(async (req, res) => {
+        const finish = () => {
+          clearTimeout(timeout);
+          server.close();
+          resolve10();
+        };
+        const fail = (err) => {
+          clearTimeout(timeout);
+          server.close();
+          reject(err);
+        };
         if (!req.url?.startsWith("/callback")) {
           res.writeHead(404);
           res.end();
           return;
         }
-        const url = new URL(req.url, `http://localhost:${port}`);
+        const url = new URL(req.url, `http://127.0.0.1:${port}`);
         const code = url.searchParams.get("code");
         const returnedState = url.searchParams.get("state");
         if (returnedState !== state || !code) {
           res.writeHead(400, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Authentication failed.</h2><p>Invalid state or missing code. You can close this window.</p></body></html>");
-          server.close();
-          reject(new Error("Authentication failed: invalid state or missing code"));
+          fail(new Error("Authentication failed: invalid state or missing code"));
           return;
         }
         try {
-          const tokenRes = await fetch(`${options.apiUrl}/v1/auth/cli/token`, {
+          const tokenRes = await fetch(`${options.apiUrl}/v1/auth/token/exchange`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({
-              grant_type: "authorization_code",
               code,
-              redirect_uri: redirectUri,
               code_verifier: verifier
             })
           });
@@ -107,28 +145,31 @@ function registerLogin(program2) {
             throw new Error(`Token exchange failed: ${tokenRes.status}`);
           }
           const tokenData = await tokenRes.json();
-          store.saveToken(tokenData.access_token, options.apiUrl);
+          store.saveSession({
+            token: tokenData.data.token,
+            refreshToken: tokenData.data.refresh_token,
+            expiresAt: tokenData.data.expires_at,
+            apiUrl: options.apiUrl
+          });
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Authenticated!</h2><p>You can close this window and return to the CLI.</p></body></html>");
         } catch (e) {
           res.writeHead(500, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Authentication failed.</h2><p>Token exchange error. You can close this window.</p></body></html>");
-          server.close();
-          reject(e);
+          fail(e instanceof Error ? e : new Error(String(e)));
           return;
         }
-        server.close();
-        resolve10();
+        finish();
       });
-      server.listen(port, async () => {
-        const pkceUrl = `${options.apiUrl}/v1/auth/cli/authorize?code_challenge=${challenge}&code_challenge_method=S256&redirect_uri=${encodeURIComponent(redirectUri)}&state=${state}`;
+      server.listen(port, "127.0.0.1", async () => {
+        const loginUrl = `${options.idUrl}/login?client_type=cli&code_challenge=${challenge}&code_challenge_method=S256&redirect_uri=${encodeURIComponent(redirectUri)}&state=${state}`;
         console.log("Opening browser for authentication...");
         const { default: open } = await import("open");
-        await open(pkceUrl);
+        await open(loginUrl);
         console.log("Waiting for authentication callback...");
-        console.log("If the browser did not open, visit:", pkceUrl);
+        console.log("If the browser did not open, visit:", loginUrl);
       });
-      setTimeout(() => {
+      timeout = setTimeout(() => {
         server.close();
         reject(new Error("Authentication timed out after 120 seconds"));
       }, 12e4);
@@ -151,6 +192,16 @@ function registerLogout(program2) {
 }
 
 // src/api/client.ts
+var ApiError = class extends Error {
+  status;
+  body;
+  constructor(status, body, label = "API error") {
+    super(`${label} ${status}: ${body}`);
+    this.name = "ApiError";
+    this.status = status;
+    this.body = body;
+  }
+};
 var LumioApiClient = class {
   baseUrl;
   token;
@@ -172,14 +223,18 @@ var LumioApiClient = class {
       "Authorization": `Bearer ${this.token}`
     };
   }
+  /** Throw an {@link ApiError} (with status) when the response is not ok. */
+  async ensureOk(response, label = "API error") {
+    if (!response.ok) {
+      throw new ApiError(response.status, await response.text(), label);
+    }
+  }
   async get(endpoint) {
     const response = await fetch(this.url(endpoint), {
       method: "GET",
       headers: this.authHeaders()
     });
-    if (!response.ok) {
-      throw new Error(`API error ${response.status}: ${await response.text()}`);
-    }
+    await this.ensureOk(response);
     return response.json();
   }
   async post(endpoint, body) {
@@ -188,9 +243,7 @@ var LumioApiClient = class {
       headers: this.authHeaders(),
       body: body ? JSON.stringify(body) : void 0
     });
-    if (!response.ok) {
-      throw new Error(`API error ${response.status}: ${await response.text()}`);
-    }
+    await this.ensureOk(response);
     return response.json();
   }
   async put(endpoint, body) {
@@ -199,9 +252,7 @@ var LumioApiClient = class {
       headers: this.authHeaders(),
       body: body ? JSON.stringify(body) : void 0
     });
-    if (!response.ok) {
-      throw new Error(`API error ${response.status}: ${await response.text()}`);
-    }
+    await this.ensureOk(response);
     return response.json();
   }
   async delete(endpoint) {
@@ -209,9 +260,7 @@ var LumioApiClient = class {
       method: "DELETE",
       headers: this.authHeaders()
     });
-    if (!response.ok) {
-      throw new Error(`API error ${response.status}: ${await response.text()}`);
-    }
+    await this.ensureOk(response);
     return response.json();
   }
   async uploadFile(endpoint, formData) {
@@ -220,9 +269,7 @@ var LumioApiClient = class {
       headers: this.uploadHeaders(),
       body: formData
     });
-    if (!response.ok) {
-      throw new Error(`Upload error ${response.status}: ${await response.text()}`);
-    }
+    await this.ensureOk(response, "Upload error");
     return response.json();
   }
   static isCI() {
@@ -298,13 +345,19 @@ function registerInit(program2) {
         choices: ["widget", "extension", "overlay", "bot_module", "integration", "theme", "automation_node"]
       }
     ]);
-    const answers = { ...baseAnswers, targets: [], server: false };
+    const answers = {
+      name: baseAnswers.name,
+      description: baseAnswers.description,
+      category: baseAnswers.category,
+      targets: [],
+      server: false
+    };
     if (answers.category === "bot_module") {
       const { platforms } = await inquirer.prompt([{
         type: "checkbox",
         name: "platforms",
         message: "Which platforms should this bot module support?",
-        choices: ["twitch", "youtube", "kick", "trovo", "discord"],
+        choices: ["twitch", "youtube", "kick", "discord"],
         default: ["twitch"],
         validate: (input) => input.length > 0 || "Select at least one platform"
       }]);
@@ -671,6 +724,7 @@ import * as fs3 from "fs";
 import * as path3 from "path";
 
 // src/config/parser.ts
+import { NODE_TYPES, TRIGGER_MODES, VALID_PLATFORMS } from "@zaflun/lumio-extension-types";
 var ConfigError = class extends Error {
   constructor(message) {
     super(message);
@@ -713,25 +767,35 @@ function validateConfig(config) {
   if (!config.extensionId) {
     throw new ConfigError("extensionId is required. Run `lumio init` or create an extension at the dashboard.");
   }
+  if (!/^[A-Za-z0-9_-]{1,64}$/.test(config.extensionId)) {
+    throw new ConfigError("extensionId is invalid: only letters, digits, '-' and '_' (max 64 chars) are allowed.");
+  }
   if (!config.name) {
     throw new ConfigError("name is required in lumio.config.json");
   }
   if (config.category === "bot_module") {
     if (!config.platforms || config.platforms.length === 0) {
-      throw new ConfigError("At least one platform is required for bot_module (twitch, youtube, kick, trovo, discord)");
+      throw new ConfigError(`At least one platform is required for bot_module (${VALID_PLATFORMS.join(", ")})`);
+    }
+    const invalid = config.platforms.filter((p) => !VALID_PLATFORMS.includes(p));
+    if (invalid.length > 0) {
+      throw new ConfigError(`Invalid platform(s): ${invalid.join(", ")}. Must be one of: ${VALID_PLATFORMS.join(", ")}`);
     }
   } else if (config.category === "automation_node") {
     if (!config.nodeType) {
-      throw new ConfigError("nodeType is required for automation_node extensions (trigger, action, or logic)");
+      throw new ConfigError(`nodeType is required for automation_node extensions (${NODE_TYPES.join(", ")})`);
     }
-    if (!["trigger", "action", "logic"].includes(config.nodeType)) {
-      throw new ConfigError("nodeType must be one of: trigger, action, logic");
+    if (!NODE_TYPES.includes(config.nodeType)) {
+      throw new ConfigError(`nodeType must be one of: ${NODE_TYPES.join(", ")}`);
     }
     if (!config.node) {
       throw new ConfigError("node configuration is required for automation_node extensions");
     }
     if (config.nodeType === "trigger" && !config.node.triggerMode) {
-      throw new ConfigError("node.triggerMode is required for trigger nodes (webhook, polling, or both)");
+      throw new ConfigError(`node.triggerMode is required for trigger nodes (${TRIGGER_MODES.join(", ")})`);
+    }
+    if (config.node.triggerMode && !TRIGGER_MODES.includes(config.node.triggerMode)) {
+      throw new ConfigError(`node.triggerMode must be one of: ${TRIGGER_MODES.join(", ")}`);
     }
     if (config.nodeType !== "trigger" && config.node.triggerMode) {
       throw new ConfigError("node.triggerMode is only valid for trigger nodes");
@@ -964,6 +1028,7 @@ import * as fs4 from "fs";
 import * as path4 from "path";
 import { execFile } from "child_process";
 import { promisify } from "util";
+import { createRequire } from "module";
 var execFileAsync = promisify(execFile);
 function registerBuild(program2) {
   program2.command("build").description("Bundle extension as standalone HTML + source archive").action(async () => {
@@ -986,6 +1051,27 @@ function registerBuild(program2) {
     if (config.category === "bot_module" && config.targets.length === 0) {
       console.log("  Bot module \u2014 no UI targets to bundle.");
     }
+    if (config.server) {
+      const serverEntry = ["server/handler.ts", "server/handler.js", "server/index.ts", "server/index.js"].find((f) => fs4.existsSync(path4.resolve(f)));
+      if (serverEntry) {
+        await build({
+          entryPoints: [path4.resolve(serverEntry)],
+          bundle: true,
+          minify: true,
+          format: "esm",
+          outfile: path4.join(distDir, "server.js"),
+          platform: "neutral",
+          target: "es2022",
+          external: ["@zaflun/lumio-sdk", "@zaflun/lumio-protocol"],
+          define: {
+            "process.env.NODE_ENV": '"production"'
+          }
+        });
+        console.log("  Built: dist/server.js");
+      } else {
+        console.warn("  Warning: server: true but no server/handler.ts or server/index.ts found.");
+      }
+    }
     const cssEntryFile = ["src/globals.css", "src/style.css", "src/index.css"].find((f) => fs4.existsSync(path4.resolve(f)));
     let compiledCssPath = null;
     if (cssEntryFile) {
@@ -995,8 +1081,16 @@ function registerBuild(program2) {
         console.log("  Tailwind CSS v4 detected \u2014 compiling...");
         compiledCssPath = path4.join(distDir, "styles.css");
         try {
-          await execFileAsync("npx", [
-            "@tailwindcss/cli",
+          const projectRequire = createRequire(path4.join(path4.resolve("."), "package.json"));
+          const cliPkgPath = projectRequire.resolve("@tailwindcss/cli/package.json");
+          const cliPkg = JSON.parse(fs4.readFileSync(cliPkgPath, "utf-8"));
+          const binRel = typeof cliPkg.bin === "string" ? cliPkg.bin : cliPkg.bin?.tailwindcss ?? Object.values(cliPkg.bin ?? {})[0];
+          if (!binRel) {
+            throw new Error("@tailwindcss/cli has no bin entry");
+          }
+          const binPath = path4.join(path4.dirname(cliPkgPath), binRel);
+          await execFileAsync(process.execPath, [
+            binPath,
             "-i",
             path4.resolve(cssEntryFile),
             "-o",
@@ -1004,9 +1098,10 @@ function registerBuild(program2) {
             "--minify"
           ], { cwd: path4.resolve(".") });
           console.log("  Compiled: dist/styles.css");
-        } catch {
-          console.warn("  Warning: Tailwind CSS compilation failed. Install tailwindcss v4: npm add -D tailwindcss@^4.3");
-          compiledCssPath = null;
+        } catch (err) {
+          console.error("  Error: Tailwind CSS compilation failed. Install tailwindcss v4: npm add -D tailwindcss@^4.3 @tailwindcss/cli@^4.3");
+          console.error(`  ${err instanceof Error ? err.message : String(err)}`);
+          process.exit(1);
         }
       } else {
         compiledCssPath = path4.join(distDir, "styles.css");
@@ -1063,10 +1158,10 @@ function registerBuild(program2) {
       });
       console.log(`  Built: dist/${target}.js`);
     }
-    const { default: archiver } = await import("archiver");
+    const { TarArchive } = await import("archiver");
     const sourceArchivePath = path4.join(distDir, "source.tar.gz");
     const output = fs4.createWriteStream(sourceArchivePath);
-    const archive = archiver("tar", { gzip: true });
+    const archive = new TarArchive({ gzip: true });
     archive.pipe(output);
     archive.glob("**/*", {
       cwd: path4.resolve("."),
@@ -1074,10 +1169,24 @@ function registerBuild(program2) {
         "node_modules/**",
         "dist/**",
         ".git/**",
+        ".git",
         ".next/**",
         ".lumio-dist/**",
         "*.tgz",
-        "*.tar.gz"
+        "*.tar.gz",
+        // Secrets & credentials must never be uploaded to the store: the
+        // archive is visible to reviewers. Exclude env files (except the
+        // example), npm/yarn auth, and local CLI state.
+        // archiver 8's readdir-glob@3 dropped the `!pattern` un-ignore
+        // feature (each ignore entry is now an independent minimatch, so a
+        // leading `!` inverts that one matcher and ignores everything else).
+        // Keep `.env.example` via an extglob instead of a negated entry.
+        "**/.env",
+        "**/.env.!(example)",
+        "**/.npmrc",
+        "**/.yarnrc",
+        "**/.yarnrc.yml",
+        "**/.lumio/**"
       ],
       dot: true
     });
@@ -1175,7 +1284,7 @@ var MAX_FILE_SIZE = 10 * 1024 * 1024;
 var MAX_TOTAL_SIZE = 50 * 1024 * 1024;
 var MAX_FILES = 200;
 function registerDeploy(program2) {
-  program2.command("deploy").description("Upload extension to Lumio (status: draft)").option("-v, --version <version>", "Version override").option("-d, --description <text>", "Release notes override").option("--breaking", "Mark as breaking change").option("--draft", "Explicitly mark as draft").option("--token <token>", "API token (for CI, skips login)").option("--system", "Deploy as system extension (no developer profile required)").action(async (options) => {
+  program2.command("deploy").description("Upload extension to Lumio (status: draft)").option("-v, --version <version>", "Version override").option("-d, --description <text>", "Release notes override").option("--breaking", "Mark as breaking change").option("--draft", "Explicitly mark as draft").option("--token <token>", "API token (for CI, skips login). Use a developer key (lm_dev_*) minted under Account \u2192 Developer for publishing.").option("--system", "Deploy as system extension (no developer profile required)").action(async (options) => {
     const store = new CredentialStore();
     const token = options.token ?? store.getToken();
     if (!token) {
@@ -1218,6 +1327,64 @@ function registerDeploy(program2) {
         }
       }
     }
+    if (config.sounds && config.sounds.length > 0) {
+      const limitsApiUrl = process.env.LUMIO_API_URL ?? store.getApiUrl();
+      try {
+        const limitsRes = await fetch(
+          `${limitsApiUrl}/v1/developer/extensions/${config.extensionId}/limits`,
+          { headers: { Authorization: `Bearer ${token}` } }
+        );
+        if (limitsRes.ok) {
+          const limitsJson = await limitsRes.json();
+          const maxSounds = limitsJson.data?.max_sounds ?? 50;
+          const maxFileSize = limitsJson.data?.max_sound_file_size ?? 10485760;
+          const maxStorage = limitsJson.data?.max_sound_storage_bytes ?? 209715200;
+          if (config.sounds.length > maxSounds) {
+            console.error(
+              `Error: Extension declares ${config.sounds.length} sounds, but your limit is ${maxSounds}.`
+            );
+            console.error(
+              "Request a limit increase at /account/developer/limits or contact support."
+            );
+            process.exit(1);
+          }
+          let totalSize2 = 0;
+          for (const sound of config.sounds) {
+            const soundPath = path5.resolve("dist", "sounds", sound.file);
+            if (fs5.existsSync(soundPath)) {
+              const size = fs5.statSync(soundPath).size;
+              totalSize2 += size;
+              if (size > maxFileSize) {
+                console.error(
+                  `Error: Sound file "${sound.file}" is ${(size / 1024 / 1024).toFixed(1)} MB but your per-file limit is ${(maxFileSize / 1024 / 1024).toFixed(1)} MB.`
+                );
+                console.error(
+                  "Request a limit increase at /account/developer/limits or contact support."
+                );
+                process.exit(1);
+              }
+            }
+          }
+          if (totalSize2 > maxStorage) {
+            console.error(
+              `Error: Total sound size is ${(totalSize2 / 1024 / 1024).toFixed(1)} MB but your storage limit is ${(maxStorage / 1024 / 1024).toFixed(1)} MB.`
+            );
+            console.error(
+              "Request a limit increase at /account/developer/limits or contact support."
+            );
+            process.exit(1);
+          }
+        } else if (limitsRes.status !== 404) {
+          console.warn(
+            `  Warning: Could not fetch sound limits (HTTP ${limitsRes.status}), skipping pre-flight check.`
+          );
+        }
+      } catch {
+        console.warn(
+          "  Warning: Could not reach API for sound limit check, skipping pre-flight check."
+        );
+      }
+    }
     const version = options.version ?? config.version;
     let releaseNotes = options.description ?? "";
     if (!releaseNotes) {
@@ -1448,16 +1615,27 @@ function requireClient() {
 }
 function registerEnv(program2) {
   const envCmd = program2.command("env").description("Manage server-side secrets for the extension");
-  envCmd.command("set <key> <value>").description("Set a secret (POST /v1/developer/extensions/{id}/secrets)").action(async (key, value) => {
+  envCmd.command("set <key> [value]").description("Set a secret (POST /v1/developer/extensions/{id}/secrets). Omit <value> to be prompted (hidden) or read it from the LUMIO_SECRET env var \u2014 avoids leaking the secret into shell history / the process list.").action(async (key, value) => {
     if (!validateSecretKey(key)) {
       console.error(
         "Invalid key format. Use uppercase letters, numbers, and underscores only (e.g. API_KEY)."
       );
       process.exit(1);
     }
+    let secretValue = value ?? process.env.LUMIO_SECRET;
+    if (secretValue === void 0) {
+      const { default: inquirer } = await import("inquirer");
+      const answer = await inquirer.prompt([{
+        type: "password",
+        name: "value",
+        mask: "*",
+        message: `Value for ${key}:`
+      }]);
+      secretValue = answer.value;
+    }
     const config = loadConfig();
     const client = requireClient();
-    await client.post(`/v1/developer/extensions/${config.extensionId}/secrets`, { key, value });
+    await client.post(`/v1/developer/extensions/${config.extensionId}/secrets`, { key, value: secretValue });
     console.log(`Secret ${key} set.`);
   });
   envCmd.command("list").description("List all secrets (keys only, no values)").action(async () => {
@@ -1471,7 +1649,7 @@ function registerEnv(program2) {
   envCmd.command("delete <key>").description("Delete a secret").action(async (key) => {
     const config = loadConfig();
     const client = requireClient();
-    await client.delete(`/v1/developer/extensions/${config.extensionId}/secrets/${key}`);
+    await client.delete(`/v1/developer/extensions/${config.extensionId}/secrets/${encodeURIComponent(key)}`);
     console.log(`Secret ${key} deleted.`);
   });
 }
@@ -1528,7 +1706,17 @@ function registerRun(program2) {
       process.exit(1);
     }
     const client = new LumioApiClient(store.getApiUrl(), token);
-    const args = argsJson ? JSON.parse(argsJson) : {};
+    let args = {};
+    if (argsJson) {
+      try {
+        args = JSON.parse(argsJson);
+      } catch (err) {
+        console.error(
+          `Invalid JSON for args: ${err instanceof Error ? err.message : String(err)}`
+        );
+        process.exit(1);
+      }
+    }
     const body = { type: fnRef.type, args };
     if (BOT_HANDLER_TYPES.includes(fnRef.type)) {
       body.user = {
@@ -1547,7 +1735,7 @@ function registerRun(program2) {
     }
     try {
       const result = await client.post(
-        `/v1/extension-installs/${config.extensionId}/execute/${fnRef.name}`,
+        `/v1/extension-installs/${config.extensionId}/execute/${encodeURIComponent(fnRef.name)}`,
         body
       );
       console.log(JSON.stringify(result, null, 2));
@@ -1582,7 +1770,9 @@ function createProgram() {
   const program2 = new Command();
   program2.name("lumio");
   program2.description("Lumio Extension CLI -- Build, test, and deploy Lumio extensions");
-  program2.version("2026.5.1");
+  const require2 = createRequire2(import.meta.url);
+  const { version } = require2("../package.json");
+  program2.version(version);
   registerLogin(program2);
   registerLogout(program2);
   registerWhoami(program2);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zaflun/lumio-cli",
-  "version": "0.5.2",
-  "description": "Lumio Extension CLI — Build, test, and deploy Lumio extensions",
+  "version": "0.6.2",
+  "description": "Lumio Extension CLI - Build, test, and deploy Lumio extensions",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -14,23 +14,26 @@
     "templates"
   ],
   "dependencies": {
-    "archiver": "^7.0.1",
-    "chalk": "^5.4.1",
-    "commander": "^13.1.0",
-    "esbuild": "^0.25.4",
-    "eventsource": "^3.0.6",
-    "inquirer": "^12.6.0",
-    "open": "^10.1.2",
+    "archiver": "^8.0.0",
+    "chalk": "^6.0.0",
+    "commander": "^15.0.0",
+    "esbuild": "^0.28.2",
+    "eventsource": "^4.1.1",
+    "inquirer": "^14.0.2",
+    "open": "^11.0.2",
     "ora": "^8.2.0",
-    "@zaflun/lumio-extension-types": "0.3.2"
+    "@zaflun/lumio-extension-types": "0.3.3"
   },
   "devDependencies": {
-    "@types/archiver": "^6.0.3",
+    "@types/archiver": "^8.0.0",
     "@types/eventsource": "^1.1.15",
-    "typescript": "^5.8.3",
-    "vitest": "^3.1.4",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.10",
     "tsup": "^8.4.0"
   },
+  "engines": {
+    "node": ">=22.13.0"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",