lua-cli 3.27.0 → 3.29.0

package/docs/CLI_REFERENCE.md

@@ -600,7 +600,8 @@ lua marketplace [noun] [action] [options]
 With no arguments, prompts for a domain — **Skills** or **Agent templates** — then hands off to that domain's own interactive picker. Pass `noun` (`skill` or `template`) to skip straight to a domain, and `action` for non-interactive mode.
 
 **Skill actions** (`lua marketplace skill <action>`):
-- `list`, `publish`, `edit`, `unlist`, `unpublish`, `mine` — manage your own listings
+- `list`, `publish`, `edit`, `unlist`, `unpublish`, `transfer`, `org` — manage listings owned by the configured agent's organization
+- `mine` — list skills originally authored by the caller; ownership is still shown separately through `creatorOrgId`
 - `search`, `view`, `install`, `update`, `uninstall`, `installed` — browse and manage skills on this agent
 
 **Template actions** (`lua marketplace template <action>`):
@@ -622,6 +623,9 @@ $ lua marketplace
 $ lua marketplace skill install --marketplace-id xyz --version-id v1 --force
 ✅ Skill installed successfully
 
+$ lua marketplace skill transfer --marketplace-id xyz --new-org-id org-b --force
+✅ Skill is now owned by organization org-b
+
 $ lua marketplace template apply --template-id xyz --all-installed --force
 ```
 

package/docs/README.md

@@ -1,6 +1,6 @@
-# lua-cli v3.27.0
+# lua-cli v3.29.0
 
-Welcome to the comprehensive API documentation for lua-cli v3.27.0. This guide covers every API, class, and function exported by the package.
+Welcome to the comprehensive API documentation for lua-cli v3.29.0. This guide covers every API, class, and function exported by the package.
 
 ## 📚 Documentation Index
 
@@ -269,4 +269,3 @@ import { env } from 'lua-cli';
 
 const apiKey = env('MY_API_KEY');
 ```
-

package/docs/api/LuaWebhook.md

@@ -48,11 +48,37 @@ interface LuaWebhookConfig {
   /** Optional Zod schema for body validation */
   bodySchema?: ZodType;
 
+  /** Optional HMAC-SHA256 signing key (see Request Verification) */
+  secret?: string;
+
   /** Function that executes the webhook logic */
   execute: (event: LuaWebhookEvent) => Promise<any>;
 }
 ```
 
+## Request Verification
+
+A webhook URL is public. Set `secret` and Lua requires every request to carry
+`x-lua-signature: sha256=<hex HMAC-SHA256 of the raw body>`; a missing, malformed
+or wrong signature is rejected with 401 before `execute` runs. Omit `secret` and
+behaviour is unchanged.
+
+```typescript
+new LuaWebhook({
+  name: 'payment-webhook',
+  description: 'Handle payment events',
+  secret: 'a-long-random-string',
+  execute: async (event) => ({ received: true }),
+});
+```
+
+The signature covers the exact request bytes, so the sender must sign the same
+string it transmits. `secret` must be a literal or a compile-time-resolvable
+constant — the compiler cannot read `process.env.X` and fails the build rather
+than deploying an unprotected webhook. The value is applied on every
+`lua push webhook`, so rotation is a re-deploy; `secret: ''` clears it. No
+command prints it.
+
 ## Event Structure
 
 The `execute` function receives a `LuaWebhookEvent`:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lua-cli",
-  "version": "3.27.0",
+  "version": "3.29.0",
   "description": "Build, test, and deploy AI agents with custom tools, webhooks, and scheduled jobs. Features LuaAgent unified configuration, streaming chat, and batch deployment.",
   "readmeFilename": "README.md",
   "main": "dist/api-exports.js",
@@ -119,8 +119,8 @@
     "build:vendor": "node scripts/build-vendor.mjs",
     "build:dts": "tsc -p tsconfig.build.json",
     "build:dts-rollup": "node scripts/run-api-extractor.mjs",
-    "test": "jest",
+    "test": "node ../../scripts/test-gate.mjs jest",
     "test:watch": "jest --watch",
-    "test:coverage": "jest --coverage"
+    "test:coverage": "node ../../scripts/test-gate.mjs jest --coverage"
   }
 }

package/template/package.json

@@ -20,7 +20,7 @@
     "inquirer": "^12.9.6",
     "stripe": "^17.5.0",
     "js-yaml": "^4.1.0",
-    "lua-cli": "^3.27.0",
+    "lua-cli": "^3.29.0",
     "openai": "^5.23.0",
     "uuid": "^13.0.0",
     "zod": "^3.24.1"