@lotics/cli 0.172.1 → 0.175.0

package/dist/src/cli.js

@@ -45696,7 +45696,7 @@ function resultSideEffects(result) {
 }
 
 // src/version.ts
-var VERSION = "0.172.1";
+var VERSION = "0.175.0";
 
 // src/timezone.ts
 function machineTimezone() {
@@ -45708,6 +45708,9 @@ function machineTimezone() {
   }
 }
 
+// src/cli.ts
+import { spawn as spawn4 } from "node:child_process";
+
 // src/docs_command.ts
 import fs5 from "node:fs";
 import path5 from "node:path";
@@ -45919,6 +45922,12 @@ var COMMANDS = [
       "                                       these rows ship to everyone who copies the starter"
     ]
   },
+  {
+    verbs: ["upgrade"],
+    help: [
+      "  lotics upgrade                       Update this CLI to the latest version"
+    ]
+  },
   {
     verbs: ["docs"],
     help: [
@@ -48393,7 +48402,7 @@ function walk(node, visit) {
   }
 }
 
-// src/generate_app_fields.ts
+// ../shared/src/generate_app_fields.ts
 var HEADER = `// Auto-generated by 'lotics app codegen' and 'lotics app pull'.
 // DO NOT EDIT \u2014 regenerated from the workspace schema.
 //
@@ -48511,6 +48520,17 @@ export type AppFields = typeof F;
 export type AppOptions = typeof OPT;
 `;
 }
+function codegenTableIds(queries, allowlist) {
+  const ids = new Set(allowlist);
+  for (const declaration of Object.values(queries)) {
+    for (const id of collectQueryTableIds(declaration.ast)) ids.add(id);
+  }
+  return [...ids];
+}
+function readCodegenTablesAllowlist(pkg) {
+  const tables = pkg?.lotics?.codegen?.tables;
+  return Array.isArray(tables) ? tables.filter((t) => typeof t === "string") : [];
+}
 
 // src/app_workflow_check.ts
 import fs7 from "node:fs";
@@ -71970,18 +71990,13 @@ function writeAppDts(projectDir, manifest) {
   ensureAppVitestSetup(projectDir);
   return written.map(([file2]) => file2);
 }
-function readCodegenTablesAllowlist(projectDir) {
-  const pkg = JSON.parse(fs8.readFileSync(path9.join(projectDir, "package.json"), "utf-8"));
-  const tables = pkg.lotics?.codegen?.tables;
-  return Array.isArray(tables) ? tables.filter((t) => typeof t === "string") : [];
-}
 function resolveCodegenTableIds(projectDir, queries) {
-  const ids = /* @__PURE__ */ new Set();
-  for (const decl of Object.values(queries)) {
-    for (const id of collectQueryTableIds(decl.ast)) ids.add(id);
+  let manifest = null;
+  try {
+    manifest = JSON.parse(fs8.readFileSync(path9.join(projectDir, "package.json"), "utf-8"));
+  } catch {
   }
-  for (const id of readCodegenTablesAllowlist(projectDir)) ids.add(id);
-  return [...ids];
+  return codegenTableIds(queries, readCodegenTablesAllowlist(manifest));
 }
 function writeAppFields(projectDir, tables) {
   const dotLotics = path9.join(projectDir, ".lotics");
@@ -74023,15 +74038,19 @@ function reportKnowledgeWarnings(warnings) {
   answering from nowhere. Create them with those names, or edit the agent.`
   );
 }
+function instantiateBody(args) {
+  return {
+    ...args.noSampleData === true ? { no_sample_data: true } : {},
+    ...args.adopt === true ? { adopt: true } : {},
+    build_on_server: true
+  };
+}
 async function starterInit(client, args) {
   const starter = await client.getPackage(args.starter_id);
   note(
     `Copying ${starter.name}${starter.is_official ? " (official)" : ""} into this workspace\u2026`
   );
-  const result = await client.instantiateStarter(args.starter_id, {
-    ...args.noSampleData === true ? { no_sample_data: true } : {},
-    ...args.adopt === true ? { adopt: true } : {}
-  });
+  const result = await client.instantiateStarter(args.starter_id, instantiateBody(args));
   const tables = Object.keys(result.binding.entities ?? {}).sort();
   const knowledgeDocs = Object.keys(result.binding.knowledge ?? {}).sort();
   const templates = Object.keys(result.binding.templates ?? {}).sort();
@@ -74094,19 +74113,42 @@ Done \u2014 these are yours now, with no link back to the starter.`);
     stamp: { id: null, number: null },
     kept
   });
+  const serverDeployed = result.deployed ?? null;
   if (starter.owned_by_caller !== true) {
     warn(
-      `
+      serverDeployed !== null ? `
+Built ${starter.name} on Lotics \u2014 its package scripts and vite config are the
+  publisher's code, run in an isolated container rather than on your machine.${starter.is_official ? " Lotics reviewed this starter." : ""}` : `
 Building ${starter.name} \u2014 this runs its build on your machine (its package scripts
   and vite config are the publisher's code, executed as you).${starter.is_official ? " Lotics reviewed this starter." : ""}`
     );
-  } else {
+  } else if (serverDeployed === null) {
     note(`Building and deploying\u2026`);
   }
-  await appDeploy(client, {
-    projectDir: targetPath,
-    message: `Copied from starter ${starter.name}`
-  });
+  const resumeDir = path10.relative(process.cwd(), targetPath) || ".";
+  try {
+    if (serverDeployed !== null) {
+      note(`Deployed v${serverDeployed.version_number} \u2014 built on Lotics, no Node needed here.`);
+    } else {
+      await appDeploy(client, {
+        projectDir: targetPath,
+        message: `Copied from starter ${starter.name}`
+      });
+    }
+  } catch (error52) {
+    const reason = error52 instanceof Error ? error52.message : String(error52);
+    throw new Error(
+      `${reason}
+
+The copy itself is DONE and nothing needs repeating: the tables, the sample
+records and the project all landed. Only the deploy is left.
+
+  Finish it:  cd ${resumeDir} && lotics app deploy -m "Copied from starter ${starter.name}"
+
+Do NOT re-run the copy \u2014 it would adopt the tables this one just created and
+insert the sample records again.`
+    );
+  }
   let signInUrl = null;
   try {
     const link = await client.login({
@@ -103302,6 +103344,31 @@ function alreadySetUp(email3) {
   if (config2?.email !== email3) return false;
   return Object.keys(config2.profiles ?? {}).length > 0;
 }
+async function runUpgrade() {
+  const cmd = updateCommand();
+  console.error(`Upgrading ${VERSION} \u2192 latest
+  ${cmd}
+`);
+  const proc = spawn4(cmd, {
+    // The command is one of three literals this binary chooses between, never
+    // anything a caller supplied — and each is a pipeline that needs a shell.
+    shell: true,
+    stdio: "inherit",
+    env: process.env
+  });
+  const code = await new Promise((resolve2, reject2) => {
+    proc.on("error", reject2);
+    proc.on("exit", (exitCode) => resolve2(exitCode ?? 1));
+  });
+  if (code !== 0) {
+    console.error(
+      `
+Upgrade failed (exit ${code}). Run it yourself to see why:
+  ${cmd}`
+    );
+    process.exit(1);
+  }
+}
 async function handleSignup(positionalEmail, flags) {
   const email3 = positionalEmail ?? (process.stdin.isTTY ? await prompt("Email: ") : "");
   if (!email3) {
@@ -103650,6 +103717,10 @@ async function main() {
     docsCommand({ area: subcommand });
     return;
   }
+  if (command === "upgrade") {
+    await runUpgrade();
+    return;
+  }
   if (command === "report") {
     let input = subcommand ?? "";
     if (input.startsWith("@")) {

package/dist/src/client.d.ts

@@ -403,11 +403,25 @@ export declare class LoticsClient {
         version?: number;
         no_sample_data?: boolean;
         adopt?: boolean;
+        /** Ask the server to build and deploy the copy, so this machine needs no Node. */
+        build_on_server?: boolean;
     }): Promise<{
         app_id: string | null;
         starter_id: string;
         version: number;
         bundle_url: string | null;
+        /**
+         * The version the SERVER deployed, when it did.
+         *
+         * Optional in this type on purpose: a server that predates the field omits
+         * it entirely, and it is absent rather than null. Callers must treat "not
+         * there" and "null" alike and build locally — assuming the request was
+         * honoured would report success over an app nobody built.
+         */
+        deployed?: {
+            version_id: string;
+            version_number: number;
+        } | null;
         binding: Record<string, Record<string, string>>;
         sample_record_ids: Record<string, string[]>;
         knowledge_warnings: {

package/docs/cli_reference.md

@@ -46,6 +46,7 @@ Per-command syntax, flags, contracts, and gotchas for the public `lotics` CLI. S
 | `lotics starter show <starter_id>` | One starter's name, description, current version and trust standing (`official` — reviewed by Lotics; `your organization's own`). Read it before copying a starter you did not publish. |
 | `lotics starter init <starter_id> [path]` | **Copy a starter into this workspace.** Server-side it scaffolds the tables and fields, creates the document templates and knowledge docs, inserts the sample records, creates a BESPOKE app and materializes its queries, workflows and agents onto it. Then it stops: a starter ships **source only**, with no prebuilt bundle, so the app source is downloaded here, hydrated against the live app (the same steps `app pull` runs), built, and deployed — which is why this needs node and a few minutes, and why the app is not servable until the deploy lands. **What you get is yours outright**: an ordinary app plus ordinary tables, with no link back to the starter, nothing pinned, and nothing to upgrade. Edit any of it. **It builds the publisher's code on your machine** — the copy has to build where your workspace's field ids are, so `npm run build` runs their build script and vite loads their `vite.config.ts` in Node, as you. Dependencies install with `npm ci --ignore-scripts` — the lockfile's exact tree (so a starter published months ago resolves the same packages today), and no lifecycle scripts (the path that fires before you run anything). Neither changes the build itself. That is why provenance is the gate: **copyable only if the starter is Lotics-reviewed or your own organization published it** — copying runs the author's code (its bundle, its workflows, its agents) under YOUR authority, so provenance is the gate, enforced server-side. **Refuses a workspace that already has tables** unless `--adopt`: scaffold matches an entity by DISPLAY NAME, so a starter declaring `Contacts` would bind to yours. `--json` prints one object on stdout instead of progress (the shape is under `lotics start`) and captures npm/vite output unless the build fails. `--no-sample-data` skips the sample records; with them, the created record ids are reported — they are ordinary records, delete them whenever. Resolves and ANNOUNCES its workspace first (`lotics → <org> / <workspace>` on stderr). Admin-only. Authoring the registry (`starter publish/release/unpublish`) stays operator-only. |
 | `lotics starter fixtures capture [--entity <alias> ...] [--limit <n>]` | **(authoring)** Write this app's live records into the project as `fixtures/<entity-alias>.json` — the sample data a starter carries, so a copy lands with something in it. Run from an app project; the app id comes from its manifest. The alias-keyed shape is produced server-side, because the aliases are minted when the starter is extracted and exist nowhere a project can read them. `--entity` is repeatable and comma-separated; omitted, every table the app declares is captured. **Capture a linked set in ONE call** — a link between two rows only resolves within a single capture, so taking companies and contacts separately drops the edge between them (it says so when it happens). `--limit` bounds rows per table (default 10, max 200). **READ WHAT IT WROTE before committing**: these rows are created verbatim in every workspace that copies the starter, so a real customer name, price or address captured here is published. Files, formulas, rollups, lookups and autonumbers are never captured — the platform writes those. Admin-only; writes nothing to the workspace. |
+| `lotics upgrade` | Update this CLI in place. Runs the same installer a person would, chosen by how THIS copy arrived: an npm install upgrades through npm, a script install re-runs the script — the runtime knows which (the executable is compiled, the npm bin runs under node), so nobody has to. It downloads nothing itself; resolving a version, verifying the checksum and replacing a running executable already exist in the installers, and a second copy of that inside the binary would be a second thing to get right. Replacing the binary while it runs is safe — a rename leaves the running image mapped on unix, and on Windows the installer moves the old aside precisely because the file is in use. Already current is a no-op that says so. Needs no auth. |
 | `lotics docs` \| `lotics docs <area>` | The index of the reference docs, **resolved out of the packages installed beside this project** — never carried by this CLI. **Both levels are discovered by looking**: every `@lotics/*` package carrying an `AGENTS.md` or a `docs/` in any `node_modules/@lotics` from the current directory UPWARD (nearest wins, so a hoisted root copy never shadows the one a project's own imports resolve to), and within each, every area it actually ships. Titles come from each file's own `# heading` and the version from the installed `package.json`, so a doc OR a whole package added upstream appears with no change to this CLI, and a skewed install is visible rather than reassuring. A package's index is named after the package (`lotics docs ui`), never `index`. `@lotics/app-sdk`, `@lotics/ui` and `@lotics/cli` sort first as a reading ORDER, not a filter. Both the index and `<area>` print to **stdout** — the index is the payload of a bare `lotics docs`, so `lotics docs | grep -i excel` works — with only the provenance line on stderr, so `lotics docs ai > ai.md` is the doc alone; a name two packages share is refused with both qualified forms (`lotics docs ui/templates`) rather than resolved silently. Needs no auth. Outside a project only `@lotics/cli`'s own resolve, and it says so. |
 | `lotics report '<json>'` \| `lotics report @report.json` | File a report with the Lotics team about what got in your way. **Covers the classes telemetry structurally cannot see**: a capability that does not exist (no command ran, so nothing was recorded), a command that exited 0 having done the wrong thing, an error whose message did not name the remedy, and anything that made authoring slower than it should be. **A frame, not a paragraph** — `{goal, actual, expected?, tried?, wanted?}`, `goal` and `actual` required, unknown keys dropped rather than refused. **No severity or category.** Ingest is inline JSON, `@file`, or `-` for stdin. A bare sentence is refused with the frame printed beside it, so the fix is one step; a bare invocation prints the frame BEFORE asking for a credential, since someone whose key will not resolve is exactly who has something to report. **Not spooled**: unlike telemetry it posts inline, prints whether it landed, and exits non-zero if it did not, echoing the report back so a failed send never loses it. Runs regardless of `LOTICS_TELEMETRY` — invoking it IS the consent that passive collection needs an opt-in for — but with telemetry off there are no recorded commands to attach, and it says so rather than implying context it does not have. Requires auth. Never paste records, file contents, or credentials. |
 | `lotics app check` | Every pre-flight `deploy` runs, WITHOUT building or shipping. **First, whether this project is even based on the served version** — the one thing a deploy REFUSES outright rather than pushing (the server 409s a stale `prev_version_id`), and the one finding that invalidates every other: a stale tree and the live app are two different apps, so comparing them reports nothing trustworthy. Stale exits 1 naming both versions and stops before the rest; a project with no stamp at all — or an app with no version yet — is a first deploy, not a conflict. `deploy` runs the SAME assertion off the app row it already fetched, so a stale tree fails before it pushes a binding or builds, instead of after the upload arrives and the server 409s. Then: the manifest's agent schemas against the live app row, every binding a deploy would push, aliases the source calls that nothing bound (queries, workflows AND agents), bindings the app serves that the source names nowhere, capability-gated SDK calls the manifest doesn't declare, a missing icon/theme, a missing app `description` (it heads the capability catalog the chat agent reads every turn, and its absence has no other symptom), a `vite.config.ts` that never defines `global`/`__DEV__`, a `window.open` in the app's own source, and an INSTALLED `@lotics/app-sdk` below the version that understands the host's realtime push — read from `node_modules`, not the dependency range, because a caret is minor-locked below 1.0 so `^0.79.x` can never resolve `0.80` and `npm update` does nothing (all three fail ONLY in the deployed app — dev bundles with esbuild and production with rollup, so typecheck, lint, build and `app dev` are all green while react-native-web reads `global.cancelAnimationFrame` as a free variable and the sandboxed iframe drops a popup silently), an agent holding `run_app_query`/`run_app_workflow` with an EMPTY `query_aliases`/`workflow_aliases` (the tool is the capability, the alias list is the reach — empty means every call it makes is refused while the run still COMPLETES, so it surfaces as a model ignoring its prompt; read off the live row, never the manifest, which mirrors those fields but is pushed by no verb), and a notice for any alias the source computes at runtime (invisible to every check here and to `--prune`'s unbind guard). **And whether the kit this app builds against has fallen behind what is published** — `@lotics/ui` and `@lotics/app-sdk`, read from `node_modules` for the same reason as the floor check above: a range keeps accepting, so an app pinned `^44.x` reads healthy for a year, and even an in-range one sits on the lockfile's older patch until `npm update` (never `npm install`, which honours the lock). A MAJOR behind is loud and names the packages actually behind — plus `@lotics/ui`'s `MIGRATION.md`, when ui is one of them, since it is the only half that keeps one; anything smaller is one quiet line, because a warning that fires on every deploy is one the reader stops seeing. The registry lookup is bounded and every failure — offline, slow, private — is silence: a version check must never become a new way for a deploy to fail. Adds no rule of its own — each finding is the same helper `deploy` calls, so a green check means a deploy will not complain. **Exits 1 on what a `deploy` would REFUSE or PUSH** — an agent schema that disagrees with the live app, and any binding the project has ahead of the app (an edited workflow body or declaration, edited agent prose, a changed query). Both are things a deploy would act on, so CI gating on a green check means a deploy has nothing left to do; genuine advisories (capabilities, branding, a runtime-computed alias, orphaned bindings) stay advisory and never fail it. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/cli",
-  "version": "0.172.1",
+  "version": "0.175.0",
   "description": "Lotics SDK and CLI for AI agents",
   "type": "module",
   "bin": {