@lotics/cli 0.205.0 → 0.205.1

package/AGENTS.md

@@ -55,12 +55,23 @@ response there is *not* evidence the subcommand is absent. To find out whether s
 - **A credential is either a SIGN-IN or an API KEY, and `logout` treats them differently.** A profile
   from `auth login` / `auth signup` acts as the person who confirmed it and is theirs — `lotics auth
   logout` revokes it server-side, and it lapses on its own after 90 idle days (each use pushes that
-  out). A profile from `auth api-key` holds a key an ADMIN issued, which is routinely also on a
-  server and on other machines, so logout only forgets it locally and says so; only an admin revokes
-  it. A profile that states no kind (saved before the field existed) is resolved against the SERVER
+  out). A profile from `auth api-key` holds a key an ADMIN issued. A key created in Settings carries
+  its OWN access — every app and table, or only the ones chosen on the key, so a listing that comes
+  back short is the key's reach, not a bug — while a key created FOR a person carries that
+  person's access and dies with their membership. Either is routinely also on a server and on
+  other machines, so logout only forgets it locally and says so; only an admin revokes it. A profile that states no kind (saved before the field existed) is resolved against the SERVER
   and revoked only if the answer is a sign-in; a bare `--api-key` / `LOTICS_API_KEY` names no
   profile to remove at all. Nothing is ever revoked on a guess — between two, the destructive one is
   wrong. `lotics auth whoami` prints the kind, asking the server when the store cannot say.
+- **A key created in Settings never administers the organization, whatever its access.** The verbs
+  `docs/cli_reference.md` marks *admin only* split in two under a key: the ones that BUILD inside a workspace
+  the key reaches — `scaffold apply`, `library init`, `app upgrade`, `workspace doctor`, `scaffold
+  export`, `field rename` — run as before, while managing people, sharing or ownership, creating or
+  deleting a workspace, changing workspace settings, setting credit limits, reading the access log
+  and publishing a starter or an app's API answer `403` and name the remedy: an admin signed in, so
+  `lotics auth login <email>` and run it again. A sign-in acts as that person and is refused none of
+  them. Do not retry a `403` with the same credential and do not ask for a wider key — no answer on
+  the key's own screen grants this.
 - **A 401 names its remedy — act on the hint, do not retry.** "This credential expired / was
   revoked / belongs to a member who is no longer active" carries the one remedy that ends this
   credential: run `lotics auth login <email>` for a sign-in, or ask the admin who issued it for a

package/README.md

@@ -124,9 +124,9 @@ The CLI checks for updates once per day and prints a note on stderr, naming the
 
 ## Authentication
 
-**Two kinds of credential, and which you hold decides what `logout` does.** `auth signup` / `auth login` give this machine a **sign-in** — it acts as you, carries whatever role you have, and is yours to see and revoke at Settings → Security → *Keys and terminals*; it lapses after 90 days of disuse, and each use pushes that out. `auth api-key` saves an **API key** an admin issued: it acts as the member it was created for, often lives on a server and on other people's machines too, and only an admin revokes it. `lotics auth whoami` prints which kind this machine holds — from the saved profile, or from the server when the profile does not say.
+**Two kinds of credential, and which you hold decides what `logout` does.** `auth signup` / `auth login` give this machine a **sign-in** — it acts as you, carries whatever role you have, and is yours to see and revoke at Settings → Security → *Keys and terminals*; it lapses after 90 days of disuse, and each use pushes that out. `auth api-key` saves an **API key** an admin issued. A key an admin creates in Settings has its own name and its own access, reaching either every app and table or only the ones chosen on the key; a key created FOR a person carries that person's access and stops working when that person is removed. Either kind often lives on a server and on other people's machines too, and only an admin revokes it. `lotics auth whoami` prints which kind this machine holds — from the saved profile, or from the server when the profile does not say.
 
-When a credential stops working the refusal says which of the three ways it is dead — "This credential was revoked." / "expired." / "belongs to a member who is no longer active in this organization." — and names both remedies, because a credential acts as a person whether it is their own sign-in or a key an admin issued under their membership, and nothing on the row tells the two apart: sign in again with `lotics auth login <email>`, or ask the admin who issued it for a new key. A key the server does not recognize at all gets one generic answer, deliberately: an unrecognized key learns nothing from being refused.
+When a credential stops working the refusal says which of the three ways it is dead — "… was revoked." / "… expired." / "… belongs to a member who is no longer active in this organization." — and its `hint` names the remedy: `lotics auth login <email>` for a terminal sign-in, ask an admin for a new key for an API key. A credential whose record does not say which of the two it is gets both. A key the server does not recognize at all gets one generic answer, deliberately: an unrecognized key learns nothing from being refused.
 
 **`lotics auth signup`** — Creates a new Lotics account, organization, workspace, and API key in one step. Sends a magic link email so you can access the web app.
 

package/dist/src/cli.js

@@ -40111,7 +40111,7 @@ function resultSideEffects(result) {
 }
 
 // src/version.ts
-var VERSION = "0.205.0";
+var VERSION = "0.205.1";
 
 // src/timezone.ts
 function machineTimezone() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/cli",
-  "version": "0.205.0",
+  "version": "0.205.1",
   "description": "Lotics SDK and CLI for AI agents",
   "type": "module",
   "bin": {