@lotics/cli 0.263.0 → 0.264.0

package/dist/src/client.js

@@ -1,20 +1,3 @@
-// ../shared/src/transport_error.ts
-function gatewayErrorMessage(status) {
-  if (status === 524) {
-    return "The request took too long to finish (gateway timeout). It may still be running \u2014 check back in a moment, or try again.";
-  }
-  if (status >= 500) {
-    return "The service is temporarily unavailable. Please try again shortly.";
-  }
-  return "The service returned an unexpected response. Please try again.";
-}
-function transportErrorMessage(status, parsed) {
-  const jsonMessage = parsed && typeof parsed.message === "string" ? parsed.message : null;
-  if (jsonMessage === null) return gatewayErrorMessage(status);
-  const authored = typeof parsed.code === "string" && parsed.code.length > 0;
-  return status < 500 || authored ? jsonMessage : gatewayErrorMessage(status);
-}
-
 // ../shared/src/multipart_parts.ts
 var DEFAULT_MAX_RETRIES = 5;
 var MAX_RETRY_DELAY_MS = 15e3;
@@ -150,44 +133,6 @@ var LoticsRequestError = class extends Error {
   body;
 };
 var WEB_APP_URL = process.env.LOTICS_WEB_URL ?? "https://lotics.ai";
-async function fetchOfficialStarters(apiUrl) {
-  const read = await getPublicJson(`${apiUrl}/v1/starters/official`, "list the packages");
-  if (!read.ok) {
-    throw new Error(
-      `Lotics answered ${read.status} listing the packages. If this keeps happening, browse ${WEB_APP_URL}/docs/cli.`
-    );
-  }
-  return read.body;
-}
-async function getPublicJson(url, what) {
-  let response;
-  try {
-    response = await fetch(url, { signal: AbortSignal.timeout(PUBLIC_FETCH_TIMEOUT_MS) });
-  } catch (error) {
-    throw new Error(
-      `Could not reach Lotics to ${what} (${error instanceof Error ? error.message : String(error)}). Check your connection, or browse ${WEB_APP_URL}/docs/cli.`
-    );
-  }
-  if (!response.ok) return { ok: false, status: response.status };
-  return { ok: true, body: await response.json() };
-}
-async function readOfficialStarter(apiUrl, starter_id) {
-  const read = await getPublicJson(
-    `${apiUrl}/v1/starters/official/${encodeURIComponent(starter_id)}`,
-    `read ${starter_id}`
-  );
-  if (!read.ok) return read;
-  return { ok: true, package: read.body };
-}
-async function getOfficialStarter(apiUrl, starter_id) {
-  const read = await readOfficialStarter(apiUrl, starter_id);
-  if (!read.ok) {
-    throw new Error(
-      `Lotics answered ${read.status} reading ${starter_id}. Only packages Lotics publishes can be read without an account.`
-    );
-  }
-  return read.package;
-}
 var PUBLIC_FETCH_TIMEOUT_MS = 1e4;
 async function startCliLogin(apiUrl, email) {
   let response;
@@ -232,12 +177,9 @@ function newRequestId() {
 var LoticsClient = class {
   apiKey;
   workspaceId;
-  /** The active "View as" target member id, if any. Read-only after
-   *  construction — surfaced so `lotics app dev` can show it in the banner. */
+  /** The active "View as" target member id, if any; sent on every request. */
   viewAsMemberId;
-  /** API URL the client is configured against. Read-only after construction.
-   *  Surfaced for callers that need to display it (`lotics app dev`'s banner) or
-   *  to hand it on (the wrapper page's RPC target, the scaffold's font proxy). */
+  /** The instance this client sends every request to. */
   baseUrl;
   constructor(options) {
     this.apiKey = options.apiKey;
@@ -278,7 +220,7 @@ var LoticsClient = class {
    * `x-posthog-session-id` and `x-request-id` onto the per-request Logger, so
    * they ride EVERY log line that request emits — the validation 400, the tool
    * error, the timing. Sending them is therefore the whole of the correlation
-   * work: it turns an anonymous API-key request into "`app workflow set`, from
+   * work: it turns an anonymous API-key request into "`app deploy`, from
    * cli 0.117.0, the fourth command of this session".
    *
    * The request id is minted HERE, with the other headers, so it cannot reach
@@ -360,33 +302,6 @@ var LoticsClient = class {
   async createWorkspace(body) {
     return this.request("POST", "/v1/workspaces", body);
   }
-  /**
-   * Apply a workspace MODEL to the current workspace — the from-scratch half of
-   * the starter pipeline, on a contract nobody published.
-   *
-   * Additive: with `adopt`, an entity whose label already names a table here
-   * binds to it and gains the fields, options and views it is missing; without
-   * `adopt`, that label is refused. Nothing is ever modified or deleted, and
-   * rows land only where every bound table is empty. Admin-only.
-   */
-  async scaffoldWorkspace(body) {
-    return this.request("POST", "/v1/workspaces/scaffold", body);
-  }
-  /**
-   * Read this workspace's schema back as a model — the tables it has (or only
-   * the ones named), their fields, options and views, plus its roles.
-   *
-   * A pure read, and admin-only for the same reason the scaffold is: the whole
-   * schema is what comes back.
-   */
-  async exportWorkspaceModel(opts = {}) {
-    const params = new URLSearchParams();
-    if (opts.tables !== void 0 && opts.tables.length > 0) {
-      params.set("tables", opts.tables.join(","));
-    }
-    const qs = params.toString();
-    return this.request("GET", `/v1/workspaces/model${qs ? `?${qs}` : ""}`);
-  }
   /**
    * What each alias of a workspace model became here, with what this workspace
    * calls every one of them now.
@@ -399,43 +314,6 @@ var LoticsClient = class {
   async getModelBinding() {
     return this.request("GET", "/v1/workspaces/model/binding");
   }
-  /**
-   * Forget what one alias is bound to here — the escape from a binding whose
-   * target has been deleted. Forgets everything addressed under it too: an
-   * entity owns its fields, its options and its rows.
-   */
-  async deleteModelBinding(kind, alias) {
-    const params = new URLSearchParams({ kind, alias });
-    return this.request("DELETE", `/v1/workspaces/model/binding?${params.toString()}`);
-  }
-  /**
-   * This workspace's tables, id and display name — the label side of every
-   * alias bind, and the one reading of `query_tables` the CLI has.
-   *
-   * Here rather than at each caller because the tool answers a row shape
-   * (`table_id` / `table_name`) that four commands were each unpacking by hand,
-   * and four unpackings of one wire shape are four places a field rename breaks.
-   */
-  async listTables() {
-    const listed = await this.execute("query_tables", {}, { format: "json" });
-    if (listed.error) throw new Error(`could not list this workspace's tables: ${listed.error}`);
-    return (Array.isArray(listed.result) ? listed.result : []).flatMap((row) => {
-      if (row === null || typeof row !== "object") return [];
-      const { table_id, table_name } = row;
-      return typeof table_id === "string" && typeof table_name === "string" ? [{ id: table_id, name: table_name }] : [];
-    });
-  }
-  /** This workspace's document templates, id and name — the same reading, one level over. */
-  async listTemplates() {
-    const read = await this.execute("query_templates", {}, { format: "json" });
-    if (read.error) throw new Error(`could not list this workspace's document templates: ${read.error}`);
-    const listed = read.result === null || typeof read.result !== "object" ? [] : Reflect.get(read.result, "templates");
-    return (Array.isArray(listed) ? listed : []).flatMap((row) => {
-      if (row === null || typeof row !== "object") return [];
-      const { id, name } = row;
-      return typeof id === "string" && typeof name === "string" ? [{ id, name }] : [];
-    });
-  }
   /**
    * Record which file each of a model's document PATHS was uploaded as.
    *
@@ -447,14 +325,6 @@ var LoticsClient = class {
   async recordModelDocuments(documents) {
     return this.request("PUT", "/v1/workspaces/model/binding/documents", { documents });
   }
-  /**
-   * Record which app each of a plan's app aliases became — stated by the create
-   * that made it, since an app row is made from a name and the alias is the
-   * author's file. What a sibling act naming that app resolves through.
-   */
-  async recordModelApps(apps) {
-    return this.request("PUT", "/v1/workspaces/model/binding/apps", { apps });
-  }
   /** Renames (and re-settings) the CURRENT workspace — the endpoint reads the
    *  target from the request's workspace, never a path id. */
   async updateWorkspace(body) {
@@ -526,132 +396,9 @@ var LoticsClient = class {
     return this.request("PATCH", "/v1/knowledge_docs", body);
   }
   // --- Apps ---
-  async getApp(app_id) {
-    return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}`);
-  }
   async createApp(body) {
     return this.request("POST", "/v1/apps", body);
   }
-  /**
-   * Take a starter off the shelf, or `undo` to put it back (backs `opctl
-   * library unpublish`). It hides from non-owning orgs and can no longer be
-   * copied; copies already made are unaffected — they never linked back.
-   * Owner-org admin-only.
-   */
-  async unpublishStarter(starter_id, body) {
-    return this.request("POST", `/v1/starters/${encodeURIComponent(starter_id)}/unpublish`, body);
-  }
-  /**
-   * Edit a starter's registry listing — the name and description a stranger
-   * reads before copying, and what every copy's app row is created from.
-   *
-   * A version is an immutable snapshot; the listing is not. Omit a field to
-   * leave it, pass `description: null` to clear it. Owner-org admin-only.
-   */
-  async editStarterListing(starter_id, body) {
-    return this.request("POST", `/v1/starters/${encodeURIComponent(starter_id)}/listing`, body);
-  }
-  // --- Starters (registry reads + copies) ---
-  // Authoring is server-side, through the publish job (`requestStarterPublish`).
-  // There is no client-side create-starter / upload-bundle path.
-  /**
-   * The starters this organization can copy — Lotics-reviewed ones plus its own,
-   * never a catalogue of everything published. The server returns exactly what
-   * instantiate would accept, so the list cannot offer a refusal. Admin-only.
-   */
-  async listStarters() {
-    return this.request("GET", "/v1/starters");
-  }
-  /**
-   * Copy a starter into the current workspace.
-   *
-   * Server-side this scaffolds the schema, creates the templates, docs and
-   * sample records, creates every app the starter carries and deploys each
-   * from its prebuilt dist — no build anywhere. `apps` reports each deploy;
-   * one that failed carries its `error` and the copy is complete around it.
-   * Admin-only.
-   */
-  async instantiateStarter(starter_id, body) {
-    return this.request(
-      "POST",
-      `/v1/starters/${encodeURIComponent(starter_id)}/instantiate`,
-      body
-    );
-  }
-  /**
-   * Which starter this app is the origin of. 404 when it has published none.
-   *
-   * The app row carries no pin, so this is the only app→starter direction there
-   * is — provenance lives on the published version. Admin-only.
-   */
-  async getAppOriginStarter(app_id) {
-    return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}/origin-starter`);
-  }
-  /**
-   * Apply the latest version of the package this app was copied from.
-   *
-   * The other provenance direction from `getAppOriginStarter`, and the only one
-   * that writes: that one answers which package this app PUBLISHED, this one
-   * reads what a copy recorded and re-derives the app against a later release.
-   *
-   * The offer is partial by design and the result says how partial: schema is
-   * additive (`created_fields`, and a `dropped_fields` the new version stopped
-   * declaring is left standing), and an artifact the owner has edited is kept
-   * and named (`skipped_workflows` / `skipped_agents`). An app with no
-   * provenance is a 400, and one already on the latest release a 409 — both
-   * refusals, both before any write. Admin-only.
-   */
-  async upgradeApp(app_id, opts = {}) {
-    return this.request("POST", `/v1/apps/${encodeURIComponent(app_id)}/upgrade`, {
-      ...opts.acknowledge_breaking_api_change ? { acknowledge_breaking_api_change: true } : {},
-      ...opts.connections === void 0 ? {} : { connections: opts.connections }
-    });
-  }
-  /**
-   * Capture live records from this workspace as a starter's sample data.
-   *
-   * The alias-keyed shape is produced SERVER-side, because the contract alias
-   * space is minted by extract and exists nowhere a project can read it. Pure
-   * read — the caller writes the returned files into the project and reviews
-   * them, which matters: these rows are copied verbatim into every workspace
-   * that takes the starter. Admin-only.
-   */
-  async captureStarterFixtures(app_id, opts = {}) {
-    const params = new URLSearchParams();
-    if (opts.entities !== void 0 && opts.entities.length > 0) {
-      params.set("entities", opts.entities.join(","));
-    }
-    if (opts.limit !== void 0) params.set("limit", String(opts.limit));
-    const qs = params.toString();
-    return this.request(
-      "GET",
-      `/v1/apps/${encodeURIComponent(app_id)}/fixtures-capture${qs ? `?${qs}` : ""}`
-    );
-  }
-  /**
-   * Fetch a registry starter's metadata (`latest_version` and the Lotics-backed
-   * `is_official` trust badge). Admin-only; cross-tenant by id.
-   */
-  async getStarter(starter_id) {
-    return this.request("GET", `/v1/starters/${encodeURIComponent(starter_id)}`);
-  }
-  /** Version history newest-first (no contract payloads) — backs `opctl library show`. Admin-only. */
-  async listStarterVersions(starter_id) {
-    return this.request("GET", `/v1/starters/${encodeURIComponent(starter_id)}/versions`);
-  }
-  /**
-   * One version's contract — what a copy of it is supposed to produce. The
-   * history above omits it (heavy per row); this is the read that carries it,
-   * so a check compares a copy against the declaration itself rather than
-   * against a description of it. Admin-only; cross-tenant by id like
-   * `getStarter`.
-   */
-  async getStarterVersion(starter_id, version) {
-    return this.request(
-      "GET",
-      `/v1/starters/${encodeURIComponent(starter_id)}/versions/${encodeURIComponent(String(version))}`
-    );
-  }
   /**
    * Workspace-wide dangling-reference sweep — active app/workflow artifacts
    * whose prefixed schema ids no longer resolve. Backs
@@ -660,106 +407,11 @@ var LoticsClient = class {
   async getWorkspaceDanglingReferences() {
     return this.request("GET", "/v1/workspaces/dangling-references");
   }
-  // --- Starter publishing (the authoring verbs; copying is `instantiateStarter`) ---
-  /**
-   * Preview publishing a set of this workspace's apps as one starter version —
-   * the GET behind `opctl library publish` (no `--yes`). The server runs the
-   * same extraction the publish runs and reports which starter it would
-   * release into (null: it would mint one), the next version, the aliases a
-   * first publish can still rename, the diff against the current version, the
-   * knowledge delta, and the findings (an `error` blocks the publish). No
-   * writes. Admin-only.
-   */
-  async previewStarterPublish(opts) {
-    const params = new URLSearchParams();
-    params.set("app_ids", opts.app_ids.join(","));
-    if (opts.starter_id !== void 0) params.set("starter_id", opts.starter_id);
-    if (opts.knowledge_doc_ids !== void 0) params.set("knowledge_doc_ids", opts.knowledge_doc_ids.join(","));
-    if (opts.renames !== void 0 && opts.renames.length > 0) params.set("renames", JSON.stringify(opts.renames));
-    if (opts.name !== void 0) params.set("name", opts.name);
-    if (opts.description !== void 0) params.set("description", opts.description);
-    if (opts.icon !== void 0) params.set("icon", opts.icon);
-    if (opts.color !== void 0) params.set("color", opts.color);
-    return this.request("GET", `/v1/starters/publish-preview?${params.toString()}`);
-  }
-  /**
-   * Publish this workspace's apps as a starter version — a JOB, because every
-   * app is built once against sentinel field keys and eleven builds outlast a
-   * request. Everything a request can refuse is refused here with nothing
-   * written: a blocking finding or another publish still running for this
-   * org (409), a missing deploy or a bad declaration (400). The response is
-   * the job to poll with `getStarterPublish`. Admin-only.
-   */
-  async requestStarterPublish(body) {
-    const { color, ...rest } = body;
-    return this.request("POST", "/v1/starters/publishes", {
-      ...rest,
-      ...color !== void 0 ? { theme: { color } } : {}
-    });
-  }
-  /** The state of a publish: which app is building, and the version once every dist is in. */
-  async getStarterPublish(publish_id) {
-    return this.request("GET", `/v1/starters/publishes/${encodeURIComponent(publish_id)}`);
-  }
-  /**
-   * The ROW RULE each of these tables declares — `private_filters` as stored, or
-   * `null` where the table has none.
-   *
-   * `GET /v1/tables/{id}` rather than the `get_table` tool beside it: the rule is
-   * an IAM fact about who may read a row, and the tool's output is the schema an
-   * agent writes records against, which is why it carries fields and not this.
-   * One call per id. A table this credential may not read — 403, or 404 for one
-   * that is gone — is DROPPED: the only caller warns about rules it can see, and
-   * a table it cannot read is not evidence of one. EVERY other failure throws.
-   * An expired key, a 500, a timeout and an offline host all mean the scan has
-   * no answer, and swallowing them would render as "this table declares no
-   * rule" — the guard at its quietest exactly where it knows least.
-   *
-   * The filter is carried untyped: a published `.d.ts` cannot name
-   * `@lotics/shared`'s filter schema, and the one reader asks a single question
-   * of the tree rather than interpreting it.
-   */
-  async getTableRowRules(tableIds) {
-    const tables = await Promise.all(
-      tableIds.map(async (table_id) => {
-        try {
-          const table = await this.request(
-            "GET",
-            `/v1/tables/${encodeURIComponent(table_id)}`
-          );
-          return { id: table.id, name: table.name, private_filters: table.private_filters ?? null };
-        } catch (error) {
-          const notVisible = error instanceof LoticsRequestError && (error.status === 403 || error.status === 404);
-          if (!notVisible) throw error;
-          return null;
-        }
-      })
-    );
-    return tables.filter((table) => table !== null);
-  }
-  /**
-   * The organization's member groups — the directory `lotics app codegen` turns
-   * into the `GRP` alias map.
-   *
-   * Over the HTTP route rather than `query_member_groups`, because the tool is
-   * admin-only and the route is member-visible by design (`docs/iam.md` § Groups:
-   * reading the directory is not administration). Codegen runs for every author,
-   * so an admin-only read here would leave a non-admin's `GRP` empty and their
-   * app unbuildable.
-   */
-  async getMemberGroups() {
-    const { groups } = await this.request(
-      "GET",
-      "/v1/iam/member_groups"
-    );
-    return groups.map((group) => ({ id: group.id, name: group.name }));
-  }
   /**
-   * Resolve the display name + fields (incl. select options) of the given tables
-   * — the schema `lotics app codegen` turns into the runtime `.lotics/app_fields.ts`
-   * alias maps. One `get_table` call per id (the tool surface has no batch
-   * variant); a missing/inaccessible table is dropped rather than throwing, so a
-   * stale id in the scope set never fails codegen.
+   * Resolve the display name + fields (incl. select options) of the given tables.
+   * One `get_table` call per id (the tool surface has no batch variant); a
+   * missing/inaccessible table is dropped rather than throwing, so a stale id in
+   * the scope set never fails the caller.
    */
   async getWorkspaceSchema(tableIds) {
     const tables = await Promise.all(
@@ -794,75 +446,11 @@ var LoticsClient = class {
     );
     return tables.filter((t) => t !== null);
   }
-  /**
-   * Rename an app's public subdomain — the label its origin is built on.
-   * Mirrors PUT /v1/apps/{app_id}/subdomain, and returns the finished `origin`
-   * because only the instance knows the domain and scheme it serves apps on.
-   * The old subdomain stops resolving once the change lands.
-   */
-  async setAppSubdomain(app_id, public_subdomain) {
-    return this.request(
-      "PUT",
-      `/v1/apps/${encodeURIComponent(app_id)}/subdomain`,
-      { public_subdomain }
-    );
-  }
-  /**
-   * Publish the app's API — the owner's promise about what its declared queries
-   * and workflows return to a caller outside the app.
-   *
-   * Snapshots the contract and answers the version it took, plus what the
-   * published surface exposes that the owner may not have intended. A query
-   * that does not name its columns is refused (400) before anything is written:
-   * the app cannot promise field names it never stated.
-   */
-  async publishAppApi(app_id) {
-    return this.request("POST", `/v1/apps/${encodeURIComponent(app_id)}/api/publish`, {});
-  }
-  /** End the promise. `unpublished: false` means the app was publishing nothing,
-   *  which this leaves unchanged. The superseded snapshot stays, so a later
-   *  publish continues the numbering rather than reusing a version. */
-  async unpublishAppApi(app_id) {
-    return this.request("DELETE", `/v1/apps/${encodeURIComponent(app_id)}/api/publish`);
-  }
-  /** Whether the app is publishing an API, and which contract version. */
-  async getAppApiPublication(app_id) {
-    return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}/api/publication`);
-  }
-  /**
-   * The published API as an OpenAPI 3.1 document — what a consumer's own
-   * generator reads. Rendered from the live SNAPSHOT rather than the manifest,
-   * so it describes what the app has promised; 404 while nothing is published.
-   */
-  async getAppOpenApiDocument(app_id) {
-    return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}/openapi.json`);
-  }
-  async getAppVersion(app_id, version_id) {
-    return this.request(
-      "GET",
-      `/v1/apps/${encodeURIComponent(app_id)}/versions/${encodeURIComponent(version_id)}`
-    );
-  }
-  async getAppVersionSourceUrl(app_id, version_id) {
-    const result = await this.request(
-      "GET",
-      `/v1/apps/${encodeURIComponent(app_id)}/versions/${encodeURIComponent(version_id)}/source`
-    );
-    return result.url;
-  }
-  /** Deploy history for an app — newest first. Backs `lotics app versions`. */
-  async listAppVersions(app_id, opts) {
-    const qs = new URLSearchParams();
-    if (opts?.limit != null) qs.set("limit", String(opts.limit));
-    if (opts?.offset != null) qs.set("offset", String(opts.offset));
-    const suffix = qs.toString() ? `?${qs.toString()}` : "";
-    return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}/versions${suffix}`);
-  }
   // ── App iframe RPC endpoints ──────────────────────────────────────────────
   // These mirror the two ops handled by frontend/features/app_ui/app_iframe_host.tsx.
   // The deployed iframe sends postMessage to the parent frontend, which calls
-  // these same endpoints via the user's session cookie. `lotics app dev`
-  // forwards the iframe's postMessage to these methods using the CLI's API key.
+  // these same endpoints via the user's session cookie; here they run under the
+  // client's API key.
   /**
    * Run a named query declared in the app's manifest, scoped to the app's IAM
    * principal. Mirrors POST /v1/apps/{app_id}/query.
@@ -870,294 +458,11 @@ var LoticsClient = class {
   async appQuery(app_id, body) {
     return this.request("POST", `/v1/apps/${encodeURIComponent(app_id)}/query`, body);
   }
-  async appMembers(app_id, group_id) {
-    const qs = group_id ? `?group_id=${encodeURIComponent(group_id)}` : "";
-    return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}/members${qs}`);
-  }
-  /**
-   * Resolve the full option set (key, label, color) of a named query's select
-   * columns, and the units of its figures read per row — the picker companion
-   * to `appQuery`. Mirrors
-   * POST /v1/apps/{app_id}/field-options.
-   */
-  async appFieldOptions(app_id, alias) {
-    return this.request("POST", `/v1/apps/${encodeURIComponent(app_id)}/field-options`, { alias });
-  }
-  /**
-   * What the app's writes will change — each bound workflow's record-write subset, each query's column
-   * sources, the fields they name. Mirrors GET /v1/apps/{app_id}/write_model; the dev server hands it to
-   * the app's SDK whole, so its parts stay opaque here.
-   */
-  async appWriteModel(app_id) {
-    return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}/write_model`);
-  }
-  /**
-   * Where the app's SDK drew a write the server then stored differently, counted by workflow, field and kind.
-   * Mirrors POST /v1/apps/{app_id}/prediction_misses; the server checks the report's shape.
-   */
-  async appPredictionMisses(app_id, report) {
-    return this.request("POST", `/v1/apps/${encodeURIComponent(app_id)}/prediction_misses`, report);
-  }
-  /**
-   * Execute a workflow by alias declared in package.json#lotics.workflows.
-   * Mirrors POST /v1/apps/{app_id}/workflows/{alias}/execute.
-   */
-  async appWorkflow(app_id, alias, inputs, minted_ids) {
-    const url = `${this.baseUrl}/v1/apps/${encodeURIComponent(app_id)}/workflows/${encodeURIComponent(alias)}/execute`;
-    const headers = this.buildHeaders();
-    headers["Content-Type"] = "application/json";
-    let response;
-    try {
-      response = await fetch(url, { method: "POST", headers, body: JSON.stringify({ inputs, ...minted_ids === void 0 ? {} : { minted_ids } }) });
-    } catch (err) {
-      return { status: "error", message: err instanceof Error ? err.message : "The workflow request failed." };
-    }
-    const text = await response.text();
-    let parsed = null;
-    if (text) {
-      try {
-        parsed = JSON.parse(text);
-      } catch {
-      }
-    }
-    if (response.ok) return parsed ?? {};
-    return { status: "error", message: transportErrorMessage(response.status, parsed) };
-  }
-  /**
-   * Bind (create or replace) an app workflow by alias via the `set_app_workflow`
-   * tool — the SINGLE author of `apps.workflows` + the workflow row. `source` is
-   * the verbatim JS-subset body (no `on({...})` trigger). `inputs`/`outputs` are
-   * the typed schemas declared in `package.json#lotics.workflows.<alias>`. The
-   * server re-verifies the body and echoes the bound `outputs` (declared, else
-   * DERIVED from `return({ data })`), so the CLI can show the author what shape
-   * `result.data` will carry. Wraps the tool rather than a bespoke endpoint so
-   * the file flow stays a convenience over the existing single-author contract.
-   */
-  async setAppWorkflow(app_id, alias, body) {
-    return this.execute("set_app_workflow", {
-      app_id,
-      alias,
-      source: body.source,
-      ...body.inputs ? { inputs: body.inputs } : {},
-      ...body.outputs ? { outputs: body.outputs } : {},
-      ...body.name ? { name: body.name } : {},
-      ...body.description ? { description: body.description } : {},
-      ...body.expected_body_sha ? { expected_body_sha: body.expected_body_sha } : {},
-      // Sent only when the caller asked for it: absent means "refuse a break",
-      // which is the answer a caller who said nothing gave.
-      ...body.acknowledge_breaking_api_change ? { acknowledge_breaking_api_change: true } : {},
-      // Sent only when asked: a server that predates it refuses the parameter
-      // rather than performing the write.
-      ...body.verify_only ? { verify_only: true } : {}
-    });
-  }
-  /**
-   * Bind (create or replace) an app query by alias via the `set_app_query` tool
-   * — the deploy-free authoring path for `apps.queries`, parallel to
-   * `setAppWorkflow`. `declaration` is the `{ ast, params? }` from
-   * `package.json#lotics.queries.<alias>`. The server validates it exactly as a
-   * deploy validates the manifest. Note: `apps.queries` is manifest-authoritative,
-   * so the next `lotics app deploy` overwrites this from the manifest.
-   */
-  async setAppQuery(app_id, alias, declaration, expected_sha, acknowledge_breaking_api_change) {
-    return this.execute("set_app_query", {
-      app_id,
-      alias,
-      declaration,
-      ...expected_sha ? { expected_sha } : {},
-      ...acknowledge_breaking_api_change ? { acknowledge_breaking_api_change: true } : {}
-    });
-  }
-  /**
-   * Bind (create or replace) an app agent by alias via the `set_app_agent` tool
-   * — the deploy-free authoring path for `apps.agents`, parallel to
-   * `setAppWorkflow`/`setAppQuery`.
-   *
-   * `set_app_agent` REPLACES the whole declaration, so this takes the whole
-   * declaration. `lotics app agent set` is the caller that assembles it (prose
-   * from `src/agents/<alias>.md`, typed fields from the manifest) precisely so
-   * no caller has to remember that a partial payload silently drops
-   * `instructions`, `outputs` and the model pin.
-   */
-  async setAppAgent(app_id, alias, patch, acknowledge_breaking_api_change) {
-    return this.execute("set_app_agent", {
-      app_id,
-      alias,
-      ...patch,
-      // Sent only when the caller asked for it: absent means "refuse a break",
-      // which is the answer a caller who said nothing gave.
-      ...acknowledge_breaking_api_change ? { acknowledge_breaking_api_change: true } : {}
-    });
-  }
   /**
-   * Fetch one app workflow's faithful source + bound input/output schemas via
-   * `get_app_workflow`. `source` is the JS-subset body re-rendered from the
-   * persisted step tree (incl. the `return({ data })` clause, opaque field/option
-   * keys) — the exact text `lotics app workflow set` would push back. Feeds
-   * `lotics app pull`, which writes it to `src/workflows/<alias>.ts`.
+   * Upload a custom app's build as a new version of the live app — `POST /v1/apps/{id}/versions`.
+   * The version carries the app's queries, workflows, agents and capabilities forward unchanged;
+   * those are written through their own tools.
    */
-  async getAppWorkflow(app_id, alias) {
-    return this.execute("get_app_workflow", { app_id, alias });
-  }
-  /**
-   * The app's capability catalog exactly as a chat or MCP caller reads it —
-   * every query, workflow and agent alias the caller's scope reaches, with the
-   * description each is chosen BY. One read for the whole app, so a check over
-   * what those readers see costs one request rather than one per alias.
-   */
-  async getAppCapabilities(app_id) {
-    return this.execute("get_app_capabilities", { app_id });
-  }
-  /**
-   * Fetch the server-generated workspace `.d.ts` + the wrapper envelope that
-   * make a `src/workflows/<alias>.ts` body locally typecheckable (GAP-59).
-   * The server is the single source of the type model — the CLI never
-   * re-implements it. `envelope_prefix`/`envelope_suffix` are the exact
-   * `async function __workflow(): …` wrapper the server compiles inside, so the
-   * local typecheck mirrors the set-time verdict. Mirrors
-   * POST /v1/apps/{app_id}/workflows/{alias}/dts.
-   *
-   * `declaration` (the manifest's `{ inputs?, outputs? }`) is posted as the body
-   * `{ declaration }` ONLY when the alias isn't `set` on the server yet — the
-   * server then synthesizes the dts from the declared schemas instead of 400ing
-   * "no workflow alias". A registered alias needs no declaration (the server's
-   * own bound contract wins), so the field is omitted in that case.
-   */
-  async getAppWorkflowDts(app_id, alias, declaration) {
-    return this.request(
-      "POST",
-      `/v1/apps/${encodeURIComponent(app_id)}/workflows/${encodeURIComponent(alias)}/dts`,
-      declaration ? { declaration } : void 0
-    );
-  }
-  /**
-   * Open a streaming agent run and return the RAW streamed `Response` (the
-   * caller reads `res.body`). Unlike `request`, this does not buffer/parse the
-   * body — it's the SSE stream the `lotics app dev` harness proxies to the
-   * iframe. Mirrors POST /v1/apps/{app_id}/agents/{alias}/runs.
-   */
-  async appAgentRunStream(app_id, alias, body, signal) {
-    const headers = { ...this.buildHeaders(), "Content-Type": "application/json" };
-    const res = await fetch(
-      `${this.baseUrl}/v1/apps/${encodeURIComponent(app_id)}/agents/${encodeURIComponent(alias)}/runs`,
-      { method: "POST", headers, body: JSON.stringify(body), signal }
-    );
-    if (!res.ok) await this.throwResponseError(res, headers["x-request-id"]);
-    return res;
-  }
-  /**
-   * Continue a PARKED (`awaiting_input`) agent run with the user's answer to its
-   * pending `ask_user_choice` — returns the RAW streamed continuation `Response`,
-   * exactly like `appAgentRunStream`. Mirrors
-   * POST /v1/apps/{app_id}/agent-runs/{run_id}/continue.
-   */
-  async appAgentRunContinueStream(app_id, run_id, body, signal) {
-    const headers = { ...this.buildHeaders(), "Content-Type": "application/json" };
-    const res = await fetch(
-      `${this.baseUrl}/v1/apps/${encodeURIComponent(app_id)}/agent-runs/${encodeURIComponent(run_id)}/continue`,
-      { method: "POST", headers, body: JSON.stringify(body), signal }
-    );
-    if (!res.ok) await this.throwResponseError(res, headers["x-request-id"]);
-    return res;
-  }
-  /**
-   * A session's app-agent run history, oldest-first (the run just started is the
-   * last, and its exact id is on the stream response's `x-app-agent-run-id`
-   * header). Transcript excluded; structured `output`/`input` included. Mirrors
-   * GET /v1/apps/{app_id}/agent-runs.
-   */
-  async listAgentRuns(app_id, session_id) {
-    return this.request(
-      "GET",
-      `/v1/apps/${encodeURIComponent(app_id)}/agent-runs?session_id=${encodeURIComponent(session_id)}`
-    );
-  }
-  /**
-   * A single run by id — the poll read a client follows after its stream drops
-   * (a parked `awaiting_input` row carries `pending_interactive` so the question
-   * survives reconnection). Mirrors GET /v1/apps/{app_id}/agent-runs/{run_id}.
-   */
-  async getAgentRun(app_id, run_id) {
-    return this.request(
-      "GET",
-      `/v1/apps/${encodeURIComponent(app_id)}/agent-runs/${encodeURIComponent(run_id)}`
-    );
-  }
-  /**
-   * Request cancellation of an in-flight (or parked) run. Mirrors
-   * POST /v1/apps/{app_id}/agent-runs/{run_id}/cancel.
-   */
-  async cancelAgentRun(app_id, run_id) {
-    return this.request(
-      "POST",
-      `/v1/apps/${encodeURIComponent(app_id)}/agent-runs/${encodeURIComponent(run_id)}/cancel`
-    );
-  }
-  /**
-   * Mint a presigned URL for uploading a file into an app. Mirrors
-   * POST /v1/apps/{app_id}/files/upload-url.
-   */
-  async appRequestFileUpload(app_id, body) {
-    return this.request(
-      "POST",
-      `/v1/apps/${encodeURIComponent(app_id)}/files/upload-url`,
-      body
-    );
-  }
-  /**
-   * Finalize a presigned upload once the bytes are in storage. Mirrors
-   * POST /v1/apps/{app_id}/files/complete.
-   */
-  async appCompleteFileUpload(app_id, body) {
-    return this.request(
-      "POST",
-      `/v1/apps/${encodeURIComponent(app_id)}/files/complete`,
-      body
-    );
-  }
-  /** A file of the app under another name — a new file over the same bytes, for a save to put in the old one's place. */
-  async appRenameFile(app_id, file_id, filename) {
-    return this.request(
-      "POST",
-      `/v1/apps/${encodeURIComponent(app_id)}/files/${encodeURIComponent(file_id)}/rename`,
-      { filename }
-    );
-  }
-  // App-scoped record comments — the `lotics app dev` loop forwards the iframe's
-  // `comments.*` ops to these (production routes them through the iframe host).
-  // App authority + tenant floor are enforced server-side; these are thin.
-  async appGetRecordComments(app_id, record_id) {
-    return this.request(
-      "GET",
-      `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments`
-    );
-  }
-  async appCreateRecordComment(app_id, record_id, body) {
-    return this.request(
-      "POST",
-      `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments`,
-      body
-    );
-  }
-  async appUpdateRecordComment(app_id, record_id, comment_id, body) {
-    return this.request(
-      "PATCH",
-      `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments/${encodeURIComponent(comment_id)}`,
-      body
-    );
-  }
-  async appDeleteRecordComment(app_id, record_id, comment_id) {
-    await this.request(
-      "DELETE",
-      `/v1/apps/${encodeURIComponent(app_id)}/records/${encodeURIComponent(record_id)}/comments/${encodeURIComponent(comment_id)}`
-    );
-  }
-  async appGetTableCommentCounts(app_id, table_id) {
-    return this.request(
-      "GET",
-      `/v1/apps/${encodeURIComponent(app_id)}/tables/${encodeURIComponent(table_id)}/comment-counts`
-    );
-  }
   async deployAppVersion(args) {
     const formData = new FormData();
     formData.append(
@@ -1170,22 +475,8 @@ var LoticsClient = class {
       new Blob([new Uint8Array(args.dist_archive)], { type: "application/gzip" }),
       "dist.tar.gz"
     );
-    if (args.prev_version_id) {
-      formData.append("prev_version_id", args.prev_version_id);
-    }
-    if (args.message) {
-      formData.append("message", args.message);
-    }
-    formData.append("queries", JSON.stringify(args.queries ?? {}));
-    if (args.capabilities !== void 0) {
-      formData.append("capabilities", JSON.stringify(args.capabilities));
-    }
-    formData.append("workflow_aliases", JSON.stringify(args.workflow_aliases ?? []));
-    formData.append("agent_aliases", JSON.stringify(args.agent_aliases ?? []));
-    formData.append("query_aliases", JSON.stringify(args.query_aliases ?? []));
-    if (args.acknowledge_breaking_api_change) {
-      formData.append("acknowledge_breaking_api_change", "true");
-    }
+    if (args.prev_version_id) formData.append("prev_version_id", args.prev_version_id);
+    if (args.message) formData.append("message", args.message);
     const url = `${this.baseUrl}/v1/apps/${encodeURIComponent(args.app_id)}/versions`;
     const headers = this.buildHeaders();
     const response = await fetch(url, { method: "POST", headers, body: formData });
@@ -1405,10 +696,6 @@ export {
   LoticsClient,
   LoticsRequestError,
   WEB_APP_URL,
-  fetchOfficialStarters,
-  getOfficialStarter,
-  getPublicJson,
   pollCliLogin,
-  readOfficialStarter,
   startCliLogin
 };