@lotics/cli 0.74.0 → 0.76.0

package/README.md

@@ -210,7 +210,12 @@ lotics package sync --workspace wsp_dev    # migrate the dev installation only
 lotics package reset --workspace wsp_dev   # DEV-ONLY: drop scaffolded tables, re-scaffold clean
 
 # Operate installations (workspace admin)
+lotics package show apg_...                # registry metadata + version history (trust badge, channel, yank)
 lotics package install apg_... --version 2 # scaffold + materialize + deploy + pin
+lotics package install apg_... --config heading="Ops board"   # per-knob overrides over contract defaults
+lotics package config app_... --set show_done=false           # edit a live installation's config (partial merge)
+lotics package uninstall app_... [--archive-tables]           # remove an installation; workflows stop firing
+lotics package retire apg_... [--undo]     # owner-org: refuse NEW installs (existing keep working + upgrading)
 lotics package doctor app_...              # version pin vs latest + drift + local edits (exit 1 on findings)
 lotics package rebind-role app_... <alias> <grp_id>  # re-point a package role at another group (re-materializes)
 lotics package upgrade app_...             # preview, then apply (additive; overlay preserved)

package/dist/app_commands.d.ts

@@ -117,6 +117,22 @@ export declare function runNpm(args: string[], cwd: string): Promise<void>;
  * the author fixes the config.
  */
 export declare function ensureAppTsconfig(projectDir: string): void;
+/**
+ * Write the three `.lotics/app_{workflows,queries,agents}.d.ts` companions from
+ * the manifest's maps, then heal the app's tsconfig so they actually load. Called
+ * from `app create / pull / dev / deploy / codegen`, so the augmented `AppWorkflows`
+ * / `AppQueries` / `AppAgents` types stay in sync with the manifest.
+ *
+ * The heal is at the write boundary on purpose: a `.d.ts` written but not loaded is
+ * useless (a bare `.lotics` include is skipped by TypeScript's include-glob walk and
+ * loads zero of them), so `ensureAppTsconfig` couples "wrote the types" with "the
+ * program can see them" — no caller can do one without the other.
+ */
+export declare function writeAppDts(projectDir: string, manifest: {
+    workflows?: Record<string, AppWorkflowDeclaration>;
+    queries?: Record<string, AppQueryDeclaration>;
+    agents?: Record<string, AppAgentDeclaration>;
+}): string[];
 /**
  * `lotics app codegen [path]` — regenerate every `.lotics/` artifact from the
  * manifest + workspace schema, WITHOUT a deploy. The `.d.ts` companions are

package/dist/app_commands.js

@@ -386,7 +386,7 @@ export function ensureAppTsconfig(projectDir) {
  * loads zero of them), so `ensureAppTsconfig` couples "wrote the types" with "the
  * program can see them" — no caller can do one without the other.
  */
-function writeAppDts(projectDir, manifest) {
+export function writeAppDts(projectDir, manifest) {
     const dotLotics = path.join(projectDir, ".lotics");
     fs.mkdirSync(dotLotics, { recursive: true });
     const written = [

package/dist/args.d.ts

@@ -53,6 +53,14 @@ export declare function parseArgs(argv: string[]): {
          * `keep`.
          */
         resolve: string[];
+        /** `--config key=value` (repeatable): per-knob config overrides at `package install`. */
+        config: string[];
+        /** `--set key=value` (repeatable): per-knob config edits at `package config`. */
+        set: string[];
+        /** `--archive-tables`: also archive the scaffolded tables at `package uninstall`. */
+        archiveTables: boolean;
+        /** `--undo`: reverse a `package retire` / `package yank`. */
+        undo: boolean;
         version: boolean;
         help: boolean;
     };

package/dist/args.js

@@ -31,6 +31,10 @@ export function parseArgs(argv) {
         cleanup: false,
         packageVersion: undefined,
         resolve: [],
+        config: [],
+        set: [],
+        archiveTables: false,
+        undo: false,
         version: false,
         help: false,
     };
@@ -106,6 +110,28 @@ export function parseArgs(argv) {
                 flags.resolve.push(value);
                 break;
             }
+            case "--config": {
+                const value = argv[++i];
+                if (value === undefined || value.startsWith("-")) {
+                    throw new Error("--config requires a value: key=value (repeatable).");
+                }
+                flags.config.push(value);
+                break;
+            }
+            case "--set": {
+                const value = argv[++i];
+                if (value === undefined || value.startsWith("-")) {
+                    throw new Error("--set requires a value: key=value (repeatable).");
+                }
+                flags.set.push(value);
+                break;
+            }
+            case "--archive-tables":
+                flags.archiveTables = true;
+                break;
+            case "--undo":
+                flags.undo = true;
+                break;
             case "--version":
             case "-v": {
                 // Inside a `package` command, `--version` carries a value (the

package/dist/cli.js

@@ -14,7 +14,7 @@ import { LoticsClient, API_BASE_URL } from "./client.js";
 import { resolveContext, deleteConfig, getConfigPath, loadGlobalConfig, saveGlobalConfig, loadLocalConfig, upsertProfile, removeProfile, setActiveOrg, setSelectedWorkspace, resolveProfileByNameOrId, checkForUpdate, } from "./config.js";
 import { VERSION } from "./version.js";
 import { appCreate, appPull, appDeploy, appDev, appSetSubdomain, appRename, appVersions, appCodegen, appExecuteWorkflow, appWorkflowSet, appWorkflowPull, appWorkflowCheck, appQuerySet, appUiLink, } from "./app_commands.js";
-import { packageInstall, packageEject, packageDoctor, packageUpgrade, parseResolveFlags, packageNew, packageBuild, packagePublish, packageDev, packageSync, packageReset, packageExtract, packageAdopt, packageFleetUpgrade, } from "./package_commands.js";
+import { packageInstall, packageUninstall, packageConfig, packageRetire, packageShow, parseInstallConfigFlags, packageEject, packageDoctor, packageUpgrade, parseResolveFlags, packageNew, packageBuild, packagePublish, packageDev, packageSync, packageReset, packageExtract, packageAdopt, packageFleetUpgrade, packageYank, } from "./package_commands.js";
 import { parseArgs } from "./args.js";
 import { ingestJsonArgs } from "./inputs.js";
 import { runXlsxCommand } from "./xlsx.js";
@@ -103,9 +103,18 @@ COMMANDS
                                        dev server (--workspace <dev_ws> selects it)
   lotics package sync [path]           Re-sync (additive migrate + materialize) into a dev ws
   lotics package reset [path]          DEV-ONLY: drop scaffolded tables + re-scaffold clean
-  lotics package install <package> [--version N]
+  lotics package install <package> [--version N] [--config key=value ...]
                                        Install an app package into this workspace
                                        (scaffolds the data model + deploys + materializes)
+  lotics package uninstall <app_id> [--archive-tables]
+                                       Remove an installation (archives artifacts; with the
+                                       flag also archives the scaffolded tables it created)
+  lotics package config <app_id> [--set key=value ...]
+                                       Show or edit an installation's config knobs
+  lotics package show <package_id>     Registry metadata + version history
+  lotics package retire <package_id> [--undo]
+                                       Retire a package (refuse new installs, hide from other
+                                       orgs); existing installations keep working + upgrade
   lotics package upgrade <app_id> [--version N] [--resolve <key>=recreate|revert|keep|<id> ...]
                                        Preview-then-apply a package upgrade; refuses while
                                        any drift/modified finding lacks a --resolve, and
@@ -124,6 +133,7 @@ COMMANDS
                                        origin app (reads .lotics/adopt_binding.json;
                                        --version N pins a specific version)
   lotics package fleet-upgrade <package_id> [--version N]
+  lotics package yank <package_id> <version> [--undo]
                                        Upgrade EVERY installation of the package across
                                        your org: applies where the preview is clean,
                                        skips + reports findings (exit 1 unless all current)
@@ -699,7 +709,11 @@ async function main() {
         console.error("  lotics package dev [path] [--workspace <ws>]     Sync into a dev workspace + run the app dev server");
         console.error("  lotics package sync [path] [--workspace <ws>]    Re-sync (additive migrate + materialize) into a dev workspace");
         console.error("  lotics package reset [path] [--workspace <ws>]   DEV-ONLY: drop scaffolded tables + re-scaffold clean");
-        console.error("  lotics package install <package> [--version N]   Install a package into this workspace");
+        console.error("  lotics package install <package> [--version N] [--config key=value ...]   Install a package into this workspace");
+        console.error("  lotics package uninstall <app_id> [--archive-tables]   Remove an installation (opt-in table archival)");
+        console.error("  lotics package config <app_id> [--set key=value ...]   Show or edit an installation's config knobs");
+        console.error("  lotics package show <package_id>                 Registry metadata + version history (channel, yank, changelog)");
+        console.error("  lotics package retire <package_id> [--undo]      Retire a package (refuse new installs; installs keep working)");
         console.error("  lotics package upgrade <app_id> [--version N] [--resolve ns.alias=recreate|<id>]   Preview + apply an upgrade");
         console.error("  lotics package doctor [app_id]                   Health: version pin vs latest + binding drift");
         console.error("  lotics package rebind-role <app_id> <alias> <grp_id>   Re-point a package role at another group");
@@ -707,6 +721,7 @@ async function main() {
         console.error("  lotics package extract <app_id> [path]           Promote a bespoke app to a draft package project");
         console.error("  lotics package adopt <app_id> [path]             Bind the published project onto the origin app");
         console.error("  lotics package fleet-upgrade <package_id> [--version N]   Upgrade every org installation (clean ones apply; findings skip)");
+        console.error("  lotics package yank <package_id> <version> [--undo]       Refuse new installs/upgrades of a broken published version (pinned installations keep running)");
         process.exit(1);
     }
     if (command === "run" && !subcommand) {
@@ -869,7 +884,48 @@ async function main() {
                     process.exit(1);
                 }
             }
-            await packageInstall(client, { package_id: packageId, version });
+            const config = flags.config.length > 0 ? parseInstallConfigFlags(flags.config) : undefined;
+            await packageInstall(client, {
+                package_id: packageId,
+                version,
+                ...(config !== undefined ? { config } : {}),
+            });
+            return;
+        }
+        if (subcommand === "uninstall") {
+            const appId = toolArgs;
+            if (!appId) {
+                console.error("Usage: lotics package uninstall <app_id> [--archive-tables]");
+                process.exit(1);
+            }
+            await packageUninstall(client, { app_id: appId, archive_tables: flags.archiveTables });
+            return;
+        }
+        if (subcommand === "config") {
+            const appId = toolArgs;
+            if (!appId) {
+                console.error("Usage: lotics package config <app_id> [--set key=value ...]");
+                process.exit(1);
+            }
+            await packageConfig(client, { app_id: appId, sets: flags.set });
+            return;
+        }
+        if (subcommand === "retire") {
+            const packageId = toolArgs;
+            if (!packageId) {
+                console.error("Usage: lotics package retire <package_id> [--undo]");
+                process.exit(1);
+            }
+            await packageRetire(client, { package_id: packageId, undo: flags.undo });
+            return;
+        }
+        if (subcommand === "show") {
+            const packageId = toolArgs;
+            if (!packageId) {
+                console.error("Usage: lotics package show <package_id>");
+                process.exit(1);
+            }
+            await packageShow(client, { package_id: packageId });
             return;
         }
         if (subcommand === "eject") {
@@ -909,6 +965,16 @@ async function main() {
             await packageAdopt(client, { app_id: appId, version, projectDir: restArgs[0] });
             return;
         }
+        if (subcommand === "yank") {
+            const packageId = toolArgs;
+            const version = Number(restArgs[0]);
+            if (!packageId || !Number.isInteger(version) || version <= 0) {
+                console.error("Usage: lotics package yank <package_id> <version> [--undo]");
+                process.exit(1);
+            }
+            await packageYank(client, { package_id: packageId, version, undo: flags.undo });
+            return;
+        }
         if (subcommand === "fleet-upgrade") {
             const packageId = toolArgs;
             if (!packageId) {

package/dist/cli_dispatch.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli_dispatch.test.js

@@ -0,0 +1,90 @@
+/**
+ * Dispatch smoke test over the BUILT CLI artifact — every `package` subcommand
+ * must route to its own handler, proven by its usage/refusal line appearing on
+ * a bare invocation. The dispatch in cli.ts is one hand-rolled argv walk with
+ * subcommand names repeated across command families (`doctor` exists in both
+ * `workspace` and `package`) and split positional conventions (`toolArgs` +
+ * `restArgs`), and nothing else tests it: `package yank` shipped dispatched
+ * inside the WORKSPACE family and surfaced only on the first live invocation.
+ *
+ * The fake API key satisfies `requireClient` (client construction is offline);
+ * every asserted path exits before any network call. Spawns run in an empty
+ * temp cwd so path-defaulting subcommands fail on the missing project file —
+ * which equally proves their dispatch reached the right handler.
+ */
+import { beforeAll, describe, expect, it } from "vitest";
+import { execFileSync, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const cliBin = path.join(packageRoot, "dist", "src", "cli.js");
+const emptyCwd = fs.mkdtempSync(path.join(os.tmpdir(), "lotics-cli-dispatch-"));
+function runCli(args) {
+    const result = spawnSync(process.execPath, [cliBin, ...args], {
+        cwd: emptyCwd,
+        env: {
+            ...process.env,
+            LOTICS_API_KEY: "ltk_dispatch_smoke_fake_key_never_used_on_wire",
+            // A pinned (fake) workspace skips the pre-dispatch auto-resolution,
+            // which would otherwise hit the network (`listWorkspaces`) before any
+            // usage gate. Nothing below ever reaches the wire.
+            LOTICS_WORKSPACE: "wsp_dispatch_smoke_fake",
+            LOTICS_ORG: "",
+        },
+        encoding: "utf-8",
+        timeout: 30_000,
+    });
+    return { status: result.status, stderr: result.stderr ?? "" };
+}
+beforeAll(() => {
+    // Bundle the real artifact from src (esbuild only — no tsgo; vitest's
+    // transform already type-agnostic). ~1s.
+    execFileSync(process.execPath, ["scripts/build_cli.mjs"], { cwd: packageRoot });
+}, 120_000);
+describe("lotics package <subcommand> dispatch", () => {
+    // Positional-requiring subcommands: a bare invocation must print the
+    // subcommand's OWN usage line — reaching it proves family routing AND that
+    // the usage gate fires before any network/filesystem work.
+    const usageCases = [
+        ["install", /Usage: lotics package install/],
+        ["uninstall", /Usage: lotics package uninstall/],
+        ["config", /Usage: lotics package config/],
+        ["retire", /Usage: lotics package retire <package_id>/],
+        ["show", /Usage: lotics package show <package_id>/],
+        ["upgrade", /Usage: lotics package upgrade/],
+        ["yank", /Usage: lotics package yank <package_id> <version>/],
+        ["rebind-role", /Usage: lotics package rebind-role/],
+        ["fleet-upgrade", /Usage: lotics package fleet-upgrade/],
+        ["extract", /Usage: lotics package extract/],
+        ["adopt", /Usage: lotics package adopt/],
+        ["new", /Usage: lotics package new/],
+    ];
+    for (const [sub, usage] of usageCases) {
+        it(`routes "package ${sub}" to its handler (usage on missing args)`, () => {
+            const { status, stderr } = runCli(["package", sub]);
+            expect(stderr).toMatch(usage);
+            expect(stderr).not.toMatch(/Unknown package subcommand/);
+            expect(status).toBe(1);
+        });
+    }
+    // Path-defaulting subcommands: in an empty cwd they must fail on the missing
+    // package project — their handler's message, not the dispatcher's. (`sync`
+    // is excluded: it validates the dev workspace over the network BEFORE
+    // reading the project, so it can't be smoke-tested offline.)
+    const projectCases = ["build", "publish"];
+    for (const sub of projectCases) {
+        it(`routes "package ${sub}" to its handler (missing project in empty cwd)`, () => {
+            const { status, stderr } = runCli(["package", sub]);
+            expect(stderr).toMatch(/No package\.json in|not a package project/);
+            expect(stderr).not.toMatch(/Unknown package subcommand/);
+            expect(status).toBe(1);
+        });
+    }
+    it("still rejects a genuinely unknown subcommand", () => {
+        const { status, stderr } = runCli(["package", "frobnicate"]);
+        expect(stderr).toMatch(/Unknown package subcommand/);
+        expect(status).toBe(1);
+    });
+});

package/dist/client.d.ts

@@ -200,6 +200,16 @@ export declare class LoticsClient {
          * through the `context` op for production parity.
          */
         config?: Record<string, string | number | boolean> | null;
+        /** Package registry id this app was installed from; null for a bespoke/ejected app. */
+        package_id?: string | null;
+        /** The installed package version (upgrade pin); null for a bespoke/ejected app. */
+        package_version?: number | null;
+        /**
+         * Package install join — per-namespace alias→id maps (entities/fields/
+         * options/templates/roles) plus the `workflows` artifact registry. Null for
+         * a bespoke app. Used to preview what `package uninstall` will archive.
+         */
+        binding?: Record<string, Record<string, string>> | null;
     }>;
     createApp(body: {
         name: string;
@@ -219,6 +229,7 @@ export declare class LoticsClient {
      */
     installAppPackage(package_id: string, body: {
         version?: number;
+        config?: Record<string, string | number | boolean>;
     }): Promise<{
         id: string;
         name: string;
@@ -227,6 +238,43 @@ export declare class LoticsClient {
         package_version: number | null;
         current_version_id: string | null;
     }>;
+    /**
+     * Uninstall a package installation (backs `lotics package uninstall`). Does
+     * everything DELETE does plus archives the installation's lifecycle
+     * artifacts; with `archive_tables` it also archives the scaffolded entity
+     * tables — refused server-side unless this installation created them
+     * (provenance) and nothing else references them. Admin-only.
+     */
+    uninstallAppPackage(app_id: string, body: {
+        archive_tables: boolean;
+    }): Promise<{
+        id: string;
+        uninstalled: boolean;
+        archived_table_ids: string[];
+    }>;
+    /**
+     * Partial-merge a package installation's config (backs `lotics package config
+     * --set`). Only the provided keys change; validated against the installed
+     * contract. Returns the full effective config. Admin-only.
+     */
+    updateAppPackageConfig(app_id: string, body: {
+        config: Record<string, string | number | boolean>;
+    }): Promise<{
+        config: Record<string, string | number | boolean>;
+    }>;
+    /**
+     * Retire (or `undo` un-retire) a registry package (backs `lotics package
+     * retire`). Retiring refuses NEW installs and hides the package from
+     * non-owning orgs; existing installations keep working and may still upgrade.
+     * Owner-org admin-only.
+     */
+    retireAppPackage(package_id: string, body: {
+        undo: boolean;
+    }): Promise<{
+        id: string;
+        name: string;
+        retired_at: string | null;
+    }>;
     /**
      * Eject an installation from its package — re-deploy the pinned version's
      * source as a workspace-owned app version, then sever the package link
@@ -287,6 +335,17 @@ export declare class LoticsClient {
      * per-installation consent flow. Backs `lotics package fleet-upgrade`.
      * Admin-only; org-scoped (no workspace header needed).
      */
+    /**
+     * Yank / unyank a published package version — refuses NEW installs/upgrades/
+     * adopts targeting it; pinned installations keep running. Owner-org
+     * admin-only. Backs `lotics package yank`.
+     */
+    yankAppPackageVersion(package_id: string, version: number, yanked: boolean): Promise<{
+        package_id: string;
+        version: number;
+        yanked_at: string | null;
+        latest_version: number;
+    }>;
     fleetUpgradeAppPackage(package_id: string, body: {
         version?: number;
     }): Promise<{
@@ -335,9 +394,22 @@ export declare class LoticsClient {
         description: string | null;
         latest_version: number;
         is_official: boolean;
+        retired_at: string | null;
+        /** Absent from a pre-deploy server — treat undefined as not-owned (the badge under-claims, never over-claims). */
+        owned_by_caller?: boolean;
         created_at: string;
         updated_at: string;
     }>;
+    /** Version history newest-first (no contract payloads) — backs `lotics package show`. Admin-only. */
+    listAppPackageVersions(package_id: string): Promise<{
+        versions: Array<{
+            version: number;
+            changelog: string | null;
+            channel: "release" | "dev";
+            yanked_at: string | null;
+            created_at: string;
+        }>;
+    }>;
     /**
      * Publish a new immutable package version — multipart upload of the alias-keyed
      * contract (JSON) + the prebuilt code bundle (a gzipped tarball carrying
@@ -349,6 +421,8 @@ export declare class LoticsClient {
         contract: unknown;
         bundle: Buffer;
         changelog?: string | null;
+        /** 'dev' = dev-loop publish: pinned by the dev installation, never the installable latest. */
+        channel?: "release" | "dev";
     }): Promise<{
         id: string;
         package_id: string;

package/dist/client.js

@@ -212,6 +212,33 @@ export class LoticsClient {
     async installAppPackage(package_id, body) {
         return this.request("POST", `/v1/app-packages/${encodeURIComponent(package_id)}/installations`, body);
     }
+    /**
+     * Uninstall a package installation (backs `lotics package uninstall`). Does
+     * everything DELETE does plus archives the installation's lifecycle
+     * artifacts; with `archive_tables` it also archives the scaffolded entity
+     * tables — refused server-side unless this installation created them
+     * (provenance) and nothing else references them. Admin-only.
+     */
+    async uninstallAppPackage(app_id, body) {
+        return this.request("POST", `/v1/apps/${encodeURIComponent(app_id)}/uninstall`, body);
+    }
+    /**
+     * Partial-merge a package installation's config (backs `lotics package config
+     * --set`). Only the provided keys change; validated against the installed
+     * contract. Returns the full effective config. Admin-only.
+     */
+    async updateAppPackageConfig(app_id, body) {
+        return this.request("PATCH", `/v1/apps/${encodeURIComponent(app_id)}/package-config`, body);
+    }
+    /**
+     * Retire (or `undo` un-retire) a registry package (backs `lotics package
+     * retire`). Retiring refuses NEW installs and hides the package from
+     * non-owning orgs; existing installations keep working and may still upgrade.
+     * Owner-org admin-only.
+     */
+    async retireAppPackage(package_id, body) {
+        return this.request("POST", `/v1/app-packages/${encodeURIComponent(package_id)}/retire`, body);
+    }
     /**
      * Eject an installation from its package — re-deploy the pinned version's
      * source as a workspace-owned app version, then sever the package link
@@ -255,6 +282,14 @@ export class LoticsClient {
      * per-installation consent flow. Backs `lotics package fleet-upgrade`.
      * Admin-only; org-scoped (no workspace header needed).
      */
+    /**
+     * Yank / unyank a published package version — refuses NEW installs/upgrades/
+     * adopts targeting it; pinned installations keep running. Owner-org
+     * admin-only. Backs `lotics package yank`.
+     */
+    async yankAppPackageVersion(package_id, version, yanked) {
+        return this.request("POST", `/v1/app-packages/${encodeURIComponent(package_id)}/versions/${version}/yank`, { yanked });
+    }
     async fleetUpgradeAppPackage(package_id, body) {
         return this.request("POST", `/v1/app-packages/${encodeURIComponent(package_id)}/fleet-upgrade`, body);
     }
@@ -275,6 +310,10 @@ export class LoticsClient {
     async getAppPackage(package_id) {
         return this.request("GET", `/v1/app-packages/${encodeURIComponent(package_id)}`);
     }
+    /** Version history newest-first (no contract payloads) — backs `lotics package show`. Admin-only. */
+    async listAppPackageVersions(package_id) {
+        return this.request("GET", `/v1/app-packages/${encodeURIComponent(package_id)}/versions`);
+    }
     /**
      * Publish a new immutable package version — multipart upload of the alias-keyed
      * contract (JSON) + the prebuilt code bundle (a gzipped tarball carrying
@@ -288,6 +327,8 @@ export class LoticsClient {
         formData.append("bundle", new Blob([new Uint8Array(args.bundle)], { type: "application/gzip" }), "bundle.tar.gz");
         if (args.changelog)
             formData.append("changelog", args.changelog);
+        if (args.channel)
+            formData.append("channel", args.channel);
         const url = `${this.baseUrl}/v1/app-packages/${encodeURIComponent(package_id)}/versions`;
         const response = await fetch(url, {
             method: "POST",

package/dist/package_commands.d.ts

@@ -176,13 +176,50 @@ export declare function packageUpgrade(client: LoticsClient, args: {
     version?: number;
     resolutions: Record<string, UpgradeResolutionValue>;
 }): Promise<void>;
+/**
+ * `lotics package show <package_id>` — registry metadata + version history
+ * (trust badge, retirement, per-version channel/yank/changelog). The read
+ * surface for "what is this package and what shipped when".
+ */
+export declare function packageShow(client: LoticsClient, args: {
+    package_id: string;
+}): Promise<void>;
 export declare function packageInstall(client: LoticsClient, args: {
     package_id: string;
     version?: number;
+    config?: Record<string, string | number | boolean>;
 }): Promise<void>;
 export declare function packageEject(client: LoticsClient, args: {
     app_id: string;
 }): Promise<void>;
+/** `--config key=value` (install): inferred types, server-validated. */
+export declare function parseInstallConfigFlags(config: string[]): Record<string, string | number | boolean>;
+/**
+ * `lotics package config <app_id>` — show the installation's effective config;
+ * with `--set key=value` (repeatable) partial-merge edits, each value parsed by
+ * the knob's current type. No `--set` prints the values.
+ */
+export declare function packageConfig(client: LoticsClient, args: {
+    app_id: string;
+    sets: string[];
+}): Promise<void>;
+/**
+ * `lotics package uninstall <app_id> [--archive-tables]` — remove a package
+ * installation. Prints what will be archived (workflow artifacts, plus the
+ * scaffolded tables when the flag is set), then uninstalls.
+ */
+export declare function packageUninstall(client: LoticsClient, args: {
+    app_id: string;
+    archive_tables: boolean;
+}): Promise<void>;
+/**
+ * `lotics package retire <package_id> [--undo]` — retire (or un-retire) a
+ * registry package. Owner-org admin-only.
+ */
+export declare function packageRetire(client: LoticsClient, args: {
+    package_id: string;
+    undo: boolean;
+}): Promise<void>;
 /**
  * `lotics package extract <app_id> [path]` — promote a bespoke app to a DRAFT
  * package project (docs/app_packages.md § Promotion). Calls the extract read,
@@ -220,6 +257,17 @@ export declare function packageAdopt(client: LoticsClient, args: {
  * installations are reported per line and the process exits 1 so a release
  * script can gate on "fleet fully current".
  */
+/**
+ * `lotics package yank <package_id> <version> [--undo]` — mark a published
+ * version uninstallable (or restore it). New installs/upgrades/adopts refuse a
+ * yanked version and "latest" skips it; installations already pinned keep
+ * running. Owner-org admin-only.
+ */
+export declare function packageYank(client: LoticsClient, args: {
+    package_id: string;
+    version: number;
+    undo: boolean;
+}): Promise<void>;
 export declare function packageFleetUpgrade(client: LoticsClient, args: {
     package_id: string;
     version?: number;