@lunnoa/client 1.5.0 → 2.1.0

package/README.md

@@ -7,7 +7,7 @@ TypeScript SDK for building applications **on top of** [Lunnoa Automate](https:/
 
 ## What is this?
 
-`@lunnoa/client` is the official consumption SDK for the Lunnoa Automate **Public API**: a typed client for agents and chat (with SSE streaming), workflows and executions, entities (Objects), knowledge, queues, variables, connections, and projects — plus a codegen command that types the SDK against **your** deployment's entity types, workflows, and agents.
+`@lunnoa/client` is the official consumption SDK for the Lunnoa Automate **Public API**: a typed client for agents and chat (with SSE streaming), workflows and executions, entities (Objects), knowledge, queues, variables, and connections — plus a codegen command that types the SDK against **your** deployment's entity types, workflows, and agents.
 
 **The boundary with the other Lunnoa SDK:** [`@lunnoa/toolkit`](https://github.com/lunnoa-automate/lunnoa_toolkit) is for building integration apps that run *inside* the platform (`createAction` / `createApp`); **`@lunnoa/client` is for building applications *on top of* the platform** — including `define*` factories, `runs.start`, and CLI deploy of workflows/agents.
 
@@ -27,49 +27,17 @@ npm install @lunnoa/client
 npx @lunnoa/client init my-app --url https://lunnoa.your-company.example
 ```
 
-Scaffolds the [lunnoa-starter](https://github.com/lunnoa-automate/lunnoa-starter) Next.js template (thin, Docker-deployable, both auth patterns behind `LUNNOA_AUTH_MODE`) and writes `.env`, prompting for an API key when run interactively. `--template <owner/repo[#ref]|./local-folder>` overrides the source. Then `npm install` and open the folder in Claude Code / Cursor / Codex.
+Scaffolds the [lunnoa-starter](https://github.com/lunnoa-automate/lunnoa-starter) Next.js template (thin, Docker-deployable, Lunnoa user login) and writes `.env`, prompting for an API key for CLI commands when run interactively. `--template <owner/repo[#ref]|./local-folder>` overrides the source. Then `npm install` and open the folder in Claude Code / Cursor / Codex.
 
 ## Quickstart
 
 ```typescript
-import { LunnoaClient } from '@lunnoa/client';
+import { createBrowserClient, isLoginRequires2FA } from '@lunnoa/client';
 
-const lunnoa = new LunnoaClient({
+const lunnoa = createBrowserClient({
   baseUrl: 'https://lunnoa.your-company.example',
-  apiKey: process.env.LUNNOA_API_KEY, // lna_... — server-side only
 });
 
-const { data: invoices } = await lunnoa.entities.list({
-  objectTypeSlug: 'invoice',
-  state: 'pending',
-  expansion: ['attributes'],
-});
-```
-
-A SuperAdmin creates API keys in **Adminspace → API keys**, choosing the workspace and an RBAC role for the key's service account. The role is the key's entire capability model — grant the minimum permission set, not Admin.
-
-## Two auth patterns
-
-| Pattern | Credential | Where |
-|---|---|---|
-| **A. Backend holds the key** | `apiKey: 'lna_...'` via `createServerClient` | Your server, background jobs, server-rendered pages. The key acts as a workspace-scoped service account. |
-| **B. End users are Lunnoa users** | User JWT via `createBrowserClient` + `lunnoa.auth.*` | Browser apps. Login, 2FA, refresh, and SSO discovery are wrapped; per-user permissions apply. |
-
-```typescript
-import {
-  createBrowserClient,
-  createServerClient,
-  isLoginRequires2FA,
-} from '@lunnoa/client';
-
-// Pattern A — server-side
-const server = createServerClient({
-  baseUrl,
-  apiKey: process.env.LUNNOA_API_KEY!,
-});
-
-// Pattern B — browser (tokens in localStorage by default; auto-refresh on 401)
-const lunnoa = createBrowserClient({ baseUrl });
 const result = await lunnoa.auth.login({ email, password });
 if (isLoginRequires2FA(result)) {
   await lunnoa.auth.verify2faLogin({
@@ -77,12 +45,17 @@ if (isLoginRequires2FA(result)) {
     token: totpCode,
   });
 }
-const me = await lunnoa.auth.me();
+
+const { data: invoices } = await lunnoa.entities.list({
+  objectTypeSlug: 'invoice',
+  state: 'pending',
+  expansion: ['attributes'],
+});
 ```
 
-**API keys never ship to browsers.** The SDK enforces this: constructing a client with an `lna_` key while `window` exists throws immediately. Browser apps either use Pattern B or call your own backend, which holds the key (backend-for-frontend).
+People using the app sign in as Lunnoa users (invite, SSO, or SCIM). Their permissions apply. The deployment must allow your origin via `CORS_ALLOWED_ORIGINS`.
 
-For Pattern B the deployment must allow your origin via its `CORS_ALLOWED_ORIGINS` configuration. See the Authentication guide under `guides/develop/client/auth` in Lunnoa Docs for SSO redirect constraints and token stores.
+`lna_...` API keys are for the CLI (discovery, codegen, deploy), not for the app session. A SuperAdmin creates them in **Adminspace → API keys**, with a minimal RBAC role. The SDK throws if an `lna_` key is used while `window` exists. See the Authentication guide under `guides/develop/client/auth` in Lunnoa Docs for SSO redirect constraints and token stores.
 
 ### React (optional)
 
@@ -117,7 +90,7 @@ Peer: `react` ≥ 18 (required for `/react`). `@ai-sdk/react` (behind `useAgentC
 
 Most namespaces map to the Public API surface (`openapi.public.json`):
 
-`auth` · `agents` · `tasks` · `agentChat` (SSE streaming) · `workflows` · `executions` · `actions` · `entities` · `entityTypes` · `knowledge` · `queues` · `queueItems` · `variables` · `connections` · `projects` · `workflowApps` · `discovery`
+`auth` · `agents` · `tasks` · `agentChat` (SSE streaming) · `workflows` · `executions` · `actions` · `entities` · `entityTypes` · `knowledge` · `queues` · `queueItems` · `variables` · `connections` · `workflowApps` · `discovery`
 
 `approvals` uses the authenticated **workspace** API (`/api/approvals/...`), not Public API v1. The inbox is filtered to requests where the current user is an eligible approver.
 
@@ -253,10 +226,10 @@ npx @lunnoa/client codegen --url https://lunnoa.your-company.example --api-key l
 This writes `lunnoa.generated.ts`:
 
 ```typescript
-import { LunnoaClient } from '@lunnoa/client';
+import { createBrowserClient } from '@lunnoa/client';
 import { createDeploymentClient } from './lunnoa/lunnoa.generated';
 
-const lunnoa = createDeploymentClient(new LunnoaClient({ baseUrl, apiKey }));
+const lunnoa = createDeploymentClient(createBrowserClient({ baseUrl }));
 
 // Entity attributes and states are compile-time checked:
 const open = await lunnoa.entities.invoice.list({ state: 'pending' });
@@ -276,7 +249,7 @@ Re-run codegen whenever entity types, workflows, or agents change on the deploym
 
 ## Define, run, and CLI deploy
 
-Author local definitions with `defineWorkflow` / `defineAgent` / `defineEntityType`, run linear chains with `lunnoa.runs.start`, and upsert with the CLI (prefer CLI over calling upsert from app code). An entity type slug is unique on the deployment. Deploy grants that type to the API key's workspace when the slug is new, and will not rewrite a type already granted to other workspaces (no `--project-id`). Instance writes reject unknown attribute keys unless `allowUnknownAttributes` is true — use the reserved `extensions` object for flexible bags:
+Author local definitions with `defineWorkflow` / `defineAgent` / `defineEntityType`, run linear chains with `lunnoa.runs.start`, and upsert with the CLI (prefer CLI over calling upsert from app code). Agent and workflow upsert is by slug inside the workspace on the API key. An entity type slug is unique on the deployment. Deploy grants that type to the API key's workspace when the slug is new, and will not rewrite a type already granted to other workspaces. Instance writes reject unknown attribute keys unless `allowUnknownAttributes` is true — use the reserved `extensions` object for flexible bags:
 
 ```bash
 npx @lunnoa/client entity-types deploy ./human.ts --url https://lunnoa.example --api-key lna_...
@@ -286,9 +259,9 @@ Workflows and agents:
 
 ```bash
 npx @lunnoa/client workflows deploy ./workflows/sync-orders.ts \
-  --url https://lunnoa.example --api-key lna_... --project-id <uuid>
+  --url https://lunnoa.example --api-key lna_...
 npx @lunnoa/client agents deploy ./agents/triage.ts \
-  --url https://lunnoa.example --api-key lna_... --project-id <uuid>
+  --url https://lunnoa.example --api-key lna_...
 ```
 
 `defineAction` binds catalogue actions only; toolkit `createAction` is for in-platform apps. See Lunnoa Docs under `guides/develop/client/define`, `runs`, and `cli-deploy`.
@@ -307,7 +280,6 @@ npx @lunnoa/client connections list --app gmail --json
 npx @lunnoa/client agents list --json
 npx @lunnoa/client workflows list --json
 npx @lunnoa/client entity-types list --json
-npx @lunnoa/client projects list --json
 npx @lunnoa/client features --json
 ```
 
@@ -338,7 +310,7 @@ Partner paste block:
 
 ```text
 Use @lunnoa/client skills: lunnoa-solution-design then lunnoa-client.
-LUNNOA_URL=… LUNNOA_API_KEY=lna_… (server only). Project ID=…
+LUNNOA_URL=… LUNNOA_API_KEY=lna_… (server only).
 Start by interviewing me, then workflowApps.list() / codegen.
 ```
 

package/dist/cli.js

@@ -12,7 +12,7 @@ function isBrowserEnvironment() {
 function assertApiKeyAllowedInEnvironment(apiKey) {
   if (isBrowserEnvironment()) {
     throw new Error(
-      "Refusing to use a Lunnoa API key (lna_...) in a browser environment. API keys are server-side credentials: anyone opening dev tools could read the key and act as the service account across its whole workspace. Either call the Lunnoa API from your own backend which holds the key (backend-for-frontend pattern), or authenticate the end user with a Lunnoa user JWT and pass it as `accessToken`."
+      "Refusing to use a Lunnoa API key (lna_...) in a browser environment. API keys are for the CLI and operator scripts, not for app login. Anyone opening dev tools could read the key and act as the service account across its whole workspace. Sign the end user in with lunnoa.auth.login and pass their JWT as `accessToken`."
     );
   }
   if (!apiKey.startsWith(API_KEY_PREFIX)) {
@@ -94,7 +94,7 @@ var HttpClient = class {
     }
     if (!options.apiKey && !options.accessToken && !options.tokenStore) {
       throw new Error(
-        "LunnoaClient requires an apiKey (server-side), an accessToken (user JWT), or a tokenStore (Pattern B)."
+        "LunnoaClient requires an accessToken or tokenStore (Lunnoa user JWT), or an apiKey for operator scripts."
       );
     }
     if (options.apiKey) {
@@ -661,12 +661,12 @@ var AgentsResource = class {
     });
   }
   /**
-   * Upsert an agent by project-scoped slug.
+   * Upsert an agent by slug inside the workspace on the API key.
    * Prefer the CLI (`npx @lunnoa/client agents deploy`) for happy-path deploy.
    */
-  upsertBySlug(projectId, body, options) {
+  upsertBySlug(body, options) {
     const payload = "kind" in body && body.kind === "agent" ? agentDefinitionToUpsert(body, options) : body;
-    return this.http.post(`/api/projects/${projectId}/agents/upsert`, {
+    return this.http.post("/api/agents/upsert", {
       body: payload
     });
   }
@@ -1090,10 +1090,8 @@ var TablesResource = class {
   }
   http;
   /** Lists tables in the API key's workspace (without columns and rows). */
-  list(options = {}) {
-    return this.http.get("/api/tables", {
-      query: { projectId: options.projectId }
-    });
+  list() {
+    return this.http.get("/api/tables");
   }
   /** Returns a single table by ID, including columns and rows. */
   get(id) {
@@ -1513,30 +1511,6 @@ var KnowledgeResource = class {
   }
 };
 
-// src/resources/projects.ts
-var ProjectsResource = class {
-  constructor(http) {
-    this.http = http;
-  }
-  http;
-  /** Lists projects in the workspace, most recently updated first. */
-  list(options) {
-    return this.http.get("/api/projects", {
-      query: serializeListQuery(options)
-    });
-  }
-  /** Returns a single project. */
-  get(projectId, options) {
-    return this.http.get(`/api/projects/${projectId}`, {
-      query: serializeListQuery(options)
-    });
-  }
-  /** Creates a project. */
-  create(data) {
-    return this.http.post("/api/projects", { body: data });
-  }
-};
-
 // src/resources/queue-items.ts
 var QueueItemsResource = class {
   constructor(http) {
@@ -1816,7 +1790,7 @@ var RunsResource = class {
    * Start a linear multi-step ad-hoc Execution.
    *
    * Accepts a `defineWorkflow` result, a step array, or an explicit
-   * `{ steps, projectId?, name? }` payload.
+   * `{ steps, name? }` payload.
    */
   start(input) {
     const options = normalizeStartRunInput(input);
@@ -2034,15 +2008,14 @@ var WorkflowsResource = class {
     });
   }
   /**
-   * Upsert a workflow by project-scoped slug from a linear step list.
+   * Upsert a workflow by slug inside the workspace on the API key.
    * Prefer the CLI (`npx @lunnoa/client workflows deploy`) for happy-path deploy.
    */
-  upsertBySlug(projectId, body) {
+  upsertBySlug(body) {
     const payload = "kind" in body && body.kind === "workflow" ? workflowDefinitionToUpsert(body) : body;
-    return this.http.post(
-      `/api/projects/${projectId}/workflows/upsert`,
-      { body: payload }
-    );
+    return this.http.post("/api/workflows/upsert", {
+      body: payload
+    });
   }
   /**
    * Starts a new execution of the workflow with the given trigger inputs.
@@ -2077,7 +2050,7 @@ var WorkflowsResource = class {
 var LunnoaClient = class {
   /** The underlying HTTP layer, exposed for advanced/escape-hatch requests. */
   http;
-  /** Login, refresh, SSO discovery, and session helpers (Pattern B). */
+  /** Login, refresh, SSO discovery, and session helpers for Lunnoa users. */
   auth;
   agents;
   tasks;
@@ -2104,7 +2077,6 @@ var LunnoaClient = class {
   variables;
   scorecards;
   connections;
-  projects;
   workflowApps;
   discovery;
   constructor(options) {
@@ -2128,7 +2100,6 @@ var LunnoaClient = class {
     this.variables = new VariablesResource(this.http);
     this.scorecards = new ScorecardsResource(this.http);
     this.connections = new ConnectionsResource(this.http);
-    this.projects = new ProjectsResource(this.http);
     this.discovery = new DiscoveryResource(this.http);
   }
 };
@@ -2142,14 +2113,12 @@ var GROUPS_WITH_SUBCOMMAND = /* @__PURE__ */ new Set([
   "tools",
   "apps",
   "connections",
-  "projects",
   "skills"
 ]);
 var VALUE_FLAGS = /* @__PURE__ */ new Set([
   "--url",
   "--api-key",
   "--access-token",
-  "--project-id",
   "--out",
   "--app",
   "--template"
@@ -2206,9 +2175,6 @@ function parseArgs(argv) {
         case "--access-token":
           args.accessToken = value;
           break;
-        case "--project-id":
-          args.projectId = value;
-          break;
         case "--out":
           args.out = value;
           break;
@@ -2249,12 +2215,11 @@ var USAGE = `Usage:
   npx @lunnoa/client entity-types list [--json]
   npx @lunnoa/client tables list [--json]
   npx @lunnoa/client tables get <slugOrId> [--json]
-  npx @lunnoa/client projects list [--json]
   npx @lunnoa/client features [--json]
 
-  Deploy (upsert by slug):
-  npx @lunnoa/client workflows deploy <path> --url <url> --api-key <key> --project-id <uuid>
-  npx @lunnoa/client agents deploy <path> --url <url> --api-key <key> --project-id <uuid>
+  Deploy (upsert by slug inside the workspace on the API key):
+  npx @lunnoa/client workflows deploy <path> --url <url> --api-key <key>
+  npx @lunnoa/client agents deploy <path> --url <url> --api-key <key>
   npx @lunnoa/client entity-types deploy <path> --url <url> --api-key <key>
 
   Agent skills (copies this version's skills into .claude/skills and .cursor/skills):
@@ -2264,7 +2229,6 @@ Options:
   --url           Base URL of the Lunnoa Automate deployment
   --api-key       Machine API key (lna_...)
   --access-token  User JWT as an alternative to --api-key
-  --project-id    Project UUID (required for workflow/agent deploy)
   --out           Output directory for lunnoa.generated.ts (codegen; default: ./src/lunnoa)
   --app           Restrict tools/connections to one workflow app id
   --for-agent     Only catalogue entries with availableForAgent
@@ -2272,12 +2236,12 @@ Options:
   --json          Machine-readable JSON (preferred for coding agents)
   --help          Show this help
 
-Environment: LUNNOA_URL, LUNNOA_API_KEY, LUNNOA_PROJECT_ID (also read from ./.env)
+Environment: LUNNOA_URL, LUNNOA_API_KEY (also read from ./.env)
 Optional config file: lunnoa.config.ts | .mjs | .js | .json
 
 tools get prints inputConfig and a defineAction() sketch. tools list is compact;
-run tools get for the schema. Entity-type deploy uses a deployment-wide slug
-and grants the API key's workspace when the slug is new (no --project-id).
+run tools get for the schema. An entity-type slug is unique on the deployment
+and grants the API key's workspace when the slug is new.
 A slug already granted to other workspaces is not rewritten. Unknown instance attributes are rejected unless
 allowUnknownAttributes is true; use extensions.
 `;
@@ -2750,7 +2714,7 @@ async function runEntityTypesList(client, args) {
   ]);
 }
 async function runTablesList(client, args) {
-  const tables = await client.tables.list({ projectId: args.projectId });
+  const tables = await client.tables.list();
   const rows = tables.map((table) => ({
     id: table.id,
     slug: table.slug,
@@ -2782,28 +2746,6 @@ async function runTablesGet(client, args) {
   console.log(`columns: ${(table.columns ?? []).map((c) => c.key).join(", ")}`);
   console.log(`rows:    ${table.rows?.length ?? 0}`);
 }
-async function runProjectsList(client, args) {
-  const projects = await client.projects.list({
-    expansion: ["description", "countAgents", "countWorkflows"]
-  });
-  const rows = projects.map((project) => ({
-    id: project.id,
-    name: project.name,
-    description: project.description ?? "",
-    agents: project._count?.agents ?? "",
-    workflows: project._count?.workflows ?? ""
-  }));
-  if (args.json) {
-    printJson(rows);
-    return;
-  }
-  printTable(rows, [
-    { key: "id", header: "ID" },
-    { key: "name", header: "NAME" },
-    { key: "agents", header: "AGENTS" },
-    { key: "workflows", header: "WORKFLOWS" }
-  ]);
-}
 async function runFeatures(client, args) {
   const features = await client.discovery.enabledFeatures();
   if (args.json) {
@@ -3084,7 +3026,7 @@ function generateFactory(entityEntries, workflowEntries, agentEntries) {
  * entity types, workflows, and agents.
  *
  * \`\`\`ts
- * const lunnoa = createDeploymentClient(new LunnoaClient({ baseUrl, apiKey }));
+ * const lunnoa = createDeploymentClient(createBrowserClient({ baseUrl }));
  * const open = await lunnoa.entities.invoice.list({ state: 'pending' });
  * \`\`\`
  */
@@ -3298,14 +3240,14 @@ async function loadOptionalConfig() {
     if (name.endsWith(".json")) {
       const { readFile: readFile2 } = await import("fs/promises");
       const raw = await readFile2(absolute, "utf8");
-      return JSON.parse(raw);
+      const cfg2 = JSON.parse(raw);
+      return { url: cfg2.url, apiKey: cfg2.apiKey };
     }
     const mod = await import(pathToFileURL(absolute).href);
     const cfg = mod.default ?? mod;
     return {
       url: cfg.url,
-      apiKey: cfg.apiKey,
-      projectId: cfg.projectId
+      apiKey: cfg.apiKey
     };
   }
   return {};
@@ -3329,6 +3271,13 @@ function setEnvValues(source, values) {
   }
   return out;
 }
+function dropRetiredProjectEnv(source) {
+  const body = source.split("\n").filter(
+    (line) => !line.includes("LUNNOA_PROJECT_ID") && !line.includes("projects list") && !/Project UUID/i.test(line)
+  ).join("\n").replace(/\n{3,}/g, "\n\n").replace(/\n+$/, "");
+  return body.length ? `${body}
+` : "";
+}
 async function isDirectory(path) {
   return (await stat(path).catch(() => void 0))?.isDirectory() ?? false;
 }
@@ -3379,13 +3328,16 @@ async function runInit(args) {
   if (process.stdin.isTTY && (!url || !apiKey)) {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     url ||= (await rl.question("Lunnoa URL (e.g. https://lunnoa.your-company.example): ")).trim();
-    apiKey ||= (await rl.question("API key lna_... (server-side only; Enter to skip and sign in as a user instead): ")).trim();
+    apiKey ||= (await rl.question("API key lna_... (CLI only: discovery, codegen, deploy. Enter to skip): ")).trim();
     rl.close();
   }
   const example = await readFile(join(dest, ".env.example"), "utf8").catch(() => "");
   await writeFile(
     join(dest, ".env"),
-    setEnvValues(example, { LUNNOA_URL: url, LUNNOA_API_KEY: apiKey }),
+    setEnvValues(dropRetiredProjectEnv(example), {
+      LUNNOA_URL: url,
+      LUNNOA_API_KEY: apiKey
+    }),
     "utf8"
   );
   console.log(`
@@ -3395,7 +3347,7 @@ Next steps:`);
   console.log(`  cd ${args.path}`);
   console.log("  npm install");
   if (!apiKey) {
-    console.log("  Add LUNNOA_API_KEY to .env, or set LUNNOA_AUTH_MODE=user to sign in with your Lunnoa account");
+    console.log("  The app signs people in as Lunnoa users. Add LUNNOA_API_KEY to .env when you want CLI discovery and deploy");
   }
   console.log("  npm run dev");
   console.log("  Open the folder in Claude Code / Cursor / Codex and describe your idea.");
@@ -3427,7 +3379,6 @@ async function bindClient(args) {
   const url = args.url ?? process.env.LUNNOA_URL ?? fileConfig.url;
   const apiKey = args.apiKey ?? process.env.LUNNOA_API_KEY ?? fileConfig.apiKey;
   const accessToken = args.accessToken;
-  const projectId = args.projectId ?? process.env.LUNNOA_PROJECT_ID ?? fileConfig.projectId;
   if (!url) {
     throw new Error("Missing --url (or LUNNOA_URL / lunnoa.config).");
   }
@@ -3438,7 +3389,6 @@ async function bindClient(args) {
   }
   return {
     client: new LunnoaClient({ baseUrl: url, apiKey, accessToken }),
-    projectId,
     url
   };
 }
@@ -3486,29 +3436,19 @@ async function deployWorkflow(args) {
   if (!args.path) {
     throw new Error("Missing definition path. Example: workflows deploy ./workflow.ts");
   }
-  const { client, projectId } = await bindClient(args);
-  if (!projectId) {
-    throw new Error(
-      "Missing --project-id (or LUNNOA_PROJECT_ID / lunnoa.config)."
-    );
-  }
+  const { client } = await bindClient(args);
   const mod = await loadDefinitionModule(args.path);
   const def = pickWorkflowDefinition(mod);
   const payload = workflowDefinitionToUpsert(def);
-  console.log(`Deploying workflow slug="${payload.slug}" to project ${projectId} ...`);
-  const result = await client.workflows.upsertBySlug(projectId, payload);
+  console.log(`Deploying workflow slug="${payload.slug}" ...`);
+  const result = await client.workflows.upsertBySlug(payload);
   console.log(`Upserted workflow ${result.id} (${payload.slug})`);
 }
 async function deployAgent(args) {
   if (!args.path) {
     throw new Error("Missing definition path. Example: agents deploy ./agent.ts");
   }
-  const { client, projectId } = await bindClient(args);
-  if (!projectId) {
-    throw new Error(
-      "Missing --project-id (or LUNNOA_PROJECT_ID / lunnoa.config)."
-    );
-  }
+  const { client } = await bindClient(args);
   const mod = await loadDefinitionModule(args.path);
   const def = pickAgentDefinition(mod);
   const workflowIds = [];
@@ -3517,7 +3457,6 @@ async function deployAgent(args) {
     if (unwrapped && typeof unwrapped === "object" && unwrapped.kind === DEFINE_KINDS.workflow) {
       const wf = unwrapped;
       const upserted = await client.workflows.upsertBySlug(
-        projectId,
         workflowDefinitionToUpsert(wf)
       );
       if (upserted.id) {
@@ -3527,8 +3466,8 @@ async function deployAgent(args) {
     }
   }
   const payload = agentDefinitionToUpsert(def, { workflowIds });
-  console.log(`Deploying agent slug="${payload.slug}" to project ${projectId} ...`);
-  const result = await client.agents.upsertBySlug(projectId, payload);
+  console.log(`Deploying agent slug="${payload.slug}" ...`);
+  const result = await client.agents.upsertBySlug(payload);
   console.log(`Upserted agent ${result.id} (${payload.slug})`);
 }
 async function deployEntityType(args) {
@@ -3552,8 +3491,7 @@ var DISCOVERY_SUBCOMMANDS = {
   apps: ["list", "get"],
   connections: ["list", "get"],
   tables: ["list", "get"],
-  features: void 0,
-  projects: ["list"]
+  features: void 0
 };
 function isDiscoveryCommand(args) {
   const { command, subcommand } = args;
@@ -3563,9 +3501,6 @@ function isDiscoveryCommand(args) {
   if (command === "features") {
     return true;
   }
-  if (command === "projects" && (subcommand === "list" || !subcommand)) {
-    return true;
-  }
   if ((command === "agents" || command === "workflows" || command === "entity-types") && subcommand === "list") {
     return true;
   }
@@ -3643,10 +3578,6 @@ async function runDiscovery(args) {
     await runTablesGet(client, args);
     return true;
   }
-  if (command === "projects" && (subcommand === "list" || !subcommand)) {
-    await runProjectsList(client, args);
-    return true;
-  }
   if (command === "features") {
     await runFeatures(client, args);
     return true;

package/dist/index.cjs

@@ -8,7 +8,7 @@ function isBrowserEnvironment() {
 function assertApiKeyAllowedInEnvironment(apiKey) {
   if (isBrowserEnvironment()) {
     throw new Error(
-      "Refusing to use a Lunnoa API key (lna_...) in a browser environment. API keys are server-side credentials: anyone opening dev tools could read the key and act as the service account across its whole workspace. Either call the Lunnoa API from your own backend which holds the key (backend-for-frontend pattern), or authenticate the end user with a Lunnoa user JWT and pass it as `accessToken`."
+      "Refusing to use a Lunnoa API key (lna_...) in a browser environment. API keys are for the CLI and operator scripts, not for app login. Anyone opening dev tools could read the key and act as the service account across its whole workspace. Sign the end user in with lunnoa.auth.login and pass their JWT as `accessToken`."
     );
   }
   if (!apiKey.startsWith(API_KEY_PREFIX)) {
@@ -90,7 +90,7 @@ var HttpClient = class {
     }
     if (!options.apiKey && !options.accessToken && !options.tokenStore) {
       throw new Error(
-        "LunnoaClient requires an apiKey (server-side), an accessToken (user JWT), or a tokenStore (Pattern B)."
+        "LunnoaClient requires an accessToken or tokenStore (Lunnoa user JWT), or an apiKey for operator scripts."
       );
     }
     if (options.apiKey) {
@@ -703,12 +703,12 @@ var AgentsResource = class {
     });
   }
   /**
-   * Upsert an agent by project-scoped slug.
+   * Upsert an agent by slug inside the workspace on the API key.
    * Prefer the CLI (`npx @lunnoa/client agents deploy`) for happy-path deploy.
    */
-  upsertBySlug(projectId, body, options) {
+  upsertBySlug(body, options) {
     const payload = "kind" in body && body.kind === "agent" ? agentDefinitionToUpsert(body, options) : body;
-    return this.http.post(`/api/projects/${projectId}/agents/upsert`, {
+    return this.http.post("/api/agents/upsert", {
       body: payload
     });
   }
@@ -1132,10 +1132,8 @@ var TablesResource = class {
   }
   http;
   /** Lists tables in the API key's workspace (without columns and rows). */
-  list(options = {}) {
-    return this.http.get("/api/tables", {
-      query: { projectId: options.projectId }
-    });
+  list() {
+    return this.http.get("/api/tables");
   }
   /** Returns a single table by ID, including columns and rows. */
   get(id) {
@@ -1555,30 +1553,6 @@ var KnowledgeResource = class {
   }
 };
 
-// src/resources/projects.ts
-var ProjectsResource = class {
-  constructor(http) {
-    this.http = http;
-  }
-  http;
-  /** Lists projects in the workspace, most recently updated first. */
-  list(options) {
-    return this.http.get("/api/projects", {
-      query: serializeListQuery(options)
-    });
-  }
-  /** Returns a single project. */
-  get(projectId, options) {
-    return this.http.get(`/api/projects/${projectId}`, {
-      query: serializeListQuery(options)
-    });
-  }
-  /** Creates a project. */
-  create(data) {
-    return this.http.post("/api/projects", { body: data });
-  }
-};
-
 // src/resources/queue-items.ts
 var QueueItemsResource = class {
   constructor(http) {
@@ -1858,7 +1832,7 @@ var RunsResource = class {
    * Start a linear multi-step ad-hoc Execution.
    *
    * Accepts a `defineWorkflow` result, a step array, or an explicit
-   * `{ steps, projectId?, name? }` payload.
+   * `{ steps, name? }` payload.
    */
   start(input) {
     const options = normalizeStartRunInput(input);
@@ -2076,15 +2050,14 @@ var WorkflowsResource = class {
     });
   }
   /**
-   * Upsert a workflow by project-scoped slug from a linear step list.
+   * Upsert a workflow by slug inside the workspace on the API key.
    * Prefer the CLI (`npx @lunnoa/client workflows deploy`) for happy-path deploy.
    */
-  upsertBySlug(projectId, body) {
+  upsertBySlug(body) {
     const payload = "kind" in body && body.kind === "workflow" ? workflowDefinitionToUpsert(body) : body;
-    return this.http.post(
-      `/api/projects/${projectId}/workflows/upsert`,
-      { body: payload }
-    );
+    return this.http.post("/api/workflows/upsert", {
+      body: payload
+    });
   }
   /**
    * Starts a new execution of the workflow with the given trigger inputs.
@@ -2119,7 +2092,7 @@ var WorkflowsResource = class {
 var LunnoaClient = class {
   /** The underlying HTTP layer, exposed for advanced/escape-hatch requests. */
   http;
-  /** Login, refresh, SSO discovery, and session helpers (Pattern B). */
+  /** Login, refresh, SSO discovery, and session helpers for Lunnoa users. */
   auth;
   agents;
   tasks;
@@ -2146,7 +2119,6 @@ var LunnoaClient = class {
   variables;
   scorecards;
   connections;
-  projects;
   workflowApps;
   discovery;
   constructor(options) {
@@ -2170,7 +2142,6 @@ var LunnoaClient = class {
     this.variables = new VariablesResource(this.http);
     this.scorecards = new ScorecardsResource(this.http);
     this.connections = new ConnectionsResource(this.http);
-    this.projects = new ProjectsResource(this.http);
     this.discovery = new DiscoveryResource(this.http);
   }
 };
@@ -2266,7 +2237,6 @@ exports.HttpClient = HttpClient;
 exports.KnowledgeResource = KnowledgeResource;
 exports.LunnoaApiError = LunnoaApiError;
 exports.LunnoaClient = LunnoaClient;
-exports.ProjectsResource = ProjectsResource;
 exports.QueueItemsResource = QueueItemsResource;
 exports.QueuesResource = QueuesResource;
 exports.RunsResource = RunsResource;