Croft

Provisions an empty app on this workspace: a git repo, subdomain, port, and golden-path scaffold files. It contains no feature implementation and is not yet live.

Permanently deletes an app: removes its containers, data, and source code from the server, then deletes the app record. Irreversible. Does not affect other apps or the server. Deletes only when confirm is true.

Commits, builds (Nixpacks), and deploys the app. Returns a deploy job id; the build runs in the background and its deploy_state moves through queued and running before it ends in succeeded or failed. The app is live only once the deploy has succeeded.

Returns a connector's full manifest — base URL, auth style, and the named operations (method, path, params) an app can call. Never returns the credential.

Get an app's file manifest, recent releases, and secret key names.

Return the Croft golden-path rules that every app on this workspace must follow.

Grant an existing user access to an app.

Gives one of your apps access to a connector. The app can then call the connector's operations. Note: this lets the app's code, and everyone the app is shared with, use the connector's credential. A connector an admin has marked admins-only can only be granted by an admin. Some connectors require admin approval: when a creator grants one of those, the grant is created as 'requested' and an owner/admin must approve it (they're emailed) before the app can use it — owners/admins granting it are approved automatically.

Invite someone by email, set their workspace role, and grant app access. role is member (use apps), creator (can build their own apps), or admin. apps is 'all' or a list of app names.

List the apps in this workspace with their URLs, status, and last release.

Lists the workspace's API connectors (external services apps can call without holding the credential) and their state. `active` connectors are usable; `draft` ones still need a workspace admin to add the credential.

Lists the connectors an app can reach and each grant's state.

List an app's secret key names (never values).

List the people in this workspace and which apps they can access.

Recent runtime logs for an app (relayed from its box).

Creates a new API connector as a DRAFT from the vendor's API docs: you supply the base URL, auth style, and an operations manifest. A workspace member (owner, admin, or creator) then opens the panel and adds the credential to activate it — the credential never passes through you. auth_style is bearer|header|query|basic; for header/query also give auth_param (the header/param name).

Read one file from an app's own git repo on this Croft workspace. No external API — the path is resolved inside the app's repository.

For an app that has PUBLIC routes: request permission for it to use protected resources (its granted connectors AND other apps' shared data). Public apps are blocked from these by default so a public page can't leak workspace data. If you (the caller) are an owner or admin, this is granted immediately; if you're a creator it creates a request that an owner/admin approves (they're emailed). Call this when building a public app that also needs a connector or shared data.

Revoke a user's access to an app.

Re-deploy the previous release of an app.

Turns this app's database sharing on or off. Off by default (the database is private). When on, other apps in the same workspace may read AND write this app's SQLite database through Croft's internal broker at http://croft-data:8080/q/<this-app-name> (send {"sql":"…","params":[…]}), and this app is listed to other apps as reusable shared data. By default apps that have PUBLIC routes cannot read this shared data (a leak guard); an owner/admin can pass allow_public: true to let public apps read it too. Turn sharing on for an app whose data other apps should reuse — e.g. a CRM's contacts list that an invoicing app also needs.

Sets which of an app's paths are reachable WITHOUT login. By default an app is fully private (workspace login required everywhere). Pass the complete desired list of specific paths (e.g. ["/survey"]); each listed path and everything under it becomes public, everything else stays private. An empty list makes the app fully private again. The whole app cannot be made public — root or wildcard paths are rejected.

Sets the app's scheduled tasks. Each is { name, cron, path }: on the cron (standard 5-field, UTC) Croft makes an internal POST to the app's path, and the app does the work (e.g. send a daily email, sync an API). Use this for anything recurring instead of writing your own cron — it survives deploys and reboots and is shown in the panel. Also implement the endpoint (e.g. a POST route at that path). Pass the full desired list; an empty list clears all schedules.

Set (or replace) an env secret for an app. Value is stored encrypted and injected at deploy.

Reports an app's deploy and health status. `live` is true only when the latest deploy has fully succeeded; `deploy_state` gives the current stage (queued, running, succeeded, or failed). Read-only and safe to call repeatedly — each call returns the current stage, so it can be polled to follow a deploy's progress.

Writes files into an app's git repo and commits them (as 'Claude via Croft'). files is a list of {path, content}. Committed files are staged in the repo; they are not built or published until the app is deployed.