The API

Everything lemonfiber can tell you, it can tell a machine. Every answer arrives in one wrapper — api_version, kind, data — and that wrapper is a stable, versioned interface rather than output that happens to be parsable.

It reaches you two ways. --json on the command line prints it. lemonfiber ui serves it over local HTTP: one read endpoint for each question a command answers, POST /api/actions/<name> for anything that changes something, and GET /api/events as a live stream — all of it behind a token minted for that run, on a socket bound to this machine. --lan offers it to your network instead, and is refused until a password has been set. Both surfaces dispatch through the same entry point, so neither can say something about your stack that the other would not.

The binary carries the web app as well, embedded the way the stack beside it is: a submodule at assets/web, pinned to a built revision, and a build whose two halves speak different wire versions stops rather than shipping. A build told to carry none says so, and lemonfiber ui --assets <dir> serves a directory instead. The shape of the surface is the web API contract; the envelope covers the endpoints, the guard, and what is still missing.

The two SDKs below are written against that contract and generate their types from the same artefact the command line serialises with, so what they parse is what both surfaces already emit.

The envelopeThe three fields every payload arrives in, and the rules a client has to keep.

Every payload kindEvery kind the contract describes, and the six documented field by field.

The TypeScript SDKTyped calls, a typed event stream and a typed error, with no runtime dependencies.

The PHP SDKA peer of the TypeScript client, built on Saloon, with one class per kind.

Two version numbersWhy the package version and the wire version are different numbers doing different jobs.

The shapes are generated and the meanings are not. Fields, types, optionality and permitted enum values come from a contract artefact built out of the Rust types that actually serialise the reply, so no client transcribes them by hand. Everything a schema cannot express — the heartbeat, what a resumed stream may claim is current, where the token travels — is prose in the contract, and every client implements and tests it.

Where to go next

If you are writing a script rather than a client, the global flags covers --json and the commands covers what you can ask for. If you are building against the boundary itself, the architecture notes explain how the core is put together behind it.