Edits an app's draft: writes files into a temporary running copy of the app and returns dev_url, WITHOUT a commit or a build. Use it on managed apps with draft runtimes: static, vite, react, vue, svelte, sveltekit, remix, nextjs, astro, nuxt, angular, gatsby, fastapi, flask, django, node, and configured sanic presets. Go, rust and spring-boot require the server rollout flag; dockerfile has no draft runtime. Start can return starting: retry sync_files to check readiness. Startup notes arrive once in note, even after a slow start. data chooses copy (default) or empty on a new draft; a running draft keeps its choice. Where enabled and available, Copy seeds the database and app files at start and reads the bucket live; Empty starts without that data. Writes stay in the draft. The reply reports modes, timestamps and unavailable-copy notes. A change in the draft is not live and not saved: tell the user so, and give dev_url as a preview. New drafts inherit default_public, including drafts with data; the owner can switch public/private on the draft row. Google-login apps stay behind their login and cannot be made public. get_app_status reports the draft public flag. dev_url is private unless the draft is public; do not suggest sharing it unless the owner made it public (plus expires_at and notice when the app is a temporary 72h project). When the user is happy with the result, publish_draft makes everything the draft holds live in ONE commit (deploy_files once with the final files does the same); a commit per small edit fills the timeline and is slow. The result gives unsaved_files, the number of files that exist only in the draft, and next_step. A draft is temporary: it stops after 30 minutes without a sync, and the platform can stop it earlier. When it stops by itself, the files it received are kept for 24 hours; the next sync_files starts a new draft, brings them back and says so in note, so do not resend everything. The owner can stop a draft from the dashboard, which discards its unsaved files; note then says so. The draft does not change deploy_url or canonical_host, and it keeps running after a publish. Each file accepts an optional sha256 (hex) to verify against; on any mismatch the whole call fails before anything is applied, naming the offending file(s), and the response echoes each file's actual sha256 in files[]. Requires a read-write token.