@lotics/cli 0.57.0 → 0.62.0

package/dist/src/cli.js

@@ -12243,12 +12243,12 @@ var require_tokens = __commonJS({
       });
     }
     exports2.assignCategoriesMapProp = assignCategoriesMapProp;
-    function singleAssignCategoriesToksMap(path7, nextNode) {
-      utils_1.forEach(path7, function(pathNode) {
+    function singleAssignCategoriesToksMap(path8, nextNode) {
+      utils_1.forEach(path8, function(pathNode) {
         nextNode.categoryMatchesMap[pathNode.tokenTypeIdx] = true;
       });
       utils_1.forEach(nextNode.CATEGORIES, function(nextCategory) {
-        var newPath = path7.concat(nextNode);
+        var newPath = path8.concat(nextNode);
         if (!utils_1.contains(newPath, nextCategory)) {
           singleAssignCategoriesToksMap(newPath, nextCategory);
         }
@@ -14011,10 +14011,10 @@ var require_interpreter = __commonJS({
       /** @class */
       (function(_super) {
         __extends(AbstractNextPossibleTokensWalker2, _super);
-        function AbstractNextPossibleTokensWalker2(topProd, path7) {
+        function AbstractNextPossibleTokensWalker2(topProd, path8) {
           var _this = _super.call(this) || this;
           _this.topProd = topProd;
-          _this.path = path7;
+          _this.path = path8;
           _this.possibleTokTypes = [];
           _this.nextProductionName = "";
           _this.nextProductionOccurrence = 0;
@@ -14068,9 +14068,9 @@ var require_interpreter = __commonJS({
       /** @class */
       (function(_super) {
         __extends(NextAfterTokenWalker2, _super);
-        function NextAfterTokenWalker2(topProd, path7) {
-          var _this = _super.call(this, topProd, path7) || this;
-          _this.path = path7;
+        function NextAfterTokenWalker2(topProd, path8) {
+          var _this = _super.call(this, topProd, path8) || this;
+          _this.path = path8;
           _this.nextTerminalName = "";
           _this.nextTerminalOccurrence = 0;
           _this.nextTerminalName = _this.path.lastTok.name;
@@ -14767,10 +14767,10 @@ var require_lookahead = __commonJS({
       }
       return result;
     }
-    function pathToHashKeys(path7) {
+    function pathToHashKeys(path8) {
       var keys2 = [""];
-      for (var i2 = 0; i2 < path7.length; i2++) {
-        var tokType = path7[i2];
+      for (var i2 = 0; i2 < path8.length; i2++) {
+        var tokType = path8[i2];
         var longerKeys = [];
         for (var j = 0; j < keys2.length; j++) {
           var currShorterKey = keys2[j];
@@ -15082,9 +15082,9 @@ var require_checks = __commonJS({
       return errors;
     }
     exports2.validateRuleIsOverridden = validateRuleIsOverridden;
-    function validateNoLeftRecursion(topRule, currRule, errMsgProvider, path7) {
-      if (path7 === void 0) {
-        path7 = [];
+    function validateNoLeftRecursion(topRule, currRule, errMsgProvider, path8) {
+      if (path8 === void 0) {
+        path8 = [];
       }
       var errors = [];
       var nextNonTerminals = getFirstNoneTerminal(currRule.definition);
@@ -15097,15 +15097,15 @@ var require_checks = __commonJS({
           errors.push({
             message: errMsgProvider.buildLeftRecursionError({
               topLevelRule: topRule,
-              leftRecursionPath: path7
+              leftRecursionPath: path8
             }),
             type: parser_1.ParserDefinitionErrorType.LEFT_RECURSION,
             ruleName
           });
         }
-        var validNextSteps = utils.difference(nextNonTerminals, path7.concat([topRule]));
+        var validNextSteps = utils.difference(nextNonTerminals, path8.concat([topRule]));
         var errorsFromNextSteps = utils.map(validNextSteps, function(currRefRule) {
-          var newPath = utils.cloneArr(path7);
+          var newPath = utils.cloneArr(path8);
           newPath.push(currRefRule);
           return validateNoLeftRecursion(topRule, currRefRule, errMsgProvider, newPath);
         });
@@ -22714,8 +22714,8 @@ var require_utils4 = __commonJS({
       var result = transform[inputType][outputType](input);
       return result;
     };
-    exports2.resolve = function(path7) {
-      var parts = path7.split("/");
+    exports2.resolve = function(path8) {
+      var parts = path8.split("/");
       var result = [];
       for (var index = 0; index < parts.length; index++) {
         var part = parts[index];
@@ -28568,18 +28568,18 @@ var require_object = __commonJS({
       var object = new ZipObject(name, zipObjectContent, o);
       this.files[name] = object;
     };
-    var parentFolder = function(path7) {
-      if (path7.slice(-1) === "/") {
-        path7 = path7.substring(0, path7.length - 1);
+    var parentFolder = function(path8) {
+      if (path8.slice(-1) === "/") {
+        path8 = path8.substring(0, path8.length - 1);
       }
-      var lastSlash = path7.lastIndexOf("/");
-      return lastSlash > 0 ? path7.substring(0, lastSlash) : "";
+      var lastSlash = path8.lastIndexOf("/");
+      return lastSlash > 0 ? path8.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path7) {
-      if (path7.slice(-1) !== "/") {
-        path7 += "/";
+    var forceTrailingSlash = function(path8) {
+      if (path8.slice(-1) !== "/") {
+        path8 += "/";
       }
-      return path7;
+      return path8;
     };
     var folderAdd = function(name, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults2.createFolders;
@@ -29579,8 +29579,10 @@ var require_lib3 = __commonJS({
 });
 
 // src/cli.ts
-import fs7 from "node:fs";
-import path6 from "node:path";
+import dns from "node:dns";
+import net2 from "node:net";
+import fs8 from "node:fs";
+import path7 from "node:path";
 import readline from "node:readline";
 
 // src/client.ts
@@ -29678,8 +29680,8 @@ var LoticsClient = class {
     }
     return headers;
   }
-  async request(method, path7, body) {
-    const url = `${this.baseUrl}${path7}`;
+  async request(method, path8, body) {
+    const url = `${this.baseUrl}${path8}`;
     const headers = this.buildHeaders();
     const init = { method, headers };
     if (body !== void 0) {
@@ -29744,6 +29746,38 @@ var LoticsClient = class {
   async createApp(body) {
     return this.request("POST", "/v1/apps", body);
   }
+  /**
+   * Resolve the display name + fields (incl. select options) of the given tables
+   * — the schema `lotics app codegen` turns into the runtime `.lotics/app_fields.ts`
+   * alias maps. One `get_table` call per id (the tool surface has no batch
+   * variant); a missing/inaccessible table is dropped rather than throwing, so a
+   * stale id in the scope set never fails codegen.
+   */
+  async getWorkspaceSchema(tableIds) {
+    const tables = await Promise.all(
+      tableIds.map(async (table_id) => {
+        const res = await this.execute("get_table", { table_id });
+        if (res.error || res.result === null || typeof res.result !== "object") return null;
+        const table = res.result;
+        if (typeof table.id !== "string" || typeof table.name !== "string" || !Array.isArray(table.fields)) {
+          return null;
+        }
+        const fields = table.fields.flatMap((field) => {
+          if (field === null || typeof field !== "object") return [];
+          const f = field;
+          if (typeof f.key !== "string" || typeof f.name !== "string") return [];
+          const options = Array.isArray(f.options) ? f.options.flatMap((opt) => {
+            if (opt === null || typeof opt !== "object") return [];
+            const o = opt;
+            return typeof o.key === "string" && typeof o.name === "string" ? [{ id: o.key, label: o.name }] : [];
+          }) : void 0;
+          return [{ id: f.key, name: f.name, ...options && options.length > 0 ? { options } : {} }];
+        });
+        return { id: table.id, name: table.name, fields };
+      })
+    );
+    return tables.filter((t) => t !== null);
+  }
   /**
    * Rename an app's public subdomain — its `<slug>.lotics.app` address.
    * Mirrors PUT /v1/apps/{app_id}/subdomain. The old subdomain stops
@@ -29818,6 +29852,52 @@ var LoticsClient = class {
     if (response.ok) return parsed ?? {};
     return { status: "error", message: transportErrorMessage(response.status, parsed) };
   }
+  /**
+   * Bind (create or replace) an app workflow by alias via the `set_app_workflow`
+   * tool — the SINGLE author of `apps.workflows` + the workflow row. `source` is
+   * the verbatim JS-subset body (no `on({...})` trigger). `inputs`/`outputs` are
+   * the typed schemas declared in `package.json#lotics.workflows.<alias>`. The
+   * server re-verifies the body and echoes the bound `outputs` (declared, else
+   * DERIVED from `return({ data })`), so the CLI can show the author what shape
+   * `result.data` will carry. Wraps the tool rather than a bespoke endpoint so
+   * the file flow stays a convenience over the existing single-author contract.
+   */
+  async setAppWorkflow(app_id, alias, body) {
+    return this.execute("set_app_workflow", {
+      app_id,
+      alias,
+      source: body.source,
+      ...body.inputs ? { inputs: body.inputs } : {},
+      ...body.outputs ? { outputs: body.outputs } : {},
+      ...body.name ? { name: body.name } : {},
+      ...body.description ? { description: body.description } : {}
+    });
+  }
+  /**
+   * Fetch one app workflow's faithful source + bound input/output schemas via
+   * `get_app_workflow`. `source` is the JS-subset body re-rendered from the
+   * persisted step tree (incl. the `return({ data })` clause, opaque field/option
+   * keys) — the exact text `lotics app workflow set` would push back. Feeds
+   * `lotics app pull`, which writes it to `src/workflows/<alias>.ts`.
+   */
+  async getAppWorkflow(app_id, alias) {
+    return this.execute("get_app_workflow", { app_id, alias });
+  }
+  /**
+   * Fetch the server-generated workspace `.d.ts` + the wrapper envelope that
+   * make a `src/workflows/<alias>.ts` body locally typecheckable (GAP-59).
+   * The server is the single source of the type model — the CLI never
+   * re-implements it. `envelope_prefix`/`envelope_suffix` are the exact
+   * `async function __workflow(): …` wrapper the server compiles inside, so the
+   * local typecheck mirrors the set-time verdict. Mirrors
+   * POST /v1/apps/{app_id}/workflows/{alias}/dts.
+   */
+  async getAppWorkflowDts(app_id, alias) {
+    return this.request(
+      "POST",
+      `/v1/apps/${encodeURIComponent(app_id)}/workflows/${encodeURIComponent(alias)}/dts`
+    );
+  }
   /**
    * Open a streaming agent run and return the RAW streamed `Response` (the
    * caller reads `res.body`). Unlike `request`, this does not buffer/parse the
@@ -30262,8 +30342,8 @@ var pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
 var VERSION = pkg.version;
 
 // src/app_commands.ts
-import fs3 from "node:fs";
-import path4 from "node:path";
+import fs4 from "node:fs";
+import path5 from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 import { tmpdir } from "node:os";
 
@@ -30323,7 +30403,9 @@ function buildStarterTemplate(args) {
             "@vitejs/plugin-react": "^4.3.0",
             jsdom: "^25.0.0",
             oxlint: "^0.13.0",
-            typescript: "^5.6.0",
+            // Track the platform's TS major so `lotics app workflow check` (which runs
+            // the app's OWN typescript) gives the same verdict the server does at set-time.
+            typescript: "~6.0.3",
             vite: "^5.4.0",
             vitest: "^2.1.0"
           },
@@ -30366,7 +30448,18 @@ function buildStarterTemplate(args) {
           // fall to `unknown`. The explicit glob makes the dot-dir the non-wildcard
           // base, which IS read. (GAP-38.)
           include: ["src", ".lotics/**/*"],
-          exclude: ["node_modules"]
+          // src/workflows/<alias>.ts bodies run on the server (workflow globals:
+          // trigger / runtime / tool calls), and each pulls its own per-alias
+          // ambient globals under `.lotics/workflows/`. BOTH are excluded from
+          // the main typecheck: the bodies would apply the app's DOM lib (the
+          // server doesn't), and the per-alias `.globals.d.ts` files each declare
+          // their OWN ambient `trigger` — loading several into one program
+          // collides those declarations and reports false errors. Type-check the
+          // bodies with `lotics app workflow check` instead — it builds ONE
+          // isolated program per alias (mirroring the server's set-time verify),
+          // so the ambient `trigger` is unambiguous. The server stays the single
+          // verifier on `lotics app workflow set`.
+          exclude: ["node_modules", "src/workflows", ".lotics/workflows"]
         },
         null,
         2
@@ -30705,6 +30798,63 @@ const routes = [
 export default function App() {
   return <AppRouter routes={routes} />;
 }
+`
+    },
+    {
+      // The home for editable workflow bodies. `lotics app pull` writes one
+      // `src/workflows/<alias>.ts` per bound workflow (faithful server source);
+      // edit it, then `lotics app workflow set <alias>` pushes it back through
+      // set_app_workflow (the server verifies). A new app has no bound workflows
+      // yet, so this is just the docked directory + the loop reference. It's a
+      // .md (not a .ts) so tsc's `include: ["src"]` never tries to compile it —
+      // a workflow body is a JS-subset expression over server globals
+      // (trigger / runtime / tool calls) that does NOT typecheck standalone.
+      path: "src/workflows/README.md",
+      content: `# Workflow bodies
+
+Editable JS-subset bodies of this app's workflows live here, one file per alias:
+\`src/workflows/<alias>.ts\`.
+
+## Loop
+
+\`\`\`bash
+lotics app workflow pull          # write/refresh every src/workflows/<alias>.ts from the server
+# edit src/workflows/<alias>.ts
+lotics app workflow check <alias> # typecheck the body locally (same verdict as \`set\`)
+lotics app workflow set <alias>   # push it back through set_app_workflow (the server verifies)
+\`\`\`
+
+\`lotics app pull <app_id>\` also writes these files (alongside the rest of the project).
+
+## What a body is
+
+A workflow body is a **JS-subset expression** that runs server-side using workflow
+globals (\`trigger\`, \`runtime\`, tool calls) and ends with \`return({ data })\`. Each
+pulled file wraps the body in the server's \`__workflow\` envelope and references its
+per-alias ambient globals at \`.lotics/workflows/<alias>.globals.d.ts\`, so it **is**
+locally typecheckable:
+
+\`\`\`bash
+lotics app workflow check        # check every body; [alias] to check one
+\`\`\`
+
+\`check\` builds ONE isolated program per alias (the app's own \`typescript\`, the
+server's compile options \u2014 strict, lib es2022 with no DOM), so each body's ambient
+\`trigger\` is unambiguous and the verdict mirrors set-time verify. The main
+\`npm run typecheck\` excludes \`src/workflows\` + \`.lotics/workflows\` (the bodies would
+apply the app's DOM lib, and the per-alias globals collide on \`trigger\`). The
+verification that matters still runs on the **server** when you \`set\` \u2014 the same
+guarantee as authoring via \`set_app_workflow\` directly. Edit only the body BETWEEN
+the wrapper lines; the wrapper, the \`/// <reference>\`, and the \`export {};\` marker
+are CLI bookkeeping (stripped on \`set\`). Do not rename a file (the filename is the
+alias the binding is keyed by).
+
+## Authority
+
+\`lotics app deploy\` never authors workflows \u2014 it carries code, queries, and
+capabilities only. \`apps.workflows\` has exactly one author: \`set_app_workflow\`
+(which \`lotics app workflow set\` calls). The typed \`inputs\`/\`outputs\` schema for
+each alias lives in \`package.json#lotics.workflows.<alias>\`.
 `
     },
     {
@@ -30894,6 +31044,18 @@ import http from "node:http";
 import net from "node:net";
 import { spawn } from "node:child_process";
 
+// src/child_env.ts
+function ipv4ChildEnv(env) {
+  return {
+    ...env,
+    NODE_OPTIONS: [
+      env.NODE_OPTIONS,
+      "--dns-result-order=ipv4first",
+      "--network-family-autoselection-attempt-timeout=2000"
+    ].filter(Boolean).join(" ")
+  };
+}
+
 // src/dev/rpc_handler.ts
 var SUPPORTED_OPS = /* @__PURE__ */ new Set([
   "query",
@@ -31354,7 +31516,7 @@ async function startDevServer(args) {
     {
       cwd: args.projectDir,
       stdio: [process.stdin.isTTY ? "inherit" : "ignore", "inherit", "inherit"],
-      env: { ...process.env, FORCE_COLOR: "1" }
+      env: ipv4ChildEnv({ ...process.env, FORCE_COLOR: "1" })
     }
   );
   let stopped = false;
@@ -31778,6 +31940,254 @@ ${lines.join("\n")}
 `;
 }
 
+// ../shared/src/app_query_ast.ts
+function collectQueryTableIds(node) {
+  const result = /* @__PURE__ */ new Set();
+  walk(node, (n) => {
+    if (n.kind === "from_table") result.add(n.table_id);
+  });
+  return result;
+}
+function walk(node, visit) {
+  visit(node);
+  switch (node.kind) {
+    case "from_table":
+      return;
+    case "project":
+    case "filter":
+    case "group":
+    case "window":
+    case "sort":
+    case "limit":
+    case "unpivot":
+      walk(node.from, visit);
+      return;
+    case "join":
+      walk(node.left, visit);
+      walk(node.right, visit);
+      return;
+    case "union":
+      for (const child of node.sources) walk(child, visit);
+      return;
+    default: {
+      const _exhaustive = node;
+      void _exhaustive;
+      return;
+    }
+  }
+}
+
+// src/generate_app_fields.ts
+var HEADER4 = `// Auto-generated by 'lotics app codegen' (and app pull/dev/deploy).
+// DO NOT EDIT \u2014 regenerated from the workspace schema.
+//
+// Runtime field + option ids addressed by stable display-name aliases:
+//   record.data[F.<TABLE>.<field>]            \u2192 "fld_\u2026"
+//   value === OPT.<TABLE>.<field>.<option>    \u2192 "opt_\u2026"
+// A rename on the platform re-runs codegen and moves these in lockstep.
+`;
+function slugifyAlias(name, upper) {
+  const stripped = name.normalize("NFD").replace(/[̀-ͯ]/g, "").replace(/đ/g, "d").replace(/Đ/g, "D");
+  const cased = upper ? stripped.toUpperCase() : stripped.toLowerCase();
+  const slug = cased.replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  if (slug === "") return "_";
+  return /^[0-9]/.test(slug) ? `_${slug}` : slug;
+}
+function dedupeAliases(names, upper) {
+  const used = /* @__PURE__ */ new Map();
+  return names.map((name) => {
+    const base = slugifyAlias(name, upper);
+    const seen = used.get(base);
+    if (seen === void 0) {
+      used.set(base, 1);
+      return base;
+    }
+    let n = seen + 1;
+    while (used.has(`${base}_${n}`)) n++;
+    used.set(base, n);
+    used.set(`${base}_${n}`, 1);
+    return `${base}_${n}`;
+  });
+}
+function propKey(alias) {
+  return isValidIdentifier(alias) ? alias : JSON.stringify(alias);
+}
+function aliasTables(tables) {
+  const tableAliases = dedupeAliases(
+    tables.map((t) => t.name),
+    true
+  );
+  return tables.map((table, i2) => {
+    const fieldAliases = dedupeAliases(
+      table.fields.map((f) => f.name),
+      false
+    );
+    return {
+      alias: tableAliases[i2],
+      table,
+      fields: table.fields.map((field, j) => ({ alias: fieldAliases[j], field }))
+    };
+  });
+}
+function emitFieldMap(aliased) {
+  const tableBlocks = aliased.map(({ alias, fields }) => {
+    const fieldLines = fields.map(
+      ({ alias: fieldAlias, field }) => `    ${propKey(fieldAlias)}: ${JSON.stringify(field.id)},`
+    );
+    return `  ${propKey(alias)}: {
+${fieldLines.join("\n")}
+  },`;
+  });
+  return `export const F = {
+${tableBlocks.join("\n")}
+} as const;`;
+}
+function emitOptionMap(aliased) {
+  const tableBlocks = [];
+  for (const { alias, fields } of aliased) {
+    const fieldBlocks = [];
+    for (const { alias: fieldAlias, field } of fields) {
+      const options = field.options ?? [];
+      if (options.length === 0) continue;
+      const optionAliases = dedupeAliases(
+        options.map((o) => o.label),
+        false
+      );
+      const optionLines = options.map(
+        (option, i2) => `      ${propKey(optionAliases[i2])}: ${JSON.stringify(option.id)},`
+      );
+      fieldBlocks.push(`    ${propKey(fieldAlias)}: {
+${optionLines.join("\n")}
+    },`);
+    }
+    if (fieldBlocks.length === 0) continue;
+    tableBlocks.push(`  ${propKey(alias)}: {
+${fieldBlocks.join("\n")}
+  },`);
+  }
+  if (tableBlocks.length === 0) return `export const OPT = {} as const;`;
+  return `export const OPT = {
+${tableBlocks.join("\n")}
+} as const;`;
+}
+function generateAppFields(tables) {
+  if (tables.length === 0) {
+    return `${HEADER4}
+export const F = {} as const;
+
+export const OPT = {} as const;
+
+/** Field-id alias map (empty \u2014 no tables in scope). */
+export type AppFields = typeof F;
+/** Select-option alias map (empty \u2014 no tables in scope). */
+export type AppOptions = typeof OPT;
+`;
+  }
+  const aliased = aliasTables(tables);
+  return `${HEADER4}
+${emitFieldMap(aliased)}
+
+${emitOptionMap(aliased)}
+
+/** Field-id alias map: \`F[<TABLE>][<field>]\` is the \`fld_\u2026\` id (literal-typed). */
+export type AppFields = typeof F;
+/** Select-option alias map: \`OPT[<TABLE>][<field>][<option>]\` is the \`opt_\u2026\` id. */
+export type AppOptions = typeof OPT;
+`;
+}
+
+// src/app_workflow_check.ts
+import fs3 from "node:fs";
+import path4 from "node:path";
+import { createRequire } from "node:module";
+function workflowCheckCompilerOptions(tsApi) {
+  return {
+    target: tsApi.ScriptTarget.ES2022,
+    module: tsApi.ModuleKind.ESNext,
+    lib: ["lib.es2022.d.ts"],
+    strict: true,
+    noImplicitAny: true,
+    strictNullChecks: true,
+    noImplicitReturns: false,
+    noEmit: true,
+    allowJs: false,
+    isolatedModules: false,
+    skipLibCheck: true,
+    moduleResolution: tsApi.ModuleResolutionKind.NodeNext,
+    types: [],
+    declaration: false
+  };
+}
+function bodyLineOffset(wrappedSource) {
+  const lines = wrappedSource.split("\n");
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    if (/^\s*async\s+function\s+__workflow\s*\(/.test(lines[i2])) return i2 + 1;
+  }
+  return 0;
+}
+async function loadProjectTypescript(projectDir) {
+  const requireFromProject = createRequire(path4.join(projectDir, "package.json"));
+  let resolved;
+  try {
+    resolved = requireFromProject.resolve("typescript");
+  } catch {
+    throw new Error(
+      `Could not resolve 'typescript' from ${projectDir}. 'lotics app workflow check' type-checks bodies with the app's own compiler \u2014 run 'npm install' (the scaffold ships typescript as a devDependency).`
+    );
+  }
+  const mod = await import(pathToImportUrl(resolved));
+  return mod.default ?? mod;
+}
+function pathToImportUrl(p) {
+  const resolved = path4.resolve(p);
+  const prefixed = resolved.startsWith("/") ? resolved : `/${resolved}`;
+  return `file://${prefixed.split(path4.sep).join("/")}`;
+}
+function checkOneWorkflowBody(tsApi, input) {
+  const wrapped = fs3.readFileSync(input.bodyPath, "utf-8");
+  const offset = bodyLineOffset(wrapped);
+  const program = tsApi.createProgram({
+    rootNames: [input.globalsPath, input.bodyPath],
+    options: workflowCheckCompilerOptions(tsApi)
+  });
+  const bodyFile = program.getSourceFile(input.bodyPath);
+  if (!bodyFile) {
+    return [
+      {
+        line: 1,
+        col: 1,
+        code: "INTERNAL",
+        message: `workflow check: body file was not loaded (${input.bodyPath})`
+      }
+    ];
+  }
+  const issues = [];
+  for (const d of tsApi.getPreEmitDiagnostics(program)) {
+    if (d.file !== bodyFile) continue;
+    let line = 1;
+    let col = 1;
+    if (typeof d.start === "number") {
+      const lc2 = bodyFile.getLineAndCharacterOfPosition(d.start);
+      line = Math.max(1, lc2.line + 1 - offset);
+      col = lc2.character + 1;
+    }
+    issues.push({
+      line,
+      col,
+      code: `TS${d.code}`,
+      message: tsApi.flattenDiagnosticMessageText(d.messageText, "\n")
+    });
+  }
+  return issues;
+}
+function checkWorkflowBodies(tsApi, aliases) {
+  return aliases.map(({ alias, input }) => ({
+    alias,
+    bodyPath: input.bodyPath,
+    issues: checkOneWorkflowBody(tsApi, input)
+  }));
+}
+
 // src/app_commands.ts
 async function fetchLatestNpmVersion(packageName) {
   try {
@@ -31795,6 +32205,100 @@ async function fetchLatestNpmVersion(packageName) {
     return null;
   }
 }
+var WORKFLOWS_DIR = path5.join("src", "workflows");
+var WORKFLOW_GLOBALS_DIR = path5.join(".lotics", "workflows");
+var WORKFLOW_TSCONFIG_EXCLUDES = ["src/workflows", ".lotics/workflows"];
+var FALLBACK_ENVELOPE_PREFIX = "async function __workflow(): Promise<__WorkflowReturn | void> {\n";
+var FALLBACK_ENVELOPE_SUFFIX = "\n}";
+function workflowFileHeader(alias) {
+  const refPath = path5.join("..", "..", WORKFLOW_GLOBALS_DIR, `${alias}.globals.d.ts`).split(path5.sep).join("/");
+  return `/// <reference path="${refPath}" />
+// Auto-pulled workflow body for "${alias}". Edit the BODY between the wrapper
+// lines below, then check + push with:
+//   lotics app workflow check ${alias}
+//   lotics app workflow set ${alias}
+// The push goes through set_app_workflow, where the SERVER verifies the body.
+// The __workflow wrapper + the reference above are CLI bookkeeping (stripped on
+// set) \u2014 they only make the body typecheck locally against the workspace types.
+// Do NOT rename this file \u2014 the filename is the alias the binding is keyed by.
+export {};
+`;
+}
+function workflowFilePath(projectDir, alias) {
+  return path5.join(projectDir, WORKFLOWS_DIR, `${alias}.ts`);
+}
+function workflowGlobalsPath(projectDir, alias) {
+  return path5.join(projectDir, WORKFLOW_GLOBALS_DIR, `${alias}.globals.d.ts`);
+}
+function writeWorkflowGlobals(projectDir, alias, dts) {
+  const dir = path5.join(projectDir, WORKFLOW_GLOBALS_DIR);
+  fs4.mkdirSync(dir, { recursive: true });
+  const file = workflowGlobalsPath(projectDir, alias);
+  fs4.writeFileSync(file, `${dts.replace(/\s+$/, "")}
+`);
+  return file;
+}
+function writeWorkflowFile(projectDir, alias, source, envelope = { prefix: FALLBACK_ENVELOPE_PREFIX, suffix: FALLBACK_ENVELOPE_SUFFIX }) {
+  const dir = path5.join(projectDir, WORKFLOWS_DIR);
+  fs4.mkdirSync(dir, { recursive: true });
+  const file = workflowFilePath(projectDir, alias);
+  const body = source.replace(/\s+$/, "");
+  fs4.writeFileSync(file, `${workflowFileHeader(alias)}
+${envelope.prefix}${body}${envelope.suffix}
+`);
+  return file;
+}
+var WORKFLOW_WRAPPER_OPENER = /^\s*async\s+function\s+__workflow\s*\(/;
+function stripWorkflowHeader(content) {
+  const lines = content.split("\n");
+  let headerEnd = 0;
+  while (headerEnd < lines.length && /^\s*\/\//.test(lines[headerEnd])) headerEnd++;
+  while (headerEnd < lines.length && /^\s*export\s*\{\s*\}\s*;?\s*$/.test(lines[headerEnd])) headerEnd++;
+  while (headerEnd < lines.length && lines[headerEnd].trim() === "") headerEnd++;
+  let start;
+  if (headerEnd < lines.length && WORKFLOW_WRAPPER_OPENER.test(lines[headerEnd])) {
+    start = headerEnd;
+  } else if (lines.length > 0 && WORKFLOW_WRAPPER_OPENER.test(lines[0])) {
+    start = 0;
+  } else {
+    return content.replace(/\s+$/, "");
+  }
+  let end = lines.length - 1;
+  while (end > start && lines[end].trim() === "") end--;
+  if (lines[end]?.trim() === "}") {
+    return lines.slice(start + 1, end).join("\n").replace(/\s+$/, "");
+  }
+  return lines.slice(start + 1).join("\n").replace(/\s+$/, "");
+}
+async function writeWorkflowFiles(client, projectDir, app_id, aliases) {
+  const written = [];
+  for (const alias of aliases) {
+    const res = await client.getAppWorkflow(app_id, alias);
+    const source = res.error || res.result === null || typeof res.result !== "object" ? null : res.result.source;
+    if (typeof source !== "string" || source.trim() === "") {
+      console.error(
+        `\u26A0 Skipped src/workflows/${alias}.ts \u2014 the server returned no readable source (${res.error ?? "legacy workflow with no rendered body"}).`
+      );
+      continue;
+    }
+    const envelope = await fetchWorkflowGlobals(client, projectDir, app_id, alias);
+    writeWorkflowFile(projectDir, alias, source, envelope);
+    written.push(alias);
+  }
+  return written;
+}
+async function fetchWorkflowGlobals(client, projectDir, app_id, alias) {
+  try {
+    const { dts, envelope_prefix, envelope_suffix } = await client.getAppWorkflowDts(app_id, alias);
+    writeWorkflowGlobals(projectDir, alias, dts);
+    return { prefix: envelope_prefix, suffix: envelope_suffix };
+  } catch (err2) {
+    console.error(
+      `\u26A0 Could not fetch workflow types for "${alias}" (${err2 instanceof Error ? err2.message : String(err2)}). Wrote the body with the fallback wrapper; its local typecheck may be degraded.`
+    );
+    return { prefix: FALLBACK_ENVELOPE_PREFIX, suffix: FALLBACK_ENVELOPE_SUFFIX };
+  }
+}
 function runTar(args, cwd) {
   return new Promise((resolve, reject2) => {
     const proc = spawn2("tar", args, { cwd, stdio: ["ignore", "ignore", "pipe"] });
@@ -31811,7 +32315,7 @@ function runTar(args, cwd) {
 }
 function runNpm(args, cwd) {
   return new Promise((resolve, reject2) => {
-    const proc = spawn2("npm", args, { cwd, stdio: "inherit" });
+    const proc = spawn2("npm", args, { cwd, stdio: "inherit", env: ipv4ChildEnv(process.env) });
     proc.on("error", reject2);
     proc.on("exit", (code) => {
       if (code === 0) resolve();
@@ -31820,11 +32324,11 @@ function runNpm(args, cwd) {
   });
 }
 function readAppMeta(projectDir) {
-  const pkgPath2 = path4.join(projectDir, "package.json");
-  if (!fs3.existsSync(pkgPath2)) {
+  const pkgPath2 = path5.join(projectDir, "package.json");
+  if (!fs4.existsSync(pkgPath2)) {
     throw new Error(`No package.json found at ${projectDir}. Run 'lotics app create' first.`);
   }
-  const pkg2 = JSON.parse(fs3.readFileSync(pkgPath2, "utf-8"));
+  const pkg2 = JSON.parse(fs4.readFileSync(pkgPath2, "utf-8"));
   if (!pkg2.lotics?.app_id || !pkg2.lotics.workspace_id) {
     throw new Error(
       `package.json is missing the 'lotics' field with app_id and workspace_id. Was this folder created with 'lotics app create'?`
@@ -31842,27 +32346,109 @@ function readAppMeta(projectDir) {
   };
 }
 function writeAppMeta(projectDir, meta) {
-  const pkgPath2 = path4.join(projectDir, "package.json");
-  const pkg2 = JSON.parse(fs3.readFileSync(pkgPath2, "utf-8"));
+  const pkgPath2 = path5.join(projectDir, "package.json");
+  const pkg2 = JSON.parse(fs4.readFileSync(pkgPath2, "utf-8"));
   pkg2.lotics = meta;
-  fs3.writeFileSync(pkgPath2, JSON.stringify(pkg2, null, 2) + "\n");
+  fs4.writeFileSync(pkgPath2, JSON.stringify(pkg2, null, 2) + "\n");
 }
-function writeAppDts(projectDir, manifest) {
-  const dotLotics = path4.join(projectDir, ".lotics");
-  fs3.mkdirSync(dotLotics, { recursive: true });
-  fs3.writeFileSync(
-    path4.join(dotLotics, "app_workflows.d.ts"),
-    generateAppWorkflowsDts(manifest.workflows)
-  );
-  fs3.writeFileSync(
-    path4.join(dotLotics, "app_queries.d.ts"),
-    generateAppQueriesDts(manifest.queries)
-  );
-  fs3.writeFileSync(
-    path4.join(dotLotics, "app_agents.d.ts"),
-    generateAppAgentsDts(manifest.agents)
+function ensureWorkflowTsconfigExcludes(projectDir) {
+  const tsconfigPath = path5.join(projectDir, "tsconfig.json");
+  if (!fs4.existsSync(tsconfigPath)) {
+    console.error(
+      `\u26A0 No tsconfig.json at ${projectDir} \u2014 could not ensure ${WORKFLOW_TSCONFIG_EXCLUDES.join(", ")} are excluded. Add them to your tsconfig's "exclude" so npm run typecheck skips the workflow bodies.`
+    );
+    return;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(fs4.readFileSync(tsconfigPath, "utf-8"));
+  } catch (err2) {
+    console.error(
+      `\u26A0 Could not parse tsconfig.json (${err2 instanceof Error ? err2.message : String(err2)}) \u2014 add ${WORKFLOW_TSCONFIG_EXCLUDES.join(", ")} to its "exclude" manually so npm run typecheck skips the workflow bodies.`
+    );
+    return;
+  }
+  if (!parsed || typeof parsed !== "object") return;
+  const current = Array.isArray(parsed.exclude) ? parsed.exclude : [];
+  const currentStrings = current.filter((e) => typeof e === "string");
+  const toAdd = WORKFLOW_TSCONFIG_EXCLUDES.filter((g) => !currentStrings.includes(g));
+  if (toAdd.length === 0) return;
+  parsed.exclude = [...currentStrings, ...toAdd];
+  fs4.writeFileSync(tsconfigPath, JSON.stringify(parsed, null, 2) + "\n");
+  console.error(
+    `Patched tsconfig.json: added ${toAdd.join(", ")} to "exclude" so npm run typecheck skips the workflow bodies (check them with: lotics app workflow check).`
   );
 }
+function writeAppDts(projectDir, manifest) {
+  const dotLotics = path5.join(projectDir, ".lotics");
+  fs4.mkdirSync(dotLotics, { recursive: true });
+  const written = [
+    [path5.join(dotLotics, "app_workflows.d.ts"), generateAppWorkflowsDts(manifest.workflows)],
+    [path5.join(dotLotics, "app_queries.d.ts"), generateAppQueriesDts(manifest.queries)],
+    [path5.join(dotLotics, "app_agents.d.ts"), generateAppAgentsDts(manifest.agents)]
+  ];
+  for (const [file, content] of written) fs4.writeFileSync(file, content);
+  return written.map(([file]) => file);
+}
+function readCodegenTablesAllowlist(projectDir) {
+  const pkg2 = JSON.parse(fs4.readFileSync(path5.join(projectDir, "package.json"), "utf-8"));
+  const tables = pkg2.lotics?.codegen?.tables;
+  return Array.isArray(tables) ? tables.filter((t) => typeof t === "string") : [];
+}
+function resolveCodegenTableIds(projectDir, queries) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const decl of Object.values(queries)) {
+    for (const id of collectQueryTableIds(decl.ast)) ids.add(id);
+  }
+  for (const id of readCodegenTablesAllowlist(projectDir)) ids.add(id);
+  return [...ids];
+}
+function writeAppFields(projectDir, tables) {
+  const dotLotics = path5.join(projectDir, ".lotics");
+  fs4.mkdirSync(dotLotics, { recursive: true });
+  const file = path5.join(dotLotics, "app_fields.ts");
+  fs4.writeFileSync(file, generateAppFields(tables));
+  return file;
+}
+async function appCodegen(args) {
+  const projectDir = path5.resolve(args.projectDir ?? process.cwd());
+  const meta = readAppMeta(projectDir);
+  const dtsPaths = writeAppDts(projectDir, {
+    workflows: meta.workflows,
+    queries: meta.queries,
+    agents: meta.agents
+  });
+  for (const p of dtsPaths) console.error(`Regenerated ${p}`);
+  if (!args.client) {
+    console.error(
+      "Skipped .lotics/app_fields.ts \u2014 no workspace credentials resolved. Run authenticated (or set LOTICS_API_KEY) to regenerate field/option ids."
+    );
+    return;
+  }
+  const tableIds = resolveCodegenTableIds(projectDir, meta.queries ?? {});
+  try {
+    const tables = await args.client.getWorkspaceSchema(tableIds);
+    const fieldsPath = writeAppFields(projectDir, tables);
+    console.error(`Regenerated ${fieldsPath} (${tables.length} table${tables.length === 1 ? "" : "s"})`);
+  } catch (err2) {
+    console.error(
+      `\u26A0 Could not fetch the workspace schema (${err2 instanceof Error ? err2.message : String(err2)}). Kept the existing .lotics/app_fields.ts.`
+    );
+  }
+  await refreshWorkflowGlobals(args.client, projectDir, meta.app_id, Object.keys(meta.workflows ?? {}));
+  if (Object.keys(meta.workflows ?? {}).length > 0) ensureWorkflowTsconfigExcludes(projectDir);
+}
+async function refreshWorkflowGlobals(client, projectDir, app_id, aliases) {
+  for (const alias of aliases) {
+    const file = workflowFilePath(projectDir, alias);
+    if (!fs4.existsSync(file)) continue;
+    const body = stripWorkflowHeader(fs4.readFileSync(file, "utf-8"));
+    if (body.trim() === "") continue;
+    const envelope = await fetchWorkflowGlobals(client, projectDir, app_id, alias);
+    writeWorkflowFile(projectDir, alias, body, envelope);
+    console.error(`Refreshed ${path5.relative(projectDir, file)} + its workflow types`);
+  }
+}
 function stampPulledManifest(projectDir, args) {
   writeAppMeta(projectDir, {
     app_id: args.app_id,
@@ -31881,21 +32467,21 @@ async function downloadToFile(url, destPath) {
     throw new Error(`Failed to download ${url}: ${response.status}`);
   }
   const buffer = Buffer.from(await response.arrayBuffer());
-  fs3.writeFileSync(destPath, buffer);
+  fs4.writeFileSync(destPath, buffer);
 }
 function appDirName(name) {
   const cleaned = name.replace(/[/\\]+/g, "-").replace(/[<>:"|?*]/g, "").replace(/\s+/g, " ").trim().replace(/^[.\s-]+|[.\s-]+$/g, "");
   return cleaned || "app";
 }
 async function appCreate(client, args) {
-  const targetPath = path4.resolve(args.targetPath ?? appDirName(args.name));
-  if (fs3.existsSync(targetPath)) {
-    const entries = fs3.readdirSync(targetPath);
+  const targetPath = path5.resolve(args.targetPath ?? appDirName(args.name));
+  if (fs4.existsSync(targetPath)) {
+    const entries = fs4.readdirSync(targetPath);
     if (entries.length > 0) {
       throw new Error(`Target directory ${targetPath} is not empty.`);
     }
   }
-  fs3.mkdirSync(targetPath, { recursive: true });
+  fs4.mkdirSync(targetPath, { recursive: true });
   const app = await client.createApp({ name: args.name });
   console.error(`Created app: ${app.name} (${app.id})`);
   const [uiLatest, sdkLatest] = await Promise.all([
@@ -31910,9 +32496,9 @@ async function appCreate(client, args) {
     sdk_version: sdkLatest ? `^${sdkLatest}` : void 0
   });
   for (const file of files) {
-    const fullPath = path4.join(targetPath, file.path);
-    fs3.mkdirSync(path4.dirname(fullPath), { recursive: true });
-    fs3.writeFileSync(fullPath, file.content);
+    const fullPath = path5.join(targetPath, file.path);
+    fs4.mkdirSync(path5.dirname(fullPath), { recursive: true });
+    fs4.writeFileSync(fullPath, file.content);
   }
   console.error(`Scaffolded ${files.length} files into ${targetPath}`);
   writeAppDts(targetPath, {});
@@ -31925,7 +32511,7 @@ async function appCreate(client, args) {
   });
   console.error(`
 Ready. Next steps:`);
-  console.error(`  cd ${path4.relative(process.cwd(), targetPath) || "."}`);
+  console.error(`  cd ${path5.relative(process.cwd(), targetPath) || "."}`);
   console.error(`  # edit src/App.tsx, then:`);
   console.error(`  lotics app deploy`);
 }
@@ -31940,6 +32526,21 @@ async function appRename(client, args) {
   if (res.error) throw new Error(res.error);
   console.error(`App renamed: "${args.name}" (${meta.app_id})`);
 }
+function defaultPullTarget(appId, appName) {
+  const cwdPkgPath = path5.join(process.cwd(), "package.json");
+  if (fs4.existsSync(cwdPkgPath)) {
+    let pkg2 = null;
+    try {
+      pkg2 = JSON.parse(fs4.readFileSync(cwdPkgPath, "utf-8"));
+    } catch (err2) {
+      console.error(
+        `\u26A0 Could not parse ${cwdPkgPath} (${err2 instanceof Error ? err2.message : String(err2)}) \u2014 pulling into a fresh ${appDirName(appName)}/ subdir.`
+      );
+    }
+    if (pkg2?.lotics?.app_id === appId) return process.cwd();
+  }
+  return appDirName(appName);
+}
 async function appPull(client, args) {
   const app = await client.getApp(args.app_id);
   if (!app.current_version_id) {
@@ -31949,16 +32550,16 @@ async function appPull(client, args) {
   }
   const version = await client.getAppVersion(app.id, app.current_version_id);
   const sourceUrl = await client.getAppVersionSourceUrl(app.id, version.id);
-  const targetPath = path4.resolve(args.targetPath ?? appDirName(app.name));
-  fs3.mkdirSync(targetPath, { recursive: true });
-  const tmpFile = path4.join(tmpdir(), `lotics-app-${app.id}-${Date.now()}.tar.gz`);
+  const targetPath = path5.resolve(args.targetPath ?? defaultPullTarget(app.id, app.name));
+  fs4.mkdirSync(targetPath, { recursive: true });
+  const tmpFile = path5.join(tmpdir(), `lotics-app-${app.id}-${Date.now()}.tar.gz`);
   console.error(`Downloading source archive...`);
   await downloadToFile(sourceUrl, tmpFile);
   try {
     console.error(`Extracting to ${targetPath}...`);
     await runTar(["-xzf", tmpFile, "-C", targetPath], targetPath);
   } finally {
-    if (fs3.existsSync(tmpFile)) fs3.unlinkSync(tmpFile);
+    if (fs4.existsSync(tmpFile)) fs4.unlinkSync(tmpFile);
   }
   stampPulledManifest(targetPath, {
     app_id: app.id,
@@ -31969,11 +32570,21 @@ async function appPull(client, args) {
     queries: app.queries ?? {},
     agents: app.agents ?? {}
   });
+  const aliases = Object.keys(app.workflows ?? {});
+  if (aliases.length > 0) {
+    const written = await writeWorkflowFiles(client, targetPath, app.id, aliases);
+    if (written.length > 0) {
+      console.error(
+        `Wrote ${written.length} workflow ${written.length === 1 ? "body" : "bodies"} to ${WORKFLOWS_DIR}/ (${written.join(", ")})`
+      );
+    }
+    ensureWorkflowTsconfigExcludes(targetPath);
+  }
   console.error(`Installing npm dependencies...`);
   await runNpm(["install"], targetPath);
   console.error(`
 Ready. Next steps:`);
-  console.error(`  cd ${path4.relative(process.cwd(), targetPath) || "."}`);
+  console.error(`  cd ${path5.relative(process.cwd(), targetPath) || "."}`);
   console.error(`  # edit src/App.tsx`);
   console.error(`  lotics app deploy`);
 }
@@ -31989,21 +32600,21 @@ function undeclaredCapabilities(sourceText, declared) {
   return used;
 }
 function readAppSourceText(projectDir) {
-  const srcDir = path4.join(projectDir, "src");
-  if (!fs3.existsSync(srcDir)) return "";
+  const srcDir = path5.join(projectDir, "src");
+  if (!fs4.existsSync(srcDir)) return "";
   const parts = [];
-  const walk = (dir) => {
-    for (const entry of fs3.readdirSync(dir, { withFileTypes: true })) {
-      const full = path4.join(dir, entry.name);
-      if (entry.isDirectory()) walk(full);
-      else if (/\.(ts|tsx|js|jsx)$/.test(entry.name)) parts.push(fs3.readFileSync(full, "utf8"));
+  const walk2 = (dir) => {
+    for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
+      const full = path5.join(dir, entry.name);
+      if (entry.isDirectory()) walk2(full);
+      else if (/\.(ts|tsx|js|jsx)$/.test(entry.name)) parts.push(fs4.readFileSync(full, "utf8"));
     }
   };
-  walk(srcDir);
+  walk2(srcDir);
   return parts.join("\n");
 }
 async function appDeploy(client, args) {
-  const projectDir = path4.resolve(args.projectDir ?? process.cwd());
+  const projectDir = path5.resolve(args.projectDir ?? process.cwd());
   const meta = readAppMeta(projectDir);
   const undeclared = undeclaredCapabilities(readAppSourceText(projectDir), meta.capabilities);
   if (undeclared.length > 0) {
@@ -32017,14 +32628,14 @@ async function appDeploy(client, args) {
   writeAppDts(projectDir, { workflows: meta.workflows, queries: meta.queries, agents: meta.agents });
   console.error("Building...");
   await runNpm(["run", "build"], projectDir);
-  const distDir = path4.join(projectDir, "dist");
-  if (!fs3.existsSync(distDir)) {
+  const distDir = path5.join(projectDir, "dist");
+  if (!fs4.existsSync(distDir)) {
     throw new Error(
       `Build did not produce a dist/ directory in ${projectDir}. Check that 'npm run build' is configured correctly (Vite/etc. defaults to dist/).`
     );
   }
-  const tmpSource = path4.join(tmpdir(), `lotics-source-${Date.now()}.tar.gz`);
-  const tmpDist = path4.join(tmpdir(), `lotics-dist-${Date.now()}.tar.gz`);
+  const tmpSource = path5.join(tmpdir(), `lotics-source-${Date.now()}.tar.gz`);
+  const tmpDist = path5.join(tmpdir(), `lotics-dist-${Date.now()}.tar.gz`);
   try {
     console.error("Packaging source...");
     await runTar(
@@ -32046,8 +32657,8 @@ async function appDeploy(client, args) {
     try {
       const result = await client.deployAppVersion({
         app_id: meta.app_id,
-        source_archive: fs3.readFileSync(tmpSource),
-        dist_archive: fs3.readFileSync(tmpDist),
+        source_archive: fs4.readFileSync(tmpSource),
+        dist_archive: fs4.readFileSync(tmpDist),
         prev_version_id: meta.current_version_id,
         message: args.message,
         // Sync apps.queries from the manifest. Server validates each query
@@ -32081,8 +32692,8 @@ async function appDeploy(client, args) {
       throw err2;
     }
   } finally {
-    if (fs3.existsSync(tmpSource)) fs3.unlinkSync(tmpSource);
-    if (fs3.existsSync(tmpDist)) fs3.unlinkSync(tmpDist);
+    if (fs4.existsSync(tmpSource)) fs4.unlinkSync(tmpSource);
+    if (fs4.existsSync(tmpDist)) fs4.unlinkSync(tmpDist);
   }
 }
 async function warnIfUnbranded(client, appId) {
@@ -32103,7 +32714,7 @@ async function warnIfUnbranded(client, appId) {
   }
 }
 async function appDev(client, args) {
-  const projectDir = path4.resolve(args.projectDir ?? process.cwd());
+  const projectDir = path5.resolve(args.projectDir ?? process.cwd());
   const meta = readAppMeta(projectDir);
   writeAppDts(projectDir, { workflows: meta.workflows, queries: meta.queries, agents: meta.agents });
   const app = await client.getApp(meta.app_id);
@@ -32146,6 +32757,284 @@ async function appDev(client, args) {
   console.error("\nStopping\u2026");
   await handle.stop();
 }
+function parseCreatedRecords(value) {
+  if (!Array.isArray(value)) return [];
+  const groups = [];
+  for (const entry of value) {
+    if (!entry || typeof entry !== "object") continue;
+    const tableId = entry.table_id;
+    const recordIds = entry.record_ids;
+    if (typeof tableId !== "string" || !Array.isArray(recordIds)) continue;
+    const ids = recordIds.filter((id) => typeof id === "string");
+    if (ids.length > 0) groups.push({ table_id: tableId, record_ids: ids });
+  }
+  return groups;
+}
+function parseIrreversibleToolNames(value) {
+  if (!Array.isArray(value)) return [];
+  const names = [];
+  for (const entry of value) {
+    if (!entry || typeof entry !== "object") continue;
+    const name = entry.tool_name;
+    if (typeof name === "string" && !names.includes(name)) names.push(name);
+  }
+  return names;
+}
+function printSideEffects(summary) {
+  const created = parseCreatedRecords(summary.created_records);
+  const irreversibleTools = parseIrreversibleToolNames(summary.irreversible_tool_calls);
+  const subWorkflows = summary.sub_workflows_possible === true;
+  console.error("\nCreated records:");
+  if (created.length === 0) {
+    console.error("  (none with ids to clean up)");
+  } else {
+    for (const group of created) {
+      console.error(`  ${group.table_id}: ${group.record_ids.length} record(s)`);
+      const payload = JSON.stringify({ table_id: group.table_id, record_ids: group.record_ids });
+      console.error(`    lotics run delete_records '${payload}'`);
+    }
+  }
+  const irreversiblePart = irreversibleTools.length > 0 ? `Could NOT auto-undo (clean up manually): ${irreversibleTools.join(", ")}.` : "Could NOT auto-undo: none.";
+  const subPart = subWorkflows ? " Sub-workflows may have run (after_* table workflows) \u2014 their effects are NOT in this list." : "";
+  console.error(`
+${irreversiblePart}${subPart}`);
+}
+async function cleanupCreatedRecords(client, created) {
+  if (created.length === 0) {
+    console.error("\nNo created records to clean up.");
+    return true;
+  }
+  console.error("\nCleaning up created records (delete_records \u2014 records only):");
+  let allDeleted = true;
+  for (const group of created) {
+    const res = await client.execute("delete_records", {
+      table_id: group.table_id,
+      record_ids: group.record_ids
+    });
+    if (res.error) {
+      console.error(`  \u2717 ${group.table_id}: ${res.error}`);
+      allDeleted = false;
+    } else {
+      console.error(`  \u2713 ${group.table_id}: deleted ${group.record_ids.length} record(s)`);
+    }
+  }
+  return allDeleted;
+}
+async function appExecuteWorkflow(client, args) {
+  const meta = readAppMeta(process.cwd());
+  const result = await client.appWorkflow(meta.app_id, args.alias, args.inputs);
+  console.log(JSON.stringify(result, null, 2));
+  const status = typeof result.status === "string" ? result.status : "unknown";
+  const message = typeof result.message === "string" ? result.message : "";
+  console.error(`Workflow "${args.alias}" \u2192 ${status}${message ? `: ${message}` : ""}`);
+  let cleanupFailed = false;
+  if ((args.printCreated || args.cleanup) && result.side_effects) {
+    printSideEffects(result.side_effects);
+    if (args.cleanup) {
+      const allDeleted = await cleanupCreatedRecords(
+        client,
+        parseCreatedRecords(result.side_effects.created_records)
+      );
+      cleanupFailed = !allDeleted;
+    }
+  } else if (args.printCreated || args.cleanup) {
+    console.error("\n(no side-effect summary returned by the server)");
+  }
+  if (status === "error" || cleanupFailed) process.exit(1);
+}
+async function appWorkflowSet(client, args) {
+  const projectDir = process.cwd();
+  const meta = readAppMeta(projectDir);
+  const declaration = meta.workflows?.[args.alias];
+  if (!declaration) {
+    console.error(
+      `No workflow "${args.alias}" in package.json#lotics.workflows. Bind it first (set_app_workflow), then 'lotics app pull' to write its body and manifest entry.`
+    );
+    process.exit(1);
+  }
+  const file = workflowFilePath(projectDir, args.alias);
+  if (!fs4.existsSync(file)) {
+    console.error(
+      `No workflow body at ${path5.relative(projectDir, file)}. Run 'lotics app pull ${meta.app_id}' to write src/workflows/${args.alias}.ts, then edit it.`
+    );
+    process.exit(1);
+  }
+  const source = stripWorkflowHeader(fs4.readFileSync(file, "utf-8"));
+  if (source.trim() === "") {
+    console.error(`Workflow body ${path5.relative(projectDir, file)} is empty after stripping the header.`);
+    process.exit(1);
+  }
+  const res = await client.setAppWorkflow(meta.app_id, args.alias, {
+    source,
+    inputs: declaration.inputs,
+    outputs: declaration.outputs
+  });
+  if (res.error) {
+    console.error(`Failed to set workflow "${args.alias}": ${res.error}`);
+    process.exit(1);
+  }
+  const result = res.result ?? {};
+  const workflowId = typeof result.workflow_id === "string" ? result.workflow_id : "(unknown)";
+  console.error(`Set workflow "${args.alias}" \u2192 ${workflowId}`);
+  if (result.outputs && typeof result.outputs === "object") {
+    console.error(`  result.data schema: ${JSON.stringify(result.outputs)}`);
+  }
+}
+async function appWorkflowPull(client) {
+  const projectDir = process.cwd();
+  const meta = readAppMeta(projectDir);
+  const app = await client.getApp(meta.app_id);
+  const aliases = Object.keys(app.workflows ?? {});
+  if (aliases.length === 0) {
+    console.error(`App ${meta.app_id} has no bound workflows.`);
+    return;
+  }
+  const written = await writeWorkflowFiles(client, projectDir, meta.app_id, aliases);
+  console.error(
+    `Wrote ${written.length} workflow ${written.length === 1 ? "body" : "bodies"} to ${WORKFLOWS_DIR}/` + (written.length > 0 ? ` (${written.join(", ")})` : "")
+  );
+  ensureWorkflowTsconfigExcludes(projectDir);
+}
+async function appWorkflowCheck(args) {
+  const projectDir = process.cwd();
+  const meta = readAppMeta(projectDir);
+  const bound = Object.keys(meta.workflows ?? {});
+  let aliases;
+  if (args.alias) {
+    if (!bound.includes(args.alias)) {
+      console.error(
+        `No workflow "${args.alias}" in package.json#lotics.workflows. Bound aliases: ${bound.length > 0 ? bound.join(", ") : "(none)"}.`
+      );
+      process.exit(1);
+    }
+    aliases = [args.alias];
+  } else {
+    aliases = bound;
+  }
+  if (aliases.length === 0) {
+    console.error(`App ${meta.app_id} has no bound workflows to check.`);
+    return;
+  }
+  const toCheck = [];
+  for (const alias of aliases) {
+    const bodyPath = workflowFilePath(projectDir, alias);
+    const globalsPath = workflowGlobalsPath(projectDir, alias);
+    if (!fs4.existsSync(bodyPath)) {
+      console.error(
+        `\u26A0 Skipped "${alias}" \u2014 no body at ${path5.relative(projectDir, bodyPath)}. Run 'lotics app workflow pull' to write it.`
+      );
+      continue;
+    }
+    if (!fs4.existsSync(globalsPath)) {
+      console.error(
+        `Cannot check "${alias}" \u2014 missing types at ${path5.relative(projectDir, globalsPath)}. Run 'lotics app workflow pull' (or 'lotics app codegen') to fetch them.`
+      );
+      process.exit(1);
+    }
+    toCheck.push({ alias, input: { bodyPath, globalsPath } });
+  }
+  if (toCheck.length === 0) {
+    console.error("No workflow bodies to check (every bound alias was skipped).");
+    return;
+  }
+  const tsApi = await loadProjectTypescript(projectDir);
+  const results = checkWorkflowBodies(tsApi, toCheck);
+  printWorkflowCheckResults(projectDir, results);
+  const failed = results.filter((r) => r.issues.length > 0);
+  if (failed.length > 0) process.exit(1);
+}
+function printWorkflowCheckResults(projectDir, results) {
+  let totalErrors = 0;
+  for (const r of results) {
+    const rel = path5.relative(projectDir, r.bodyPath);
+    if (r.issues.length === 0) {
+      console.error(`\u2713 ${r.alias} (${rel}) \u2014 no type errors`);
+      continue;
+    }
+    totalErrors += r.issues.length;
+    console.error(
+      `\u2717 ${r.alias} (${rel}) \u2014 ${r.issues.length} error${r.issues.length === 1 ? "" : "s"}:`
+    );
+    for (const issue of r.issues) {
+      const [first2, ...rest] = issue.message.split("\n");
+      console.error(`    ${rel}:${issue.line}:${issue.col} - ${issue.code}: ${first2}`);
+      for (const line of rest) console.error(`      ${line}`);
+    }
+  }
+  const passed = results.length - results.filter((r) => r.issues.length > 0).length;
+  console.error(
+    totalErrors === 0 ? results.length === 1 ? `
+The workflow body type-checks clean.` : `
+All ${results.length} workflow bodies type-check clean.` : `
+${totalErrors} error${totalErrors === 1 ? "" : "s"} across ${results.length - passed} of ${results.length} ${results.length === 1 ? "body" : "bodies"}.`
+  );
+}
+function findUiSrcDir(start) {
+  let dir = path5.resolve(start);
+  for (; ; ) {
+    const candidate = path5.join(dir, "packages", "ui", "src");
+    if (fs4.existsSync(candidate) && fs4.statSync(candidate).isDirectory()) return candidate;
+    const parent = path5.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+var UI_ALIAS_FIND_SOURCE = String.raw`/^@lotics\/ui\/(.+)$/`;
+function appUiLink(args) {
+  const projectDir = path5.resolve(args.projectDir ?? process.cwd());
+  const viteConfigPath = path5.join(projectDir, "vite.config.ts");
+  if (!fs4.existsSync(viteConfigPath)) {
+    throw new Error(
+      `No vite.config.ts at ${projectDir}. Run inside a 'lotics app' project directory.`
+    );
+  }
+  const uiSrc = findUiSrcDir(projectDir);
+  if (!uiSrc) {
+    throw new Error(
+      "Cannot find packages/ui/src by walking up from this directory \u2014 `lotics ui link` requires a monorepo checkout. External apps consume @lotics/ui from npm; bump the package version and widen the app's dependency range instead."
+    );
+  }
+  const hasComponent = fs4.existsSync(path5.join(uiSrc, `${args.component}.tsx`)) || fs4.existsSync(path5.join(uiSrc, `${args.component}.ts`)) || fs4.existsSync(path5.join(uiSrc, args.component));
+  if (!hasComponent) {
+    throw new Error(
+      `No '@lotics/ui/${args.component}' under ${uiSrc} (expected ${args.component}.tsx/.ts). Check the component name.`
+    );
+  }
+  const source = fs4.readFileSync(viteConfigPath, "utf-8");
+  const aliasEntry = `{ find: ${UI_ALIAS_FIND_SOURCE}, replacement: ${JSON.stringify(`${uiSrc}/$1`)} },`;
+  const alreadyLinked = source.includes(UI_ALIAS_FIND_SOURCE);
+  if (args.remove) {
+    if (!alreadyLinked) {
+      console.error("No @lotics/ui dev-link alias present \u2014 nothing to remove.");
+      return;
+    }
+    const stripped = source.replace(new RegExp(`^\\s*\\{ find: ${escapeRegExp(UI_ALIAS_FIND_SOURCE)}.*$\\n?`, "m"), "");
+    fs4.writeFileSync(viteConfigPath, stripped);
+    console.error(`Removed the @lotics/ui dev-link alias from ${viteConfigPath}.`);
+    console.error("Restart `lotics app dev` and rm -rf node_modules/.vite to clear cached modules.");
+    return;
+  }
+  if (alreadyLinked) {
+    console.error(`@lotics/ui is already dev-linked in ${viteConfigPath}.`);
+    return;
+  }
+  const aliasMatch = /resolve\s*:\s*\{[\s\S]*?alias\s*:\s*\[/.exec(source);
+  if (!aliasMatch) {
+    throw new Error(
+      `Could not find a resolve.alias array literal in ${viteConfigPath}. Refresh vite.config.ts from the starter (packages/sdk/src/starter_template.ts) and retry.`
+    );
+  }
+  const insertAt = aliasMatch.index + aliasMatch[0].length;
+  const updated = `${source.slice(0, insertAt)}
+      ${aliasEntry}${source.slice(insertAt)}`;
+  fs4.writeFileSync(viteConfigPath, updated);
+  console.error(`Dev-linked @lotics/ui \u2192 ${uiSrc} in ${viteConfigPath}.`);
+  console.error("Restart `lotics app dev` and rm -rf node_modules/.vite to clear cached modules.");
+  console.error("Finalize: PR the packages/ui change \u2192 publish \u2192 `lotics ui link <component> --remove` + bump the app's dep.");
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 
 // src/args.ts
 function parseArgs(argv) {
@@ -32162,6 +33051,8 @@ function parseArgs(argv) {
     message: void 0,
     local: false,
     all: false,
+    printCreated: false,
+    cleanup: false,
     version: false,
     help: false
   };
@@ -32212,6 +33103,13 @@ function parseArgs(argv) {
       case "--all":
         flags.all = true;
         break;
+      case "--print-created":
+      case "--report-effects":
+        flags.printCreated = true;
+        break;
+      case "--cleanup":
+        flags.cleanup = true;
+        break;
       case "--version":
       case "-v":
         flags.version = true;
@@ -32237,12 +33135,40 @@ function parseArgs(argv) {
   return { command, subcommand, toolArgs, restArgs, flags };
 }
 
+// src/inputs.ts
+async function ingestJsonArgs(opts) {
+  let raw = opts.rawArg;
+  if (raw && raw.startsWith("@")) {
+    const argsPath = raw.slice(1);
+    try {
+      raw = opts.readFile(argsPath);
+    } catch (err2) {
+      return {
+        kind: "error",
+        message: `Cannot read args file "${argsPath}": ${err2 instanceof Error ? err2.message : String(err2)}`
+      };
+    }
+  } else if (!raw && !opts.stdinIsTTY) {
+    raw = await opts.readStdin();
+  }
+  if (!raw) return { kind: "ok", args: {} };
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return { kind: "error", message: `JSON args must be an object, got: ${raw}` };
+    }
+    return { kind: "ok", args: parsed };
+  } catch {
+    return { kind: "error", message: `Invalid JSON: ${raw}` };
+  }
+}
+
 // src/xlsx.ts
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 
 // src/file_command_io.ts
-import fs4 from "node:fs";
-import path5 from "node:path";
+import fs5 from "node:fs";
+import path6 from "node:path";
 var CliError = class extends Error {
   constructor(message) {
     super(message);
@@ -32253,14 +33179,14 @@ function fail(message) {
   throw new CliError(message);
 }
 function writeFileAtomic(filePath, bytes) {
-  const dir = path5.dirname(path5.resolve(filePath));
-  const tmp = path5.join(dir, `.${path5.basename(filePath)}.${process.pid}.${Date.now()}.tmp`);
-  fs4.writeFileSync(tmp, bytes);
+  const dir = path6.dirname(path6.resolve(filePath));
+  const tmp = path6.join(dir, `.${path6.basename(filePath)}.${process.pid}.${Date.now()}.tmp`);
+  fs5.writeFileSync(tmp, bytes);
   try {
-    fs4.renameSync(tmp, filePath);
+    fs5.renameSync(tmp, filePath);
   } catch (error) {
     try {
-      fs4.unlinkSync(tmp);
+      fs5.unlinkSync(tmp);
     } catch {
     }
     throw error;
@@ -35043,16 +35969,16 @@ var MatcherView = class {
    * @returns {string|undefined}
    */
   getCurrentTag() {
-    const path7 = this._matcher.path;
-    return path7.length > 0 ? path7[path7.length - 1].tag : void 0;
+    const path8 = this._matcher.path;
+    return path8.length > 0 ? path8[path8.length - 1].tag : void 0;
   }
   /**
    * Get current namespace.
    * @returns {string|undefined}
    */
   getCurrentNamespace() {
-    const path7 = this._matcher.path;
-    return path7.length > 0 ? path7[path7.length - 1].namespace : void 0;
+    const path8 = this._matcher.path;
+    return path8.length > 0 ? path8[path8.length - 1].namespace : void 0;
   }
   /**
    * Get current node's attribute value.
@@ -35060,9 +35986,9 @@ var MatcherView = class {
    * @returns {*}
    */
   getAttrValue(attrName) {
-    const path7 = this._matcher.path;
-    if (path7.length === 0) return void 0;
-    return path7[path7.length - 1].values?.[attrName];
+    const path8 = this._matcher.path;
+    if (path8.length === 0) return void 0;
+    return path8[path8.length - 1].values?.[attrName];
   }
   /**
    * Check if current node has an attribute.
@@ -35070,9 +35996,9 @@ var MatcherView = class {
    * @returns {boolean}
    */
   hasAttr(attrName) {
-    const path7 = this._matcher.path;
-    if (path7.length === 0) return false;
-    const current = path7[path7.length - 1];
+    const path8 = this._matcher.path;
+    if (path8.length === 0) return false;
+    const current = path8[path8.length - 1];
     return current.values !== void 0 && attrName in current.values;
   }
   /**
@@ -35080,18 +36006,18 @@ var MatcherView = class {
    * @returns {number}
    */
   getPosition() {
-    const path7 = this._matcher.path;
-    if (path7.length === 0) return -1;
-    return path7[path7.length - 1].position ?? 0;
+    const path8 = this._matcher.path;
+    if (path8.length === 0) return -1;
+    return path8[path8.length - 1].position ?? 0;
   }
   /**
    * Get current node's repeat counter (occurrence count of this tag name).
    * @returns {number}
    */
   getCounter() {
-    const path7 = this._matcher.path;
-    if (path7.length === 0) return -1;
-    return path7[path7.length - 1].counter ?? 0;
+    const path8 = this._matcher.path;
+    if (path8.length === 0) return -1;
+    return path8[path8.length - 1].counter ?? 0;
   }
   /**
    * Get current node's sibling index (alias for getPosition).
@@ -36946,8 +37872,8 @@ function isAttribute(name) {
 }
 
 // ../../node_modules/fflate/esm/index.mjs
-import { createRequire } from "module";
-var require2 = createRequire("/");
+import { createRequire as createRequire2 } from "module";
+var require2 = createRequire2("/");
 var Worker;
 try {
   Worker = require2("worker_threads").Worker;
@@ -40547,10 +41473,10 @@ function resolveRelativePath(basePath, relativePath) {
   }
   return resolved.join("/");
 }
-function findZipEntry(zipEntries, path7) {
-  if (zipEntries[path7]) return zipEntries[path7];
-  if (zipEntries[`xl/${path7}`]) return zipEntries[`xl/${path7}`];
-  const noSlash = path7.replace(/^\//, "");
+function findZipEntry(zipEntries, path8) {
+  if (zipEntries[path8]) return zipEntries[path8];
+  if (zipEntries[`xl/${path8}`]) return zipEntries[`xl/${path8}`];
+  const noSlash = path8.replace(/^\//, "");
   if (zipEntries[noSlash]) return zipEntries[noSlash];
   return void 0;
 }
@@ -41848,9 +42774,9 @@ function parseExcelFromZip(zip, options) {
   }
   return result;
 }
-function findEntry(zip, path7) {
-  if (zip[path7]) return zip[path7];
-  const lower = path7.toLowerCase();
+function findEntry(zip, path8) {
+  if (zip[path8]) return zip[path8];
+  const lower = path8.toLowerCase();
   for (const key of Object.keys(zip)) {
     if (key.toLowerCase() === lower) return zip[key];
   }
@@ -42461,12 +43387,12 @@ function extractPivotRoundTripInfo(originalZip) {
     if (paths.length > 0) pivotTablesBySheetIndex.set(i2, paths);
   }
   const pivotXmlPaths = [];
-  for (const path7 of Object.keys(originalZip)) {
-    if (path7.startsWith("xl/pivotTables/") && path7.endsWith(".xml")) {
-      pivotXmlPaths.push(path7);
+  for (const path8 of Object.keys(originalZip)) {
+    if (path8.startsWith("xl/pivotTables/") && path8.endsWith(".xml")) {
+      pivotXmlPaths.push(path8);
     }
-    if (path7.startsWith("xl/pivotCache/") && path7.endsWith(".xml")) {
-      pivotXmlPaths.push(path7);
+    if (path8.startsWith("xl/pivotCache/") && path8.endsWith(".xml")) {
+      pivotXmlPaths.push(path8);
     }
   }
   return { cachesByWorkbook, pivotTablesBySheetIndex, pivotXmlPaths };
@@ -42474,15 +43400,15 @@ function extractPivotRoundTripInfo(originalZip) {
 function decode(bytes) {
   return new TextDecoder().decode(bytes);
 }
-function pivotContentTypeFor(path7) {
-  if (path7.startsWith("xl/pivotTables/") && path7.endsWith(".xml")) {
-    return `<Override PartName="/${path7}" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.pivotTable+xml"/>`;
+function pivotContentTypeFor(path8) {
+  if (path8.startsWith("xl/pivotTables/") && path8.endsWith(".xml")) {
+    return `<Override PartName="/${path8}" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.pivotTable+xml"/>`;
   }
-  if (path7.includes("/pivotCacheDefinition") && path7.endsWith(".xml")) {
-    return `<Override PartName="/${path7}" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheDefinition+xml"/>`;
+  if (path8.includes("/pivotCacheDefinition") && path8.endsWith(".xml")) {
+    return `<Override PartName="/${path8}" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheDefinition+xml"/>`;
   }
-  if (path7.includes("/pivotCacheRecords") && path7.endsWith(".xml")) {
-    return `<Override PartName="/${path7}" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheRecords+xml"/>`;
+  if (path8.includes("/pivotCacheRecords") && path8.endsWith(".xml")) {
+    return `<Override PartName="/${path8}" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.pivotCacheRecords+xml"/>`;
   }
   return void 0;
 }
@@ -42554,13 +43480,13 @@ function exportWorkbook(workbook, originalZip) {
       regeneratedPaths.add(`xl/worksheets/sheet${i2 + 1}.xml`);
       regeneratedPaths.add(`xl/worksheets/_rels/sheet${i2 + 1}.xml.rels`);
     }
-    for (const path7 of Object.keys(originalZip)) {
-      if (path7.startsWith("xl/drawings/") || path7.startsWith("xl/charts/") || path7.startsWith("xl/tables/") || path7.startsWith("xl/media/")) {
-        regeneratedPaths.add(path7);
+    for (const path8 of Object.keys(originalZip)) {
+      if (path8.startsWith("xl/drawings/") || path8.startsWith("xl/charts/") || path8.startsWith("xl/tables/") || path8.startsWith("xl/media/")) {
+        regeneratedPaths.add(path8);
       }
     }
-    for (const [path7, data] of Object.entries(originalZip)) {
-      if (!regeneratedPaths.has(path7)) entries[path7] = data;
+    for (const [path8, data] of Object.entries(originalZip)) {
+      if (!regeneratedPaths.has(path8)) entries[path8] = data;
     }
   }
   const sharedStrings = buildSharedStrings(workbook);
@@ -42575,8 +43501,8 @@ function exportWorkbook(workbook, originalZip) {
     buildWorkbookRels(workbook, pivotInfo)
   );
   const extraContentTypes = [];
-  for (const path7 of pivotInfo.pivotXmlPaths) {
-    const ct = pivotContentTypeFor(path7);
+  for (const path8 of pivotInfo.pivotXmlPaths) {
+    const ct = pivotContentTypeFor(path8);
     if (ct) extraContentTypes.push(ct);
   }
   let globalChartIndex = 1;
@@ -44337,14 +45263,14 @@ var DependencyGraph = class {
       stack.push({ cell: p, path: [cell, p] });
     }
     while (stack.length > 0) {
-      const { cell: current, path: path7 } = stack.pop();
-      if (current === cell) return path7;
+      const { cell: current, path: path8 } = stack.pop();
+      if (current === cell) return path8;
       if (visited.has(current)) continue;
       visited.add(current);
       const nextPrec = this.precedents.get(current);
       if (!nextPrec) continue;
       for (const p of nextPrec) {
-        stack.push({ cell: p, path: [...path7, p] });
+        stack.push({ cell: p, path: [...path8, p] });
       }
     }
     return null;
@@ -45335,8 +46261,8 @@ function adjustMergedCellsForColDelete(sheet, atCol, count) {
 
 // src/xlsx.ts
 function loadFile(filePath) {
-  if (!fs5.existsSync(filePath)) fail(`File not found: ${filePath}`);
-  const buffer = fs5.readFileSync(filePath);
+  if (!fs6.existsSync(filePath)) fail(`File not found: ${filePath}`);
+  const buffer = fs6.readFileSync(filePath);
   const arrayBuffer = buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
   const originalZip = unzipXlsx(arrayBuffer);
   const parsed = parseExcelBuffer(arrayBuffer);
@@ -45386,7 +46312,7 @@ function lazyEngine(workbook) {
   };
 }
 function readToJson(filePath) {
-  const buffer = fs5.readFileSync(filePath);
+  const buffer = fs6.readFileSync(filePath);
   const arrayBuffer = buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
   const parsed = parseExcelBuffer(arrayBuffer);
   return {
@@ -45776,7 +46702,7 @@ async function runXlsxCommand(subcommand, toolArgs, restArgs) {
 }
 
 // src/docx.ts
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 
 // ../docx/src/parse/parser.ts
 var import_jszip = __toESM(require_lib3(), 1);
@@ -47547,11 +48473,11 @@ async function parseDocx(buffer) {
   const zip = await import_jszip.default.loadAsync(buffer);
   const parts = /* @__PURE__ */ new Map();
   const filePromises = [];
-  zip.forEach((path7, file) => {
+  zip.forEach((path8, file) => {
     if (file.dir) return;
     filePromises.push(
       file.async("uint8array").then((bytes) => {
-        parts.set(path7, bytes);
+        parts.set(path8, bytes);
       })
     );
   });
@@ -47780,9 +48706,9 @@ var DEFAULT_PARTS = [
   ["word/theme/theme1.xml", () => encoder.encode(THEME_XML)]
 ];
 function fillDefaultParts(parts) {
-  for (const [path7, makeBytes] of DEFAULT_PARTS) {
-    if (!parts.has(path7)) {
-      parts.set(path7, makeBytes());
+  for (const [path8, makeBytes] of DEFAULT_PARTS) {
+    if (!parts.has(path8)) {
+      parts.set(path8, makeBytes());
     }
   }
   return parts;
@@ -47792,9 +48718,9 @@ function fillDefaultParts(parts) {
 async function serializeDocx(doc) {
   const zip = new import_jszip2.default();
   const parts = fillDefaultParts(new Map(doc.parts));
-  for (const [path7, bytes] of parts) {
-    if (path7 === "word/document.xml") continue;
-    zip.file(path7, bytes);
+  for (const [path8, bytes] of parts) {
+    if (path8 === "word/document.xml") continue;
+    zip.file(path8, bytes);
   }
   const documentXml = serializeDocumentXml(doc);
   zip.file("word/document.xml", documentXml);
@@ -47880,8 +48806,8 @@ var DEFAULT_DOC_ATTRS = {
   "@_xmlns:w": "http://schemas.openxmlformats.org/wordprocessingml/2006/main"
 };
 async function loadFile2(filePath) {
-  if (!fs6.existsSync(filePath)) fail(`File not found: ${filePath}`);
-  const bytes = fs6.readFileSync(filePath);
+  if (!fs7.existsSync(filePath)) fail(`File not found: ${filePath}`);
+  const bytes = fs7.readFileSync(filePath);
   return parseDocx(new Uint8Array(bytes));
 }
 async function writeDoc(filePath, doc) {
@@ -48170,6 +49096,8 @@ async function runDocxCommand(subcommand, toolArgs, restArgs) {
 }
 
 // src/cli.ts
+dns.setDefaultResultOrder("ipv4first");
+net2.setDefaultAutoSelectFamilyAttemptTimeout(2e3);
 function printHelp() {
   console.log(`Lotics CLI v${VERSION} \u2014 AI agent interface for Lotics
 
@@ -48226,9 +49154,23 @@ COMMANDS
   lotics app deploy [-m <message>]     Build + upload current dir as a new version
                                        (code + queries only \u2014 workflow bindings are
                                        managed by set_app_workflow / remove_app_workflow)
+  lotics app codegen [path]            Regenerate .lotics/* (types + field/option ids)
+                                       from the manifest + workspace schema \u2014 no deploy
+  lotics app workflow run <alias> '<json>'  Execute a bound app workflow end-to-end
+                                       (inputs: inline JSON, @file, or stdin;
+                                        --print-created reports created records +
+                                        a paste-ready cleanup plan; --cleanup also
+                                        deletes those records \u2014 NOT a rollback)
+  lotics app workflow set <alias>      Push the edited src/workflows/<alias>.ts body
+                                       through set_app_workflow (server verifies)
+  lotics app workflow pull             Rewrite src/workflows/*.ts from the server
+  lotics app workflow check [alias]    Typecheck src/workflows bodies locally (one
+                                       isolated program per alias; the app's own tsc)
   lotics app subdomain <new-subdomain> Rename the app's public <slug>.lotics.app address
   lotics app rename "<new name>"       Rename the app's display name (launcher title)
   lotics app dev [path]                Run the app locally with HMR (RPC forwarded to prod)
+  lotics ui link <component> [--remove] Dev-link @lotics/ui to the monorepo's
+                                       packages/ui/src for live HMR (monorepo only)
   lotics xlsx <subcommand> ...         Read/write/edit .xlsx files on your local filesystem
                                        (uses the bundled Lotics xlsx engine; prefer over
                                        npm xlsx/exceljs for round-trip fidelity)
@@ -48331,8 +49273,8 @@ function prompt(question) {
     });
   });
 }
-async function publicPost(path7, body) {
-  const response = await fetch(`${API_BASE_URL}${path7}`, {
+async function publicPost(path8, body) {
+  const response = await fetch(`${API_BASE_URL}${path8}`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(body)
@@ -48478,13 +49420,13 @@ async function resolveWorkspace(client, ctx) {
 function resolveUploadPaths(rawPaths) {
   const result = [];
   for (const p of rawPaths) {
-    const resolved = path6.resolve(p);
-    const stat = fs7.statSync(resolved);
+    const resolved = path7.resolve(p);
+    const stat = fs8.statSync(resolved);
     if (stat.isDirectory()) {
-      const entries = fs7.readdirSync(resolved, { withFileTypes: true });
+      const entries = fs8.readdirSync(resolved, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isFile()) {
-          result.push(path6.join(resolved, entry.name));
+          result.push(path7.join(resolved, entry.name));
         }
       }
     } else {
@@ -48588,6 +49530,38 @@ async function main() {
     await runDocxCommand(subcommand, toolArgs, restArgs);
     return;
   }
+  if (command === "ui") {
+    if (subcommand === "link") {
+      const component = toolArgs;
+      if (!component) {
+        console.error("Usage: lotics ui link <component> [--remove]");
+        console.error("Dev-links @lotics/ui to the monorepo's packages/ui/src for live HMR.");
+        process.exit(1);
+      }
+      appUiLink({ component, remove: restArgs.includes("--remove") });
+      return;
+    }
+    console.error(`Unknown ui subcommand: ${subcommand ?? "(none)"}`);
+    console.error("Usage: lotics ui link <component> [--remove]");
+    process.exit(1);
+  }
+  if (command === "app" && subcommand === "workflow" && toolArgs === "check") {
+    await appWorkflowCheck({ alias: restArgs[0] });
+    return;
+  }
+  if (command === "app" && subcommand === "codegen") {
+    const projectDir = toolArgs;
+    const ctx2 = resolveContext(flags);
+    if (!ctx2) {
+      await appCodegen({ projectDir });
+      return;
+    }
+    const viewAsMemberId = flags.viewAs ?? process.env.LOTICS_VIEW_AS;
+    const client2 = new LoticsClient({ apiKey: ctx2.apiKey, workspaceId: ctx2.workspaceId, viewAsMemberId });
+    await resolveWorkspace(client2, ctx2);
+    await appCodegen({ projectDir, client: client2 });
+    return;
+  }
   if (command === "org") {
     const global2 = loadGlobalConfig() ?? {};
     const profiles = global2.profiles ?? {};
@@ -48655,6 +49629,11 @@ async function main() {
     console.error("  lotics app create <name> [path]      Scaffold a new app locally");
     console.error("  lotics app pull <app_id> [path]      Pull an existing app for local editing");
     console.error("  lotics app deploy [-m <message>]     Build + upload the current directory");
+    console.error("  lotics app codegen [path]            Regenerate .lotics/* (types + field ids) \u2014 no deploy");
+    console.error("  lotics app workflow run <alias> '<json>'  Execute a bound app workflow end-to-end");
+    console.error("  lotics app workflow set <alias>           Push the edited src/workflows/<alias>.ts body");
+    console.error("  lotics app workflow pull                  Rewrite src/workflows/*.ts from the server");
+    console.error("  lotics app workflow check [alias]         Typecheck src/workflows bodies locally");
     console.error("  lotics app subdomain <new-subdomain> Rename the app's public <slug>.lotics.app address");
     console.error(`  lotics app rename "<new name>"        Rename the app's display name (launcher title)`);
     console.error("  lotics app dev [path]                Run the app locally with HMR + RPC forwarding");
@@ -48796,6 +49775,60 @@ Available workspaces:`);
       await appRename(client, { name: newName });
       return;
     }
+    if (subcommand === "workflow") {
+      const action = toolArgs;
+      const workflowUsage = () => {
+        console.error("Usage:");
+        console.error("  lotics app workflow run <alias> '<json>'   Execute a bound app workflow");
+        console.error("  lotics app workflow set <alias>            Push src/workflows/<alias>.ts");
+        console.error("  lotics app workflow pull                   Rewrite src/workflows/*.ts from the server");
+        console.error("  lotics app workflow check [alias]          Typecheck src/workflows bodies locally");
+        process.exit(1);
+      };
+      if (action === "run") {
+        const alias = restArgs[0];
+        if (!alias) {
+          console.error("Usage: lotics app workflow run <alias> '<json>'");
+          console.error("       lotics app workflow run <alias> @inputs.json   (read inputs from a file)");
+          console.error("       cat inputs.json | lotics app workflow run <alias>   (read inputs from stdin)");
+          console.error("Flags: --print-created (report created records + cleanup plan + caveat)");
+          console.error("       --cleanup (also delete the created records \u2014 records only, NOT a rollback)");
+          process.exit(1);
+        }
+        const ingested = await ingestJsonArgs({
+          rawArg: restArgs[1],
+          stdinIsTTY: process.stdin.isTTY ?? false,
+          readFile: (p) => fs8.readFileSync(p, "utf-8"),
+          readStdin
+        });
+        if (ingested.kind === "error") {
+          console.error(ingested.message);
+          process.exit(1);
+        }
+        await appExecuteWorkflow(client, {
+          alias,
+          inputs: ingested.args,
+          printCreated: flags.printCreated,
+          cleanup: flags.cleanup
+        });
+        return;
+      }
+      if (action === "set") {
+        const alias = restArgs[0];
+        if (!alias) {
+          console.error("Usage: lotics app workflow set <alias>");
+          console.error("Pushes the edited src/workflows/<alias>.ts body via set_app_workflow.");
+          process.exit(1);
+        }
+        await appWorkflowSet(client, { alias });
+        return;
+      }
+      if (action === "pull") {
+        await appWorkflowPull(client);
+        return;
+      }
+      workflowUsage();
+    }
     if (subcommand === "dev") {
       const projectDir = toolArgs;
       let port;
@@ -48894,29 +49927,17 @@ ${JSON.stringify(info.input_schema, null, 2)}`);
   }
   if (command === "run") {
     const toolName = subcommand;
-    let rawArgs = toolArgs;
-    if (rawArgs && rawArgs.startsWith("@")) {
-      const argsPath = rawArgs.slice(1);
-      try {
-        rawArgs = fs7.readFileSync(argsPath, "utf-8");
-      } catch (err2) {
-        console.error(
-          `Cannot read args file "${argsPath}": ${err2 instanceof Error ? err2.message : String(err2)}`
-        );
-        process.exit(1);
-      }
-    } else if (!rawArgs && !process.stdin.isTTY) {
-      rawArgs = await readStdin();
-    }
-    let args = {};
-    if (rawArgs) {
-      try {
-        args = JSON.parse(rawArgs);
-      } catch {
-        console.error(`Invalid JSON: ${rawArgs}`);
-        process.exit(1);
-      }
+    const ingested = await ingestJsonArgs({
+      rawArg: toolArgs,
+      stdinIsTTY: process.stdin.isTTY ?? false,
+      readFile: (p) => fs8.readFileSync(p, "utf-8"),
+      readStdin
+    });
+    if (ingested.kind === "error") {
+      console.error(ingested.message);
+      process.exit(1);
     }
+    const args = ingested.args;
     const timeoutMs = flags.timeout ?? 6e4;
     const result = await client.execute(toolName, args, { format: "text", timeoutMs });
     if (result.error) {