@montytools/cli 0.2.9 → 0.2.10

package/bin/monty.mjs

@@ -13,6 +13,7 @@ import { basename, dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { CATALOG, REGISTRIES } from "./catalog.mjs";
+import { CompileError, compileAppConfig } from "../lib/compile.mjs";
 
 const CONFIG_DIR = join(homedir(), ".monty");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
@@ -35,17 +36,73 @@ function fail(code, fix) {
   process.exit(1);
 }
 
-function loadConfig() {
+// ── Profiles & the .montyrc directory pin ──────────────────────────────────
+// One key PER HOST (like kubectl contexts): logging into the local platform
+// host never clobbers the prod key. Which host a command targets resolves,
+// in order: MONTY_HOST env → nearest .montyrc walking up from cwd (a
+// committable, secret-free { "host": "…" } — the venv-style pin: the
+// platform repo carries one pointing at the local host, so every monty
+// command inside it targets the dev platform) → the config's defaultHost →
+// usemonty.dev. Keys always come from the per-host profile store.
+
+function findMontyrcHost(startDir) {
+  let dir = startDir;
+  for (let i = 0; i < 30; i++) {
+    const p = join(dir, ".montyrc");
+    if (existsSync(p)) {
+      try {
+        const host = JSON.parse(readFileSync(p, "utf8")).host;
+        if (typeof host === "string" && /^https?:\/\//.test(host)) {
+          return host.replace(/\/+$/, "");
+        }
+      } catch { /* malformed pin — ignore and keep walking */ }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+
+// Reads config.json in either shape: legacy { host, key } (migrated on the
+// next login) or { defaultHost, profiles: { [host]: { key } } }.
+function normalizedConfig() {
+  let raw = null;
   try {
-    return JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
-  } catch {
-    return null;
+    raw = JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
+  } catch { /* not logged in anywhere yet */ }
+  if (!raw) return { defaultHost: null, profiles: {} };
+  if (raw.profiles && typeof raw.profiles === "object") {
+    return { defaultHost: raw.defaultHost ?? null, profiles: raw.profiles };
   }
+  const legacyHost = (raw.host ?? DEFAULT_HOST).replace(/\/+$/, "");
+  return {
+    defaultHost: legacyHost,
+    profiles: raw.key ? { [legacyHost]: { key: raw.key } } : {},
+  };
+}
+
+function resolveHost() {
+  return (
+    (process.env.MONTY_HOST ?? "").replace(/\/+$/, "") ||
+    findMontyrcHost(process.cwd()) ||
+    normalizedConfig().defaultHost ||
+    DEFAULT_HOST
+  );
+}
+
+// Same call-site shape as before ({ host, key }) — host is now always the
+// RESOLVED host and key is that host's profile key (null when not logged in
+// to this host, even if other profiles exist).
+function loadConfig() {
+  const host = resolveHost();
+  return { host, key: normalizedConfig().profiles[host]?.key ?? null };
 }
 
 // ── monty login ────────────────────────────────────────────────────────────
 async function login() {
-  const host = flag("host") ?? DEFAULT_HOST;
+  const pinnedHost = findMontyrcHost(process.cwd());
+  const host = (flag("host") ?? resolveHost()).replace(/\/+$/, "");
   let key = flag("key");
   if (!key) {
     // Browser flow: loopback callback + explicit Authorize click in the host.
@@ -61,10 +118,23 @@ async function login() {
   if (!/^mk_[0-9a-f]{48}$/.test(key)) {
     fail("INVALID_CLI_KEY", `That does not look like a Monty CLI key (mk_ + 48 hex chars). Create one at ${host}/cli-auth.`);
   }
+  // Merge into the per-host profile store — other hosts' keys survive.
+  // defaultHost only moves when the user chose the host explicitly (flag) or
+  // no pin drove the choice; a .montyrc-pinned login stays scoped to its
+  // directory and leaves the machine-wide default alone.
+  const cfg = normalizedConfig();
+  cfg.profiles[host] = { key };
+  const defaultHost =
+    flag("host") || !pinnedHost || !cfg.defaultHost ? host : cfg.defaultHost;
   mkdirSync(CONFIG_DIR, { recursive: true });
-  writeFileSync(CONFIG_PATH, JSON.stringify({ host, key }, null, 2) + "\n");
+  writeFileSync(
+    CONFIG_PATH,
+    JSON.stringify({ defaultHost, profiles: cfg.profiles }, null, 2) + "\n",
+  );
   mkdirSync(MONTY_HOME, { recursive: true });
-  console.log(`logged-in: ${host} (key saved to ~/.monty/config.json)`);
+  console.log(`logged-in: ${host} (profile saved to ~/.monty/config.json)`);
+  const others = Object.keys(cfg.profiles).filter((h) => h !== host);
+  if (others.length) console.log(`profiles: ${host} (active here)${pinnedHost ? " via .montyrc" : ""}, ${others.join(", ")}`);
   console.log(`apps home: ${MONTY_HOME}`);
   installSkills({ silent: false });
 }
@@ -427,7 +497,8 @@ async function freePort(start) {
 // Apps pin @montytools/sdk at scaffold time and go stale — the CLI knows the
 // minimum SDK its workflows need (e.g. tunnel-host allowlisting lives in the
 // SDK's vite plugin) and upgrades the app automatically before dev/deploy.
-const MIN_SDK = "0.1.2";
+const MIN_SDK = "0.1.3";
+const SDK_VITE_CACHE_STAMP = "sdk-vite-cache-version";
 
 function installedSdkVersion(appDir) {
   try {
@@ -451,23 +522,46 @@ function semverLt(a, b) {
 
 function ensureSdk(appDir) {
   const v = installedSdkVersion(appDir);
-  if (v && !semverLt(v, MIN_SDK)) return;
-  console.log(
-    v
-      ? `sdk: installed ${v} < required ${MIN_SDK} — updating @montytools/sdk`
-      : "sdk: @montytools/sdk missing — installing",
-  );
-  const pm = spawnSync("pnpm", ["--version"], { stdio: "ignore" }).status === 0 ? "pnpm" : "npm";
-  run(appDir, "sdk-update", [pm, "install", "@montytools/sdk@latest"],
-    "Could not update @montytools/sdk. Run the install manually in the app folder, then retry.");
+  if (!v || semverLt(v, MIN_SDK)) {
+    console.log(
+      v
+        ? `sdk: installed ${v} < required ${MIN_SDK} — updating @montytools/sdk`
+        : "sdk: @montytools/sdk missing — installing",
+    );
+    const pm = spawnSync("pnpm", ["--version"], { stdio: "ignore" }).status === 0 ? "pnpm" : "npm";
+    run(appDir, "sdk-update", [pm, "install", "@montytools/sdk@latest"],
+      "Could not update @montytools/sdk. Run the install manually in the app folder, then retry.");
+  }
+  syncSdkViteCache(appDir);
+}
+
+function syncSdkViteCache(appDir) {
+  const v = installedSdkVersion(appDir);
+  if (!v) return;
+  const stampDir = join(appDir, ".monty");
+  const stampPath = join(stampDir, SDK_VITE_CACHE_STAMP);
+  let stamped = null;
+  try {
+    stamped = readFileSync(stampPath, "utf8").trim();
+  } catch {
+    stamped = null;
+  }
+  if (stamped === v) return;
+  const cacheDir = join(appDir, "node_modules", ".vite");
+  if (existsSync(cacheDir)) {
+    rmSync(cacheDir, { recursive: true, force: true });
+    console.log(`vite: cleared dependency cache for @montytools/sdk ${v}`);
+  }
+  mkdirSync(stampDir, { recursive: true });
+  writeFileSync(stampPath, `${v}\n`);
 }
 
 // ── monty dev ──────────────────────────────────────────────────────────────
-// Development mode: vite locally + a Cloudflare quick tunnel registered as
-// the app's DEV channel, so workspace admins see the app live (HMR included)
+// Puts the app in Studio: vite locally + a Cloudflare quick tunnel registered
+// as the app's STUDIO channel, so workspace admins see the app (HMR included)
 // at usemonty.dev while it runs. Data is #dev-sandboxed automatically (vite
 // dev build). The heartbeat doubles as the publish poll: when an owner
-// clicks Publish in the workspace, this process builds + uploads for real.
+// clicks Publish in the workspace, this process builds + uploads to Live.
 async function dev() {
   const appDir = requireAppDir("dev");
   ensureSdk(appDir);
@@ -492,9 +586,9 @@ async function dev() {
   const sessionId = `dev_${randomBytes(16).toString("hex")}`;
   const buildFile = join(appDir, ".monty", "build");
   const buildId = existsSync(buildFile) ? readFileSync(buildFile, "utf8").trim() : undefined;
-  // The DEV schema channel: heartbeats carry the compiled schema, and edits
-  // to monty.config.ts are re-compiled (softly) so schema changes reach the
-  // platform within one heartbeat. Publish owns the PROD schema.
+  // The STUDIO schema channel: heartbeats carry the compiled schema, and
+  // edits to monty.config.ts are re-compiled (softly) so schema changes reach
+  // the platform within one heartbeat. Publish owns the LIVE schema.
   let currentMeta = meta;
   const configPath = join(appDir, "monty.config.ts");
   let configMtime = statSync(configPath).mtimeMs;
@@ -508,7 +602,7 @@ async function dev() {
       if (fresh) {
         currentMeta = fresh;
         console.log(
-          `schema: monty.config.ts changed — dev schema updated (${Object.keys(fresh.schemaJson.tables).length} tables)`,
+          `schema: monty.config.ts changed — Studio schema updated (${Object.keys(fresh.schemaJson.tables).length} tables)`,
         );
       }
     } catch { /* transient fs hiccup — next beat retries */ }
@@ -560,6 +654,9 @@ async function dev() {
           icon: currentMeta.icon,
           buildId,
           schemaJson: currentMeta.schemaJson,
+          // The expose block rides the same compile as the schema — the dev
+          // visitor preview is gated on it (devExposureJson).
+          exposure: currentMeta.exposure,
         }),
         signal: AbortSignal.timeout(DEV_SESSION_REQUEST_TIMEOUT_MS),
       });
@@ -583,7 +680,7 @@ async function dev() {
           pub.on("exit", (code) => {
             console.log(
               code === 0
-                ? "publish: done — the workspace now serves the new version (dev session continues)"
+                ? "publish: done — the app is Live for the workspace (Studio session continues)"
                 : "publish: FAILED — fix the errors above, then click Publish again",
             );
             resolve(undefined);
@@ -600,7 +697,7 @@ async function dev() {
 
   async function startDevSession() {
     if (!cfg?.key) {
-      console.log("dev: not logged in — workspace dev mode disabled (run `monty login`)");
+      console.log("dev: not logged in — workspace Studio disabled (run `monty login`)");
       return;
     }
     await clearDevSession();
@@ -618,7 +715,7 @@ async function dev() {
       if (ended || version !== tunnelVersion) return "superseded";
       if (!dnsLive) {
         if (initial) {
-          console.log("tunnel: DNS never propagated — dev mode registered on localhost (visible on this machine's browser only)");
+          console.log("tunnel: DNS never propagated — Studio registered on localhost (visible on this machine's browser only)");
         } else {
           console.log("tunnel: DNS never propagated for the new URL — keeping Studio offline until the next tunnel URL");
         }
@@ -647,13 +744,13 @@ async function dev() {
         console.log(`tunnel: ${t.url}`);
         await activateTunnelUrl(t.url, { initial: true });
       } else {
-        console.log("tunnel: unavailable — dev mode registered on localhost (visible on this machine's browser only)");
+        console.log("tunnel: unavailable — Studio registered on localhost (visible on this machine's browser only)");
       }
     }
     const registered = await heartbeat(originUrl, { claim: true });
     console.log(
       registered
-        ? `studio: ${host}/studio/${meta.slug} — your app is live there while this runs; click Publish to ship`
+        ? `studio: ${host}/studio/${meta.slug} — your app runs there while this is up; click Publish to go Live`
         : `studio: waiting for ${host}/api/dev-session — leave this running; the next heartbeat will retry`,
     );
     hbTimer = setInterval(() => void heartbeat(originUrl), DEV_SESSION_HEARTBEAT_MS);
@@ -665,7 +762,7 @@ async function dev() {
     process.stdout.write(text);
     if (!announced && /localhost:\d+/.test(text)) {
       announced = true;
-      console.log(`data: sandboxed to "${meta.slug}#dev" (live records untouched)`);
+      console.log(`data: sandboxed to "${meta.slug}#dev" (Studio sandbox; Live records untouched)`);
       console.log(`ready: http://localhost:${port}`);
       void startDevSession();
     }
@@ -719,7 +816,7 @@ async function waitForDns(hostname) {
 
 // Cloudflare quick tunnel via the cloudflared npm wrapper (downloads the
 // binary on first use). Resolves with the public URL, or null on failure —
-// dev mode then falls back to localhost-only registration.
+// Studio then falls back to localhost-only registration.
 function startTunnel(port, onUrlChange) {
   return new Promise((resolve) => {
     let child;
@@ -862,12 +959,56 @@ async function docs() {
     `Could not view ${name}. Run \`monty components\` to see the curated catalog.`);
 }
 
+// ── monty secret ─────────────────────────────────────────────────────────
+// `monty secret set KEY [value]` / `monty secret rm KEY` — per-app
+// server-function secrets. The value goes to Cloudflare's per-script secrets
+// layer for THIS app's fn-worker via the host; never stored by Monty, never
+// readable back. Read from the arg, then a TTY prompt, then stdin (piping).
+async function secret() {
+  const appDir = requireAppDir("secret");
+  const meta = await compileConfig(appDir);
+  const config = loadConfig();
+  if (!config?.key) fail("NOT_LOGGED_IN", "Run `monty login` first.");
+  const [sub, name] = rest.filter((a) => !a.startsWith("-"));
+  if ((sub !== "set" && sub !== "rm") || !name) {
+    fail("SECRET_USAGE", "Usage: `monty secret set KEY [value]` (omit value to be prompted / piped) or `monty secret rm KEY`.");
+  }
+  if (!/^[A-Z][A-Z0-9_]{0,63}$/.test(name)) {
+    fail("BAD_SECRET_NAME", "Secret names are UPPER_SNAKE_CASE (A-Z, 0-9, _), starting with a letter — e.g. OPENAI_API_KEY.");
+  }
+  const del = sub === "rm";
+  let value;
+  if (!del) {
+    value = rest.filter((a) => !a.startsWith("-"))[2];
+    if (value === undefined) {
+      if (process.stdin.isTTY) {
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        value = (await rl.question(`value for ${name}: `)).trim();
+        rl.close();
+      } else {
+        value = readFileSync(0, "utf8").trim(); // piped
+      }
+    }
+    if (!value) fail("EMPTY_SECRET", "No value provided.");
+  }
+  const res = await fetch(`${config.host}/api/secret`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${config.key}`, "content-type": "application/json" },
+    body: JSON.stringify({ slug: meta.slug, name, ...(del ? { delete: true } : { value }) }),
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.ok) {
+    fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Could not change the secret.");
+  }
+  console.log(del ? `secret: removed ${name} from ${meta.slug}` : `secret: set ${name} on ${meta.slug} (write-only; not readable back)`);
+}
+
 // ── monty deploy ───────────────────────────────────────────────────────────
 async function deploy() {
   const appDir = requireAppDir("deploy");
   ensureSdk(appDir);
   if (!rest.includes("--from-dev")) {
-    console.log("note: direct deploy skips workspace review — the usual flow is `monty dev` + the Publish button in the workspace.");
+    console.log("note: direct deploy ships straight to Live, skipping workspace review — the usual flow is `monty dev` (Studio) + the Publish button in the workspace.");
   }
   const config = loadConfig();
   if (!config?.key) {
@@ -895,6 +1036,15 @@ async function deploy() {
     meta.buildId = readFileSync(buildFile, "utf8").trim();
   }
   const form = new FormData();
+  // 3a) Server functions (optional): bundle server/index.ts into one worker
+  //     script and ride the SAME deploy. The manifest (fns) goes in meta so
+  //     the router gates /__monty/fn/* without a lookup.
+  const serverBundle = await bundleServerFns(appDir);
+  if (serverBundle) {
+    meta.fns = serverBundle.fns;
+    form.set("server-worker", new Blob([serverBundle.code]), "server-worker.mjs");
+    console.log(`fns: bundled ${serverBundle.fns.length} server function(s) (${serverBundle.fns.join(", ")})`);
+  }
   form.set("monty", JSON.stringify(meta));
   let total = 0;
   for (const file of files) {
@@ -917,49 +1067,95 @@ async function deploy() {
   console.log(`deployed: ${body.url} (version ${body.version})`);
 }
 
-async function compileConfig(appDir, { soft = false } = {}) {
+// Bundle server/index.ts (if present) into ONE Worker script: a generated
+// entry wraps the app's exports with @montytools/sdk/fn-worker's makeFnWorker,
+// esbuild bundles it for workerd. node: imports are rejected at compile time
+// — Live runs on Cloudflare Workers, not Node. Returns { code, fns } or null.
+async function bundleServerFns(appDir) {
+  const serverEntry = join(appDir, "server", "index.ts");
+  if (!existsSync(serverEntry)) return null;
   const { build } = await import("esbuild");
   const tmpDir = join(appDir, ".monty");
   mkdirSync(tmpDir, { recursive: true });
-  const entry = join(tmpDir, "compile-entry.mjs");
-  const out = join(tmpDir, "compile-out.mjs");
+  const entry = join(tmpDir, "fn-worker-entry.mjs");
+  const out = join(tmpDir, "fn-worker-out.mjs");
   writeFileSync(entry, [
-    `import { app } from "../monty.config";`,
-    `import { compileApp } from "@montytools/sdk/compile";`,
-    `process.stdout.write(JSON.stringify(compileApp(app)));`,
+    `import * as appFns from "../server/index";`,
+    `import { makeFnWorker } from "@montytools/sdk/fn-worker";`,
+    `export default makeFnWorker(appFns);`,
   ].join("\n"));
+  // Fail the deploy if server code reaches for Node built-ins — a Worker
+  // can't run them, and a silent runtime crash on Live is the worst outcome.
+  const banPlatformImports = {
+    name: "ban-platform-imports",
+    setup(b) {
+      b.onResolve({ filter: /^node:/ }, (a) => ({
+        errors: [{ text: `server/ cannot import "${a.path}" — server functions run on Cloudflare Workers (Web APIs only: fetch, crypto, URL…), not Node.` }],
+      }));
+      b.onResolve({ filter: /^cloudflare:/ }, (a) => ({
+        errors: [{ text: `server/ cannot import "${a.path}" — Cloudflare bindings are platform-private. Use ctx.records, ctx.secrets, fetch, crypto, and other Web APIs.` }],
+      }));
+    },
+  };
+  let fns;
   try {
     await build({
       entryPoints: [entry],
       outfile: out,
       bundle: true,
-      platform: "node",
       format: "esm",
-      target: "node22",
+      platform: "browser",
+      target: "es2022",
+      conditions: ["workerd", "worker", "browser"],
       absWorkingDir: appDir,
       logLevel: "silent",
+      plugins: [banPlatformImports],
     });
-    const result = spawnSync(process.execPath, [out], { encoding: "utf8" });
-    if (result.status !== 0) {
-      if (soft) {
-        console.log("schema: monty.config.ts doesn't compile right now — keeping the last good schema");
-        return null;
-      }
-      fail("CONFIG_COMPILE_FAILED", `monty.config.ts threw while loading:\n${result.stderr}\nFix the config (it must only call defineApp with zod tables).`);
+    fns = discoverFnExports(serverEntry);
+    if (fns.length === 0) {
+      fail("NO_FN_EXPORTS", "server/index.ts exists but exports no async functions. Export named functions like `export async function score(args, ctx) {…}`, or remove the folder.");
     }
-    return JSON.parse(result.stdout);
+    return { code: readFileSync(out, "utf8"), fns };
   } catch (e) {
-    if (e?.errors) {
+    if (e?.code === "NO_FN_EXPORTS") throw e; // fail() already exited; guard for safety
+    const msg = e?.errors?.[0]?.text ?? e?.message ?? String(e);
+    fail("FN_BUNDLE_FAILED", `Could not bundle server/index.ts: ${msg}`);
+  } finally {
+    rmSync(entry, { force: true });
+    rmSync(out, { force: true });
+  }
+}
+
+// The manifest = the named exports of server/index.ts, read statically
+// (regex over `export … function NAME` / `export const NAME =`). onEvent is
+// included when present but the platform invokes it, not useServerFn.
+function discoverFnExports(serverEntry) {
+  const src = readFileSync(serverEntry, "utf8");
+  const names = new Set();
+  const re =
+    /export\s+(?:async\s+)?function\s+([a-zA-Z_$][\w$]*)|export\s+const\s+([a-zA-Z_$][\w$]*)\s*=/g;
+  let m;
+  while ((m = re.exec(src))) {
+    const name = m[1] ?? m[2];
+    if (/^[a-zA-Z][a-zA-Z0-9_]{0,63}$/.test(name)) names.add(name);
+  }
+  return [...names];
+}
+
+// Thin wrapper over the shared pipeline (lib/compile.mjs): `soft` keeps the
+// Studio heartbeat's last good schema through transient config breakage.
+async function compileConfig(appDir, { soft = false } = {}) {
+  try {
+    return await compileAppConfig(appDir);
+  } catch (e) {
+    if (e instanceof CompileError) {
       if (soft) {
         console.log("schema: monty.config.ts doesn't compile right now — keeping the last good schema");
         return null;
       }
-      fail("CONFIG_COMPILE_FAILED", `esbuild could not bundle monty.config.ts: ${e.errors[0]?.text ?? e.message}`);
+      fail(e.code, e.fix);
     }
     throw e;
-  } finally {
-    rmSync(entry, { force: true });
-    rmSync(out, { force: true });
   }
 }
 
@@ -1033,11 +1229,14 @@ switch (command) {
   case "deploy":
     await deploy();
     break;
+  case "secret":
+    await secret();
+    break;
   default:
     console.log("usage: monty <login|create|current|select|apps|install|dev|build|typecheck|add|components|docs|deploy|skills>");
     console.log("  login       [--host <url>] [--key <mk_...>]  sign in (opens your browser to authorize)");
     console.log("  create      <slug> [--name N] [--icon I] [--build ID]  stamp a new app into ~/Monty/<slug>");
-    console.log("  dev         [--port N]                      run locally, auto-picks a free port (sandboxed data)");
+    console.log("  dev         [--port N]                      run the app in Studio locally, auto-picks a free port (sandboxed data)");
     console.log("  add         <name...>                      install curated UI components (see `monty components`)");
     console.log("  components  [query]                        list the curated component catalog");
     console.log("  docs        <name>                         view a component's source before installing");
@@ -1047,7 +1246,7 @@ switch (command) {
     console.log("  install                                     install app dependencies");
     console.log("  build                                       production build (vite, via monty)");
     console.log("  typecheck                                   typecheck (builds first if needed)");
-    console.log("  deploy                                      build + upload this app");
+    console.log("  deploy                                      build + upload this app straight to Live");
     console.log("  skills                                      install/refresh the agent build skill");
     process.exit(command ? 1 : 0);
 }

package/lib/compile.mjs

@@ -0,0 +1,67 @@
+// The ONE config-compile pipeline: esbuild-bundle a temp entry that runs the
+// app's OWN compileApp/zod/sdk instances on monty.config.ts, execute it in a
+// subprocess, parse the emitted metadata. Used by `monty dev`/`monty deploy`
+// (bin/monty.mjs) and the demo harness (scripts/demo.mjs) — one pipeline, so
+// what a demo installs is byte-for-byte what a deploy would send.
+import { spawnSync } from "node:child_process";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+export class CompileError extends Error {
+  constructor(code, fix) {
+    super(`[${code}] ${fix}`);
+    this.code = code;
+    this.fix = fix;
+  }
+}
+
+// Compile appDir/monty.config.ts → { slug, name, icon?, schemaJson, exposure? }.
+// Throws CompileError:
+// - CONFIG_BUNDLE_FAILED — esbuild could not bundle (usually unlinked deps)
+// - CONFIG_COMPILE_FAILED — the config threw while loading
+export async function compileAppConfig(appDir) {
+  appDir = resolve(appDir); // esbuild requires an absolute absWorkingDir
+  // esbuild is a dependency of THIS package (@montytools/cli), so resolution
+  // from here works for any caller — no per-script resolution dance.
+  const { build } = await import("esbuild");
+  const tmpDir = join(appDir, ".monty");
+  mkdirSync(tmpDir, { recursive: true });
+  const entry = join(tmpDir, "compile-entry.mjs");
+  const out = join(tmpDir, "compile-out.mjs");
+  writeFileSync(entry, [
+    `import { app } from "../monty.config";`,
+    `import { compileApp } from "@montytools/sdk/compile";`,
+    `process.stdout.write(JSON.stringify(compileApp(app)));`,
+  ].join("\n"));
+  try {
+    await build({
+      entryPoints: [entry],
+      outfile: out,
+      bundle: true,
+      platform: "node",
+      format: "esm",
+      target: "node22",
+      absWorkingDir: appDir,
+      logLevel: "silent",
+    });
+    const result = spawnSync(process.execPath, [out], { encoding: "utf8" });
+    if (result.status !== 0) {
+      throw new CompileError(
+        "CONFIG_COMPILE_FAILED",
+        `monty.config.ts threw while loading:\n${result.stderr}\nFix the config (it must only call defineApp with zod tables).`,
+      );
+    }
+    return JSON.parse(result.stdout);
+  } catch (e) {
+    if (e?.errors) {
+      throw new CompileError(
+        "CONFIG_BUNDLE_FAILED",
+        `esbuild could not bundle monty.config.ts: ${e.errors[0]?.text ?? e.message}\nRun \`pnpm install\` so the app's deps link, then retry.`,
+      );
+    }
+    throw e;
+  } finally {
+    rmSync(entry, { force: true });
+    rmSync(out, { force: true });
+  }
+}

package/package.json

@@ -1,12 +1,18 @@
 {
   "name": "@montytools/cli",
-  "version": "0.2.9",
+  "version": "0.2.10",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TomasMonty/monty-v2.git",
+    "directory": "packages/cli"
+  },
   "type": "module",
   "bin": {
     "monty": "./bin/monty.mjs"
   },
   "files": [
     "bin",
+    "lib",
     "template",
     "skills"
   ],
@@ -15,7 +21,7 @@
   },
   "scripts": {
     "prepack": "node scripts/bundle-template.mjs",
-    "typecheck": "node --check bin/monty.mjs",
+    "typecheck": "node --check bin/monty.mjs && node --check lib/compile.mjs",
     "postinstall": "node bin/postinstall.mjs"
   },
   "dependencies": {

package/skills/monty-build/SKILL.md

@@ -11,6 +11,11 @@ platform's job. The complete contract lives in the app's own `AGENTS.md`
 (nearest-file-wins — read it before writing code). This skill is the map, not
 the territory.
 
+Every app has two states: **Live** (published — what members and visitors
+see) and **Studio** (development — your running `monty dev` session on
+`#dev`-sandboxed data). Those are the only names for them; "dev"/"prod"
+mean something else on this platform.
+
 ## Rules
 
 1. **Folders are managed.** Apps live in `~/Monty/<slug>`. `monty current`
@@ -20,12 +25,12 @@ the territory.
    (if the prompt includes a `build id`, pass it: `--build <id>` — the
    workspace's New app screen tracks your progress live) →
    `monty install` → edit `monty.config.ts` (zod tables) + `src/routes/` →
-   verify with `monty dev` (auto-port, already authenticated, sandboxed
-   data). **You are done when `monty dev` prints the workspace dev URL and
-   the app works — leave `monty dev` running.** Publishing to the whole
-   workspace is the OWNER'S click (Publish in the workspace menu bar);
-   **never run `monty deploy` yourself** unless the user explicitly asks
-   for a direct production deploy.
+   verify with `monty dev` — the app's Studio state (auto-port, already
+   authenticated, sandboxed data). **You are done when `monty dev` prints
+   the workspace Studio URL and the app works — leave `monty dev`
+   running.** Taking the app Live is the OWNER'S click (Publish in the
+   workspace menu bar); **never run `monty deploy` yourself** unless the
+   user explicitly asks for a direct Live deploy.
 3. **Everything through the CLI.** `monty install`, `monty build`,
    `monty typecheck`, `monty dev`, `monty deploy` — never run vite, tsc,
    pnpm, or npm scripts directly. `monty dev` auto-picks a free port and
@@ -41,8 +46,9 @@ the territory.
 7. **Errors are instructions.** Every failure prints
    `[MontyError CODE] Fix: …` — do exactly what the Fix says; don't guess.
    Typecheck failures block deploy by design.
-8. **Verify before deploy.** `monty dev` writes to a `#dev` sandbox — live
-   team records are never touched, so exercise the app for real.
+8. **Verify before publish.** `monty dev` writes to the `#dev` Studio
+   sandbox — Live team records are never touched, so exercise the app for
+   real.
 
 ## CLI reference
 
@@ -52,7 +58,7 @@ the territory.
 | `monty create <slug>` | stamp a new app into `~/Monty/<slug>` |
 | `monty current` / `select` / `apps` | where am I / jump to app / list local |
 | `monty install` / `build` / `typecheck` | full lifecycle via the CLI — no raw pnpm/vite/tsc |
-| `monty dev` | run locally (auto-picks a free port), sandboxed data, auto-auth |
+| `monty dev` | run the app in Studio (auto-picks a free port), sandboxed data, auto-auth |
 | `monty add <name…>` | install curated shadcn components |
-| `monty deploy` | build + typecheck + upload; app appears in the workspace |
+| `monty deploy` | build + typecheck + upload straight to Live (owner escape hatch) |
 | `monty skills` | (re)install this skill for your agent |

package/template/AGENTS.md

@@ -123,11 +123,12 @@ monty dev         # Vite + HMR, auto-picks a free port and prints it
 Headless? Verify with `monty build` then `monty typecheck` (typecheck builds
 first when needed — the build generates `src/routeTree.gen.ts`).
 
-**Development vs production:** while `monty dev` runs, the app is live in
-the workspace in DEV mode (workspace admins only, tunneled, `#dev` sandboxed
-data). Shipping to the whole team is the owner's **Publish** click in the
+**Studio vs Live:** every Monty app has two states. While `monty dev` runs,
+the app is in **Studio** — visible in the workspace to admins only
+(tunneled, `#dev` sandboxed data). **Live** is the published state the
+whole team sees. Going Live is the owner's **Publish** click in the
 workspace menu bar — it signals your running `monty dev`, which builds,
-typechecks, and uploads. You are done when the app works in dev mode;
+typechecks, and uploads. You are done when the app works in Studio;
 leave `monty dev` running and let the owner publish. Only run
 `monty deploy` directly if the user explicitly asks.
 
@@ -135,12 +136,12 @@ leave `monty dev` running and let the owner publish. Only run
 `http://localhost:5173` is ALREADY AUTHENTICATED — no sign-in screen (the dev
 server mints short-lived workspace tokens from the CLI login). Point
 Playwright or any browser automation at it, click through your app against
-live sandboxed data, and read your errors in the `monty dev` terminal
+reactive sandboxed data, and read your errors in the `monty dev` terminal
 (`[browser:error] …` lines). Edit → HMR → look → fix: verify your own work.
 
-Dev writes go to a sandboxed `#dev` namespace inside your real workspace —
-iterate freely, live app data is untouched. The "DEV · … · sandbox data" badge
-confirms it.
+Studio writes go to a sandboxed `#dev` namespace inside your real workspace —
+iterate freely, Live app data is untouched. The "STUDIO · … · sandbox data"
+badge confirms it.
 
 ## Modeling tips
 

package/template/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {
     "@fontsource-variable/roboto": "^5.2.10",
-    "@montytools/sdk": "^0.1.2",
+    "@montytools/sdk": "^0.1.3",
     "@tanstack/react-router": "1.170.17",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",