@montytools/cli 0.4.2 → 0.5.1

package/bin/monty.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // monty — the Monty platform CLI. Output is agent-shaped: structured
 // single-line events, no spinners, instruction-shaped errors, and a
-// deterministic final line (`deployed: …` / `error: …`).
+// deterministic final line (`saved: …` / `error: …`).
 
 import { spawn, spawnSync } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
@@ -16,6 +16,8 @@ import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { CATALOG, REGISTRIES } from "./catalog.mjs";
 import { CompileError, compileAppConfig } from "../lib/compile.mjs";
+import { manifestHash } from "../lib/schemaCodegen.mjs";
+import { readSchemaState, schemaPull, writeSchemaState } from "../lib/schemaPull.mjs";
 
 // MONTY_HOME overrides the state root (default ~/.monty): config.json,
 // apps/, and desktop.json all live under it. This is how a second, isolated
@@ -61,10 +63,30 @@ function flag(name) {
 }
 
 function fail(code, fix) {
+  // A failing save narrates itself to the desktop chip before exiting.
+  saveFailNote?.(code, fix);
+  saveFailNote = null;
   console.error(`error: [MontyError ${code}] Fix: ${fix}`);
   process.exit(1);
 }
 
+// Set by deploy() while a save runs; fail() and the exit hook route the
+// error instruction into .monty/save.json so the chip shows it.
+let saveFailNote = null;
+
+// The save state file the desktop tails: .monty/save.json narrates every
+// save — agent-run saves in their own terminal included — so the chip can
+// show Saving…/Saved/"Couldn't save" without parsing any output.
+function writeSaveJson(appDir, state) {
+  try {
+    mkdirSync(join(appDir, ".monty"), { recursive: true });
+    writeFileSync(
+      join(appDir, ".monty", "save.json"),
+      JSON.stringify({ ...state, at: Date.now() }, null, 2) + "\n",
+    );
+  } catch { /* advisory — the chip just misses this save */ }
+}
+
 // ── Profiles & the .montyrc directory pin ──────────────────────────────────
 // One key PER HOST (like kubectl contexts): logging into the local platform
 // host never clobbers the prod key. Which host a command targets resolves,
@@ -255,6 +277,22 @@ function readMarker(path) {
   }
 }
 
+// True when the installed marker is BEHIND this CLI. Ordering matters: two
+// CLI versions share one machine (repo link vs npm global, bundle vs
+// global), and an equality check makes them overwrite each other's skills
+// on every alternating run — the older one must never win.
+function markerOutdated(marker) {
+  if (!marker) return true;
+  const a = marker.split(".").map(Number);
+  const b = CLI_VERSION.split(".").map(Number);
+  if (a.some(Number.isNaN) || b.some(Number.isNaN)) return marker !== CLI_VERSION;
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] || 0) < (b[i] || 0)) return true;
+    if ((a[i] || 0) > (b[i] || 0)) return false;
+  }
+  return false;
+}
+
 function skillsCliAdd({ global = false, cwd = undefined } = {}) {
   const args = ["-y", "skills", "add", SKILLS_SRC, "-y", "--copy", ...(global ? ["-g"] : []), ...SKILL_AGENTS];
   const res = spawnSync("npx", args, { cwd, stdio: "ignore", timeout: 120_000 });
@@ -283,7 +321,7 @@ function installSkills({ appDir = null, silent = true, force = false } = {}) {
   if (process.env.MONTY_NO_SKILLS) return;
   try {
     let changed = false;
-    if (force || readMarker(GLOBAL_SKILLS_MARKER) !== CLI_VERSION) {
+    if (force || markerOutdated(readMarker(GLOBAL_SKILLS_MARKER))) {
       if (!skillsCliAdd({ global: true })) manualInstall(null);
       mkdirSync(CONFIG_DIR, { recursive: true });
       writeFileSync(GLOBAL_SKILLS_MARKER, CLI_VERSION + "\n");
@@ -291,7 +329,7 @@ function installSkills({ appDir = null, silent = true, force = false } = {}) {
     }
     if (appDir) {
       const marker = join(appDir, ".agents", "skills", "monty-build", "VERSION");
-      if (force || readMarker(marker) !== CLI_VERSION) {
+      if (force || markerOutdated(readMarker(marker))) {
         if (!skillsCliAdd({ cwd: appDir })) manualInstall(appDir);
         mkdirSync(dirname(marker), { recursive: true });
         writeFileSync(marker, CLI_VERSION + "\n");
@@ -308,17 +346,42 @@ function installSkills({ appDir = null, silent = true, force = false } = {}) {
 // ── monty current / select / apps ───────────────────────────────────────────
 // Folder management users never think about: every app lives in ~/Monty,
 // `current` says where you are, `select` prints the folder for cd $(...).
+// The app-root marker is the IDENTITY STAMP (.monty/app.json — written by
+// create and pull) or, for older folders, monty.config.ts.
+function isAppRoot(dir) {
+  return existsSync(join(dir, ".monty", "app.json")) || existsSync(join(dir, "monty.config.ts"));
+}
+
 function findAppRoot(start) {
   let d = start;
   for (;;) {
-    if (existsSync(join(d, "monty.config.ts"))) return d;
+    if (isAppRoot(d)) return d;
     const parent = dirname(d);
     if (parent === d) return null;
     d = parent;
   }
 }
 
+// The identity stamp: { id, slug, name, icon, registryOwned? } — the app's
+// durable identity on this machine, independent of the config file.
+function readAppJson(dir) {
+  try {
+    return JSON.parse(readFileSync(join(dir, ".monty", "app.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function writeAppJson(dir, patch) {
+  mkdirSync(join(dir, ".monty"), { recursive: true });
+  const next = { ...(readAppJson(dir) ?? {}), ...patch };
+  writeFileSync(join(dir, ".monty", "app.json"), JSON.stringify(next, null, 2) + "\n");
+  return next;
+}
+
 function readSlugFromConfig(dir) {
+  const stamped = readAppJson(dir)?.slug;
+  if (typeof stamped === "string" && stamped) return stamped;
   try {
     return /slug:\s*"([^"]+)"/.exec(readFileSync(join(dir, "monty.config.ts"), "utf8"))?.[1] ?? null;
   } catch {
@@ -327,6 +390,8 @@ function readSlugFromConfig(dir) {
 }
 
 function readIdFromConfig(dir) {
+  const stamped = readAppJson(dir)?.id;
+  if (typeof stamped === "string" && stamped) return stamped;
   try {
     return /^[ \t]*id:\s*"([^"]+)"/m.exec(readFileSync(join(dir, "monty.config.ts"), "utf8"))?.[1] ?? null;
   } catch {
@@ -338,7 +403,7 @@ function scanAppsHome(root) {
   if (!existsSync(root)) return [];
   return readdirSync(root)
     .map((name) => join(root, name))
-    .filter((p) => existsSync(join(p, "monty.config.ts")))
+    .filter((p) => isAppRoot(p))
     .map((p) => ({ path: p, slug: readSlugFromConfig(p) ?? basename(p), id: readIdFromConfig(p) }));
 }
 
@@ -389,11 +454,10 @@ function apps() {
 }
 
 // Pack the app's source tree (node_modules/dist/.monty/.git excluded) into a
-// tar.gz buffer + its sha256 — the snapshot unit `monty commit` and deploys
-// both upload. gzip runs with -n (no embedded timestamp) so an UNCHANGED
-// tree packs to identical bytes — that's what makes "nothing to commit"
-// detectable by hash. Returns null when packing fails; { tooLarge } past
-// the 10MB cap.
+// tar.gz buffer + its sha256 — the snapshot unit every `monty save`
+// uploads. gzip runs with -n (no embedded timestamp) so an UNCHANGED tree
+// packs to identical bytes — the hash doubles as the change detector.
+// Returns null when packing fails; { tooLarge } past the 10MB cap.
 function packSource(appDir) {
   mkdirSync(join(appDir, ".monty"), { recursive: true });
   const srcTar = join(appDir, ".monty", "source-upload.tar.gz");
@@ -415,60 +479,12 @@ function packSource(appDir) {
 }
 
 function readSlug(appDir) {
-  try {
-    return /slug:\s*"([^"]+)"/.exec(readFileSync(join(appDir, "monty.config.ts"), "utf8"))?.[1] ?? null;
-  } catch {
-    return null;
-  }
-}
-
-// ── monty commit ───────────────────────────────────────────────────────────
-// Version the app's source WITHOUT publishing: pack the tree, upload it as
-// one line of history. Git commit with everything stripped except "track
-// versions" — no branches, no diffs, no local repo; history lives in the
-// workspace and survives this folder.
-async function commit() {
-  const appDir = requireAppDir("commit");
-  const slug = readSlug(appDir);
-  if (!slug) fail("NO_SLUG", "monty.config.ts has no slug — fix the config, then retry.");
-  const { host, key } = loadConfig();
-  if (!key) fail("NOT_LOGGED_IN", "Committing stores the snapshot in your workspace. Run `monty login` first.");
-  const mIdx = rest.indexOf("-m");
-  const message = flag("message") ?? (mIdx >= 0 ? rest[mIdx + 1] : undefined) ?? "checkpoint";
-  const packed = packSource(appDir);
-  if (packed === null) fail("PACK_FAILED", "Packing the source failed (tar error). Retry; check the folder is readable.");
-  if (packed.tooLarge) fail("SOURCE_TOO_LARGE", "The source tree exceeds 10 MB (node_modules/dist excluded). Remove large assets, then retry.");
-  try {
-    const stamp = JSON.parse(readFileSync(join(appDir, ".monty", "source.json"), "utf8"));
-    if (stamp.hash === packed.hash) {
-      console.log(`nothing to commit — source unchanged since ${packed.hash.slice(0, 7)}`);
-      return;
-    }
-  } catch {
-    /* no stamp yet — first commit from this folder */
-  }
-  const form = new FormData();
-  form.set("monty", JSON.stringify({ slug, hash: packed.hash, message }));
-  form.set("source", new Blob([packed.buf]), "source.tar.gz");
-  const res = await fetch(`${host}/api/source`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${key}` },
-    body: form,
-  });
-  const body = await res.json().catch(() => null);
-  if (!res.ok || !body?.ok) {
-    fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Uploading the snapshot failed — check the connection and retry.");
-  }
-  writeFileSync(
-    join(appDir, ".monty", "source.json"),
-    JSON.stringify({ hash: packed.hash, syncedAt: Date.now() }) + "\n",
-  );
-  console.log(`committed: ${packed.hash.slice(0, 7)} "${message}" (${(packed.buf.byteLength / 1024).toFixed(0)} KB)`);
+  return readSlugFromConfig(appDir);
 }
 
 // ── monty log ──────────────────────────────────────────────────────────────
-// The app's version history, newest first. Commits and publishes share one
-// timeline. (Not `monty logs` — that tails the dev shell.)
+// The app's version history, newest first — one row per `monty save`.
+// (Not `monty logs` — that tails the dev shell.)
 async function versionsLog() {
   const slug = rest.find((a) => !a.startsWith("-")) ?? readSlug(process.cwd());
   if (!slug) fail("NO_SLUG", "Usage: monty log [slug] — or run it inside an app folder.");
@@ -482,19 +498,19 @@ async function versionsLog() {
     fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Could not list versions — check the connection and `monty login`.");
   }
   if (body.versions.length === 0) {
-    console.log(`no versions of "${slug}" yet — \`monty commit\` or a publish creates the first one.`);
+    console.log(`no versions of "${slug}" yet — \`monty save\` creates the first one.`);
     return;
   }
   for (const v of body.versions) {
     const when = new Date(v.createdAt).toISOString().slice(0, 16).replace("T", " ");
-    console.log(`${v.hash.slice(0, 7)}  ${when}  ${v.published ? "[published] " : ""}${v.message}`);
+    console.log(`${v.hash.slice(0, 7)}  ${when}  ${v.message}`);
   }
   console.log(`\nrestore one: monty pull ${slug} --version <hash> [--force]`);
 }
 
 // ── monty pull ─────────────────────────────────────────────────────────────
-// Restore an app's published source snapshot onto this machine. Every
-// `monty deploy`/publish uploads the source tree beside the bundle; pull is
+// Restore an app's saved source snapshot onto this machine. Every
+// `monty save` uploads the source tree beside the bundle; pull is
 // how a second machine (or one that lost the folder) gets the code back.
 // Refuses to touch an existing folder without --force — it may hold
 // unpublished work the snapshot would destroy.
@@ -539,11 +555,11 @@ async function pull() {
     expectedHash = matches[0].hash;
     downloadUrl = `${host}/api/source?slug=${slug}&hash=${expectedHash}`;
   } else if (!app.sourceHash) {
-    fail("NO_SOURCE", `"${slug}" has no source snapshot yet — snapshots ride each publish and \`monty commit\`. Run either once from the machine that has the source, then pull works everywhere.`);
+    fail("NO_SOURCE", `"${slug}" has no source snapshot yet — snapshots ride each \`monty save\`. Run it once from the machine that has the source, then pull works everywhere.`);
   }
   const target = app.id ? join(MONTY_HOME, app.id) : join(LEGACY_MONTY_HOME, slug);
   if (existsSync(target) && !rest.includes("--force")) {
-    fail("DIR_EXISTS", `${target} already exists and may hold unpublished work. Compare it with the published version first; re-run with --force to REPLACE it with the snapshot.`);
+    fail("DIR_EXISTS", `${target} already exists and may hold unsaved work. Compare it with the saved version first; re-run with --force to REPLACE it with the snapshot.`);
   }
 
   console.log(`pull: ${slug}${versionFlag ? ` @ ${expectedHash.slice(0, 7)}` : ""} <- ${host}`);
@@ -557,7 +573,7 @@ async function pull() {
   const buf = Buffer.from(await res.arrayBuffer());
   const hash = createHash("sha256").update(buf).digest("hex");
   if (hash !== expectedHash) {
-    fail("SOURCE_CORRUPT", "The downloaded snapshot failed verification — retry; if it persists, republish the app from a machine that has the source.");
+    fail("SOURCE_CORRUPT", "The downloaded snapshot failed verification — retry; if it persists, run `monty save` again from a machine that has the source.");
   }
 
   // Extract into a staging folder, then move into place — a failed extract
@@ -571,7 +587,7 @@ async function pull() {
   rmSync(tarFile, { force: true });
   if (untar.status !== 0) {
     rmSync(staging, { recursive: true, force: true });
-    fail("EXTRACT_FAILED", "Unpacking the snapshot failed. Retry; if it persists, republish the app.");
+    fail("EXTRACT_FAILED", "Unpacking the snapshot failed. Retry; if it persists, run `monty save` again from a machine that has the source.");
   }
   if (existsSync(target)) rmSync(target, { recursive: true, force: true });
   renameSync(staging, target);
@@ -591,11 +607,112 @@ async function pull() {
     join(target, ".monty", "source.json"),
     JSON.stringify({ hash, syncedAt: Date.now() }) + "\n",
   );
+  // Re-stamp identity (the snapshot excludes .monty/): the workspace row is
+  // the authority for id/name/icon.
+  writeAppJson(target, {
+    ...(app.id ? { id: app.id } : {}),
+    slug,
+    ...(app.name ? { name: app.name } : {}),
+    ...(app.icon ? { icon: app.icon } : {}),
+  });
   console.log(`pulled: ${target}`);
   console.log("next: `monty install`, then `monty dev`.");
 }
 
 // ── monty create ───────────────────────────────────────────────────────────
+// A CONFIG-ONLY app: no SPA at all — monty.config.ts is the whole app and
+// the platform shell renders it. The presence of index.html is the marker
+// (every SPA template ships one; the config-only scaffold never does).
+function isConfigOnlyApp(appDir) {
+  return !existsSync(join(appDir, "index.html"));
+}
+
+// Literal read of the config's `schedule` block ({ fn: "cron expr" }) —
+// the same light-touch parse the SDK's vite plugin uses for publicFns.
+// Registry-owned sessions read it this way so the cron ticker works
+// without a config compile.
+function readScheduleLiteral(appDir) {
+  try {
+    const src = readFileSync(join(appDir, "monty.config.ts"), "utf8");
+    const block = /schedule:\s*{([^}]*)}/m.exec(src)?.[1];
+    if (!block) return undefined;
+    const out = {};
+    for (const m of block.matchAll(/["']?([a-zA-Z][a-zA-Z0-9_]*)["']?\s*:\s*"([^"]+)"/g)) {
+      out[m[1]] = m[2];
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+// The code half's custom pages, by file convention: every TOP-LEVEL route
+// file in src/routes/ is a page (nested routes — dot-separated names — are a
+// page's inner paths). `__root`/`index` are the SPA's own plumbing, never
+// pages. Saves register these as fnsJson.pages; a running session serves
+// every declared page directly.
+function discoverPages(appDir) {
+  const routesDir = join(appDir, "src", "routes");
+  if (!existsSync(routesDir)) return [];
+  return readdirSync(routesDir)
+    .filter((f) => /\.(tsx|jsx)$/.test(f))
+    .map((f) => f.replace(/\.(tsx|jsx)$/, ""))
+    .filter((name) => /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(name) && name !== "index")
+    .sort()
+    .map((name) => ({ name, path: `/${name}` }));
+}
+
+const CONFIG_ONLY_AGENTS_MD = `# This is a CONFIG-ONLY Monty app
+
+The app is rendered by the Monty platform from its WORKSPACE manifest —
+tables (zod), derived fields (\`rollup\`/\`lookup\`/\`formula\`), \`metrics\`,
+\`settings\`, and \`pages\`. There is no src/, no React, no build.
+
+- The schema lives in the workspace, and its door is the schema API:
+  read it with \`monty schema\`, change it with \`monty schema set <file|->\`
+  (validated, CAS-guarded, live within seconds). monty.config.ts edits do
+  NOT change a workspace-owned app's schema.
+- Formulas are strings in the Monty expression grammar, e.g.
+  \`formula(montyMoney(), "monthlySales * commissionRate")\` — fields declared
+  ABOVE the formula and \`metrics.<name>\` are in scope.
+- Need a bespoke page later? \`monty add page\` declares it and upgrades this
+  app with a SPA scaffold; \`monty save\` ships the code.
+`;
+
+function writeConfigOnlyScaffold(target, { appId, slug, name, icon }) {
+  mkdirSync(target, { recursive: true });
+  writeFileSync(join(target, "monty.config.ts"), `import { defineApp } from "@montytools/sdk";
+
+// This file IS the app: tables, derived fields, metrics, settings, pages.
+// The Monty platform renders it — no src/, no build. Declare tables as zod
+// objects; derive with rollup()/lookup()/formula(); see AGENTS.md.
+export const app = defineApp({
+  id: "${appId}",
+  slug: "${slug}",
+  name: "${name}",
+  icon: "${icon}",
+  tables: {},
+});
+
+export type App = typeof app;
+`);
+  writeFileSync(join(target, "package.json"), JSON.stringify({
+    name: slug,
+    private: true,
+    type: "module",
+    dependencies: { "@montytools/sdk": "latest", zod: "^4.4.3" },
+  }, null, 2) + "\n");
+  writeFileSync(join(target, "tsconfig.json"), JSON.stringify({
+    compilerOptions: {
+      target: "ES2022", module: "ESNext", moduleResolution: "bundler",
+      strict: true, skipLibCheck: true, noEmit: true,
+    },
+    include: ["monty.config.ts"],
+  }, null, 2) + "\n");
+  writeFileSync(join(target, ".gitignore"), "node_modules/\n.monty/\n");
+  writeFileSync(join(target, "AGENTS.md"), CONFIG_ONLY_AGENTS_MD);
+}
+
 async function create() {
   const slug = rest.find((a) => !a.startsWith("--"));
   if (!slug || slug.length > 64 || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slug)) {
@@ -652,6 +769,51 @@ async function create() {
   }
   mkdirSync(dirname(target), { recursive: true });
 
+  // DEFAULT: config-only — no SPA. monty.config.ts is the whole app and the
+  // platform shell renders it; \`monty add page\` scaffolds a SPA the moment a
+  // bespoke page is needed. \`--spa\` keeps the old full-SPA scaffold
+  // (\`--config-only\` stays accepted as the now-default no-op).
+  if (!rest.includes("--spa")) {
+    console.log(`create: ${slug} -> ${target} (config-only)`);
+    writeConfigOnlyScaffold(target, { appId, slug, name, icon });
+    // The identity stamp is the app-root marker and identity source from
+    // here on — the config file is just code.
+    writeAppJson(target, { id: appId, slug, name, icon });
+    // The user's brief lands at the top of AGENTS.md, same as SPA creates.
+    const brief = flag("description");
+    if (brief?.trim()) {
+      const agentsPath = join(target, "AGENTS.md");
+      writeFileSync(
+        agentsPath,
+        `# What to build: ${name}\n\n${brief.trim()}\n\n---\n\n` + readFileSync(agentsPath, "utf8"),
+      );
+      console.log("brief: AGENTS.md carries the app description");
+    }
+    const cBuildId = flag("build");
+    if (cBuildId && /^[a-z0-9]{10,64}$/i.test(cBuildId)) {
+      mkdirSync(join(target, ".monty"), { recursive: true });
+      writeFileSync(join(target, ".monty", "build"), cBuildId + "\n");
+      try {
+        await fetch(`${host}/api/build`, {
+          method: "POST",
+          headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+          body: JSON.stringify({ buildId: cBuildId, slug }),
+        });
+      } catch { /* progress signal only */ }
+    }
+    if (!existsSync(join(target, "CLAUDE.md"))) {
+      try {
+        symlinkSync("AGENTS.md", join(target, "CLAUDE.md"));
+      } catch {
+        writeFileSync(join(target, "CLAUDE.md"), "@AGENTS.md\n");
+      }
+    }
+    installSkills({ appDir: target });
+    console.log(`created: ${target}`);
+    console.log(`next: cd ${target} && monty install && monty dev`);
+    return;
+  }
+
   // Template is bundled into the published package (../template). Fall back to
   // the monorepo path when running the CLI in-place during development.
   const pkgRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
@@ -676,7 +838,7 @@ async function create() {
   // hard-excludes the real name from tarballs); the in-repo template has the
   // real file. Normalize, and backfill for bundles that carried neither —
   // without a .gitignore, tailwind v4's content scan includes .monty/ and
-  // full-reloads Studio on every dev.json touch.
+  // full-reloads the session on every dev.json touch.
   const gitignorePath = join(target, ".gitignore");
   if (existsSync(join(target, "gitignore"))) {
     renameSync(join(target, "gitignore"), gitignorePath);
@@ -704,6 +866,9 @@ async function create() {
     htmlPath,
     readFileSync(htmlPath, "utf8").replace(/<title>[^<]*<\/title>/, `<title>${name}</title>`),
   );
+  // The identity stamp is the app-root marker and identity source from
+  // here on — the config file is just code the bundle imports.
+  writeAppJson(target, { id: appId, slug, name, icon });
 
   // The user's brief (--description, e.g. from the desktop's create dialog)
   // goes to the TOP of AGENTS.md — agent harnesses can't be handed an initial
@@ -819,7 +984,7 @@ async function freePort(start) {
 // Apps pin @montytools/sdk at scaffold time and go stale — the CLI knows the
 // minimum SDK its workflows need (e.g. tunnel-host allowlisting lives in the
 // SDK's vite plugin) and upgrades the app automatically before dev/deploy.
-const MIN_SDK = "0.1.5";
+const MIN_SDK = "0.2.1";
 const SDK_VITE_CACHE_STAMP = "sdk-vite-cache-version";
 
 function installedSdkVersion(appDir) {
@@ -1099,12 +1264,12 @@ function printAttach(appDir, s) {
       const beat = typeof s.lastHeartbeatAt === "number" ? Math.round((Date.now() - s.lastHeartbeatAt) / 1000) : null;
       console.log(
         beat !== null && beat > Math.round(DEV_JSON_STALE_MS / 1000)
-          ? `state: online (no heartbeat for ${beat}s — Studio may show offline)`
+          ? `state: online (no heartbeat for ${beat}s — the workspace may show the session offline)`
           : `state: online (heartbeat ${beat ?? "?"}s ago)`,
       );
-      if (s.studioUrl) console.log(`studio: ${s.studioUrl} — your app runs there while this is up; click Publish to go Live`);
+      if (s.host && s.slug) console.log(`app: ${s.host}/apps/${s.slug} — your app runs there while this is up`);
     } else {
-      console.log("state: ready (registering with the workspace — the Studio link appears on the first successful heartbeat)");
+      console.log("state: ready (registering with the workspace — the app link appears on the first successful heartbeat)");
     }
   }
   console.log("logs: `monty logs -f` follows output; `monty logs -n 100` shows recent lines");
@@ -1226,11 +1391,11 @@ async function sweepOrphans(s) {
 }
 
 // ── monty dev ──────────────────────────────────────────────────────────────
-// Puts the app in Studio: vite locally + a Cloudflare quick tunnel registered
-// as the app's STUDIO channel, so workspace admins see the app (HMR included)
-// at usemonty.dev while it runs. Data is #dev-sandboxed automatically (vite
-// dev build). The heartbeat doubles as the publish poll: when an owner
-// clicks Publish in the workspace, this process builds + uploads to Live.
+// Runs the app's session: vite locally + a Cloudflare quick tunnel
+// registered as the app's session channel, so workspace admins see the
+// app (HMR included) at usemonty.dev while it runs. One data namespace:
+// the session reads and writes the app's REAL records — editing is the
+// change going live. `monty save` ships code.
 async function dev() {
   const appDir = requireAppDir("dev");
 
@@ -1279,43 +1444,67 @@ async function dev() {
 
   installSkills({ appDir });
   ensureSdk(appDir);
-  const meta = await compileConfig(appDir);
+  // Registry-owned apps (stamped on the first configIgnored beat): the
+  // platform reads NOTHING from the config compile — identity comes from
+  // the stamp and the compile is skipped entirely. The config file is just
+  // code the bundle imports; `schedule` (a code-door declaration the
+  // session cron ticker needs) is read literally, the same way the vite
+  // plugin reads `publicFns`.
+  const stamp = readAppJson(appDir);
+  const registryOwned = stamp?.registryOwned === true && typeof stamp?.slug === "string";
+  const meta = registryOwned
+    ? { slug: stamp.slug, name: stamp.name, icon: stamp.icon, schedule: readScheduleLiteral(appDir) }
+    : await compileConfig(appDir);
   const cfg = loadConfig();
   const host = cfg?.host ?? DEFAULT_HOST;
+  // CONFIG-ONLY apps run no vite and no tunnel: `monty dev` is watch +
+  // compile + push — the platform shell renders the app.
+  const configOnly = isConfigOnlyApp(appDir);
   // Auto-pick a free port (agents run several apps side by side); an
   // explicit --port is honored strictly.
   const requested = flag("port");
-  const port = requested ? Number(requested) : await freePort(5173);
+  const port = configOnly ? null : requested ? Number(requested) : await freePort(5173);
 
-  const viteBin = resolveViteBin(appDir);
-  if (!viteBin) {
-    fail("VITE_MISSING", "vite is not installed in this app. Run `monty install`, then `monty dev` again.");
+  let child = null;
+  if (!configOnly) {
+    const viteBin = resolveViteBin(appDir);
+    if (!viteBin) {
+      fail("VITE_MISSING", "vite is not installed in this app. Run `monty install`, then `monty dev` again.");
+    }
+    console.log(`dev: starting vite on :${port} (app "${meta.slug}")`);
+    child = spawn(process.execPath, [viteBin, "dev", "--port", String(port), "--strictPort"], {
+      cwd: appDir,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  } else {
+    console.log(`dev: config-only app "${meta.slug}" — no vite; watching monty.config.ts`);
   }
 
-  console.log(`dev: starting vite on :${port} (app "${meta.slug}")`);
-  const child = spawn(process.execPath, [viteBin, "dev", "--port", String(port), "--strictPort"], {
-    cwd: appDir,
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-
   let tunnelChild = null;
-  let pubChild = null;
   let hbTimer = null;
   let touchTimer = null;
   let cronTimer = null;
-  let publishing = false;
   let ended = false;
   let registeredOnce = false;
+  // Held-config warnings print once per drift episode, not every beat.
+  let driftAnnounced = false;
+  // The registry-owned notice prints once per session.
+  let configIgnoredAnnounced = false;
   const devStartedAt = Date.now();
   const sessionId = `dev_${randomBytes(16).toString("hex")}`;
   const buildFile = join(appDir, ".monty", "build");
   const buildId = existsSync(buildFile) ? readFileSync(buildFile, "utf8").trim() : undefined;
-  // The STUDIO schema channel: heartbeats carry the compiled schema, and
-  // edits to monty.config.ts are re-compiled (softly) so schema changes reach
-  // the platform within one heartbeat. Publish owns the LIVE schema.
+  // The session schema channel (manifest-less apps): heartbeats carry the
+  // compiled schema, and edits to monty.config.ts are re-compiled (softly)
+  // so schema changes reach the platform within one heartbeat.
+  // Registry-owned apps skip all of it — their schema lives behind the
+  // doors, and the local config copy follows the registry (auto-pull below).
   let currentMeta = meta;
+  // Once per registry change: the manifest hash we last tried to sync the
+  // local config copy to (successful or refused — never loop on dirty).
+  let syncAttemptedHash = null;
   const configPath = join(appDir, "monty.config.ts");
-  let configMtime = statSync(configPath).mtimeMs;
+  let configMtime = existsSync(configPath) ? statSync(configPath).mtimeMs : 0;
 
   // Advertise this session. The touch timer (not the platform heartbeat,
   // which starts minutes late or never when logged out) keeps updatedAt
@@ -1335,11 +1524,11 @@ async function dev() {
     sessionId,
     state: "starting",
     loggedIn,
-    appUrl: `http://localhost:${port}`,
+    appUrl: configOnly ? null : `http://localhost:${port}`,
     tunnelUrl: null,
-    studioUrl: loggedIn ? `${host}/studio/${meta.slug}` : null,
-    previewUrl: loggedIn
-      ? `${host}/studio/${meta.slug}?dev=${encodeURIComponent(`http://localhost:${port}`)}`
+    // Field names are wire contract (the desktop reads them).
+    previewUrl: loggedIn && !configOnly
+      ? `${host}/apps/${meta.slug}?dev=${encodeURIComponent(`http://localhost:${port}`)}`
       : null,
     publishing: false,
     lastHeartbeatAt: null,
@@ -1348,7 +1537,7 @@ async function dev() {
   });
   touchTimer = setInterval(() => sf.write({}), DEV_JSON_TOUCH_MS);
 
-  // The STUDIO cron runner: the Live counterpart is a real Cloudflare Cron
+  // The session cron runner: the Live counterpart is a real Cloudflare Cron
   // Trigger on the app's fn-worker; here the CLI matches monty.config.ts
   // `schedule` entries against the UTC clock once per minute and invokes the
   // fn through the same /__monty/fn runtime (x-monty-schedule marks the
@@ -1384,6 +1573,7 @@ async function dev() {
   cronTimer = setInterval(cronTick, 20_000);
 
   async function refreshSchemaIfChanged() {
+    if (registryOwned) return; // the doors own the schema; nothing to push
     try {
       const m = statSync(configPath).mtimeMs;
       if (m === configMtime) return;
@@ -1392,7 +1582,7 @@ async function dev() {
       if (fresh) {
         currentMeta = fresh;
         console.log(
-          `schema: monty.config.ts changed — Studio schema updated (${Object.keys(fresh.schemaJson.tables).length} tables)`,
+          `schema: monty.config.ts changed — session schema updated (${Object.keys(fresh.schemaJson.tables).length} tables)`,
         );
       }
     } catch { /* transient fs hiccup — next beat retries */ }
@@ -1417,11 +1607,10 @@ async function dev() {
     if (hbTimer) clearInterval(hbTimer);
     if (touchTimer) clearInterval(touchTimer);
     if (cronTimer) clearInterval(cronTimer);
-    try { pubChild?.kill(); } catch { /* already gone */ }
     try { tunnelChild?.kill(); } catch { /* already gone */ }
     // vite is a direct child (no npx wrapper), so this actually kills it —
     // a bare SIGTERM from the desktop must never orphan vite on the port.
-    try { child.kill(); } catch { /* already gone */ }
+    try { child?.kill(); } catch { /* already gone */ }
     sf.remove();
     logSink.close();
     await clearDevSession();
@@ -1433,9 +1622,8 @@ async function dev() {
     if (hbTimer) clearInterval(hbTimer);
     if (touchTimer) clearInterval(touchTimer);
     if (cronTimer) clearInterval(cronTimer);
-    try { pubChild?.kill(); } catch { /* already gone */ }
     try { tunnelChild?.kill(); } catch { /* already gone */ }
-    try { child.kill(); } catch { /* already gone */ }
+    try { child?.kill(); } catch { /* already gone */ }
     console.log(`dev-session: superseded — ${fix}`);
     sf.remove(); // guarded — never deletes the new owner's file
     logSink.close();
@@ -1455,7 +1643,7 @@ async function dev() {
         headers: { authorization: `Bearer ${liveKey}`, "content-type": "application/json" },
         body: JSON.stringify({
           slug: meta.slug,
-          tunnelUrl: originUrl,
+          ...(originUrl !== undefined ? { tunnelUrl: originUrl } : {}),
           sessionId,
           // Keep claiming until the first successful registration, but only
           // within the lock's own 90s TTL window: after a takeover/crash the
@@ -1468,9 +1656,19 @@ async function dev() {
           icon: currentMeta.icon,
           buildId,
           schemaJson: currentMeta.schemaJson,
+          // App Manifest v2 (docs/manifest-v2.md) — present only for V2
+          // configs; lands only for manifest-less apps (the doors own the
+          // rest).
+          manifest: currentMeta.manifest,
+          // The CAS base for the manifest-less landing (see `monty schema
+          // pull`).
+          baseManifestHash:
+            currentMeta.manifest !== undefined ? readSchemaState(appDir)?.hash : undefined,
           // The expose block rides the same compile as the schema — the dev
-          // visitor preview is gated on it (devExposureJson).
+          // visitor preview of a manifest-less app is gated on it.
           exposure: currentMeta.exposure,
+          // Rules ride the same channel (manifest-less apps only).
+          rules: currentMeta.rules,
         }),
         signal: AbortSignal.timeout(DEV_SESSION_REQUEST_TIMEOUT_MS),
       });
@@ -1480,6 +1678,11 @@ async function dev() {
           stopSuperseded(data.fix ?? "A newer `monty dev` session is active for this app.");
           return false;
         }
+        if (data?.code === "MANIFEST_DRIFT") {
+          // Remote schema edits (another agent, via the API) — the terminal
+          // the building agent is watching gets the fix, invariant #4.
+          console.log(`schema drift (remote changes):${data.summary ? `\n${data.summary}` : ""}`);
+        }
         console.log(`dev-session: ${data?.code ?? r.status}${data?.fix ? ` — ${data.fix}` : ""}`);
         // A dead key is a SIGNED-OUT session — advertise it so the desktop
         // (which owns the session) can surface sign-in instead of letting
@@ -1489,43 +1692,77 @@ async function dev() {
         }
         return false;
       }
+      if (data?.manifestDrift) {
+        // The session registered, but the config push was HELD: the stored
+        // schema changed since this checkout last synced (another editor).
+        if (!driftAnnounced) {
+          driftAnnounced = true;
+          console.log(`schema drift (remote changes):${data.manifestDrift.summary ? `\n${data.manifestDrift.summary}` : ""}`);
+          console.log(`config push held: ${data.manifestDrift.fix ?? "Run `monty schema pull`, merge, then save again."}`);
+        }
+      } else if (currentMeta.manifest !== undefined) {
+        driftAnnounced = false;
+        // This beat's manifest landed LIVE — the new CAS base.
+        try { writeSchemaState(appDir, manifestHash(currentMeta.manifest)); } catch { /* state is advisory */ }
+      }
       if (!registeredOnce) {
         registeredOnce = true;
         sf.write({ state: "online", loggedIn: true, lastHeartbeatAt: Date.now() });
       } else {
         sf.write({ loggedIn: true, lastHeartbeatAt: Date.now() });
       }
-      if (data?.publishRequested && !publishing && !ended) {
-        publishing = true;
-        sf.write({ publishing: true });
-        console.log("publish: requested from the workspace — building & uploading…");
-        const pubTee = logSink.source();
-        await new Promise((resolve) => {
-          pubChild = spawn(process.execPath, [fileURLToPath(import.meta.url), "deploy", "--from-dev"], {
-            cwd: appDir,
-            stdio: ["ignore", "pipe", "pipe"],
+      if (data?.configIgnored && !configIgnoredAnnounced) {
+        configIgnoredAnnounced = true;
+        console.log("schema: this app's data schema lives in the workspace — monty.config.ts edits do NOT change it. Read it: `monty schema`; change it: `monty schema set <file>`.");
+        // Stamp registry ownership: from the next session on, the config
+        // compile is skipped entirely.
+        try {
+          writeAppJson(appDir, {
+            registryOwned: true,
+            slug: meta.slug,
+            ...(currentMeta.name ? { name: currentMeta.name } : {}),
+            ...(currentMeta.icon ? { icon: currentMeta.icon } : {}),
           });
-          pubChild.stdout.on("data", (c) => {
-            process.stdout.write(c);
-            pubTee(c);
-          });
-          pubChild.stderr.on("data", (c) => {
-            process.stderr.write(c);
-            pubTee(c);
-          });
-          pubChild.on("exit", (code) => {
-            pubChild = null;
-            pubTee.flush();
-            console.log(
-              code === 0
-                ? "publish: done — the app is Live for the workspace (Studio session continues)"
-                : "publish: FAILED — fix the errors above, then click Publish again",
-            );
-            resolve(undefined);
-          });
-        });
-        publishing = false;
-        sf.write({ publishing: false });
+        } catch { /* the stamp is a convenience; the beat decided */ }
+      }
+      // The local config copy follows the registry: when the stored manifest
+      // moved (another editor, the schema door) and the local file is clean,
+      // regenerate it in place — the sync of the mechanical copy is
+      // automatic. Dirty or uncompilable files are left alone with the fix.
+      if (
+        typeof data?.manifestHash === "string" &&
+        existsSync(configPath) &&
+        data.manifestHash !== readSchemaState(appDir)?.hash &&
+        data.manifestHash !== syncAttemptedHash
+      ) {
+        syncAttemptedHash = data.manifestHash;
+        try {
+          // Already in sync (fresh checkout, no state file yet)? Stamp the
+          // base and leave the file alone — regenerate only on real drift.
+          let alreadySynced = false;
+          try {
+            const compiled = await compileAppConfig(appDir);
+            if (compiled.manifest && manifestHash(compiled.manifest) === data.manifestHash) {
+              writeSchemaState(appDir, data.manifestHash);
+              alreadySynced = true;
+            }
+          } catch { /* uncompilable — let schemaPull's dirty check narrate */ }
+          if (!alreadySynced) {
+            await schemaPull({
+              appDir,
+              host,
+              key: loadConfig()?.key ?? cfg.key,
+              slug: meta.slug,
+              force: false,
+              compileAppConfig,
+              fail: (code, fix) => {
+                throw new Error(`${code} — ${fix}`);
+              },
+            });
+          }
+        } catch (e) {
+          console.log(`schema: the workspace manifest changed but the local copy was NOT regenerated (${String(e?.message ?? e).slice(0, 240)})`);
+        }
       }
       return true;
     } catch {
@@ -1536,11 +1773,12 @@ async function dev() {
 
   async function startDevSession() {
     if (!cfg?.key) {
-      console.log("dev: not logged in — workspace Studio disabled (run `monty login`)");
+      console.log("dev: not logged in — workspace session disabled (run `monty login`)");
       return;
     }
     await clearDevSession();
-    let originUrl = `http://localhost:${port}`;
+    // Config-only sessions register WITHOUT an origin — nothing to iframe.
+    let originUrl = configOnly ? undefined : `http://localhost:${port}`;
     let tunnelUpdate = Promise.resolve();
     let tunnelVersion = 0;
     async function activateTunnelUrl(url, { initial = false } = {}) {
@@ -1557,17 +1795,17 @@ async function dev() {
       if (ended || version !== tunnelVersion) return "superseded";
       if (!dnsLive) {
         if (initial) {
-          console.log("tunnel: DNS never propagated — Studio registered on localhost (visible on this machine's browser only)");
+          console.log("tunnel: DNS never propagated — session registered on localhost (visible on this machine's browser only)");
         } else {
-          console.log("tunnel: DNS never propagated for the new URL — keeping Studio offline until the next tunnel URL");
+          console.log("tunnel: DNS never propagated for the new URL — keeping the session offline until the next tunnel URL");
         }
         return "failed";
       }
       originUrl = url;
       sf.write({ tunnelUrl: url });
-      console.log(initial ? "tunnel: DNS live" : "tunnel: DNS live; Studio URL updated");
+      console.log(initial ? "tunnel: DNS live" : "tunnel: DNS live; session URL updated");
       if (!initial && !(await heartbeat(originUrl))) {
-        console.log("dev-session: Studio still has no registered tunnel; the next heartbeat will retry");
+        console.log("dev-session: the session still has no registered tunnel; the next heartbeat will retry");
       }
       return "activated";
     }
@@ -1579,7 +1817,7 @@ async function dev() {
         console.log("tunnel: URL update failed — waiting for the next tunnel URL");
       });
     };
-    if (!rest.includes("--no-tunnel")) {
+    if (!configOnly && !rest.includes("--no-tunnel")) {
       console.log("tunnel: starting (cloudflared quick tunnel)…");
       // cloudflared output is teed to dev.log only (the terminal stays quiet,
       // exactly as today) — post-mortems get the tunnel noise.
@@ -1591,22 +1829,46 @@ async function dev() {
         console.log(`tunnel: ${t.url}`);
         await activateTunnelUrl(t.url, { initial: true });
       } else {
-        console.log("tunnel: unavailable — Studio registered on localhost (visible on this machine's browser only)");
+        console.log("tunnel: unavailable — session registered on localhost (visible in this machine's browser only)");
       }
     }
     const registered = await heartbeat(originUrl, { claim: true });
     console.log(
       registered
-        ? `studio: ${host}/studio/${meta.slug} — your app runs there while this is up; click Publish to go Live`
-        : `studio: waiting for ${host}/api/dev-session — leave this running; the next heartbeat will retry`,
+        ? `preview: ${host}/apps/${meta.slug} — the app surface follows this session while it runs; \`monty save\` updates the cloud copy`
+        : `preview: waiting for ${host}/api/dev-session — leave this running; the next heartbeat will retry`,
     );
     hbTimer = setInterval(() => void heartbeat(originUrl), DEV_SESSION_HEARTBEAT_MS);
   }
 
+  if (configOnly) {
+    sf.write({ state: "ready" });
+    console.log(
+      registryOwned
+        ? "ready: config-only — the workspace owns this app's schema; edit it with `monty schema` / `monty schema set`"
+        : "ready: config-only — saves land LIVE; the workspace renders them within seconds",
+    );
+    void startDevSession();
+    if (!registryOwned) {
+      // Manifest-less apps only: config edits should land in seconds, not a
+      // heartbeat — watch the mtime and trigger an early beat (which
+      // recompiles + pushes). Registry-owned apps have nothing to push.
+      const cfgWatch = setInterval(() => {
+        try {
+          if (statSync(configPath).mtimeMs !== configMtime) void heartbeat(undefined);
+        } catch { /* transient fs hiccup */ }
+      }, 2000);
+      const stopWatch = () => clearInterval(cfgWatch);
+      process.on("SIGINT", stopWatch);
+      process.on("SIGTERM", stopWatch);
+      process.on("SIGHUP", stopWatch);
+    }
+  }
+
   let announced = false;
   const viteOutTee = logSink.source();
   const viteErrTee = logSink.source();
-  child.stdout.on("data", (chunk) => {
+  child?.stdout.on("data", (chunk) => {
     const text = chunk.toString();
     process.stdout.write(text);
     viteOutTee(chunk);
@@ -1616,23 +1878,23 @@ async function dev() {
     if (!announced && /localhost:\d+/.test(text.replace(ANSI_RE, ""))) {
       announced = true;
       sf.write({ state: "ready" });
-      console.log(`data: sandboxed to "${meta.slug}#dev" (Studio sandbox; Live records untouched)`);
+      console.log(`data: live — this session reads and writes the app\'s real records`);
       console.log(`ready: http://localhost:${port}`);
       void startDevSession();
     }
   });
   // vite stderr is where build errors and the SDK's browser-error mirror
   // land — piped (was inherit) so `monty logs` sees them too.
-  child.stderr.on("data", (chunk) => {
+  child?.stderr.on("data", (chunk) => {
     process.stderr.write(chunk);
     viteErrTee(chunk);
   });
-  child.on("error", (e) => {
+  child?.on("error", (e) => {
     void endSession().then(() => {
       fail("VITE_SPAWN_FAILED", `Could not start vite: ${e?.message ?? e}. Run \`monty install\`, then retry.`);
     });
   });
-  child.on("exit", (code) => {
+  child?.on("exit", (code) => {
     viteOutTee.flush();
     viteErrTee.flush();
     void endSession().then(() => process.exit(code ?? 0));
@@ -1806,7 +2068,7 @@ async function waitForDns(hostname) {
 
 // Cloudflare quick tunnel via the cloudflared npm wrapper (downloads the
 // binary on first use). Resolves with the public URL, or null on failure —
-// Studio then falls back to localhost-only registration. onOutput receives
+// the session then falls back to localhost-only registration. onOutput receives
 // every chunk (both fds) for the dev.log tee.
 function startTunnel(port, onUrlChange, onOutput) {
   return new Promise((resolve) => {
@@ -1881,11 +2143,237 @@ function resolveComponent(name) {
   return name;
 }
 
+// ── monty add page <name> ──────────────────────────────────────────────────
+// Upgrades an app with a bespoke (custom) page: scaffolds the SPA on first
+// use (config-only apps gain src/ + vite from the template — their
+// monty.config.ts and AGENTS.md stay untouched), declares
+// `pages.<name> = { kind: "custom", path: "/<name>" }`, and writes the page
+// route. DECLARE-FIRST: on a workspace-owned app the entry lands through
+// the schema door BEFORE the code exists — a save carrying an undeclared
+// route refuses (DEPLOY_UNDECLARED_PAGE). The Shopify model: system pages
+// stay shell-rendered; only this page is the app's own code.
+
+// Declare the page through the schema door. Returns "declared" | "already"
+// (workspace-owned app) or "config" (manifest-less: the config file is
+// still that app's editor, the caller registers the entry there).
+async function declarePageThroughDoor(appDir, pageName) {
+  const slug = readSlug(appDir);
+  const { host, key } = loadConfig();
+  if (!slug || !key) return "config";
+  const read = await fetch(`${host}/api/schema?slug=${slug}`, {
+    headers: { authorization: `Bearer ${key}` },
+  }).catch(() => null);
+  const readBody = await read?.json().catch(() => null);
+  if (!read?.ok || !readBody?.ok || readBody.manifest === null) return "config";
+  const manifest = readBody.manifest;
+  const keyOf = (n) => n.toLowerCase().replace(/[^a-z0-9]/g, "");
+  const declared = Object.keys(manifest.pages ?? {}).find((n) => keyOf(n) === keyOf(pageName));
+  if (declared) {
+    const kind = manifest.pages[declared]?.kind;
+    if (kind !== "custom") {
+      fail("PAGE_KIND", `"${declared}" is a ${kind} page in the app's manifest — custom code can't replace it. Pick another page name.`);
+    }
+    return "already";
+  }
+  // An empty pages block means default view pages derive from the tables;
+  // materialize them first so declaring one custom page can't hide the rest.
+  const pages =
+    manifest.pages && Object.keys(manifest.pages).length > 0
+      ? { ...manifest.pages }
+      : Object.fromEntries(Object.keys(manifest.tables ?? {}).map((t) => [t, { kind: "view", table: t }]));
+  pages[pageName] = { kind: "custom", path: `/${pageName}` };
+  const res = await fetch(`${host}/api/schema`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+    body: JSON.stringify({ slug, manifest: { ...manifest, pages }, baseHash: readBody.hash }),
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.ok) {
+    fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Declaring the page through the schema door failed — check the connection and retry.");
+  }
+  try { writeSchemaState(appDir, body.hash); } catch { /* state is advisory */ }
+  return "declared";
+}
+
+async function addPage(appDir, pageName) {
+  if (!pageName || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(pageName) || pageName.length > 32) {
+    fail("INVALID_PAGE", 'Usage: monty add page <name> — lowercase letters/digits with single hyphens, max 32 chars (e.g. "reports").');
+  }
+  const configPath = join(appDir, "monty.config.ts");
+  if (!existsSync(configPath)) {
+    fail("NO_CONFIG", `No monty.config.ts in ${appDir} — run this inside a Monty app.`);
+  }
+  const config = readFileSync(configPath, "utf8");
+  const appName = config.match(/name: "([^"]*)"/)?.[1] ?? pageName;
+  const routeFile = join(appDir, "src", "routes", `${pageName}.tsx`);
+  if (existsSync(routeFile)) {
+    fail("PAGE_EXISTS", `src/routes/${pageName}.tsx already exists. Edit it, or pick a different page name.`);
+  }
+  if (config.includes(`"/${pageName}"`) || new RegExp(`^\\s*${pageName}:`, "m").test(config)) {
+    console.log(`note: "${pageName}" may already be declared in monty.config.ts — check its pages block after this.`);
+  }
+  // Declare BEFORE any code exists: if the door refuses, nothing to clean up.
+  const declared = await declarePageThroughDoor(appDir, pageName);
+  if (declared !== "config") {
+    console.log(
+      declared === "declared"
+        ? `declared: pages.${pageName} through the schema door — live in the workspace now`
+        : `declared: pages.${pageName} already in the workspace manifest`,
+    );
+  }
+
+  // First custom page on a config-only app: bring in the SPA scaffold.
+  if (isConfigOnlyApp(appDir)) {
+    const pkgRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+    const templateDir = [
+      join(pkgRoot, "template"),
+      join(pkgRoot, "..", "template"),
+    ].find((d) => existsSync(join(d, "monty.config.ts")));
+    if (!templateDir) {
+      fail("TEMPLATE_MISSING", "The Monty app template is missing from this CLI install. Reinstall the monty CLI.");
+    }
+    console.log(`add page: upgrading config-only app with the SPA scaffold`);
+    cpSync(templateDir, appDir, {
+      recursive: true,
+      force: false, // existing files (config, AGENTS.md, package.json…) win
+      filter: (src) => {
+        const base = basename(src);
+        if (["node_modules", "dist", ".monty", ".env.local", "routeTree.gen.ts"].includes(base)) return false;
+        // The app keeps its own identity files.
+        if (["monty.config.ts", "AGENTS.md", "CLAUDE.md"].includes(base)) return false;
+        return true;
+      },
+    });
+    // gitignore ships name-mangled in the published bundle (see create()).
+    if (existsSync(join(appDir, "gitignore")) && !existsSync(join(appDir, ".gitignore"))) {
+      renameSync(join(appDir, "gitignore"), join(appDir, ".gitignore"));
+    }
+    // Merge the template's SPA deps/scripts into the app's package.json —
+    // the config-only one has only sdk+zod and no scripts.
+    const tplPkg = JSON.parse(readFileSync(join(templateDir, "package.json"), "utf8"));
+    const pkgPath = join(appDir, "package.json");
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    pkg.scripts = { ...tplPkg.scripts, ...pkg.scripts };
+    pkg.dependencies = { ...tplPkg.dependencies, ...pkg.dependencies };
+    pkg.devDependencies = { ...tplPkg.devDependencies, ...pkg.devDependencies };
+    // vite.config.ts imports the ESM-only sdk plugin — without the
+    // template's module type the config loads as CJS and fails to resolve it.
+    if (tplPkg.type && !pkg.type) pkg.type = tplPkg.type;
+    // The published template pins the sdk; a workspace app may carry
+    // workspace:* — the merge above keeps the app's existing pin either way.
+    writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+    const htmlPath = join(appDir, "index.html");
+    if (existsSync(htmlPath)) {
+      writeFileSync(htmlPath, readFileSync(htmlPath, "utf8").replace(/<title>[^<]*<\/title>/, `<title>${appName}</title>`));
+    }
+    // Client env for the SPA half, same as create().
+    if (!existsSync(join(appDir, ".env.local"))) {
+      try {
+        const { host } = loadConfig();
+        const cfg = await fetch(`${host}/api/config`).then((r) => r.json());
+        writeFileSync(join(appDir, ".env.local"), `VITE_CONVEX_URL=${cfg.convexUrl}\nVITE_CLERK_PUBLISHABLE_KEY=${cfg.clerkPublishableKey}\n`);
+        console.log("config: .env.local written");
+      } catch {
+        console.log("config: WARNING — could not fetch client config; copy .env.example to .env.local manually");
+      }
+    }
+    // The template's starter index route assumes it IS the app — for a page
+    // upgrade the shell owns the app; drop the starter so the page below is
+    // the only route beside __root.
+    const starter = join(appDir, "src", "routes", "index.tsx");
+    if (existsSync(starter)) rmSync(starter);
+    appendFileSync(
+      join(appDir, "AGENTS.md"),
+      `\n---\n\n## Custom pages\n\nThis app now has a SPA half (src/) serving CUSTOM pages inside the\nplatform shell. Each page = a route in src/routes/ + a\n\`pages.<name>: { kind: "custom", path: "/<name>" }\` declaration.\nDECLARE-FIRST: \`monty add page <name>\` declares the entry (through the\nschema door on workspace-owned apps) before writing the route — a save\ncarrying an undeclared route refuses. System pages (table views) stay\nshell-rendered — only build bespoke UI here. \`monty dev\` serves both.\nAfter every meaningful change verified in dev, run\n\`monty save "<what changed>"\` — it pushes the work to the cloud copy,\nlike \`git push main\`.\n\nEvery custom page opens with \`PageHeader\` from \`@montytools/sdk/ui\` —\nthe same bar the shell renders on system pages (page actions go in it as\n\`PageHeaderButton\`s, \`primary\` for the one main action). Also there:\n\`FloatingBar\`/\`FloatingBarButton\` and the Lyra table classes\n\`SURFACE\`/\`THEAD\`/\`TH\`/\`ROW\`/\`CHIP\`.\n`,
+    );
+  }
+
+  // The generated route imports @montytools/sdk/ui, whose Tailwind classes
+  // only compile if the app's CSS scans the sdk dist — older scaffolds
+  // predate the @source line.
+  const cssPath = join(appDir, "src", "index.css");
+  if (existsSync(cssPath)) {
+    const css = readFileSync(cssPath, "utf8");
+    if (!css.includes("@montytools/sdk/dist/ui.js")) {
+      const lines = css.split("\n");
+      let lastImport = -1;
+      lines.forEach((l, i) => { if (/^@import\s/.test(l)) lastImport = i; });
+      lines.splice(lastImport + 1, 0, '@source "../node_modules/@montytools/sdk/dist/ui.js";');
+      writeFileSync(cssPath, lines.join("\n"));
+      console.log("config: src/index.css now scans @montytools/sdk/ui (Tailwind @source)");
+    }
+  }
+
+  // The page route: a real, working start — SDK data hooks, shell-aware.
+  mkdirSync(dirname(routeFile), { recursive: true });
+  const pageTitle = (pageName[0].toUpperCase() + pageName.slice(1)).replace(/-/g, " ");
+  writeFileSync(routeFile, `import { createFileRoute } from "@tanstack/react-router";
+import { PageHeader } from "@montytools/sdk/ui";
+
+export const Route = createFileRoute("/${pageName}")({
+  component: ${pageComponentName(pageName)},
+});
+
+// A CUSTOM page: bespoke UI mounted inside the platform shell at
+// /apps/<slug>/${pageName}. Data comes from @montytools/sdk hooks
+// (useList/useInsert/…) against the same tables the shell renders. The
+// PageHeader bar is the same chrome system pages wear — keep it first, put
+// page actions in it (PageHeaderButton).
+function ${pageComponentName(pageName)}() {
+  return (
+    <div className="flex h-full min-h-dvh flex-col">
+      <PageHeader title="${pageTitle}" />
+      <main className="min-h-0 flex-1 overflow-auto p-6">
+        <p className="text-sm text-muted-foreground">
+          Build this page. It ships with the app on the next \`monty save\`.
+        </p>
+      </main>
+    </div>
+  );
+}
+`);
+  console.log(`page: src/routes/${pageName}.tsx`);
+
+  // Manifest-less apps only: the config file is still their editor, so the
+  // entry registers there (workspace-owned apps declared through the door
+  // above — a config edit would be inert).
+  if (declared === "config") {
+    const entry = `    ${JSON.stringify(pageName).includes("-") ? JSON.stringify(pageName) : pageName}: { kind: "custom", path: "/${pageName}" },`;
+    let next = null;
+    if (/^(\s*)pages:\s*{/m.test(config)) {
+      next = config.replace(/^(\s*)pages:\s*{/m, (m) => `${m}\n${entry}`);
+    } else {
+      // No pages block: add one right before the config's closing `});`.
+      const close = config.lastIndexOf("});");
+      if (close !== -1) {
+        next = config.slice(0, close) + `  pages: {\n${entry}\n  },\n` + config.slice(close);
+      }
+    }
+    if (next) {
+      writeFileSync(configPath, next);
+      console.log(`config: pages.${pageName} registered in monty.config.ts`);
+    } else {
+      console.log(`config: could not auto-edit monty.config.ts — add this to defineApp yourself:\n  pages: { ${pageName}: { kind: "custom", path: "/${pageName}" } }`);
+    }
+  }
+
+  console.log(`added: custom page "${pageName}"`);
+  console.log(`next: monty install && monty dev — the shell mounts /${pageName} live; \`monty save\` pushes it to the cloud copy.`);
+}
+
+function pageComponentName(pageName) {
+  return pageName.split("-").map((w) => w[0].toUpperCase() + w.slice(1)).join("") + "Page";
+}
+
 async function add() {
   const appDir = requireAppDir("add");
   const names = rest.filter((a) => !a.startsWith("--"));
   if (names.length === 0) {
-    fail("NO_COMPONENT", "Usage: monty add <name...> — run `monty components` to see what's available.");
+    fail("NO_COMPONENT", "Usage: monty add <name...> — run `monty components` to see what's available (or `monty add page <name>` for a custom page).");
+  }
+  if (names[0] === "page") {
+    await addPage(appDir, names[1]);
+    return;
   }
   const items = names.flatMap((n) => [resolveComponent(n), ...(CATALOG[n]?.also ?? [])]);
 
@@ -1960,7 +2448,12 @@ async function docs() {
 // readable back. Read from the arg, then a TTY prompt, then stdin (piping).
 async function secret() {
   const appDir = requireAppDir("secret");
-  const meta = await compileConfig(appDir);
+  // Identity comes from the stamp when it exists — no config compile for
+  // one slug read.
+  const stamped = readAppJson(appDir);
+  const meta = typeof stamped?.slug === "string" && stamped.slug
+    ? { slug: stamped.slug }
+    : await compileConfig(appDir);
   const config = loadConfig();
   if (!config?.key) fail("NOT_LOGGED_IN", "Run `monty login` first.");
   const [sub, name] = rest.filter((a) => !a.startsWith("-"));
@@ -1997,13 +2490,25 @@ async function secret() {
   console.log(del ? `secret: removed ${name} from ${meta.slug}` : `secret: set ${name} on ${meta.slug} (write-only; not readable back)`);
 }
 
-// ── monty deploy ───────────────────────────────────────────────────────────
+// ── monty save ─────────────────────────────────────────────────────────────
+// Push the working copy to the cloud copy, like `git push main`. `deploy` is
+// the compat alias; both run the same pipeline (build + typecheck gate every
+// save, then one multipart POST). The optional message rides the deploy meta
+// so the platform can narrate the save later.
 async function deploy() {
-  const appDir = requireAppDir("deploy");
+  const appDir = requireAppDir(command);
   ensureSdk(appDir);
-  if (!rest.includes("--from-dev")) {
-    console.log("note: direct deploy ships straight to Live, skipping workspace review — the usual flow is `monty dev` (Studio) + the Publish button in the workspace.");
-  }
+  const message = rest.find((a) => !a.startsWith("-")) ?? null;
+  const saveJson = (state) => writeSaveJson(appDir, { message, ...state });
+  saveJson({ status: "saving" });
+  saveFailNote = (code, fix) => saveJson({ status: "error", detail: fix });
+  process.on("exit", (exitCode) => {
+    // A crash that never reached fail() (network throw, unhandled rejection)
+    // must not leave the chip on "Saving…" forever.
+    if (exitCode !== 0 && saveFailNote) {
+      saveJson({ status: "error", detail: "The save stopped before finishing. Run `monty save` again." });
+    }
+  });
   const config = loadConfig();
   if (!config?.key) {
     fail("NOT_LOGGED_IN", "Run `monty login` first (create a key at /cli-auth in the Monty host).");
@@ -2014,17 +2519,40 @@ async function deploy() {
   console.log("compile: monty.config.ts");
   const meta = await compileConfig(appDir);
   console.log(`compile: ok (app "${meta.slug}", ${Object.keys(meta.schemaJson.tables).length} tables)`);
-
-  // 2) Fail fast locally before any upload. Build FIRST — it also generates
-  //    src/routeTree.gen.ts, without which tsc fails on a fresh checkout.
-  run(appDir, "build", ["npx", "vite", "build"],
-    "The production build failed. Read the vite error above; it names the file to fix.");
-  run(appDir, "typecheck", ["npx", "tsc", "--noEmit"],
-    "TypeScript errors above. Fix them in the listed files; `monty deploy` never uploads code that does not compile.");
+  // `monty save "what changed"` — the message rides the meta for the
+  // platform to render as this save's Activity row.
+  if (message) meta.message = message;
+
+  // Registry-owned apps ship IMPLEMENTATION ONLY: manifest, schema, rules,
+  // and exposure are door-owned (the server holds them regardless — not
+  // sending them keeps the wire honest). Code-door declarations
+  // (publicFns, schedule, pages, functions) still ride.
+  const registryOwned = readAppJson(appDir)?.registryOwned === true;
+  if (registryOwned) {
+    delete meta.schemaJson;
+    delete meta.manifest;
+    delete meta.exposure;
+    delete meta.rules;
+  }
+
+  // CONFIG-ONLY apps publish the manifest alone: no vite build, no bundle —
+  // the platform shell renders the app.
+  const configOnly = isConfigOnlyApp(appDir);
+  if (!configOnly) {
+    // 2) Fail fast locally before any upload. Build FIRST — it also generates
+    //    src/routeTree.gen.ts, without which tsc fails on a fresh checkout.
+    run(appDir, "build", ["npx", "vite", "build"],
+      "The production build failed. Read the vite error above; it names the file to fix.");
+    run(appDir, "typecheck", ["npx", "tsc", "--noEmit"],
+      "TypeScript errors above. Fix them in the listed files; `monty save` never uploads code that does not compile.");
+  } else if (!registryOwned && !meta.manifest) {
+    fail("MANIFEST_MISSING",
+      "This config-only app compiled without a manifest — that should be impossible (forceManifest). Re-run `monty install` to refresh the SDK, then retry.");
+  }
 
   // 3) Multipart POST to the host.
   const dist = join(appDir, "dist");
-  const files = walk(dist);
+  const files = configOnly ? [] : walk(dist);
   const buildFile = join(appDir, ".monty", "build");
   if (existsSync(buildFile)) {
     meta.buildId = readFileSync(buildFile, "utf8").trim();
@@ -2053,9 +2581,15 @@ async function deploy() {
           `schedule targets "${name}" but server/index.ts exports no such function. Export it (e.g. \`export async function ${name}(args, ctx) {…}\`) or remove the entry from monty.config.ts.`);
       }
     }
-    meta.fns = serverBundle.fns;
+    // Wire compat: meta.fns stays the UNION (older hosts gate dispatch on
+    // it); meta.datasets is the additive split newer hosts classify with.
+    meta.fns = [...serverBundle.fns, ...serverBundle.datasets];
+    if (serverBundle.datasets.length > 0) meta.datasets = serverBundle.datasets;
     form.set("server-worker", new Blob([serverBundle.code]), "server-worker.mjs");
-    console.log(`fns: bundled ${serverBundle.fns.length} server function(s) (${serverBundle.fns.join(", ")})`);
+    const bundled = [];
+    if (serverBundle.fns.length > 0) bundled.push(`${serverBundle.fns.length} function(s) (${serverBundle.fns.join(", ")})`);
+    if (serverBundle.datasets.length > 0) bundled.push(`${serverBundle.datasets.length} dataset(s) (${serverBundle.datasets.join(", ")})`);
+    console.log(`fns: bundled ${bundled.join(" + ")}`);
     if (publicFns.length > 0) {
       console.log(`public: ${publicFns.map((f) => `/__monty/public/${f}`).join(", ")} — open to the internet; verify signatures in the function`);
     }
@@ -2063,6 +2597,16 @@ async function deploy() {
       console.log(`schedule: ${scheduleEntries.map(([f, c]) => `${f} @ "${c}"`).join(", ")} (UTC; Live cron changes can take ~15 min to propagate)`);
     }
   }
+  // 3a½) Custom pages, by route-file convention (top-level src/routes/
+  // files) — registered as fnsJson.pages so the shell's nav knows what this
+  // bundle ships without a manifest entry.
+  if (!configOnly) {
+    const pages = discoverPages(appDir);
+    if (pages.length > 0) {
+      meta.pages = pages;
+      console.log(`pages: ${pages.map((p) => p.name).join(", ")}`);
+    }
+  }
   // 3b) SOURCE snapshot rides every publish. Without it the platform keeps
   // only the minified bundle and the sole copy of the app's code is this
   // folder — delete it and the source is gone forever. The snapshot is what
@@ -2072,16 +2616,23 @@ async function deploy() {
   {
     const packed = packSource(appDir);
     if (packed === null) {
-      console.log("source: WARNING — could not pack a snapshot (tar failed); `monty pull` will not work for this publish.");
+      console.log("source: WARNING — could not pack a snapshot (tar failed); `monty pull` will not work for this save.");
     } else if (packed.tooLarge) {
       console.log("source: WARNING — snapshot exceeds 10 MB, skipped; `monty pull` will not work for this app. Remove large assets from the app folder.");
     } else {
       sourceHash = packed.hash;
       meta.sourceHash = sourceHash;
       form.set("source", new Blob([packed.buf]), "source.tar.gz");
-      console.log(`source: ${(packed.buf.byteLength / 1024).toFixed(0)} KB snapshot rides this publish (restore anywhere: monty pull ${meta.slug})`);
+      console.log(`source: ${(packed.buf.byteLength / 1024).toFixed(0)} KB snapshot rides this save (restore anywhere: monty pull ${meta.slug})`);
     }
   }
+  // V2 schema CAS: prove which stored manifest this checkout last synced,
+  // so an API/MCP edit made meanwhile surfaces as MANIFEST_DRIFT instead of
+  // being clobbered (fix: `monty schema pull`).
+  if (meta.manifest !== undefined) {
+    const state = readSchemaState(appDir);
+    if (state?.hash) meta.baseManifestHash = state.hash;
+  }
   form.set("monty", JSON.stringify(meta));
   let total = 0;
   for (const file of files) {
@@ -2090,7 +2641,11 @@ async function deploy() {
     total += buf.byteLength;
     form.set(rel, new Blob([buf]), rel);
   }
-  console.log(`upload: ${files.length} files, ${(total / 1024).toFixed(0)} KB -> ${config.host}/api/deploy`);
+  console.log(
+    configOnly
+      ? `upload: config-only (manifest, no bundle) -> ${config.host}/api/deploy`
+      : `upload: ${files.length} files, ${(total / 1024).toFixed(0)} KB -> ${config.host}/api/deploy`,
+  );
   const res = await fetch(`${config.host}/api/deploy`, {
     method: "POST",
     headers: { authorization: `Bearer ${config.key}` },
@@ -2098,10 +2653,22 @@ async function deploy() {
   });
   const body = await res.json().catch(() => null);
   if (!res.ok || !body?.ok) {
+    if (body?.code === "MANIFEST_DRIFT" && body?.summary) {
+      console.log(`schema drift (remote changes):\n${body.summary}`);
+    }
     fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Unexpected server response — is the Monty host reachable?");
   }
   console.log(`origin: ${body.origin}`);
-  console.log(`deployed: ${body.url} (version ${body.version})`);
+  console.log(`saved: ${body.url} (version ${body.version})`);
+  if (body.manifestDrift) {
+    // The code shipped; the config was HELD — the stored schema changed
+    // since this checkout last synced (another editor).
+    console.log(`schema drift (remote changes):${body.manifestDrift.summary ? `\n${body.manifestDrift.summary}` : ""}`);
+    console.log(`config push held: ${body.manifestDrift.fix ?? "Run `monty schema pull`, merge, then deploy again."}`);
+  } else if (meta.manifest !== undefined) {
+    // The manifest just published IS the new CAS base.
+    writeSchemaState(appDir, manifestHash(meta.manifest));
+  }
   // Stamp what was published — pull uses this to tell "unchanged since last
   // sync" from "locally modified".
   if (sourceHash) {
@@ -2110,15 +2677,22 @@ async function deploy() {
       JSON.stringify({ hash: sourceHash, syncedAt: Date.now() }) + "\n",
     );
   }
+  saveFailNote = null;
+  saveJson({ status: "saved" });
 }
 
-// Bundle server/index.ts (if present) into ONE Worker script: a generated
-// entry wraps the app's exports with @montytools/sdk/fn-worker's makeFnWorker,
-// esbuild bundles it for workerd. node: imports are rejected at compile time
-// — Live runs on Cloudflare Workers, not Node. Returns { code, fns } or null.
+// Bundle the app's server code (if present) into ONE Worker script: server/
+// index.ts (functions — custom code) and datasets/index.ts (defineDataset
+// table feeds) merge into a generated entry wrapped with @montytools/sdk/
+// fn-worker's makeFnWorker; esbuild bundles it for workerd. node: imports are
+// rejected at compile time — Live runs on Cloudflare Workers, not Node.
+// Returns { code, fns, datasets } (per-folder export names) or null.
 async function bundleServerFns(appDir, schedule) {
   const serverEntry = join(appDir, "server", "index.ts");
-  if (!existsSync(serverEntry)) return null;
+  const datasetsEntry = join(appDir, "datasets", "index.ts");
+  const hasServer = existsSync(serverEntry);
+  const hasDatasets = existsSync(datasetsEntry);
+  if (!hasServer && !hasDatasets) return null;
   const { build } = await import("esbuild");
   const tmpDir = join(appDir, ".monty");
   mkdirSync(tmpDir, { recursive: true });
@@ -2128,9 +2702,10 @@ async function bundleServerFns(appDir, schedule) {
   // hands back only the matching cron expression, so the worker needs the
   // expression→fn mapping at runtime.
   writeFileSync(entry, [
-    `import * as appFns from "../server/index";`,
+    hasServer ? `import * as appFns from "../server/index";` : `const appFns = {};`,
+    hasDatasets ? `import * as appDatasets from "../datasets/index";` : `const appDatasets = {};`,
     `import { makeFnWorker } from "@montytools/sdk/fn-worker";`,
-    `export default makeFnWorker(appFns, { schedule: ${JSON.stringify(schedule ?? {})} });`,
+    `export default makeFnWorker({ ...appFns, ...appDatasets }, { schedule: ${JSON.stringify(schedule ?? {})} });`,
   ].join("\n"));
   // Fail the deploy if server code reaches for Node built-ins — a Worker
   // can't run them, and a silent runtime crash on Live is the worst outcome.
@@ -2159,15 +2734,20 @@ async function bundleServerFns(appDir, schedule) {
       logLevel: "silent",
       plugins: [banPlatformImports],
     });
-    fns = discoverFnExports(serverEntry);
-    if (fns.length === 0) {
-      fail("NO_FN_EXPORTS", "server/index.ts exists but exports no async functions. Export named functions like `export async function score(args, ctx) {…}`, or remove the folder.");
+    fns = hasServer ? discoverFnExports(serverEntry) : [];
+    const datasets = hasDatasets ? discoverFnExports(datasetsEntry) : [];
+    const dup = fns.filter((f) => datasets.includes(f));
+    if (dup.length > 0) {
+      fail("DUPLICATE_EXPORT", `"${dup[0]}" is exported from both server/index.ts and datasets/index.ts — one name, one home. Remove one of the two exports.`);
+    }
+    if (fns.length === 0 && datasets.length === 0) {
+      fail("NO_FN_EXPORTS", "server/index.ts / datasets/index.ts exist but export no functions. Export named functions like `export async function score(args, ctx) {…}`, or remove the folder.");
     }
-    return { code: readFileSync(out, "utf8"), fns };
+    return { code: readFileSync(out, "utf8"), fns, datasets };
   } catch (e) {
-    if (e?.code === "NO_FN_EXPORTS") throw e; // fail() already exited; guard for safety
+    if (e?.code === "NO_FN_EXPORTS" || e?.code === "DUPLICATE_EXPORT") throw e; // fail() already exited; guard for safety
     const msg = e?.errors?.[0]?.text ?? e?.message ?? String(e);
-    fail("FN_BUNDLE_FAILED", `Could not bundle server/index.ts: ${msg}`);
+    fail("FN_BUNDLE_FAILED", `Could not bundle the app's server code: ${msg}`);
   } finally {
     rmSync(entry, { force: true });
     rmSync(out, { force: true });
@@ -2191,10 +2771,12 @@ function discoverFnExports(serverEntry) {
 }
 
 // Thin wrapper over the shared pipeline (lib/compile.mjs): `soft` keeps the
-// Studio heartbeat's last good schema through transient config breakage.
+// the session heartbeat's last good schema through transient config breakage.
 async function compileConfig(appDir, { soft = false } = {}) {
   try {
-    return await compileAppConfig(appDir);
+    // Config-only apps (no SPA) always compile a manifest: the platform
+    // shell is their only renderer.
+    return await compileAppConfig(appDir, { forceManifest: isConfigOnlyApp(appDir) });
   } catch (e) {
     if (e instanceof CompileError) {
       if (soft) {
@@ -2228,7 +2810,7 @@ function walk(dir) {
   return out;
 }
 
-// ── cron matching (the Studio ticker in `monty dev`) ──────────────────────
+// ── cron matching (the session's cron ticker in `monty dev`) ─────────────
 // UTC, 5 fields, standard syntax: *  a,b  a-b  */n  a-b/n  plus month/day
 // names (JAN, MON). Deliberately forgiving: an unparsable field simply never
 // matches locally — Cloudflare is the syntax authority at deploy, so a bad
@@ -2289,15 +2871,14 @@ function cronFieldMatches(field, value, [lo, hi], idx) {
 // terminal — no browser, no dev session. Auth is the mk_ key exchanged at
 // /api/dev-token for a 5-minute workspace token (member lane, org_id from
 // the verified JWT), then the 6 public records functions over Convex's HTTP
-// API. `app` picks the records namespace: the plain slug is Live; --studio
-// targets "{slug}#dev" (the Studio sandbox — same wire literal the dev
-// shell uses). Results are ONE JSON document on stdout so agents can pipe.
+// API. `app` is the plain slug — every app has ONE set of records.
+// Results are ONE JSON document on stdout so agents can pipe.
 
 const DATA_VALUE_FLAGS = new Set(["app", "filter", "order", "limit", "cursor", "data", "key", "unset", "host"]);
 
 // rest, minus flags AND their values — `monty data list leads --app crm`
-// must not read "crm" as a positional. Boolean flags (--studio) have no
-// value and are skipped alone.
+// must not read "crm" as a positional. Boolean flags have no value and
+// are skipped alone.
 function dataPositionals() {
   const out = [];
   for (let i = 0; i < rest.length; i++) {
@@ -2331,7 +2912,10 @@ function resolveDataApp() {
   if (!slug) {
     fail("NO_APP", "Say which app: pass --app <slug>, or run inside an app folder. `monty apps` lists local apps.");
   }
-  return rest.includes("--studio") ? `${slug}#dev` : slug;
+  if (rest.includes("--studio")) {
+    fail("STUDIO_REMOVED", "The session sandbox is gone — every app has one set of records, and data verbs always target it. Drop --studio.");
+  }
+  return slug;
 }
 
 // mk_ key → { convexUrl, token }. The token is workspace-scoped and expires
@@ -2398,7 +2982,7 @@ function flattenRow(doc) {
 }
 
 function dataUsage() {
-  console.log("usage: monty data <verb> [table] [flags]     read/write an app's Live records (add --studio for the Studio sandbox)");
+  console.log("usage: monty data <verb> [table] [flags]     read/write an app's records");
   console.log("  schema  [table]                             the app's table shapes (from local monty.config.ts — `monty pull` first if needed)");
   console.log("  list    <table> [--filter '{\"k\":\"v\"}'] [--order asc|desc] [--limit N] [--cursor C]");
   console.log("  get     <table> <id>");
@@ -2406,7 +2990,7 @@ function dataUsage() {
   console.log("  update  <table> <id> --data '<json>' [--unset field,field]");
   console.log("  upsert  <table> --key <field[,field]> --data '<json|[json,…]>'   find-or-create matched on the key fields (idempotent)");
   console.log("  remove  <table> <id>");
-  console.log("target: --app <slug> (or run inside the app folder); default is LIVE data — --studio targets the sandbox");
+  console.log("target: --app <slug> (or run inside the app folder)");
   process.exit(1);
 }
 
@@ -2552,6 +3136,101 @@ if (command !== "dev" && command !== "logs") {
   installSkills({ appDir: findAppRoot(process.cwd()) });
 }
 
+// ── monty schema — the manifest door ──────────────────────────────────────
+// The app's data half (tables, field algebra, metrics, settings, pages)
+// lives ONLY in the workspace. `monty schema [slug]` prints the stored
+// manifest as JSON (and stamps the CAS base); edit that JSON and
+// `monty schema set <file|->` writes it back through the one landing —
+// validated server-side, additive-only by default, CAS against what you
+// read. `monty schema pull` (legacy) regenerates monty.config.ts.
+async function schemaCmd() {
+  const verb = rest[0];
+  const { host, key } = loadConfig() ?? {};
+  if (!key) fail("NOT_LOGGED_IN", "Run `monty login` first.");
+  const appDir = findAppRoot(process.cwd());
+
+  if (verb === "pull") {
+    const dir = appDir ?? process.cwd();
+    let slug = rest.slice(1).find((a) => !a.startsWith("--"));
+    if (!slug) {
+      try {
+        slug = (await compileAppConfig(dir)).slug;
+      } catch {
+        fail("INVALID_SLUG", "Pass the app slug (monty schema pull <slug>) — no compilable monty.config.ts here to read it from.");
+      }
+    }
+    await schemaPull({
+      appDir: dir, host, key, slug,
+      force: rest.includes("--force"),
+      compileAppConfig,
+      fail,
+    });
+    return;
+  }
+
+  if (verb === "set") {
+    const target = rest[1];
+    if (!target) {
+      fail("SCHEMA_USAGE", "Usage: monty schema set <file.json|-> [--allow-breaking] — the JSON is a full manifest (start from `monty schema`).");
+    }
+    let raw;
+    try {
+      raw = target === "-" ? readFileSync(0, "utf8") : readFileSync(target, "utf8");
+    } catch {
+      fail("SCHEMA_USAGE", `Could not read ${target === "-" ? "stdin" : target}. Pass a manifest JSON file, or - for stdin.`);
+    }
+    let manifest;
+    try {
+      manifest = JSON.parse(raw);
+    } catch {
+      fail("BAD_MANIFEST_JSON", "That is not valid JSON. Start from `monty schema` output, edit, and set the whole document back.");
+    }
+    const slug = typeof manifest?.slug === "string" && manifest.slug ? manifest.slug : (appDir ? readSlug(appDir) : null);
+    if (!slug) fail("INVALID_SLUG", "The manifest carries no slug and this is not an app folder — set `slug` in the JSON.");
+    // CAS: prove which stored manifest this edit was based on (stamped by
+    // the last `monty schema` read in this folder). Absent = trusting push.
+    const base = appDir && readSlug(appDir) === slug ? readSchemaState(appDir)?.hash : undefined;
+    const res = await fetch(`${host}/api/schema`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+      body: JSON.stringify({
+        slug,
+        manifest,
+        ...(base ? { baseHash: base } : {}),
+        ...(rest.includes("--allow-breaking") ? { allowBreaking: true } : {}),
+      }),
+    });
+    const body = await res.json().catch(() => null);
+    if (!res.ok || !body?.ok) {
+      if (body?.code === "MANIFEST_DRIFT" && body?.summary) {
+        console.log(`schema drift (remote changes):\n${body.summary}`);
+      }
+      fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Setting the manifest failed — is the Monty host reachable?");
+    }
+    if (appDir && readSlug(appDir) === slug) writeSchemaState(appDir, body.hash);
+    console.log(`schema: set — "${slug}" is live now (hash ${String(body.hash).slice(0, 12)})`);
+    return;
+  }
+
+  // Default: SHOW. `monty schema [slug]` — stdout is the pure manifest
+  // JSON (pipe it to a file, edit, `monty schema set` it back).
+  const slug = (verb && !verb.startsWith("-") ? verb : null) ?? (appDir ? readSlug(appDir) : null);
+  if (!slug) fail("INVALID_SLUG", "Usage: monty schema [slug] — or run it inside an app folder.");
+  const res = await fetch(`${host}/api/schema?slug=${slug}`, {
+    headers: { authorization: `Bearer ${key}` },
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.ok) {
+    fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Could not read the manifest — check the connection and `monty login`.");
+  }
+  if (body.manifest === null) {
+    fail("NO_MANIFEST", `"${slug}" has no stored manifest yet — it's a code-only app. Declare one by setting a full manifest JSON: monty schema set <file>.`);
+  }
+  if (appDir && readSlug(appDir) === slug) writeSchemaState(appDir, body.hash);
+  console.error(`# ${slug} — manifest hash ${String(body.hash).slice(0, 12)}${appDir ? " (CAS base stamped for `monty schema set`)" : ""}`);
+  console.log(JSON.stringify(body.manifest, null, 2));
+}
+
 switch (command) {
   case "login":
     await login();
@@ -2563,7 +3242,7 @@ switch (command) {
     await pull();
     break;
   case "commit":
-    await commit();
+    fail("COMMIT_REMOVED", "`monty commit` is gone — `monty save` is the one verb (every save records a history row; `monty log` lists them).");
     break;
   case "log":
   case "versions":
@@ -2595,7 +3274,7 @@ switch (command) {
     apps();
     break;
   case "skills":
-    installSkills({ appDir: findAppRoot(process.cwd()), silent: false });
+    installSkills({ appDir: findAppRoot(process.cwd()), silent: false, force: true });
     console.log("skills: up to date");
     break;
   case "install":
@@ -2607,25 +3286,28 @@ switch (command) {
   case "typecheck":
     typecheckApp();
     break;
+  case "save":
   case "deploy":
     await deploy();
     break;
   case "data":
     await data();
     break;
+  case "schema":
+    await schemaCmd();
+    break;
   case "secret":
     await secret();
     break;
   default:
-    console.log("usage: monty <login|create|pull|commit|log|current|select|apps|install|dev|logs|build|typecheck|add|components|docs|deploy|data|skills>");
+    console.log("usage: monty <login|create|pull|log|current|select|apps|install|dev|logs|build|typecheck|add|components|docs|save|data|skills>");
     console.log("  login       [--host <url>] [--key <mk_...>]  sign in (opens your browser to authorize)");
-    console.log("  create      <slug> [--name N] [--icon I] [--build ID]  register + stamp a new app into ~/.monty/apps/<id> (needs login)");
+    console.log("  create      <slug> [--name N] [--icon I] [--spa]  register a new app (config-only by default; --spa scaffolds the full SPA)");
     console.log("  pull        <slug> [--version H] [--force]  restore the app's source snapshot (latest, or one from `monty log`)");
-    console.log("  commit      [-m \"message\"]                  version the app's source in the workspace without publishing");
-    console.log("  log         [slug]                          the app's source version history (commits + publishes)");
-    console.log("  dev         [--port N] [--no-tunnel] [--takeover]  run the app in Studio, or attach to a running session (sandboxed data)");
-    console.log("  logs        [-n N] [-f]                     read/follow the dev shell log (vite output, browser errors, publish results)");
-    console.log("  add         <name...>                      install curated UI components (see `monty components`)");
+    console.log("  log         [slug]                          the app's source version history (one row per save)");
+    console.log("  dev         [--port N] [--no-tunnel] [--takeover]  run the app's session, or attach to a running one (live data, auto-auth)");
+    console.log("  logs        [-n N] [-f]                     read/follow the dev shell log (vite output, browser errors, save results)");
+    console.log("  add         <name...> | page <name>         install UI components, or scaffold a custom page (`monty add page reports`)");
     console.log("  components  [query]                        list the curated component catalog");
     console.log("  docs        <name>                         view a component's source before installing");
     console.log("  current                                     which app folder am I in?");
@@ -2634,8 +3316,10 @@ switch (command) {
     console.log("  install                                     install app dependencies");
     console.log("  build                                       production build (vite, via monty)");
     console.log("  typecheck                                   typecheck (builds first if needed)");
-    console.log("  deploy                                      build + upload this app straight to Live");
+    console.log("  save        [\"what changed\"]                 push the working copy to the cloud copy, like `git push main` (build + typecheck gate it)");
+    console.log("  deploy                                      alias of save");
     console.log("  data        <verb> [table] [flags]          read/write an app's records from the terminal (`monty data` for verbs)");
+    console.log("  schema      [slug] | set <file|->            read the app's stored manifest (JSON on stdout) / write it back (validated, CAS)");
     console.log("  skills                                      install/refresh the agent build skill");
     process.exit(command ? 1 : 0);
 }