@montytools/cli 0.5.1 → 0.5.3

package/bin/monty.mjs

@@ -18,6 +18,7 @@ import { CATALOG, REGISTRIES } from "./catalog.mjs";
 import { CompileError, compileAppConfig } from "../lib/compile.mjs";
 import { manifestHash } from "../lib/schemaCodegen.mjs";
 import { readSchemaState, schemaPull, writeSchemaState } from "../lib/schemaPull.mjs";
+import { mergeViewConfig, normalizeViewFilters, parseHiddenColumns, parseViewSort, validateViewColumns } from "../lib/views.mjs";
 
 // MONTY_HOME overrides the state root (default ~/.monty): config.json,
 // apps/, and desktop.json all live under it. This is how a second, isolated
@@ -675,6 +676,12 @@ tables (zod), derived fields (\`rollup\`/\`lookup\`/\`formula\`), \`metrics\`,
 - Formulas are strings in the Monty expression grammar, e.g.
   \`formula(montyMoney(), "monthlySales * commissionRate")\` — fields declared
   ABOVE the formula and \`metrics.<name>\` are in scope.
+- A filtered or sorted slice of one table is a shared saved view. Use
+  \`monty views set <table> <name> ...\` before adding custom code. A custom
+  page is for interactions, multi-table layouts, or visualizations that a
+  system record page cannot express. If the page is still one table, start
+  with \`RecordPage\` from \`@montytools/sdk/react\` and add typed actions
+  with the record controls from \`@montytools/sdk/ui\`.
 - Need a bespoke page later? \`monty add page\` declares it and upgrades this
   app with a SPA scaffold; \`monty save\` ships the code.
 `;
@@ -984,7 +991,7 @@ async function freePort(start) {
 // Apps pin @montytools/sdk at scaffold time and go stale — the CLI knows the
 // minimum SDK its workflows need (e.g. tunnel-host allowlisting lives in the
 // SDK's vite plugin) and upgrades the app automatically before dev/deploy.
-const MIN_SDK = "0.2.1";
+const MIN_SDK = "0.2.3";
 const SDK_VITE_CACHE_STAMP = "sdk-vite-cache-version";
 
 function installedSdkVersion(appDir) {
@@ -1312,7 +1319,7 @@ async function performTakeover(appDir, s) {
     spawnSync("taskkill", ["/pid", String(s.pid), "/T", "/F"], { stdio: "ignore" });
     if (Number.isInteger(s.vitePid)) spawnSync("taskkill", ["/pid", String(s.vitePid), "/T", "/F"], { stdio: "ignore" });
   } else if (!signalPid(s.pid, "SIGTERM")) {
-    fail("TAKEOVER_FAILED", `The running session (pid ${s.pid}) belongs to another user. Stop it manually, then rerun \`monty dev\`.`);
+    fail("TAKEOVER_FAILED", `The running session (pid ${s.pid}) belongs to another user. Stop it from the terminal or Desktop instance that started it, then rerun \`monty dev\`. If that owner is unavailable, check \`monty support status\` and submit the incident when sharing is enabled.`);
   }
   let ok = await waitGone(TAKEOVER_WAIT_MS);
   if (!ok && process.platform !== "win32") {
@@ -2874,7 +2881,7 @@ function cronFieldMatches(field, value, [lo, hi], idx) {
 // API. `app` is the plain slug — every app has ONE set of records.
 // Results are ONE JSON document on stdout so agents can pipe.
 
-const DATA_VALUE_FLAGS = new Set(["app", "filter", "order", "limit", "cursor", "data", "key", "unset", "host"]);
+const DATA_VALUE_FLAGS = new Set(["app", "filter", "order", "limit", "cursor", "data", "key", "unset", "host", "name", "type", "out", "table", "record", "field"]);
 
 // rest, minus flags AND their values — `monty data list leads --app crm`
 // must not read "crm" as a positional. Boolean flags have no value and
@@ -2920,9 +2927,9 @@ function resolveDataApp() {
 
 // mk_ key → { convexUrl, token }. The token is workspace-scoped and expires
 // in 5 minutes — minted fresh per invocation, never stored.
-async function dataAuth() {
+async function workspaceAuth() {
   const { host, key } = loadConfig();
-  if (!key) fail("NOT_LOGGED_IN", `Reading and writing app data needs your workspace (${host}). Run \`monty login\` first.`);
+  if (!key) fail("NOT_LOGGED_IN", `This command needs your workspace (${host}). Run \`monty login\` first.`);
   let convexUrl = null;
   try {
     convexUrl = (await fetch(`${host}/api/config`).then((r) => r.json()))?.convexUrl;
@@ -2936,20 +2943,20 @@ async function dataAuth() {
   if (!r.ok || !body?.token) {
     fail(body?.code ?? `HTTP_${r.status}`, body?.fix ?? "Minting a workspace token failed. Run `monty login`, then retry.");
   }
-  return { convexUrl, token: body.token };
+  return { host, convexUrl, token: body.token };
 }
 
 // One records function over Convex's public HTTP API (plain-JSON format —
 // app data is JSON by construction, no convex encoding needed). ConvexError
 // payloads carry { code, fix } and surface verbatim: errors stay
 // instructions in the terminal the agent is watching.
-async function callRecords(kind, fn, args, auth) {
+async function callConvex(kind, path, args, auth) {
   let body = null;
   try {
     const r = await fetch(`${auth.convexUrl}/api/${kind}`, {
       method: "POST",
       headers: { "content-type": "application/json", authorization: `Bearer ${auth.token}` },
-      body: JSON.stringify({ path: `records:${fn}`, args, format: "json" }),
+      body: JSON.stringify({ path, args, format: "json" }),
     });
     body = await r.json().catch(() => null);
   } catch { /* handled below */ }
@@ -2962,6 +2969,10 @@ async function callRecords(kind, fn, args, auth) {
   return body.value;
 }
 
+async function callRecords(kind, fn, args, auth) {
+  return callConvex(kind, `records:${fn}`, args, auth);
+}
+
 function printJson(value) {
   console.log(JSON.stringify(value, null, 2));
 }
@@ -2990,10 +3001,57 @@ function dataUsage() {
   console.log("  update  <table> <id> --data '<json>' [--unset field,field]");
   console.log("  upsert  <table> --key <field[,field]> --data '<json|[json,…]>'   find-or-create matched on the key fields (idempotent)");
   console.log("  remove  <table> <id>");
+  console.log("  upload  <path> [--name N] [--type mime]     store a file (10MB cap); prints the descriptor to put in a `file` field");
+  console.log("          [--table <t> --record <id> --field <f>]   …and set that row's field in the same command");
+  console.log("  download <file-id> [--out path]             fetch a stored file's bytes (id from a row's file field)");
   console.log("target: --app <slug> (or run inside the app folder)");
   process.exit(1);
 }
 
+// Uploads without --type get the MIME their extension implies; unknown
+// extensions stay application/octet-stream (the server stores, never sniffs).
+const MIME_BY_EXT = {
+  png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif",
+  webp: "image/webp", svg: "image/svg+xml", ico: "image/x-icon",
+  pdf: "application/pdf", json: "application/json", csv: "text/csv",
+  txt: "text/plain", md: "text/markdown", html: "text/html",
+  zip: "application/zip", mp3: "audio/mpeg", wav: "audio/wav",
+  mp4: "video/mp4", webm: "video/webm",
+};
+
+function inferContentType(name) {
+  const ext = /\.([a-z0-9]+)$/i.exec(name)?.[1]?.toLowerCase();
+  return (ext && MIME_BY_EXT[ext]) || "application/octet-stream";
+}
+
+const DATA_MAX_FILE_BYTES = 10 * 1024 * 1024;
+
+// POST/GET on the host's /api/files — the same rail the SDK file helpers
+// ride, authorized with the invocation's 5-minute workspace token.
+async function callFiles(method, params, auth, app, opts = {}) {
+  const url = new URL("/api/files", auth.host);
+  for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+  let r;
+  try {
+    r = await fetch(url, {
+      method,
+      headers: {
+        authorization: `Bearer ${auth.token}`,
+        "x-monty-app": app,
+        ...(opts.contentType ? { "content-type": opts.contentType } : {}),
+      },
+      ...(opts.body !== undefined ? { body: opts.body } : {}),
+    });
+  } catch {
+    fail("HOST_UNREACHABLE", `The file endpoint at ${auth.host} did not answer — check the network and retry.`);
+  }
+  if (!r.ok) {
+    const err = await r.json().catch(() => null);
+    fail(err?.code ?? `HTTP_${r.status}`, err?.fix ?? "The file request failed. Retry; if it persists, report it.");
+  }
+  return r;
+}
+
 async function data() {
   const [verb, table, id] = dataPositionals();
 
@@ -3028,12 +3086,88 @@ async function data() {
     return;
   }
 
+  if (verb === "upload") {
+    // The positional is a file PATH, not a table — the descriptor this
+    // prints is what a `file`-typed field stores; --table/--record/--field
+    // set it on an existing row in the same command.
+    const path = table;
+    if (!path) fail("MISSING_PATH", "Usage: monty data upload <path> [--name N] [--type mime] [--table <t> --record <id> --field <f>].");
+    const attachTable = flag("table");
+    const attachRecord = flag("record");
+    const attachField = flag("field");
+    const attachFlags = [attachTable, attachRecord, attachField].filter((f) => f !== undefined);
+    if (attachFlags.length > 0 && attachFlags.length < 3) {
+      fail("BAD_ATTACH", "Attaching needs all three of --table, --record, and --field — or none (then put the printed descriptor in a file field yourself).");
+    }
+    let bytes;
+    try {
+      bytes = readFileSync(path);
+    } catch {
+      fail("NO_SUCH_FILE", `Could not read "${path}" — check the path.`);
+    }
+    if (bytes.byteLength === 0) fail("EMPTY_FILE", `"${path}" is empty — nothing to upload.`);
+    if (bytes.byteLength > DATA_MAX_FILE_BYTES) {
+      fail("FILE_TOO_LARGE", `Files are limited to ${DATA_MAX_FILE_BYTES} bytes; "${path}" is ${bytes.byteLength}. Compress it first.`);
+    }
+    const name = flag("name") ?? basename(path);
+    const contentType = flag("type") ?? inferContentType(name);
+    const app = resolveDataApp();
+    const auth = await workspaceAuth();
+    if (attachFlags.length === 3) {
+      // Prove the target row exists BEFORE storing bytes — a failed attach
+      // after the upload would orphan the file.
+      const row = await callRecords("query", "get", { app, table: attachTable, id: attachRecord }, auth);
+      if (!row) fail("NOT_FOUND", `No record "${attachRecord}" in table "${attachTable}" — ids come from \`monty data list ${attachTable}\`.`);
+    }
+    const res = await callFiles("POST", { name }, auth, app, { body: bytes, contentType });
+    const file = await res.json();
+    if (attachFlags.length === 3) {
+      await callRecords("mutation", "update", {
+        app,
+        table: attachTable,
+        id: attachRecord,
+        data: { [attachField]: file },
+      }, auth);
+      printJson({ ok: true, id: attachRecord, field: attachField, file });
+    } else {
+      printJson({ file });
+    }
+    return;
+  }
+
+  if (verb === "download") {
+    // The positional is the file id (a row's file-field descriptor carries
+    // it), not a table.
+    const fileId = table;
+    if (!fileId) fail("MISSING_ID", "Usage: monty data download <file-id> [--out path] — ids come from a row's file field (its `id` key).");
+    const app = resolveDataApp();
+    const auth = await workspaceAuth();
+    const res = await callFiles("GET", { id: fileId }, auth, app);
+    const disposition = res.headers.get("content-disposition") ?? "";
+    const remoteName = /filename="([^"]+)"/.exec(disposition)?.[1] ?? fileId;
+    const out = flag("out") ?? remoteName;
+    const body = Buffer.from(await res.arrayBuffer());
+    try {
+      writeFileSync(out, body);
+    } catch {
+      fail("WRITE_FAILED", `Could not write to "${out}" — check the path and permissions.`);
+    }
+    printJson({
+      ok: true,
+      path: out,
+      name: remoteName,
+      contentType: res.headers.get("content-type") ?? "application/octet-stream",
+      size: body.byteLength,
+    });
+    return;
+  }
+
   const VERBS = new Set(["list", "get", "insert", "update", "upsert", "remove"]);
   if (!verb || !VERBS.has(verb)) dataUsage();
   if (!table) fail("MISSING_TABLE", `\`monty data ${verb}\` needs a table name: monty data ${verb} <table> … (\`monty data schema\` lists tables).`);
 
   const app = resolveDataApp();
-  const auth = await dataAuth();
+  const auth = await workspaceAuth();
 
   switch (verb) {
     case "list": {
@@ -3127,12 +3261,373 @@ async function data() {
   }
 }
 
+// ── monty views ────────────────────────────────────────────────────────────
+// Shared saved views are shell state, not app code. Agents manage them
+// through the same workspace-scoped platform functions the record page uses.
+// The CLI accepts concise filters, then stores the shell's existing
+// { filters, sort, hidden } ViewConfig shape unchanged.
+
+const VIEW_VALUE_FLAGS = new Set(["app", "filter", "sort", "hide", "name"]);
+
+function viewPositionals() {
+  const out = [];
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg.startsWith("--")) {
+      if (VIEW_VALUE_FLAGS.has(arg.slice(2))) i++;
+      continue;
+    }
+    out.push(arg);
+  }
+  return out;
+}
+
+function viewsUsage() {
+  console.log("usage: monty views <list|set|update|remove> <table> [name] [flags]");
+  console.log("  list   <table> [--app slug]");
+  console.log("  set    <table> <name> [--filter '<json>'] [--sort field:asc|desc] [--hide field,...] [--app slug]");
+  console.log("  update <table> <name> [--name new-name] [--filter '<json>'] [--sort field:asc|desc|none] [--hide field,...] [--app slug]");
+  console.log("  remove <table> <name> [--app slug]");
+  console.log("filter values: null = empty; scalar = exact; array = any listed value; {\"contains\":\"text\"}; {\"min\":0,\"max\":100}");
+  console.log("example: monty views set leads \"Evaluate\" --filter '{\"pipelineId\":null}'");
+  process.exit(1);
+}
+
+function validateViewFlagValues() {
+  for (const name of VIEW_VALUE_FLAGS) {
+    const index = rest.indexOf(`--${name}`);
+    if (index >= 0 && (rest[index + 1] === undefined || rest[index + 1].startsWith("--"))) {
+      fail("MISSING_FLAG_VALUE", `--${name} needs a value.`);
+    }
+  }
+}
+
+function viewName(input) {
+  const name = input?.trim() ?? "";
+  if (name === "" || name.length > 60) {
+    fail("BAD_VIEW_NAME", "A saved view name must be 1–60 characters.");
+  }
+  return name;
+}
+
+async function viewContext(table) {
+  const app = resolveDataApp();
+  const auth = await workspaceAuth();
+  const manifest = await callConvex("query", "platform:appManifest", { slug: app }, auth);
+  if (!manifest) {
+    fail("NO_MANIFEST", `App "${app}" has no stored manifest, so it has no system table views.`);
+  }
+  const tableSpec = manifest.tables?.[table];
+  if (!tableSpec) {
+    fail("NO_SUCH_TABLE", `App "${app}" has no table "${table}". Tables: ${Object.keys(manifest.tables ?? {}).join(", ") || "(none)"}.`);
+  }
+  const declaredPages = Object.values(manifest.pages ?? {});
+  const hasTableView =
+    declaredPages.length === 0 ||
+    declaredPages.some((page) => page?.kind === "view" && page.table === table);
+  if (!hasTableView) {
+    fail("NO_TABLE_VIEW", `Table "${table}" is not shown by a system record page. Add a { kind: "view", table: "${table}" } page through \`monty schema\`, then save the view.`);
+  }
+  return {
+    app,
+    auth,
+    fields: Object.keys(tableSpec.fields ?? {}),
+  };
+}
+
+function requestedViewConfig(fields) {
+  let config;
+  try {
+    config = {
+      filters: normalizeViewFilters(parseJsonFlag("filter")),
+      sort: parseViewSort(flag("sort")),
+      hidden: parseHiddenColumns(flag("hide")),
+    };
+    return validateViewColumns(config, fields);
+  } catch (error) {
+    fail(error?.code ?? "BAD_VIEW_CONFIG", error?.fix ?? error?.message ?? "The saved view config is invalid.");
+  }
+}
+
+function requestedViewPatch() {
+  try {
+    return {
+      ...(rest.includes("--filter") ? { filters: normalizeViewFilters(parseJsonFlag("filter")) } : {}),
+      ...(rest.includes("--sort") ? { sort: parseViewSort(flag("sort")) } : {}),
+      ...(rest.includes("--hide") ? { hidden: parseHiddenColumns(flag("hide")) } : {}),
+    };
+  } catch (error) {
+    fail(error?.code ?? "BAD_VIEW_CONFIG", error?.fix ?? error?.message ?? "The saved view config is invalid.");
+  }
+}
+
+function checkedViewConfig(config, fields) {
+  try {
+    return validateViewColumns(config, fields);
+  } catch (error) {
+    fail(error?.code ?? "BAD_VIEW_CONFIG", error?.fix ?? error?.message ?? "The saved view config is invalid.");
+  }
+}
+
+async function views() {
+  validateViewFlagValues();
+  const [verb, table, rawName] = viewPositionals();
+  if (!verb || !table || rest.includes("--help") || rest.includes("-h")) viewsUsage();
+  if (!["list", "set", "update", "remove"].includes(verb)) viewsUsage();
+  const { app, auth, fields } = await viewContext(table);
+
+  if (verb === "list") {
+    const saved = await callConvex("query", "platform:savedViews", { app, page: table }, auth);
+    printJson({ app, table, views: saved });
+    return;
+  }
+
+  const name = viewName(rawName);
+  const saved = await callConvex("query", "platform:savedViews", { app, page: table }, auth);
+  const existing = saved.find((view) => view.name === name);
+
+  if (verb === "remove") {
+    if (!existing) {
+      fail("VIEW_NOT_FOUND", `No saved view named "${name}" exists for ${table}. Run \`monty views list ${table}\` to see the names.`);
+    }
+    await callConvex("mutation", "platform:deleteView", { app, page: table, name }, auth);
+    printJson({ ok: true, app, table, name, removed: true });
+    return;
+  }
+
+  if (verb === "update") {
+    if (!existing) {
+      fail("VIEW_NOT_FOUND", `No saved view named "${name}" exists for ${table}. Run \`monty views list ${table}\` to see the names.`);
+    }
+    const nextName = flag("name") === undefined ? name : viewName(flag("name"));
+    if (nextName !== name && saved.some((view) => view.name === nextName)) {
+      fail("VIEW_ALREADY_EXISTS", `A saved view named "${nextName}" already exists for ${table}. Choose another name or update that view directly.`);
+    }
+    const patch = requestedViewPatch();
+    if (nextName === name && Object.keys(patch).length === 0) {
+      fail("NO_VIEW_CHANGES", "Provide --name, --filter, --sort, or --hide. Omitted properties stay unchanged.");
+    }
+    const config = checkedViewConfig(mergeViewConfig(existing.config, patch), fields);
+    await callConvex("mutation", "platform:saveView", { app, page: table, name: nextName, config }, auth);
+    if (nextName !== name) {
+      await callConvex("mutation", "platform:deleteView", { app, page: table, name }, auth);
+    }
+    printJson({
+      ok: true,
+      app,
+      table,
+      name: nextName,
+      updated: true,
+      renamed: nextName !== name,
+      ...(nextName !== name ? { previousName: name } : {}),
+      config,
+    });
+    return;
+  }
+
+  const config = requestedViewConfig(fields);
+  await callConvex("mutation", "platform:saveView", { app, page: table, name, config }, auth);
+  printJson({ ok: true, app, table, name, created: !existing, config });
+}
+
+// ── monty support ─────────────────────────────────────────────────────────
+// Workspace admins opt in once. After that, agents may send one structured
+// report for a persistent platform failure or missing platform capability.
+// The CLI adds selected local diagnostics, but never reads source files,
+// environment variables, app records, or a raw conversation transcript.
+function supportUsage() {
+  console.log("usage: monty support <status|enable|disable|submit>");
+  console.log("  status                         show whether agent support reports are allowed");
+  console.log("  enable [--yes]                 allow agents to send bounded reports to Monty");
+  console.log("  disable                        stop all future reports immediately");
+  console.log("  submit --data '<json|->'       send an incident, unexpected behavior, or missing feature");
+  console.log('report JSON: {"kind":"incident|unexpected_behavior|missing_feature","title":"…","summary":"…","problem":"…","expected":"…","attempted":["…"],"error":"…"}');
+  process.exit(1);
+}
+
+function redactSupportText(value) {
+  return value
+    .replaceAll(homedir(), "~")
+    .replace(/mk_[0-9a-f]{48}/gi, "[REDACTED_CLI_KEY]")
+    .replace(/\bBearer\s+[^\s"']+/gi, "Bearer [REDACTED]")
+    .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED_JWT]")
+    .replace(/([?&](?:ticket|token|key)=)[^&\s]+/gi, "$1[REDACTED]")
+    .replace(/\b([A-Z][A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|API_KEY))=\S+/g, "$1=[REDACTED]");
+}
+
+async function supportDiagnostics(appDir, host, includeLogs) {
+  let session;
+  let errorLog;
+  if (appDir) {
+    const probe = await checkDevSession(appDir);
+    const recorded = probe.session;
+    if (recorded) {
+      session = JSON.stringify({
+        live: probe.live,
+        ...(probe.reason ? { reason: probe.reason } : {}),
+        state: recorded.state ?? null,
+        cli: recorded.cli ?? null,
+        pid: Number.isInteger(recorded.pid) ? recorded.pid : null,
+        port: Number.isInteger(recorded.port) ? recorded.port : null,
+        sessionId: typeof recorded.sessionId === "string" ? recorded.sessionId : null,
+        startedAt: recorded.startedAt ?? null,
+        updatedAt: recorded.updatedAt ?? null,
+        loggedIn: recorded.loggedIn ?? null,
+        lastHeartbeatAt: recorded.lastHeartbeatAt ?? null,
+      });
+    }
+    if (includeLogs) {
+      const diagnosticLines = readLogTail(appDir, 240)
+        .filter((line) => /\b(error|warn|failed|failure|takeover|superseded|drift)\b|\[MontyError\]/i.test(line))
+        .slice(-80);
+      if (diagnosticLines.length) {
+        errorLog = redactSupportText(diagnosticLines.join("\n")).slice(-12_000);
+      }
+    }
+  }
+  return {
+    cliVersion: CLI_VERSION,
+    nodeVersion: process.version,
+    platform: process.platform,
+    arch: process.arch,
+    host,
+    ...(session ? { session: redactSupportText(session) } : {}),
+    ...(errorLog ? { errorLog } : {}),
+  };
+}
+
+async function supportRequest(method, payload) {
+  const { host, key } = loadConfig();
+  if (!key) {
+    fail("NOT_LOGGED_IN", `Support settings and reports need your workspace (${host}). Run \`monty login\` first.`);
+  }
+  let response;
+  try {
+    response = await fetch(`${host}/api/support`, {
+      method,
+      headers: {
+        authorization: `Bearer ${key}`,
+        ...(payload === undefined ? {} : { "content-type": "application/json" }),
+      },
+      ...(payload === undefined ? {} : { body: JSON.stringify(payload) }),
+      signal: AbortSignal.timeout(15_000),
+    });
+  } catch {
+    fail("SUPPORT_UNREACHABLE", `Could not reach ${host}/api/support. Check the network and retry.`);
+  }
+  const body = await response.json().catch(() => null);
+  if (!response.ok || !body?.ok) {
+    fail(body?.code ?? `HTTP_${response.status}`, body?.fix ?? "The support request failed. Retry once.");
+  }
+  return { host, body };
+}
+
+async function support() {
+  const verb = rest[0];
+  if (!verb || rest.includes("--help") || rest.includes("-h")) supportUsage();
+
+  if (verb === "status") {
+    const { body } = await supportRequest("GET");
+    console.log(`support sharing: ${body.enabled ? "enabled" : "disabled"}`);
+    if (body.enabledAt) console.log(`enabled at: ${new Date(body.enabledAt).toISOString()}`);
+    return;
+  }
+
+  if (verb === "enable") {
+    console.log("Monty support sharing lets coding agents report persistent Monty platform errors and missing platform features.");
+    console.log("Reports include: an agent-written summary, tool identity, CLI and session metadata, and selected recent error or warning lines with known secrets redacted.");
+    console.log("Error lines may contain names or values that a tool printed. Agents can omit them per report with includeLogs: false.");
+    console.log("The command does not read source files, environment variables, tool records, or the full conversation.");
+    let approved = rest.includes("--yes");
+    if (!approved && process.stdin.isTTY && process.stdout.isTTY) {
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      approved = /^y(?:es)?$/i.test((await rl.question("Allow these reports for this workspace? [y/N] ")).trim());
+      rl.close();
+    }
+    if (!approved) {
+      fail("SUPPORT_CONSENT_REQUIRED", "A person must approve support sharing. Review the notice above, ask the workspace admin, then rerun `monty support enable --yes` only after they agree.");
+    }
+    await supportRequest("PUT", { enabled: true });
+    console.log("support sharing: enabled");
+    return;
+  }
+
+  if (verb === "disable") {
+    await supportRequest("PUT", { enabled: false });
+    console.log("support sharing: disabled");
+    return;
+  }
+
+  if (verb !== "submit") supportUsage();
+
+  const rawData = flag("data");
+  if (rawData === undefined) {
+    fail("SUPPORT_REPORT_REQUIRED", "Pass the agent summary with `monty support submit --data '<json>'`. Use `--data -` to read JSON from stdin.");
+  }
+  let input;
+  try {
+    const raw = rawData === "-" ? readFileSync(0, "utf8") : rawData;
+    input = JSON.parse(raw);
+  } catch {
+    fail("BAD_SUPPORT_REPORT", "The support report is not valid JSON. Pass one object with kind, title, summary, problem, expected, and optional attempted/error fields.");
+  }
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    fail("BAD_SUPPORT_REPORT", "The support report must be one JSON object.");
+  }
+  const kinds = new Set(["incident", "unexpected_behavior", "missing_feature"]);
+  if (!kinds.has(input.kind)) {
+    fail("BAD_SUPPORT_REPORT", "kind must be `incident`, `unexpected_behavior`, or `missing_feature`.");
+  }
+  for (const field of ["title", "summary", "problem", "expected"]) {
+    if (typeof input[field] !== "string" || !input[field].trim()) {
+      fail("BAD_SUPPORT_REPORT", `${field} must be a non-empty string.`);
+    }
+  }
+  if (input.attempted !== undefined && (!Array.isArray(input.attempted) || input.attempted.some((item) => typeof item !== "string"))) {
+    fail("BAD_SUPPORT_REPORT", "attempted must be an array of short strings.");
+  }
+  if (input.error !== undefined && typeof input.error !== "string") {
+    fail("BAD_SUPPORT_REPORT", "error must be a string when provided.");
+  }
+  if (input.includeLogs !== undefined && typeof input.includeLogs !== "boolean") {
+    fail("BAD_SUPPORT_REPORT", "includeLogs must be true or false when provided.");
+  }
+
+  const appDir = findAppRoot(process.cwd());
+  const { host } = loadConfig();
+  const appSlug = typeof input.appSlug === "string"
+    ? input.appSlug
+    : appDir
+      ? readSlugFromConfig(appDir)
+      : undefined;
+  const report = {
+    ...(appSlug ? { appSlug } : {}),
+    kind: input.kind,
+    title: redactSupportText(input.title.trim()),
+    threadSummary: redactSupportText(input.summary.trim()),
+    problem: redactSupportText(input.problem.trim()),
+    expected: redactSupportText(input.expected.trim()),
+    attempted: (input.attempted ?? [])
+      .map((item) => redactSupportText(item.trim()))
+      .filter(Boolean),
+    ...(input.error?.trim() ? { error: redactSupportText(input.error.trim()) } : {}),
+    diagnostics: await supportDiagnostics(
+      appDir,
+      host,
+      input.includeLogs ?? input.kind !== "missing_feature",
+    ),
+  };
+  const { body } = await supportRequest("POST", report);
+  console.log(`support ticket: ${body.ticketId}`);
+  console.log("support: submitted to Monty");
+}
+
 // ── dispatch ───────────────────────────────────────────────────────────────
 // Keep agent skills fresh on every invocation (user level + current app).
 // `dev` and `logs` skip the refresh here: attach and log reads must stay
 // fast (a skills refresh can shell out to npx for two minutes) — dev's
 // fresh-start path installs skills itself once it owns the session.
-if (command !== "dev" && command !== "logs") {
+if (command !== "dev" && command !== "logs" && command !== "support") {
   installSkills({ appDir: findAppRoot(process.cwd()) });
 }
 
@@ -3296,11 +3791,17 @@ switch (command) {
   case "schema":
     await schemaCmd();
     break;
+  case "views":
+    await views();
+    break;
+  case "support":
+    await support();
+    break;
   case "secret":
     await secret();
     break;
   default:
-    console.log("usage: monty <login|create|pull|log|current|select|apps|install|dev|logs|build|typecheck|add|components|docs|save|data|skills>");
+    console.log("usage: monty <login|create|pull|log|current|select|apps|install|dev|logs|build|typecheck|add|components|docs|save|data|schema|views|support|skills>");
     console.log("  login       [--host <url>] [--key <mk_...>]  sign in (opens your browser to authorize)");
     console.log("  create      <slug> [--name N] [--icon I] [--spa]  register a new app (config-only by default; --spa scaffolds the full SPA)");
     console.log("  pull        <slug> [--version H] [--force]  restore the app's source snapshot (latest, or one from `monty log`)");
@@ -3320,6 +3821,8 @@ switch (command) {
     console.log("  deploy                                      alias of save");
     console.log("  data        <verb> [table] [flags]          read/write an app's records from the terminal (`monty data` for verbs)");
     console.log("  schema      [slug] | set <file|->            read the app's stored manifest (JSON on stdout) / write it back (validated, CAS)");
+    console.log("  views       <list|set|update|remove> <table> manage shared saved views on a system record page");
+    console.log("  support     <status|enable|disable|submit>   opt in and send agent-authored platform reports to Monty");
     console.log("  skills                                      install/refresh the agent build skill");
     process.exit(command ? 1 : 0);
 }

package/lib/schemaCodegen.mjs

@@ -32,7 +32,8 @@ export function manifestHash(manifest) {
 
 const IMPORTABLE = [
   "defineApp", "formula", "lookup", "montyDate", "montyFileSchema",
-  "montyMember", "montyMoney", "montyPercent", "montyRef", "rollup", "self",
+  "montyMember", "montyMoney", "montyMultiSelect", "montyPercent",
+  "montyPhone", "montyRating", "montyRef", "montySelect", "rollup", "self",
 ];
 
 function fieldsInOrder(section) {
@@ -56,10 +57,20 @@ function storedSource(spec, used) {
       src = `montyRef(${JSON.stringify(spec.table)})`;
       break;
     case "enum":
-      src = `z.enum(${JSON.stringify(spec.values)})`;
+      if (spec.valueDescriptions) {
+        used.add("montySelect");
+        src = `montySelect(${JSON.stringify(spec.values)}, ${JSON.stringify(spec.valueDescriptions)})`;
+      } else {
+        src = `z.enum(${JSON.stringify(spec.values)})`;
+      }
       break;
     case "multiSelect":
-      src = `z.array(z.enum(${JSON.stringify(spec.values)}))`;
+      if (spec.valueDescriptions) {
+        used.add("montyMultiSelect");
+        src = `montyMultiSelect(${JSON.stringify(spec.values)}, ${JSON.stringify(spec.valueDescriptions)})`;
+      } else {
+        src = `z.array(z.enum(${JSON.stringify(spec.values)}))`;
+      }
       break;
     case "email":
       src = "z.email()";
@@ -81,6 +92,7 @@ function storedSource(spec, used) {
       src = "z.any()";
   }
   if (spec.optional) src += ".optional()";
+  if (spec.description) src += `.describe(${JSON.stringify(spec.description)})`;
   return src;
 }
 
@@ -115,6 +127,7 @@ function rollupSource(spec, used, indent) {
   else lines.push("count: true,");
   if (spec.over !== undefined) lines.push(`over: ${JSON.stringify(spec.over)},`);
   if (spec.range !== undefined) lines.push(`range: ${JSON.stringify(spec.range)},`);
+  if (spec.description !== undefined) lines.push(`description: ${JSON.stringify(spec.description)},`);
   const body = lines.map((l) => `${pad}  ${l}`).join("\n");
   return `rollup(${outputSource(spec.output, used)}, {\n${body}\n${pad}})`;
 }
@@ -125,10 +138,10 @@ function fieldSource(spec, used, indent) {
       return storedSource(spec, used);
     case "formula":
       used.add("formula");
-      return `formula(${outputSource(spec.output, used)}, ${JSON.stringify(spec.expr)})`;
+      return `formula(${outputSource(spec.output, used)}, ${JSON.stringify(spec.expr)}${spec.description !== undefined ? `, ${JSON.stringify(spec.description)}` : ""})`;
     case "lookup":
       used.add("lookup");
-      return `lookup(${outputSource(spec.output, used)}, { ref: ${JSON.stringify(spec.ref)}, field: ${JSON.stringify(spec.field)} })`;
+      return `lookup(${outputSource(spec.output, used)}, { ref: ${JSON.stringify(spec.ref)}, field: ${JSON.stringify(spec.field)}${spec.description !== undefined ? `, description: ${JSON.stringify(spec.description)}` : ""} })`;
     case "rollup":
       return rollupSource(spec, used, indent);
     default:

package/lib/views.mjs

@@ -0,0 +1,138 @@
+function badViewConfig(fix, code = "BAD_VIEW_CONFIG") {
+  const error = new Error(fix);
+  error.code = code;
+  error.fix = fix;
+  throw error;
+}
+
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function valueToken(value, field) {
+  if (value === null || value === "") return "(empty)";
+  if (["string", "number", "boolean"].includes(typeof value)) return String(value);
+  badViewConfig(
+    `Filter "${field}" must be null, a string, number, boolean, an array of those values, { contains }, { min/max }, or a full saved-view filter.`,
+  );
+}
+
+function valuesFilter(values, field) {
+  if (values.length === 0) {
+    badViewConfig(`Filter "${field}" has no values. Remove it or provide at least one value.`);
+  }
+  return { kind: "values", values: [...new Set(values.map((value) => valueToken(value, field)))] };
+}
+
+function rangeFilter(input, field) {
+  const min = input.min;
+  const max = input.max;
+  if (min === undefined && max === undefined) {
+    badViewConfig(`Range filter "${field}" needs min, max, or both.`);
+  }
+  if (min !== undefined && (typeof min !== "number" || !Number.isFinite(min))) {
+    badViewConfig(`Range filter "${field}" has a non-numeric min.`);
+  }
+  if (max !== undefined && (typeof max !== "number" || !Number.isFinite(max))) {
+    badViewConfig(`Range filter "${field}" has a non-numeric max.`);
+  }
+  if (min !== undefined && max !== undefined && min > max) {
+    badViewConfig(`Range filter "${field}" has min greater than max.`);
+  }
+  return {
+    kind: "range",
+    ...(min !== undefined ? { min } : {}),
+    ...(max !== undefined ? { max } : {}),
+  };
+}
+
+function normalizeFilter(input, field) {
+  if (Array.isArray(input)) return valuesFilter(input, field);
+  if (!isObject(input)) return valuesFilter([input], field);
+
+  if (input.kind === "values") {
+    if (!Array.isArray(input.values)) {
+      badViewConfig(`Values filter "${field}" needs a values array.`);
+    }
+    return valuesFilter(input.values, field);
+  }
+  if (input.kind === "text" || (input.kind === undefined && "contains" in input)) {
+    if (typeof input.contains !== "string" || input.contains === "") {
+      badViewConfig(`Text filter "${field}" needs a non-empty contains string.`);
+    }
+    return { kind: "text", contains: input.contains };
+  }
+  if (input.kind === "range" || (input.kind === undefined && ("min" in input || "max" in input))) {
+    return rangeFilter(input, field);
+  }
+  badViewConfig(
+    `Filter "${field}" is not recognized. Use a value, an array, { contains }, { min/max }, or a full saved-view filter.`,
+  );
+}
+
+/**
+ * Agent-facing filters stay concise while the stored value is exactly the
+ * shell's existing ViewConfig shape.
+ *
+ *   { pipelineId: null }                 -> empty values filter
+ *   { status: ["Evaluate", "New"] }     -> values filter
+ *   { title: { contains: "Director" } }  -> text filter
+ *   { amount: { min: 100 } }             -> range filter
+ */
+export function normalizeViewFilters(input) {
+  if (input === undefined) return {};
+  if (!isObject(input)) {
+    badViewConfig("--filter must be one JSON object keyed by field name.");
+  }
+  return Object.fromEntries(
+    Object.entries(input).map(([field, filter]) => {
+      if (field.trim() === "") badViewConfig("View filter field names cannot be empty.");
+      return [field, normalizeFilter(filter, field)];
+    }),
+  );
+}
+
+export function parseViewSort(input) {
+  if (input === undefined) return null;
+  if (input === "none") return null;
+  const match = /^([^:]+):(asc|desc)$/.exec(input);
+  if (!match) {
+    badViewConfig('--sort must be shaped like "field:asc" or "field:desc", or be "none" to clear it.');
+  }
+  return { column: match[1], dir: match[2] };
+}
+
+export function parseHiddenColumns(input) {
+  if (input === undefined || input.trim() === "") return [];
+  return [...new Set(input.split(",").map((field) => field.trim()).filter(Boolean))];
+}
+
+export function mergeViewConfig(existing, patch) {
+  const base = isObject(existing) ? existing : {};
+  return {
+    filters: Object.hasOwn(patch, "filters")
+      ? patch.filters
+      : (isObject(base.filters) ? base.filters : {}),
+    sort: Object.hasOwn(patch, "sort") ? patch.sort : (base.sort ?? null),
+    hidden: Object.hasOwn(patch, "hidden")
+      ? patch.hidden
+      : (Array.isArray(base.hidden) ? base.hidden : []),
+  };
+}
+
+export function validateViewColumns(config, fieldNames) {
+  const known = new Set(fieldNames);
+  const used = [
+    ...Object.keys(config.filters),
+    ...(config.sort ? [config.sort.column] : []),
+    ...config.hidden,
+  ];
+  const unknown = [...new Set(used.filter((field) => !known.has(field)))];
+  if (unknown.length > 0) {
+    badViewConfig(
+      `Unknown view field${unknown.length === 1 ? "" : "s"}: ${unknown.join(", ")}. Available fields: ${fieldNames.join(", ") || "(none)"}.`,
+      "UNKNOWN_VIEW_FIELD",
+    );
+  }
+  return config;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@montytools/cli",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/TomasMonty/monty-v2.git",
@@ -21,7 +21,8 @@
   },
   "scripts": {
     "prepack": "node scripts/bundle-template.mjs",
-    "typecheck": "node --check bin/monty.mjs && node --check lib/compile.mjs && node --check lib/schemaCodegen.mjs && node --check lib/schemaPull.mjs && node --check scripts/schema-roundtrip.mjs",
+    "typecheck": "node --check bin/monty.mjs && node --check lib/compile.mjs && node --check lib/schemaCodegen.mjs && node --check lib/schemaPull.mjs && node --check lib/views.mjs && node --check scripts/schema-roundtrip.mjs",
+    "test": "node --test test/views.test.mjs",
     "postinstall": "node bin/postinstall.mjs",
     "test:roundtrip": "node scripts/schema-roundtrip.mjs"
   },

package/skills/monty-build/SKILL.md

@@ -65,20 +65,44 @@ channel switch. "dev"/"prod" mean platform environments, never app states.
    `monty schema` (JSON on stdout); change it by editing that JSON and
    running `monty schema set <file>` — validated server-side, additive by
    default. On workspace-owned apps, `monty.config.ts` edits do NOT change
-   the schema. Declare a page in the manifest BEFORE shipping its route —
-   a save with an undeclared route refuses with the fix. Field names `_*`,
-   `updatedAt`, `createdBy` are reserved.
-6. **UI is stock shadcn** (preset already wired). Add curated components with
+   the schema. Give every field a `description` and every enum/multiSelect
+   a `valueDescriptions` map saying WHEN each option applies — that's the
+   guidance later record-writing agents follow. Declare a page in the
+   manifest BEFORE shipping its route — a save with an undeclared route
+   refuses with the fix. Field names `_*`, `updatedAt`, `createdBy` are
+   reserved.
+6. **Prefer a saved view for filtered tables.** If the request is
+   one table with different filters, sorting, or hidden columns, use
+   `monty views set <table> <name> ...`. For example, an evaluation queue is
+   `monty views set leads "Evaluate" --filter '{"pipelineId":null}'`.
+   Change selected properties or rename it later with
+   `monty views update <table> <name> ...`; omitted properties stay unchanged.
+   If that table needs actions, compose `RecordPage` from
+   `@montytools/sdk/react` and add typed row/header/selection/record actions
+   with the controls from `@montytools/sdk/ui`. Write the whole page yourself
+   only when the shared components no longer fit. Custom pages remain the
+   escape hatch.
+7. **UI is stock shadcn** (preset already wired). Add curated components with
    `monty add <name>`; browse with `monty components` / `monty docs <name>`.
    How pages should LOOK — Lyra surfaces, dark-only, the chart language — is
    the `monty-design` skill; read it before styling any page.
-7. **Errors are instructions.** Every failure prints
+8. **Errors are instructions.** Every failure prints
    `[MontyError CODE] Fix: …` — do exactly what the Fix says; don't guess.
    Typecheck failures block the save by design.
-8. **Edits are real.** The dev shell reads and writes the app's LIVE
+9. **Edits are real.** The dev shell reads and writes the app's LIVE
    records — there is one set of data, and every write journals into the
    app's Activity. Exercise the app for real; clean up test rows you
    create; never seed junk into a team's working tables.
+10. **Report platform failures when sharing is enabled.** `monty support
+   status` shows whether a workspace admin has allowed agent support
+   reports. If enabled, submit one report when a Monty platform error still
+   blocks the task after you followed its `Fix` and retried, or when the
+   requested work needs a missing Monty platform feature. Summarize the
+   thread. State the observed problem, expected behavior, attempted fixes,
+   and exact error. Do not paste the full conversation. If sharing is off,
+   ask the user before running `monty support enable --yes`; never grant
+   consent yourself. Do not file reports for ordinary app-code bugs or send
+   duplicates for the same incident.
 
 ## CLI reference
 
@@ -93,5 +117,7 @@ channel switch. "dev"/"prod" mean platform environments, never app states.
 | `monty add <name…>` | install curated shadcn components |
 | `monty schema [slug]` | print the app's stored manifest (tables, pages, metrics) as JSON |
 | `monty schema set <file\|->` | write an edited manifest back (validated, CAS, additive by default) |
+| `monty views <list\|set\|update\|remove> <table>` | manage the shared saved views on a system record page |
 | `monty save ["what changed"]` | push the working copy to the cloud copy, like `git push main` (build + typecheck gate it) |
+| `monty support <status\|enable\|disable\|submit>` | manage consent and send a bounded agent-authored platform report |
 | `monty skills` | (re)install this skill for your agent |

package/skills/monty-operate/SKILL.md

@@ -40,7 +40,16 @@ normal operating work; that is what this command is for.
    values come from each row, and re-running never duplicates.
 2. **Schema first, rows second.** Field names come from
    `monty data schema`, exact spelling. The server stores what you send —
-   a misspelled field is silently a new field, not an error.
+   a misspelled field is silently a new field, not an error. The schema's
+   `description` and `enumDescriptions` annotations are the app's own
+   instructions for filling a field in: where a field has options (an
+   `enum`, alone or as array items), pick the option whose description
+   matches the situation — never your own reading of the option's name,
+   and never a value outside the list. A field without options has no
+   fixed vocabulary, so its `description` plus the conventions visible in
+   existing rows (`list` first) are the contract — write explicit,
+   consistently formatted values, not free-hand variants of the same
+   thing.
 3. **Every write is real** — operating work targets the team's data, and
    the app's Activity journals it. Destructive verbs (`remove`, bulk
    `update`) deserve a confirmation with the user unless they clearly
@@ -57,6 +66,13 @@ normal operating work; that is what this command is for.
 7. **Rows come back flattened**: your fields at the top level plus system
    fields `_id`, `_creationTime`, `updatedAt`, `createdBy`. System fields
    are read-only — never send them in `--data`.
+8. **File fields hold descriptors, never bytes or paths.** A `file`-typed
+   field stores exactly the object `monty data upload` prints
+   (`{id, name, contentType, size, uploadedAt, uploadedBy}`). Upload
+   first, then reference: use the attach flags to set an existing row's
+   field in one command, or paste the printed descriptor into `--data`
+   when inserting. Never hand-write a descriptor — an id that no upload
+   produced 404s on download.
 
 ## Command reference
 
@@ -69,6 +85,8 @@ normal operating work; that is what this command is for.
 | `monty data upsert <table> --key <field[,field]> --data '<json\|[json,…]>'` | find-or-create matched on the key fields — the idempotent write |
 | `monty data update <table> <id> --data '<json>' [--unset a,b]` | shallow-merge onto one row; `--unset` deletes fields |
 | `monty data remove <table> <id>` | delete one row |
+| `monty data upload <path> [--name N] [--type mime] [--table <t> --record <id> --field <f>]` | store a file (10MB cap); prints the descriptor a `file` field holds — the attach flags set it on an existing row in the same command |
+| `monty data download <file-id> [--out path]` | fetch a stored file's bytes to disk; the id is the `id` key of a row's file descriptor |
 
 All verbs take `--app <slug>`. Output is one JSON document on
 stdout.

package/template/AGENTS.md

@@ -36,7 +36,10 @@ Folders are managed for you: this app lives in `~/Monty/<slug>`. `monty current`
    rectangles on real axes. The `monty-design` skill is the full spec.
 4. **Schema changes = edit `monty.config.ts` and save.** Types update
    immediately. Prefer additive changes; give new fields `.optional()` or
-   `.default(...)` so existing records stay readable.
+   `.default(...)` so existing records stay readable. Describe fields for
+   the next agent that fills them in: `.describe("what this holds")` on any
+   field, and `montySelect`/`montyMultiSelect` instead of bare `z.enum` so
+   every option says WHEN it applies, not what the word means.
 5. **You are not done until the work is saved.** After every meaningful
    change verified in dev, run `monty save "<what changed>"` — it builds,
    typechecks, and pushes the working copy to the cloud copy, like
@@ -46,7 +49,7 @@ Folders are managed for you: this app lives in `~/Monty/<slug>`. `monty current`
 
 ```ts
 // monty.config.ts
-import { defineApp, montyFileSchema } from "@montytools/sdk";
+import { defineApp, montyFileSchema, montySelect } from "@montytools/sdk";
 import { z } from "zod";
 
 export const app = defineApp({
@@ -54,8 +57,12 @@ export const app = defineApp({
   tables: {
     expenses: z.object({
       title: z.string().min(1),
-      amount: z.number().positive(),
-      status: z.enum(["draft", "submitted", "approved"]).default("draft"),
+      amount: z.number().positive().describe("Receipt total in USD, tax included."),
+      status: montySelect(["draft", "submitted", "approved"], {
+        draft: "Still being filled in, not yet sent for review.",
+        submitted: "Awaiting a manager's decision.",
+        approved: "Cleared for reimbursement.",
+      }).default("draft"),
       assigneeId: z.string().optional(), // userId from useMembers()
       receipt: montyFileSchema.optional(),
     }),
@@ -146,6 +153,12 @@ export const app = defineApp({
 
 Rules that matter:
 
+- **A filtered or sorted slice of one table is a saved view.** Use
+  `monty views set <table> <name> ...` before writing a route. For example,
+  `monty views set leads "Evaluate" --filter '{"pipelineId":null}'` creates
+  a shared record view without React. Use `monty views update` to change only
+  selected properties or rename it. Custom pages remain available when the
+  requested interaction, multi-table layout, or visualization needs code.
 - **Custom pages wear the platform chrome from `@montytools/sdk/ui`** — the
   SAME components the shell renders its own pages with, so your page is
   indistinguishable from a system table view. Every custom page opens with
@@ -172,6 +185,13 @@ Rules that matter:
   mode strips) and the Lyra table classes `SURFACE`/`THEAD`/`TH`/`ROW`/`CHIP`
   for record-like tables (`<div className={SURFACE}><table>…`), identical to
   the app's Configuration surfaces.
+- **Extend records before rebuilding them.** For a custom page that is still
+  one table, use `RecordPage` from `@montytools/sdk/react`. Add behavior with
+  its typed `headerActions`, `rowActions`, `selectionActions`, and
+  `recordActions` callbacks. Use `RecordActionButton` and the lower-level
+  `RecordPage*`/`RecordTable*` components from `@montytools/sdk/ui` when you
+  need a different composition. Drop to a fully custom page only when those
+  components no longer fit.
 - **Formulas are strings**, not functions — the Monty expression grammar
   (`+ - * / %`, comparisons, `&& || !`, `IF/ROUND/ABS/MIN/MAX`,
   `metrics.<name>`). A formula sees only fields declared ABOVE it. Type
@@ -216,9 +236,12 @@ secret keys, webhooks, clocks), create `server/index.ts` with named async
 exports. Web-standard APIs only (`fetch`, `crypto`, `URL`, …) — no `node:`
 imports; it runs on Cloudflare Workers when Live and inside `monty dev` in
 a session. Every export gets `ctx`: `ctx.records` (full CRUD on all your
-tables, including ones the UI never exposes), `ctx.secrets` (see below),
-`ctx.viewer` (who called: member session/visitor/schedule/none), and
-`ctx.track()` (emit an event).
+tables, including ones the UI never exposes), `ctx.files` (platform file
+storage: `upload(data, {name?, contentType?}) → MontyFile`,
+`download(fileOrId) → Blob`, `remove(fileOrId)` — same descriptors as the
+`useUploadFile` hook, 10MB cap), `ctx.secrets` (see below), `ctx.viewer`
+(who called: member session/visitor/schedule/none), and `ctx.track()`
+(emit an event).
 
 ```ts
 // server/index.ts

package/template/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {
     "@fontsource-variable/roboto": "^5.2.10",
-    "@montytools/sdk": "^0.2.1",
+    "@montytools/sdk": "^0.2.3",
     "@tanstack/react-router": "1.170.17",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",