@montytools/cli 0.5.4 → 0.5.6

package/bin/monty.mjs

@@ -15,16 +15,14 @@ import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { CATALOG, REGISTRIES } from "./catalog.mjs";
-import { CompileError, compileAppConfig } from "../lib/compile.mjs";
-import { manifestHash } from "../lib/schemaCodegen.mjs";
-import { readSchemaState, schemaPull, writeSchemaState } from "../lib/schemaPull.mjs";
-import { mergeViewConfig, normalizeViewFilters, parseHiddenColumns, parseViewSort, validateViewColumns } from "../lib/views.mjs";
+import { readSchemaState, schemaPull, writeGenModule, writeSchemaState } from "../lib/schemaPull.mjs";
+import { mergeViewConfig, normalizeViewFilters, parseHiddenColumns, parseKanbanFlag, parseViewSort, validateViewColumns } from "../lib/views.mjs";
+import { formatViolations, lintStyles } from "../lib/styleLint.mjs";
 
 // MONTY_HOME overrides the state root (default ~/.monty): config.json,
 // apps/, and desktop.json all live under it. This is how a second, isolated
 // Monty state coexists on one machine — the desktop's dev channel points it
-// at ~/.monty-dev so platform development never touches the real state. A
-// custom root is a sandbox: the legacy visible home (~/Monty) is not scanned.
+// at ~/.monty-dev so platform development never touches the real state.
 const CONFIG_DIR = process.env.MONTY_HOME
   ? resolve(process.env.MONTY_HOME)
   : join(homedir(), ".monty");
@@ -50,11 +48,9 @@ const ANSI_RE = new RegExp(
 // Every app's source lives in one predictable, hidden place: `monty create`
 // registers the app first and the server-minted id names the folder
 // (~/.monty/apps/<id>) — id-keyed because slugs may be renamed later; the
-// `id` stamped into monty.config.ts is the durable identity. `monty login`
-// provisions the home; --dir overrides per create. Pre-id apps in the legacy
-// visible home (~/Monty) keep working — every scan reads both.
+// `id` stamped into .monty/app.json is the durable identity. `monty login`
+// provisions the home; --dir overrides per create.
 const MONTY_HOME = join(CONFIG_DIR, "apps");
-const LEGACY_MONTY_HOME = join(homedir(), "Monty");
 
 const [, , command, ...rest] = process.argv;
 
@@ -116,22 +112,16 @@ function findMontyrcHost(startDir) {
   return null;
 }
 
-// Reads config.json in either shape: legacy { host, key } (migrated on the
-// next login) or { defaultHost, profiles: { [host]: { key } } }.
+// Reads config.json: { defaultHost, profiles: { [host]: { key } } }.
 function normalizedConfig() {
   let raw = null;
   try {
     raw = JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
   } catch { /* not logged in anywhere yet */ }
-  if (!raw) return { defaultHost: null, profiles: {} };
-  if (raw.profiles && typeof raw.profiles === "object") {
-    return { defaultHost: raw.defaultHost ?? null, profiles: raw.profiles };
+  if (!raw?.profiles || typeof raw.profiles !== "object") {
+    return { defaultHost: null, profiles: {} };
   }
-  const legacyHost = (raw.host ?? DEFAULT_HOST).replace(/\/+$/, "");
-  return {
-    defaultHost: legacyHost,
-    profiles: raw.key ? { [legacyHost]: { key: raw.key } } : {},
-  };
+  return { defaultHost: raw.defaultHost ?? null, profiles: raw.profiles };
 }
 
 function resolveHost() {
@@ -344,11 +334,9 @@ function installSkills({ appDir = null, silent = true, force = false } = {}) {
   }
 }
 
-// ── monty current / select / apps ───────────────────────────────────────────
-// Folder management users never think about: every app lives in ~/Monty,
-// `current` says where you are, `select` prints the folder for cd $(...).
+// ── monty current ──────────────────────────────────────────────────────────
 // The app-root marker is the IDENTITY STAMP (.monty/app.json — written by
-// create and pull) or, for older folders, monty.config.ts.
+// create and connect) or, transitionally, monty.config.ts.
 function isAppRoot(dir) {
   return existsSync(join(dir, ".monty", "app.json")) || existsSync(join(dir, "monty.config.ts"));
 }
@@ -363,7 +351,7 @@ function findAppRoot(start) {
   }
 }
 
-// The identity stamp: { id, slug, name, icon, registryOwned? } — the app's
+// The identity stamp: { id, slug, name, icon } — the app's
 // durable identity on this machine, independent of the config file.
 function readAppJson(dir) {
   try {
@@ -400,58 +388,15 @@ function readIdFromConfig(dir) {
   }
 }
 
-function scanAppsHome(root) {
-  if (!existsSync(root)) return [];
-  return readdirSync(root)
-    .map((name) => join(root, name))
-    .filter((p) => isAppRoot(p))
-    .map((p) => ({ path: p, slug: readSlugFromConfig(p) ?? basename(p), id: readIdFromConfig(p) }));
-}
-
-function listLocalApps() {
-  // A MONTY_HOME sandbox lists only its own apps — leaking the legacy home
-  // into an isolated root would defeat the isolation.
-  return process.env.MONTY_HOME
-    ? scanAppsHome(MONTY_HOME)
-    : [...scanAppsHome(MONTY_HOME), ...scanAppsHome(LEGACY_MONTY_HOME)];
-}
-
 function current() {
   const root = findAppRoot(process.cwd());
   if (!root) {
-    fail("NOT_IN_APP", `You are not inside a Monty app. \`monty apps\` lists local apps; cd "$(monty select <slug>)" jumps to one.`);
+    fail("NOT_IN_APP", "You are not inside a Monty app. cd into the app's folder (`monty connect <slug>` pulls a copy into any folder).");
   }
   console.log(`app: ${readSlugFromConfig(root) ?? "?"}`);
   const id = readIdFromConfig(root);
   if (id) console.log(`id: ${id}`);
   console.log(`path: ${root}`);
-  if (!root.startsWith(MONTY_HOME) && !root.startsWith(LEGACY_MONTY_HOME)) {
-    console.log(`note: outside ${MONTY_HOME} (fine, but apps normally live there)`);
-  }
-}
-
-function select() {
-  const slug = rest.find((a) => !a.startsWith("--"));
-  if (!slug) {
-    fail("MISSING_SLUG", `Usage: cd "$(monty select <slug>)" — prints the app's folder.`);
-  }
-  const apps = listLocalApps();
-  const hit = apps.find((a) => a.slug === slug || a.id === slug || basename(a.path) === slug);
-  if (!hit) {
-    const known = apps.map((a) => a.slug).join(", ") || "(none)";
-    fail("APP_NOT_LOCAL", `No local source for "${slug}" on this machine. Local apps: ${known}. Create it with \`monty create ${slug}\`.`);
-  }
-  // Bare path on stdout so command substitution works: cd "$(monty select x)"
-  console.log(hit.path);
-}
-
-function apps() {
-  const local = listLocalApps();
-  if (!local.length) {
-    console.log(`no local apps in ${MONTY_HOME} — create one with \`monty create <slug>\``);
-    return;
-  }
-  for (const a of local) console.log(`${a.slug}\t${a.path}`);
 }
 
 // Pack the app's source tree (node_modules/dist/.monty/.git excluded) into a
@@ -488,7 +433,7 @@ function readSlug(appDir) {
 // (Not `monty logs` — that tails the dev shell.)
 async function versionsLog() {
   const slug = rest.find((a) => !a.startsWith("-")) ?? readSlug(process.cwd());
-  if (!slug) fail("NO_SLUG", "Usage: monty log [slug] — or run it inside an app folder.");
+  if (!slug) fail("NO_SLUG", "Usage: monty history [slug] — or run it inside an app folder.");
   const { host, key } = loadConfig();
   if (!key) fail("NOT_LOGGED_IN", "Run `monty login` first.");
   const res = await fetch(`${host}/api/source?slug=${slug}&list=1`, {
@@ -531,7 +476,7 @@ async function pull() {
   }
   const app = appsBody.apps.find((a) => a.slug === slug);
   if (!app) {
-    fail("APP_NOT_FOUND", `No app "${slug}" in this workspace. \`monty apps\` lists what exists.`);
+    fail("APP_NOT_FOUND", `No app "${slug}" in this workspace — check the app list at ${host}.`);
   }
   // --version <hash-prefix>: restore a specific snapshot from `monty log`
   // instead of the newest one. Prefixes resolve against the history list.
@@ -548,7 +493,7 @@ async function pull() {
     }
     const matches = vbody.versions.filter((v) => v.hash.startsWith(versionFlag));
     if (matches.length === 0) {
-      fail("VERSION_NOT_FOUND", `No version of "${slug}" matches "${versionFlag}". \`monty log ${slug}\` lists what exists.`);
+      fail("VERSION_NOT_FOUND", `No version of "${slug}" matches "${versionFlag}". \`monty history ${slug}\` lists what exists.`);
     }
     if (matches.length > 1) {
       fail("VERSION_AMBIGUOUS", `"${versionFlag}" matches ${matches.length} versions — use more characters of the hash.`);
@@ -558,7 +503,10 @@ async function pull() {
   } else if (!app.sourceHash) {
     fail("NO_SOURCE", `"${slug}" has no source snapshot yet — snapshots ride each \`monty save\`. Run it once from the machine that has the source, then pull works everywhere.`);
   }
-  const target = app.id ? join(MONTY_HOME, app.id) : join(LEGACY_MONTY_HOME, slug);
+  if (!app.id) {
+    fail("APP_ID_MISSING", `"${slug}" has no app id in the workspace registry — save it once from a machine that has its source, then pull works.`);
+  }
+  const target = join(MONTY_HOME, app.id);
   if (existsSync(target) && !rest.includes("--force")) {
     fail("DIR_EXISTS", `${target} already exists and may hold unsaved work. Compare it with the saved version first; re-run with --force to REPLACE it with the snapshot.`);
   }
@@ -620,30 +568,184 @@ async function pull() {
   console.log("next: `monty install`, then `monty dev`.");
 }
 
+// ── monty connect ──────────────────────────────────────────────────────────
+// The one command that turns ANY folder into a working copy of a cloud app:
+// `monty connect <slug> [dir]` (dir defaults to the current folder) pulls
+// the app's files, installs dependencies, stamps identity, and registers
+// the checkout so the desktop's picker sees it. Apps without a source
+// snapshot but with a manifest get the config-only scaffold synced from the
+// registry. Multiple copies of one app on a machine are fine.
+async function connect() {
+  const [slugArg, dirArg] = rest.filter((a) => !a.startsWith("--"));
+  if (!slugArg || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slugArg)) {
+    fail("INVALID_SLUG", "Usage: monty connect <slug> [dir] — pulls the app into dir (default: the current folder, which must be empty).");
+  }
+  const slug = slugArg;
+  const { host, key } = loadConfig();
+  if (!key) {
+    fail("NOT_LOGGED_IN", `Connecting needs your workspace (${host}). Run \`monty login\` first.`);
+  }
+  const appsRes = await fetch(`${host}/api/apps`, { headers: { authorization: `Bearer ${key}` } });
+  const appsBody = await appsRes.json().catch(() => null);
+  if (!appsRes.ok || !appsBody?.ok) {
+    fail(appsBody?.code ?? `HTTP_${appsRes.status}`, appsBody?.fix ?? "Could not list workspace apps — check the connection and `monty login`.");
+  }
+  const app = appsBody.apps.find((a) => a.slug === slug);
+  if (!app) {
+    fail("APP_NOT_FOUND", `No app "${slug}" in this workspace — check the app list at ${host}.`);
+  }
+
+  const target = resolve(process.cwd(), dirArg ?? ".");
+  if (existsSync(target)) {
+    if (!statSync(target).isDirectory()) {
+      fail("NOT_A_DIRECTORY", `${target} is a file. Point \`monty connect\` at a folder.`);
+    }
+    if (readdirSync(target).filter((n) => n !== ".DS_Store").length > 0) {
+      // A folder that already holds THIS app needs nothing — the working
+      // copy is untouched.
+      const stamp = readAppJson(target);
+      if (stamp && ((app.id && stamp.id === app.id) || stamp.slug === slug)) {
+        console.log(`connected: ${slug} -> ${target} (already a copy of this app)`);
+        console.log("next: `monty dev`");
+        return;
+      }
+      fail("DIR_NOT_EMPTY", `${target} is not empty. Connect pulls the app's files INTO the folder — run it in an empty one, or name a new folder: \`monty connect ${slug} ${slug}\`.`);
+    }
+  }
+
+  if (app.sourceHash) {
+    console.log(`connect: ${slug} <- ${host}`);
+    const res = await fetch(`${host}/api/source?slug=${slug}`, {
+      headers: { authorization: `Bearer ${key}` },
+    });
+    if (!res.ok) {
+      const b = await res.json().catch(() => null);
+      fail(b?.code ?? `HTTP_${res.status}`, b?.fix ?? "Downloading the snapshot failed — retry.");
+    }
+    const buf = Buffer.from(await res.arrayBuffer());
+    const hash = createHash("sha256").update(buf).digest("hex");
+    if (hash !== app.sourceHash) {
+      fail("SOURCE_CORRUPT", "The downloaded snapshot failed verification — retry; if it persists, run `monty save` again from a machine that has the source.");
+    }
+    // Extract into a sibling staging folder first — a failed extract never
+    // leaves a half-written copy. An existing (empty) target keeps its
+    // inode: staging contents MOVE in, so a shell sitting in it stays sane.
+    const staging = `${target}.connect-tmp`;
+    rmSync(staging, { recursive: true, force: true });
+    mkdirSync(staging, { recursive: true });
+    const tarFile = join(staging, ".source.tar.gz");
+    writeFileSync(tarFile, buf);
+    const untar = spawnSync("tar", ["-xzf", tarFile, "-C", staging], { stdio: "pipe" });
+    rmSync(tarFile, { force: true });
+    if (untar.status !== 0) {
+      rmSync(staging, { recursive: true, force: true });
+      fail("EXTRACT_FAILED", "Unpacking the snapshot failed. Retry; if it persists, run `monty save` again from a machine that has the source.");
+    }
+    if (existsSync(target)) {
+      for (const name of readdirSync(staging)) renameSync(join(staging, name), join(target, name));
+      rmSync(staging, { recursive: true, force: true });
+    } else {
+      renameSync(staging, target);
+    }
+    try {
+      const cfg = await fetch(`${host}/api/config`).then((r) => r.json());
+      writeFileSync(
+        join(target, ".env.local"),
+        `VITE_CONVEX_URL=${cfg.convexUrl}\nVITE_CLERK_PUBLISHABLE_KEY=${cfg.clerkPublishableKey}\n`,
+      );
+    } catch {
+      console.log(`config: WARNING — could not reach ${host}/api/config; copy .env.example to .env.local manually`);
+    }
+    mkdirSync(join(target, ".monty"), { recursive: true });
+    writeFileSync(
+      join(target, ".monty", "source.json"),
+      JSON.stringify({ hash, syncedAt: Date.now() }) + "\n",
+    );
+  } else {
+    // No snapshot: the app's config in the workspace IS the app — a
+    // config-only scaffold synced from it is a complete working copy.
+    console.log(`connect: ${slug} <- ${host} (config-only — the workspace holds the app's config)`);
+    if (typeof app.id !== "string" || !/^[a-z0-9]{10,64}$/i.test(app.id)) {
+      fail("APP_ID_MISSING", `"${slug}" has no usable app id in the workspace registry — save it once from a machine that has it, then connect works.`);
+    }
+    mkdirSync(target, { recursive: true });
+    writeConfigOnlyScaffold(target, { appId: app.id, slug, name: app.name, icon: app.icon });
+    console.log("config: the workspace holds this app's config — read it with `monty schema`");
+  }
+
+  // The snapshot excludes .monty/ — the workspace row is the authority for
+  // identity, so stamp it fresh.
+  writeAppJson(target, {
+    ...(app.id ? { id: app.id } : {}),
+    slug,
+    ...(app.name ? { name: app.name } : {}),
+    ...(app.icon ? { icon: app.icon } : {}),
+  });
+  if (existsSync(join(target, "package.json"))) {
+    installDepsIn(target);
+  }
+  console.log(`connected: ${slug} -> ${target}`);
+  console.log(target === process.cwd() ? "next: `monty dev`" : `next: cd ${dirArg ?? target} && monty dev`);
+}
+
 // ── monty create ───────────────────────────────────────────────────────────
-// A CONFIG-ONLY app: no SPA at all — monty.config.ts is the whole app and
-// the platform shell renders it. The presence of index.html is the marker
-// (every SPA template ships one; the config-only scaffold never does).
+// A CONFIG-ONLY app: no SPA at all — the workspace config is the whole app
+// and the platform shell renders it. The presence of index.html is the
+// marker (every SPA template ships one; config-only folders never do).
 function isConfigOnlyApp(appDir) {
   return !existsSync(join(appDir, "index.html"));
 }
 
-// Literal read of the config's `schedule` block ({ fn: "cron expr" }) —
-// the same light-touch parse the SDK's vite plugin uses for publicFns.
-// Registry-owned sessions read it this way so the cron ticker works
-// without a config compile.
-function readScheduleLiteral(appDir) {
-  try {
-    const src = readFileSync(join(appDir, "monty.config.ts"), "utf8");
-    const block = /schedule:\s*{([^}]*)}/m.exec(src)?.[1];
-    if (!block) return undefined;
-    const out = {};
-    for (const m of block.matchAll(/["']?([a-zA-Z][a-zA-Z0-9_]*)["']?\s*:\s*"([^"]+)"/g)) {
-      out[m[1]] = m[2];
-    }
-    return Object.keys(out).length > 0 ? out : undefined;
-  } catch {
-    return undefined;
+// One-time migration off the config-as-code shape: monty.config.ts stops
+// existing in app folders — the workspace owns the config and
+// src/monty.gen.ts is its generated, never-hand-edited mirror. Runs at the
+// front of `monty dev` / `monty save` / `monty schema pull`: generates the
+// mirror, rewrites src imports onto it, and retires the config as a .bak.
+// Demo folders are exempt (the demo rail compiles their config).
+async function migrateConfigToGen(appDir, { host, key, slug }) {
+  const configPath = join(appDir, "monty.config.ts");
+  if (!existsSync(configPath) || existsSync(join(appDir, "demo.json"))) return false;
+  const srcDir = join(appDir, "src");
+  if (existsSync(srcDir)) {
+    if (!key) {
+      console.log("migrate: monty.config.ts is retired, but generating src/monty.gen.ts needs the workspace — run `monty login`, then any monty command migrates this folder.");
+      return false;
+    }
+    const res = await fetch(`${host}/api/schema?slug=${encodeURIComponent(slug)}`, {
+      headers: { authorization: `Bearer ${key}` },
+    }).catch(() => null);
+    const body = await res?.json().catch(() => null);
+    if (!res?.ok || !body?.ok) {
+      console.log("migrate: could not fetch the workspace config — monty.config.ts left in place this run (edits to it never land; `monty schema` is the config).");
+      return false;
+    }
+    writeGenModule(appDir, body.manifest ?? { slug, tables: {} }, { name: body.name, icon: body.icon });
+    if (body.hash) writeSchemaState(appDir, body.hash);
+    rewriteGenImports(srcDir);
+  }
+  renameSync(configPath, `${configPath}.bak`);
+  console.log("migrated: monty.config.ts retired (kept as monty.config.ts.bak). The workspace owns the config — read it with `monty schema`, change it with `monty schema set`; src/monty.gen.ts mirrors it automatically.");
+  return true;
+}
+
+// Point every `monty.config` import in src/ at the generated module. The
+// specifier is rewritten relative to each importing file (main.tsx imports
+// "./monty.gen", a route imports "../monty.gen").
+function rewriteGenImports(srcDir) {
+  const files = walk(srcDir).filter((f) => /\.(ts|tsx)$/.test(f));
+  for (const file of files) {
+    const src = readFileSync(file, "utf8");
+    if (!src.includes("monty.config")) continue;
+    let rel = relative(dirname(file), join(srcDir, "monty.gen")).replace(/\\/g, "/");
+    if (!rel.startsWith(".")) rel = `./${rel}`;
+    const out = src.replace(
+      /(["'])(?:\.\.?\/)+monty\.config(?:\.ts)?\1/g,
+      (_m, q) => `${q}${rel}${q}`,
+    );
+    if (out !== src) {
+      writeFileSync(file, out);
+      console.log(`migrate: ${relative(dirname(srcDir), file)} now imports the generated module`);
+    }
   }
 }
 
@@ -665,14 +767,15 @@ function discoverPages(appDir) {
 
 const CONFIG_ONLY_AGENTS_MD = `# This is a CONFIG-ONLY Monty app
 
-The app is rendered by the Monty platform from its WORKSPACE manifest —
-tables (zod), derived fields (\`rollup\`/\`lookup\`/\`formula\`), \`metrics\`,
-\`settings\`, and \`pages\`. There is no src/, no React, no build.
+The app is rendered by the Monty platform from its config stored in the
+workspace — tables (zod-shaped), derived fields (\`rollup\`/\`lookup\`/
+\`formula\`), \`metrics\`, \`settings\`, and \`pages\`. There is no src/, no
+React, no build — and no config file here: the workspace copy is the only
+one.
 
-- The schema lives in the workspace, and its door is the schema API:
-  read it with \`monty schema\`, change it with \`monty schema set <file|->\`
-  (validated, CAS-guarded, live within seconds). monty.config.ts edits do
-  NOT change a workspace-owned app's schema.
+- The config's door is the schema API: read it with \`monty schema\`,
+  change it with \`monty schema set '<json>'\` (or pipe:
+  \`monty schema set -\`) — validated, CAS-guarded, live within seconds.
 - Formulas are strings in the Monty expression grammar, e.g.
   \`formula(montyMoney(), "monthlySales * commissionRate")\` — fields declared
   ABOVE the formula and \`metrics.<name>\` are in scope.
@@ -682,42 +785,19 @@ tables (zod), derived fields (\`rollup\`/\`lookup\`/\`formula\`), \`metrics\`,
   system record page cannot express. If the page is still one table, start
   with \`RecordPage\` from \`@montytools/sdk/react\` and add typed actions
   with the record controls from \`@montytools/sdk/ui\`.
-- Need a bespoke page later? \`monty add page\` declares it and upgrades this
-  app with a SPA scaffold; \`monty save\` ships the code.
+- Need a bespoke page later? \`monty page add\` declares it and upgrades this
+  app with a SPA scaffold (typed against the generated src/monty.gen.ts
+  mirror); \`monty save\` ships the code.
 `;
 
+// A config-only folder is identity + instructions, nothing more: the
+// workspace holds the app, so there is no config file, no package.json, no
+// tsconfig — nothing that even looks editable.
 function writeConfigOnlyScaffold(target, { appId, slug, name, icon }) {
   mkdirSync(target, { recursive: true });
-  writeFileSync(join(target, "monty.config.ts"), `import { defineApp } from "@montytools/sdk";
-
-// This file IS the app: tables, derived fields, metrics, settings, pages.
-// The Monty platform renders it — no src/, no build. Declare tables as zod
-// objects; derive with rollup()/lookup()/formula(); see AGENTS.md.
-export const app = defineApp({
-  id: "${appId}",
-  slug: "${slug}",
-  name: "${name}",
-  icon: "${icon}",
-  tables: {},
-});
-
-export type App = typeof app;
-`);
-  writeFileSync(join(target, "package.json"), JSON.stringify({
-    name: slug,
-    private: true,
-    type: "module",
-    dependencies: { "@montytools/sdk": "latest", zod: "^4.4.3" },
-  }, null, 2) + "\n");
-  writeFileSync(join(target, "tsconfig.json"), JSON.stringify({
-    compilerOptions: {
-      target: "ES2022", module: "ESNext", moduleResolution: "bundler",
-      strict: true, skipLibCheck: true, noEmit: true,
-    },
-    include: ["monty.config.ts"],
-  }, null, 2) + "\n");
   writeFileSync(join(target, ".gitignore"), "node_modules/\n.monty/\n");
   writeFileSync(join(target, "AGENTS.md"), CONFIG_ONLY_AGENTS_MD);
+  writeAppJson(target, { id: appId, slug, name, icon });
 }
 
 async function create() {
@@ -725,13 +805,6 @@ async function create() {
   if (!slug || slug.length > 64 || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slug)) {
     fail("INVALID_SLUG", 'Usage: monty create <slug> — lowercase letters/digits with single hyphens, max 64 chars (e.g. "standup-notes").');
   }
-  // An app with this slug already on disk means create is the wrong verb —
-  // fail BEFORE registering, and never suggest deleting anything: the folder
-  // may hold real, uncommitted work.
-  const dupe = listLocalApps().find((a) => a.slug === slug);
-  if (dupe) {
-    fail("APP_EXISTS", `"${slug}" already exists on this machine at ${dupe.path}. Keep working on it there (cd "$(monty select ${slug})"); pick a different slug for a new app.`);
-  }
   const name =
     flag("name") ??
     slug.split("-").map((w) => w[0].toUpperCase() + w.slice(1)).join(" ");
@@ -777,15 +850,12 @@ async function create() {
   mkdirSync(dirname(target), { recursive: true });
 
   // DEFAULT: config-only — no SPA. monty.config.ts is the whole app and the
-  // platform shell renders it; \`monty add page\` scaffolds a SPA the moment a
+  // platform shell renders it; \`monty page add\` scaffolds a SPA the moment a
   // bespoke page is needed. \`--spa\` keeps the old full-SPA scaffold
   // (\`--config-only\` stays accepted as the now-default no-op).
   if (!rest.includes("--spa")) {
-    console.log(`create: ${slug} -> ${target} (config-only)`);
+    console.log(`create: ${slug} -> ${target} (config-only — the workspace holds the config)`);
     writeConfigOnlyScaffold(target, { appId, slug, name, icon });
-    // The identity stamp is the app-root marker and identity source from
-    // here on — the config file is just code.
-    writeAppJson(target, { id: appId, slug, name, icon });
     // The user's brief lands at the top of AGENTS.md, same as SPA creates.
     const brief = flag("description");
     if (brief?.trim()) {
@@ -817,7 +887,7 @@ async function create() {
     }
     installSkills({ appDir: target });
     console.log(`created: ${target}`);
-    console.log(`next: cd ${target} && monty install && monty dev`);
+    console.log(`next: cd ${target} && monty dev — then \`monty schema set\` declares the tables`);
     return;
   }
 
@@ -827,7 +897,7 @@ async function create() {
   const templateDir = [
     join(pkgRoot, "template"),
     join(pkgRoot, "..", "template"),
-  ].find((d) => existsSync(join(d, "monty.config.ts")));
+  ].find((d) => existsSync(join(d, "src", "main.tsx")));
   if (!templateDir) {
     fail("TEMPLATE_MISSING", "The Monty app template is missing from this CLI install. Reinstall the monty CLI.");
   }
@@ -854,16 +924,10 @@ async function create() {
     writeFileSync(gitignorePath, "node_modules/\ndist/\n.monty/\n.env.local\n.env\n");
   }
 
-  // Stamp identity into the copied files. The id line is INSERTED (the
-  // template ships without one — only real creates have a server id).
-  const configPath = join(target, "monty.config.ts");
-  writeFileSync(
-    configPath,
-    readFileSync(configPath, "utf8")
-      .replace(/^([ \t]*)slug: "[^"]*"/m, `$1id: "${appId}",\n$1slug: "${slug}"`)
-      .replace(/name: "[^"]*"/, `name: "${name}"`)
-      .replace(/icon: "[^"]*"/, `icon: "${icon}"`),
-  );
+  // Identity into the copied files. The registry landed the empty config at
+  // registration; the generated mirror derives from it — the template's
+  // placeholder src/monty.gen.ts is replaced wholesale.
+  writeGenModule(target, { slug, tables: {} }, { name, icon });
   const pkgPath = join(target, "package.json");
   const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
   pkg.name = slug;
@@ -910,7 +974,7 @@ async function create() {
   }
 
   // Build tracking: the /new screen minted an id; recording it here lets
-  // `monty deploy` resolve it and flips the UI into "agent is working" mode.
+  // `monty save` resolve it and flips the UI into "agent is working" mode.
   const buildId = flag("build");
   if (buildId && /^[a-z0-9]{10,64}$/i.test(buildId)) {
     mkdirSync(join(target, ".monty"), { recursive: true });
@@ -937,20 +1001,35 @@ async function create() {
 // The full app lifecycle goes through the CLI — agents never invoke pnpm,
 // vite, or tsc directly. Same underlying tools, agent-shaped output, and the
 // build-before-typecheck ordering handled for you.
-function installDeps() {
-  const appDir = requireAppDir("install");
+function installDepsIn(appDir) {
   const pm = spawnSync("pnpm", ["--version"], { stdio: "ignore" }).status === 0 ? "pnpm" : "npm";
   run(appDir, "install", [pm, "install"],
     "Dependency install failed. Read the package manager error above; usually network or a bad package.json edit.");
   ensureSdk(appDir);
 }
 
+function installDeps() {
+  installDepsIn(requireAppDir("install"));
+}
+
 function buildApp() {
   const appDir = requireAppDir("build");
   run(appDir, "build", ["npx", "vite", "build"],
     "The production build failed. Read the vite error above; it names the file to fix.");
 }
 
+// `monty style` — the token-vocabulary lint, standalone. The same check
+// runs advisory at `monty dev` and blocking inside `monty save`.
+async function styleCheck() {
+  const appDir = requireAppDir("style");
+  const violations = await lintStyles(appDir);
+  if (violations.length === 0) {
+    console.log("style: clean — every class is on the token vocabulary");
+    return;
+  }
+  fail("STYLE_OFF_TOKENS", `${violations.length} off-token style${violations.length === 1 ? "" : "s"}:\n${await formatViolations(violations)}\nFix with the monty-design skill's vocabulary; a deliberate exception takes \`// monty-style-ignore\` on its line.`);
+}
+
 function typecheckApp() {
   const appDir = requireAppDir("typecheck");
   // routeTree.gen.ts is generated by the build — without it tsc fails on a
@@ -991,7 +1070,7 @@ async function freePort(start) {
 // Apps pin @montytools/sdk at scaffold time and go stale — the CLI knows the
 // minimum SDK its workflows need (e.g. tunnel-host allowlisting lives in the
 // SDK's vite plugin) and upgrades the app automatically before dev/deploy.
-const MIN_SDK = "0.2.4";
+const MIN_SDK = "0.2.6";
 const SDK_VITE_CACHE_STAMP = "sdk-vite-cache-version";
 
 function installedSdkVersion(appDir) {
@@ -1451,21 +1530,29 @@ async function dev() {
 
   installSkills({ appDir });
   ensureSdk(appDir);
-  // Registry-owned apps (stamped on the first configIgnored beat): the
-  // platform reads NOTHING from the config compile — identity comes from
-  // the stamp and the compile is skipped entirely. The config file is just
-  // code the bundle imports; `schedule` (a code-door declaration the
-  // session cron ticker needs) is read literally, the same way the vite
-  // plugin reads `publicFns`.
+  // Style advisory (non-blocking here; `monty save` enforces): put off-token
+  // styling in the terminal the agent is watching, before the session opens.
+  try {
+    const styleViolations = await lintStyles(appDir);
+    if (styleViolations.length > 0) {
+      console.log(`style: ${styleViolations.length} off-token style${styleViolations.length === 1 ? "" : "s"} — \`monty style\` lists them; \`monty save\` refuses them`);
+    }
+  } catch {}
+  // Identity comes from the .monty/app.json stamp (written by create and
+  // connect) — the platform reads NOTHING from the config file, which is
+  // just code the bundle imports. Clock work is an `every` rule now — the
+  // platform's minute tick dispatches to this session's runtime over the
+  // tunnel like any rule; the session runs no clock of its own.
   const stamp = readAppJson(appDir);
-  const registryOwned = stamp?.registryOwned === true && typeof stamp?.slug === "string";
-  const meta = registryOwned
-    ? { slug: stamp.slug, name: stamp.name, icon: stamp.icon, schedule: readScheduleLiteral(appDir) }
-    : await compileConfig(appDir);
+  if (typeof stamp?.slug !== "string" || !stamp.slug) {
+    fail("NOT_CONNECTED", "This folder carries no app identity (.monty/app.json). Run `monty connect <slug>` here to join an existing app, or `monty create <slug>` for a new one.");
+  }
+  const meta = { slug: stamp.slug, name: stamp.name, icon: stamp.icon };
   const cfg = loadConfig();
   const host = cfg?.host ?? DEFAULT_HOST;
-  // CONFIG-ONLY apps run no vite and no tunnel: `monty dev` is watch +
-  // compile + push — the platform shell renders the app.
+  await migrateConfigToGen(appDir, { host, key: cfg?.key, slug: meta.slug });
+  // CONFIG-ONLY apps run no vite and no tunnel: `monty dev` is heartbeats
+  // only — the platform shell renders the app from the workspace config.
   const configOnly = isConfigOnlyApp(appDir);
   // Auto-pick a free port (agents run several apps side by side); an
   // explicit --port is honored strictly.
@@ -1484,34 +1571,23 @@ async function dev() {
       stdio: ["ignore", "pipe", "pipe"],
     });
   } else {
-    console.log(`dev: config-only app "${meta.slug}" — no vite; watching monty.config.ts`);
+    console.log(`dev: config-only app "${meta.slug}" — no vite; the workspace owns the config (read it with \`monty schema\`)`);
   }
 
   let tunnelChild = null;
   let hbTimer = null;
   let touchTimer = null;
-  let cronTimer = null;
   let ended = false;
   let registeredOnce = false;
-  // Held-config warnings print once per drift episode, not every beat.
-  let driftAnnounced = false;
-  // The registry-owned notice prints once per session.
+  // The schema-lives-in-the-workspace notice prints once per session.
   let configIgnoredAnnounced = false;
   const devStartedAt = Date.now();
   const sessionId = `dev_${randomBytes(16).toString("hex")}`;
   const buildFile = join(appDir, ".monty", "build");
   const buildId = existsSync(buildFile) ? readFileSync(buildFile, "utf8").trim() : undefined;
-  // The session schema channel (manifest-less apps): heartbeats carry the
-  // compiled schema, and edits to monty.config.ts are re-compiled (softly)
-  // so schema changes reach the platform within one heartbeat.
-  // Registry-owned apps skip all of it — their schema lives behind the
-  // doors, and the local config copy follows the registry (auto-pull below).
-  let currentMeta = meta;
   // Once per registry change: the manifest hash we last tried to sync the
   // local config copy to (successful or refused — never loop on dirty).
   let syncAttemptedHash = null;
-  const configPath = join(appDir, "monty.config.ts");
-  let configMtime = existsSync(configPath) ? statSync(configPath).mtimeMs : 0;
 
   // Advertise this session. The touch timer (not the platform heartbeat,
   // which starts minutes late or never when logged out) keeps updatedAt
@@ -1522,7 +1598,7 @@ async function dev() {
     version: 1,
     cli: CLI_VERSION,
     pid: process.pid,
-    vitePid: child.pid ?? null,
+    vitePid: child?.pid ?? null,
     tunnelPid: null,
     port,
     slug: meta.slug,
@@ -1544,57 +1620,6 @@ async function dev() {
   });
   touchTimer = setInterval(() => sf.write({}), DEV_JSON_TOUCH_MS);
 
-  // The session cron runner: the Live counterpart is a real Cloudflare Cron
-  // Trigger on the app's fn-worker; here the CLI matches monty.config.ts
-  // `schedule` entries against the UTC clock once per minute and invokes the
-  // fn through the same /__monty/fn runtime (x-monty-schedule marks the
-  // lane, so ctx.viewer matches Live exactly). Config edits hot-apply via
-  // currentMeta. Fire-and-forget: a failing cron fn prints its instruction
-  // here and never blocks the loop.
-  let lastCronMinute = null;
-  function cronTick() {
-    const sched = currentMeta?.schedule;
-    if (!sched || !loggedIn) return;
-    const now = new Date();
-    const minute = Math.floor(now.getTime() / 60_000);
-    if (minute === lastCronMinute) return;
-    lastCronMinute = minute;
-    for (const [fn, expr] of Object.entries(sched)) {
-      if (!cronMatches(expr, now)) continue;
-      console.log(`cron: "${expr}" → ${fn}() (UTC)`);
-      const t0 = Date.now();
-      fetch(`http://localhost:${port}/__monty/fn/${fn}`, {
-        method: "POST",
-        headers: { "content-type": "application/json", "x-monty-schedule": expr },
-        body: "{}",
-      }).then(async (r) => {
-        if (r.ok) {
-          console.log(`cron: ${fn} ok (${Date.now() - t0}ms)`);
-        } else {
-          const e = await r.json().catch(() => null);
-          console.log(`cron: ${fn} failed [${e?.code ?? r.status}] ${e?.fix ?? ""}`);
-        }
-      }).catch((e) => console.log(`cron: ${fn} unreachable — ${e?.message ?? e}`));
-    }
-  }
-  cronTimer = setInterval(cronTick, 20_000);
-
-  async function refreshSchemaIfChanged() {
-    if (registryOwned) return; // the doors own the schema; nothing to push
-    try {
-      const m = statSync(configPath).mtimeMs;
-      if (m === configMtime) return;
-      configMtime = m;
-      const fresh = await compileConfig(appDir, { soft: true });
-      if (fresh) {
-        currentMeta = fresh;
-        console.log(
-          `schema: monty.config.ts changed — session schema updated (${Object.keys(fresh.schemaJson.tables).length} tables)`,
-        );
-      }
-    } catch { /* transient fs hiccup — next beat retries */ }
-  }
-
   async function clearDevSession(timeoutMs = 2000) {
     if (cfg?.key) {
       try {
@@ -1613,7 +1638,6 @@ async function dev() {
     ended = true;
     if (hbTimer) clearInterval(hbTimer);
     if (touchTimer) clearInterval(touchTimer);
-    if (cronTimer) clearInterval(cronTimer);
     try { tunnelChild?.kill(); } catch { /* already gone */ }
     // vite is a direct child (no npx wrapper), so this actually kills it —
     // a bare SIGTERM from the desktop must never orphan vite on the port.
@@ -1628,7 +1652,6 @@ async function dev() {
     ended = true;
     if (hbTimer) clearInterval(hbTimer);
     if (touchTimer) clearInterval(touchTimer);
-    if (cronTimer) clearInterval(cronTimer);
     try { tunnelChild?.kill(); } catch { /* already gone */ }
     try { child?.kill(); } catch { /* already gone */ }
     console.log(`dev-session: superseded — ${fix}`);
@@ -1639,7 +1662,6 @@ async function dev() {
 
   async function heartbeat(originUrl, { claim = false } = {}) {
     if (ended) return false; // shutdown already ran — no side effects
-    await refreshSchemaIfChanged();
     try {
       // Re-read the key EVERY beat: the desktop (or a fresh `monty login`)
       // may have replaced an expired key while this session runs — the
@@ -1659,23 +1681,9 @@ async function dev() {
           // owner. BOUNDED so a never-registering session (broken network)
           // can't steal the lock from a newer active session forever.
           claim: claim || (!registeredOnce && Date.now() - devStartedAt < 90_000),
-          name: currentMeta.name,
-          icon: currentMeta.icon,
+          name: meta.name,
+          icon: meta.icon,
           buildId,
-          schemaJson: currentMeta.schemaJson,
-          // App Manifest v2 (docs/manifest-v2.md) — present only for V2
-          // configs; lands only for manifest-less apps (the doors own the
-          // rest).
-          manifest: currentMeta.manifest,
-          // The CAS base for the manifest-less landing (see `monty schema
-          // pull`).
-          baseManifestHash:
-            currentMeta.manifest !== undefined ? readSchemaState(appDir)?.hash : undefined,
-          // The expose block rides the same compile as the schema — the dev
-          // visitor preview of a manifest-less app is gated on it.
-          exposure: currentMeta.exposure,
-          // Rules ride the same channel (manifest-less apps only).
-          rules: currentMeta.rules,
         }),
         signal: AbortSignal.timeout(DEV_SESSION_REQUEST_TIMEOUT_MS),
       });
@@ -1685,11 +1693,6 @@ async function dev() {
           stopSuperseded(data.fix ?? "A newer `monty dev` session is active for this app.");
           return false;
         }
-        if (data?.code === "MANIFEST_DRIFT") {
-          // Remote schema edits (another agent, via the API) — the terminal
-          // the building agent is watching gets the fix, invariant #4.
-          console.log(`schema drift (remote changes):${data.summary ? `\n${data.summary}` : ""}`);
-        }
         console.log(`dev-session: ${data?.code ?? r.status}${data?.fix ? ` — ${data.fix}` : ""}`);
         // A dead key is a SIGNED-OUT session — advertise it so the desktop
         // (which owns the session) can surface sign-in instead of letting
@@ -1699,76 +1702,48 @@ async function dev() {
         }
         return false;
       }
-      if (data?.manifestDrift) {
-        // The session registered, but the config push was HELD: the stored
-        // schema changed since this checkout last synced (another editor).
-        if (!driftAnnounced) {
-          driftAnnounced = true;
-          console.log(`schema drift (remote changes):${data.manifestDrift.summary ? `\n${data.manifestDrift.summary}` : ""}`);
-          console.log(`config push held: ${data.manifestDrift.fix ?? "Run `monty schema pull`, merge, then save again."}`);
-        }
-      } else if (currentMeta.manifest !== undefined) {
-        driftAnnounced = false;
-        // This beat's manifest landed LIVE — the new CAS base.
-        try { writeSchemaState(appDir, manifestHash(currentMeta.manifest)); } catch { /* state is advisory */ }
-      }
+      // publicFns rides every beat: dev.json mirrors the door-owned
+      // allowlist so the vite runtime's /__monty/public gate follows a
+      // `monty public set` / MCP change within one heartbeat.
+      const beatExtras = Array.isArray(data?.publicFns) ? { publicFns: data.publicFns } : {};
       if (!registeredOnce) {
         registeredOnce = true;
-        sf.write({ state: "online", loggedIn: true, lastHeartbeatAt: Date.now() });
+        sf.write({ state: "online", loggedIn: true, lastHeartbeatAt: Date.now(), ...beatExtras });
       } else {
-        sf.write({ loggedIn: true, lastHeartbeatAt: Date.now() });
+        sf.write({ loggedIn: true, lastHeartbeatAt: Date.now(), ...beatExtras });
       }
-      if (data?.configIgnored && !configIgnoredAnnounced) {
+      if (!configIgnoredAnnounced) {
         configIgnoredAnnounced = true;
-        console.log("schema: this app's data schema lives in the workspace — monty.config.ts edits do NOT change it. Read it: `monty schema`; change it: `monty schema set <file>`.");
-        // Stamp registry ownership: from the next session on, the config
-        // compile is skipped entirely.
-        try {
-          writeAppJson(appDir, {
-            registryOwned: true,
-            slug: meta.slug,
-            ...(currentMeta.name ? { name: currentMeta.name } : {}),
-            ...(currentMeta.icon ? { icon: currentMeta.icon } : {}),
-          });
-        } catch { /* the stamp is a convenience; the beat decided */ }
+        console.log("schema: this app's config lives in the workspace. Read it: `monty schema`; change it: `monty schema set '<json>'` (or pipe: `monty schema set -`). src/monty.gen.ts mirrors it automatically — never edit that file.");
       }
-      // The local config copy follows the registry: when the stored manifest
-      // moved (another editor, the schema door) and the local file is clean,
-      // regenerate it in place — the sync of the mechanical copy is
-      // automatic. Dirty or uncompilable files are left alone with the fix.
+      // src/monty.gen.ts follows the registry: when the stored manifest
+      // moved (another editor, the schema door), regenerate it in place —
+      // the file is generated, never hand-edited, so the overwrite is
+      // unconditional. Demo folders are exempt (the demo rail compiles
+      // their monty.config.ts).
       if (
         typeof data?.manifestHash === "string" &&
-        existsSync(configPath) &&
         data.manifestHash !== readSchemaState(appDir)?.hash &&
-        data.manifestHash !== syncAttemptedHash
+        data.manifestHash !== syncAttemptedHash &&
+        !existsSync(join(appDir, "demo.json"))
       ) {
         syncAttemptedHash = data.manifestHash;
         try {
-          // Already in sync (fresh checkout, no state file yet)? Stamp the
-          // base and leave the file alone — regenerate only on real drift.
-          let alreadySynced = false;
-          try {
-            const compiled = await compileAppConfig(appDir);
-            if (compiled.manifest && manifestHash(compiled.manifest) === data.manifestHash) {
-              writeSchemaState(appDir, data.manifestHash);
-              alreadySynced = true;
-            }
-          } catch { /* uncompilable — let schemaPull's dirty check narrate */ }
-          if (!alreadySynced) {
-            await schemaPull({
-              appDir,
-              host,
-              key: loadConfig()?.key ?? cfg.key,
-              slug: meta.slug,
-              force: false,
-              compileAppConfig,
-              fail: (code, fix) => {
-                throw new Error(`${code} — ${fix}`);
-              },
-            });
+          const r = await schemaPull({
+            appDir,
+            host,
+            key: loadConfig()?.key ?? cfg.key,
+            slug: meta.slug,
+            quiet: true,
+            fail: (code, fix) => {
+              throw new Error(`${code} — ${fix}`);
+            },
+          });
+          if (r.wrote) {
+            console.log(`schema: src/monty.gen.ts regenerated from the workspace (${data.manifestHash.slice(0, 12)})`);
           }
         } catch (e) {
-          console.log(`schema: the workspace manifest changed but the local copy was NOT regenerated (${String(e?.message ?? e).slice(0, 240)})`);
+          console.log(`schema: the workspace config changed but src/monty.gen.ts was NOT regenerated (${String(e?.message ?? e).slice(0, 240)}) — \`monty schema pull\` retries it`);
         }
       }
       return true;
@@ -1850,26 +1825,8 @@ async function dev() {
 
   if (configOnly) {
     sf.write({ state: "ready" });
-    console.log(
-      registryOwned
-        ? "ready: config-only — the workspace owns this app's schema; edit it with `monty schema` / `monty schema set`"
-        : "ready: config-only — saves land LIVE; the workspace renders them within seconds",
-    );
+    console.log("ready: config-only — the workspace owns this app's schema; edit it with `monty schema` / `monty schema set`");
     void startDevSession();
-    if (!registryOwned) {
-      // Manifest-less apps only: config edits should land in seconds, not a
-      // heartbeat — watch the mtime and trigger an early beat (which
-      // recompiles + pushes). Registry-owned apps have nothing to push.
-      const cfgWatch = setInterval(() => {
-        try {
-          if (statSync(configPath).mtimeMs !== configMtime) void heartbeat(undefined);
-        } catch { /* transient fs hiccup */ }
-      }, 2000);
-      const stopWatch = () => clearInterval(cfgWatch);
-      process.on("SIGINT", stopWatch);
-      process.on("SIGTERM", stopWatch);
-      process.on("SIGHUP", stopWatch);
-    }
   }
 
   let announced = false;
@@ -2124,7 +2081,7 @@ function startTunnel(port, onUrlChange, onOutput) {
   });
 }
 
-// ── monty add / components / docs ──────────────────────────────────────────
+// ── monty components / page ────────────────────────────────────────────────
 // Wraps the shadcn CLI behind the curated catalog: agents ask for a
 // capability by plain name ("kanban") and get the blessed, theme-compatible
 // implementation. Only catalog registries and core shadcn resolve.
@@ -2132,7 +2089,7 @@ function startTunnel(port, onUrlChange, onOutput) {
 function requireAppDir(cmd) {
   const appDir = findAppRoot(process.cwd());
   if (!appDir) {
-    fail("NOT_A_MONTY_APP", `Not inside a Monty app. \`monty apps\` lists local apps; cd "$(monty select <slug>)" jumps to one — then run \`monty ${cmd}\`.`);
+    fail("NOT_A_MONTY_APP", `Not inside a Monty app. cd into the app's folder (\`monty connect <slug>\` pulls a copy into any folder), then run \`monty ${cmd}\`.`);
   }
   return appDir;
 }
@@ -2150,29 +2107,31 @@ function resolveComponent(name) {
   return name;
 }
 
-// ── monty add page <name> ──────────────────────────────────────────────────
+// ── monty page add <name> ──────────────────────────────────────────────────
 // Upgrades an app with a bespoke (custom) page: scaffolds the SPA on first
 // use (config-only apps gain src/ + vite from the template — their
-// monty.config.ts and AGENTS.md stay untouched), declares
+// AGENTS.md stays untouched), declares
 // `pages.<name> = { kind: "custom", path: "/<name>" }`, and writes the page
 // route. DECLARE-FIRST: on a workspace-owned app the entry lands through
 // the schema door BEFORE the code exists — a save carrying an undeclared
 // route refuses (DEPLOY_UNDECLARED_PAGE). The Shopify model: system pages
 // stay shell-rendered; only this page is the app's own code.
 
-// Declare the page through the schema door. Returns "declared" | "already"
-// (workspace-owned app) or "config" (manifest-less: the config file is
-// still that app's editor, the caller registers the entry there).
+// Declare the page through the schema door (declare-first is mandatory: a
+// save carrying an undeclared route refuses). Returns "declared" | "already".
 async function declarePageThroughDoor(appDir, pageName) {
   const slug = readSlug(appDir);
   const { host, key } = loadConfig();
-  if (!slug || !key) return "config";
+  if (!slug) fail("NOT_CONNECTED", "This folder carries no app identity (.monty/app.json). Run `monty connect <slug>` first.");
+  if (!key) fail("NOT_LOGGED_IN", "Declaring a page lands in the workspace config. Run `monty login` first.");
   const read = await fetch(`${host}/api/schema?slug=${slug}`, {
     headers: { authorization: `Bearer ${key}` },
   }).catch(() => null);
   const readBody = await read?.json().catch(() => null);
-  if (!read?.ok || !readBody?.ok || readBody.manifest === null) return "config";
-  const manifest = readBody.manifest;
+  if (!read?.ok || !readBody?.ok) {
+    fail(readBody?.code ?? "HOST_UNREACHABLE", readBody?.fix ?? `Could not read the workspace config from ${host} — check the connection and retry.`);
+  }
+  const manifest = readBody.manifest ?? { slug, tables: {} };
   const keyOf = (n) => n.toLowerCase().replace(/[^a-z0-9]/g, "");
   const declared = Object.keys(manifest.pages ?? {}).find((n) => keyOf(n) === keyOf(pageName));
   if (declared) {
@@ -2198,36 +2157,35 @@ async function declarePageThroughDoor(appDir, pageName) {
   if (!res.ok || !body?.ok) {
     fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Declaring the page through the schema door failed — check the connection and retry.");
   }
-  try { writeSchemaState(appDir, body.hash); } catch { /* state is advisory */ }
+  // Stamp + regenerate together (the stamp claims the mirror matches).
+  try {
+    const stamp = readAppJson(appDir);
+    writeGenModule(appDir, { ...manifest, pages }, { name: stamp?.name, icon: stamp?.icon });
+    writeSchemaState(appDir, body.hash);
+  } catch { /* state is advisory */ }
   return "declared";
 }
 
 async function addPage(appDir, pageName) {
   if (!pageName || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(pageName) || pageName.length > 32) {
-    fail("INVALID_PAGE", 'Usage: monty add page <name> — lowercase letters/digits with single hyphens, max 32 chars (e.g. "reports").');
+    fail("INVALID_PAGE", 'Usage: monty page add <name> — lowercase letters/digits with single hyphens, max 32 chars (e.g. "reports").');
   }
-  const configPath = join(appDir, "monty.config.ts");
-  if (!existsSync(configPath)) {
-    fail("NO_CONFIG", `No monty.config.ts in ${appDir} — run this inside a Monty app.`);
+  const stamp = readAppJson(appDir);
+  if (typeof stamp?.slug !== "string" || !stamp.slug) {
+    fail("NOT_CONNECTED", `No app identity in ${appDir} (.monty/app.json) — run this inside a Monty app.`);
   }
-  const config = readFileSync(configPath, "utf8");
-  const appName = config.match(/name: "([^"]*)"/)?.[1] ?? pageName;
+  const appName = stamp.name ?? pageName;
   const routeFile = join(appDir, "src", "routes", `${pageName}.tsx`);
   if (existsSync(routeFile)) {
     fail("PAGE_EXISTS", `src/routes/${pageName}.tsx already exists. Edit it, or pick a different page name.`);
   }
-  if (config.includes(`"/${pageName}"`) || new RegExp(`^\\s*${pageName}:`, "m").test(config)) {
-    console.log(`note: "${pageName}" may already be declared in monty.config.ts — check its pages block after this.`);
-  }
   // Declare BEFORE any code exists: if the door refuses, nothing to clean up.
   const declared = await declarePageThroughDoor(appDir, pageName);
-  if (declared !== "config") {
-    console.log(
-      declared === "declared"
-        ? `declared: pages.${pageName} through the schema door — live in the workspace now`
-        : `declared: pages.${pageName} already in the workspace manifest`,
-    );
-  }
+  console.log(
+    declared === "declared"
+      ? `declared: pages.${pageName} through the schema door — live in the workspace now`
+      : `declared: pages.${pageName} already in the workspace manifest`,
+  );
 
   // First custom page on a config-only app: bring in the SPA scaffold.
   if (isConfigOnlyApp(appDir)) {
@@ -2235,7 +2193,7 @@ async function addPage(appDir, pageName) {
     const templateDir = [
       join(pkgRoot, "template"),
       join(pkgRoot, "..", "template"),
-    ].find((d) => existsSync(join(d, "monty.config.ts")));
+    ].find((d) => existsSync(join(d, "src", "main.tsx")));
     if (!templateDir) {
       fail("TEMPLATE_MISSING", "The Monty app template is missing from this CLI install. Reinstall the monty CLI.");
     }
@@ -2247,7 +2205,7 @@ async function addPage(appDir, pageName) {
         const base = basename(src);
         if (["node_modules", "dist", ".monty", ".env.local", "routeTree.gen.ts"].includes(base)) return false;
         // The app keeps its own identity files.
-        if (["monty.config.ts", "AGENTS.md", "CLAUDE.md"].includes(base)) return false;
+        if (["AGENTS.md", "CLAUDE.md"].includes(base)) return false;
         return true;
       },
     });
@@ -2289,9 +2247,19 @@ async function addPage(appDir, pageName) {
     // the only route beside __root.
     const starter = join(appDir, "src", "routes", "index.tsx");
     if (existsSync(starter)) rmSync(starter);
+    // The template's placeholder src/monty.gen.ts carries no real schema —
+    // regenerate the mirror from the workspace so the new page types
+    // against the actual tables.
+    try {
+      const { host, key } = loadConfig();
+      await schemaPull({ appDir, host, key, slug: readSlug(appDir), quiet: true, fail: (c, f) => { throw new Error(`${c} — ${f}`); } });
+      console.log("schema: src/monty.gen.ts generated from the workspace config");
+    } catch (e) {
+      console.log(`schema: could not generate src/monty.gen.ts (${String(e?.message ?? e).slice(0, 160)}) — \`monty schema pull\` retries it`);
+    }
     appendFileSync(
       join(appDir, "AGENTS.md"),
-      `\n---\n\n## Custom pages\n\nThis app now has a SPA half (src/) serving CUSTOM pages inside the\nplatform shell. Each page = a route in src/routes/ + a\n\`pages.<name>: { kind: "custom", path: "/<name>" }\` declaration.\nDECLARE-FIRST: \`monty add page <name>\` declares the entry (through the\nschema door on workspace-owned apps) before writing the route — a save\ncarrying an undeclared route refuses. System pages (table views) stay\nshell-rendered — only build bespoke UI here. \`monty dev\` serves both.\nAfter every meaningful change verified in dev, run\n\`monty save "<what changed>"\` — it pushes the work to the cloud copy,\nlike \`git push main\`.\n\nEvery custom page opens with \`PageHeader\` from \`@montytools/sdk/ui\` —\nthe same bar the shell renders on system pages (page actions go in it as\n\`PageHeaderButton\`s, \`primary\` for the one main action). Also there:\n\`FloatingBar\`/\`FloatingBarButton\` and the Lyra table classes\n\`SURFACE\`/\`THEAD\`/\`TH\`/\`ROW\`/\`CHIP\`.\n`,
+      `\n---\n\n## Custom pages\n\nThis app now has a SPA half (src/) serving CUSTOM pages inside the\nplatform shell. Each page = a route in src/routes/ + a\n\`pages.<name>: { kind: "custom", path: "/<name>" }\` declaration.\nDECLARE-FIRST: \`monty page add <name>\` declares the entry (through the\nschema door on workspace-owned apps) before writing the route — a save\ncarrying an undeclared route refuses. System pages (table views) stay\nshell-rendered — only build bespoke UI here. \`monty dev\` serves both.\nAfter every meaningful change verified in dev, run\n\`monty save "<what changed>"\` — it pushes the work to the cloud copy,\nlike \`git push main\`.\n\nEvery custom page opens with \`PageHeader\` from \`@montytools/sdk/ui\` —\nthe same bar the shell renders on system pages (page actions go in it as\n\`PageHeaderButton\`s, \`primary\` for the one main action). Also there:\n\`FloatingBar\`/\`FloatingBarButton\` and the Lyra table classes\n\`SURFACE\`/\`THEAD\`/\`TH\`/\`ROW\`/\`CHIP\`.\n`,
     );
   }
 
@@ -2340,30 +2308,6 @@ function ${pageComponentName(pageName)}() {
 }
 `);
   console.log(`page: src/routes/${pageName}.tsx`);
-
-  // Manifest-less apps only: the config file is still their editor, so the
-  // entry registers there (workspace-owned apps declared through the door
-  // above — a config edit would be inert).
-  if (declared === "config") {
-    const entry = `    ${JSON.stringify(pageName).includes("-") ? JSON.stringify(pageName) : pageName}: { kind: "custom", path: "/${pageName}" },`;
-    let next = null;
-    if (/^(\s*)pages:\s*{/m.test(config)) {
-      next = config.replace(/^(\s*)pages:\s*{/m, (m) => `${m}\n${entry}`);
-    } else {
-      // No pages block: add one right before the config's closing `});`.
-      const close = config.lastIndexOf("});");
-      if (close !== -1) {
-        next = config.slice(0, close) + `  pages: {\n${entry}\n  },\n` + config.slice(close);
-      }
-    }
-    if (next) {
-      writeFileSync(configPath, next);
-      console.log(`config: pages.${pageName} registered in monty.config.ts`);
-    } else {
-      console.log(`config: could not auto-edit monty.config.ts — add this to defineApp yourself:\n  pages: { ${pageName}: { kind: "custom", path: "/${pageName}" } }`);
-    }
-  }
-
   console.log(`added: custom page "${pageName}"`);
   console.log(`next: monty install && monty dev — the shell mounts /${pageName} live; \`monty save\` pushes it to the cloud copy.`);
 }
@@ -2372,16 +2316,17 @@ function pageComponentName(pageName) {
   return pageName.split("-").map((w) => w[0].toUpperCase() + w.slice(1)).join("") + "Page";
 }
 
-async function add() {
-  const appDir = requireAppDir("add");
-  const names = rest.filter((a) => !a.startsWith("--"));
-  if (names.length === 0) {
-    fail("NO_COMPONENT", "Usage: monty add <name...> — run `monty components` to see what's available (or `monty add page <name>` for a custom page).");
-  }
-  if (names[0] === "page") {
-    await addPage(appDir, names[1]);
-    return;
+// The page namespace: `monty page add <name>` scaffolds a bespoke page
+// (declare-first through the schema door).
+async function pageCmd() {
+  const [sub, name] = rest.filter((a) => !a.startsWith("--"));
+  if (sub !== "add") {
+    fail("INVALID_PAGE", 'Usage: monty page add <name> — scaffold a custom page (e.g. `monty page add reports`).');
   }
+  await addPage(requireAppDir("page"), name);
+}
+
+async function addComponents(appDir, names) {
   const items = names.flatMap((n) => [resolveComponent(n), ...(CATALOG[n]?.also ?? [])]);
 
   // --overwrite so shadcn never halts on a per-file prompt (an aborted prompt
@@ -2423,31 +2368,50 @@ async function add() {
   console.log(`added: ${items.join(", ")} -> src/components (already themed; import and compose)`);
 }
 
-function components() {
-  const query = rest.filter((a) => !a.startsWith("--")).join(" ").toLowerCase();
+// The component namespace: `monty components` lists/searches the curated
+// catalog, `components add <name...>` installs, `components docs <name>`
+// prints a component's source. (`search` is the explicit search subcommand;
+// a bare query searches too.)
+async function componentsCmd() {
+  const args = rest.filter((a) => !a.startsWith("--"));
+  const [sub, ...tail] = args;
+  if (sub === "add") {
+    if (tail.length === 0) {
+      fail("NO_COMPONENT", "Usage: monty components add <name...> — `monty components` lists the catalog; core shadcn components install by bare name.");
+    }
+    await addComponents(requireAppDir("components"), tail);
+    return;
+  }
+  if (sub === "docs") {
+    if (!tail[0]) {
+      fail("NO_COMPONENT", "Usage: monty components docs <name> — `monty components` lists the catalog.");
+    }
+    componentDocs(requireAppDir("components"), tail[0]);
+    return;
+  }
+  listComponents((sub === "search" ? tail : args).join(" ").toLowerCase());
+}
+
+function listComponents(query) {
   const entries = Object.entries(CATALOG).filter(
     ([name, { item, use }]) => !query || `${name} ${item} ${use}`.toLowerCase().includes(query),
   );
   const width = Math.max(...Object.keys(CATALOG).map((n) => n.length));
   const itemWidth = Math.max(...Object.values(CATALOG).map((c) => c.item.length));
-  console.log(`components: ${entries.length} curated (install with \`monty add <name>\`)`);
+  console.log(`components: ${entries.length} curated (install with \`monty components add <name>\`)`);
   for (const [name, { item, use }] of entries) {
     console.log(`  ${name.padEnd(width)}  ${item.padEnd(itemWidth)}  ${use}`);
   }
   console.log("core: any shadcn component installs by bare name (dialog, tabs, dropdown-menu, popover, tooltip, sheet, checkbox, textarea, ...)");
-  console.log("docs: `monty docs <name>` shows a component's source before installing");
+  console.log("docs: `monty components docs <name>` shows a component's source before installing");
 }
 
-async function docs() {
-  const appDir = requireAppDir("docs");
-  const name = rest.find((a) => !a.startsWith("--"));
-  if (!name) {
-    fail("NO_COMPONENT", "Usage: monty docs <name> — run `monty components` to see what's available.");
-  }
+function componentDocs(appDir, name) {
   run(appDir, "docs", ["pnpm", "dlx", "shadcn@latest", "view", resolveComponent(name)],
     `Could not view ${name}. Run \`monty components\` to see the curated catalog.`);
 }
 
+
 // ── monty secret ─────────────────────────────────────────────────────────
 // `monty secret set KEY [value]` / `monty secret rm KEY` — per-app
 // server-function secrets. The value goes to Cloudflare's per-script secrets
@@ -2455,12 +2419,11 @@ async function docs() {
 // readable back. Read from the arg, then a TTY prompt, then stdin (piping).
 async function secret() {
   const appDir = requireAppDir("secret");
-  // Identity comes from the stamp when it exists — no config compile for
-  // one slug read.
   const stamped = readAppJson(appDir);
-  const meta = typeof stamped?.slug === "string" && stamped.slug
-    ? { slug: stamped.slug }
-    : await compileConfig(appDir);
+  if (typeof stamped?.slug !== "string" || !stamped.slug) {
+    fail("NOT_CONNECTED", "This folder carries no app identity (.monty/app.json). Run `monty connect <slug>` here first.");
+  }
+  const meta = { slug: stamped.slug };
   const config = loadConfig();
   if (!config?.key) fail("NOT_LOGGED_IN", "Run `monty login` first.");
   const [sub, name] = rest.filter((a) => !a.startsWith("-"));
@@ -2498,10 +2461,11 @@ async function secret() {
 }
 
 // ── monty save ─────────────────────────────────────────────────────────────
-// Push the working copy to the cloud copy, like `git push main`. `deploy` is
-// the compat alias; both run the same pipeline (build + typecheck gate every
-// save, then one multipart POST). The optional message rides the deploy meta
-// so the platform can narrate the save later.
+// Push the working copy to the cloud copy, like `git push main` (build +
+// typecheck gate every save, then one multipart POST). A save ships
+// IMPLEMENTATION ONLY — the app's config lives in the workspace and lands
+// through the doors; the config file is never compiled here. The optional
+// message rides the meta so the platform can narrate the save later.
 async function deploy() {
   const appDir = requireAppDir(command);
   ensureSdk(appDir);
@@ -2521,40 +2485,50 @@ async function deploy() {
     fail("NOT_LOGGED_IN", "Run `monty login` first (create a key at /cli-auth in the Monty host).");
   }
 
-  // 1) Compile monty.config.ts → { slug, name, icon, schemaJson } using the
-  //    app's OWN zod/sdk instances (esbuild-bundled, run in a subprocess).
-  console.log("compile: monty.config.ts");
-  const meta = await compileConfig(appDir);
-  console.log(`compile: ok (app "${meta.slug}", ${Object.keys(meta.schemaJson.tables).length} tables)`);
+  // 1) Identity from the stamp. Neither the /__monty/public allowlist nor
+  //    clock work rides a save: sharing is door-owned (`monty public set`)
+  //    and cron is an `every` rule (the rules door).
+  const stamp = readAppJson(appDir);
+  if (typeof stamp?.slug !== "string" || !stamp.slug) {
+    fail("NOT_CONNECTED", "This folder carries no app identity (.monty/app.json). Run `monty connect <slug>` here to join an existing app, or `monty create <slug>` for a new one.");
+  }
+  const meta = {
+    slug: stamp.slug,
+    name: stamp.name ?? stamp.slug,
+    icon: stamp.icon,
+  };
   // `monty save "what changed"` — the message rides the meta for the
   // platform to render as this save's Activity row.
   if (message) meta.message = message;
+  await migrateConfigToGen(appDir, { host: config.host, key: config.key, slug: meta.slug });
 
-  // Registry-owned apps ship IMPLEMENTATION ONLY: manifest, schema, rules,
-  // and exposure are door-owned (the server holds them regardless — not
-  // sending them keeps the wire honest). Code-door declarations
-  // (publicFns, schedule, pages, functions) still ride.
-  const registryOwned = readAppJson(appDir)?.registryOwned === true;
-  if (registryOwned) {
-    delete meta.schemaJson;
-    delete meta.manifest;
-    delete meta.exposure;
-    delete meta.rules;
-  }
-
-  // CONFIG-ONLY apps publish the manifest alone: no vite build, no bundle —
-  // the platform shell renders the app.
+  // CONFIG-ONLY apps have no bundle — the platform shell renders them; the
+  // save carries the source snapshot only.
   const configOnly = isConfigOnlyApp(appDir);
-  if (!configOnly) {
-    // 2) Fail fast locally before any upload. Build FIRST — it also generates
-    //    src/routeTree.gen.ts, without which tsc fails on a fresh checkout.
+  if (configOnly) {
+    meta.configOnly = true;
+  } else {
+    // Refresh the generated mirror before the build/typecheck: code written
+    // against a schema another surface just changed must see it.
+    if (!existsSync(join(appDir, "demo.json"))) {
+      try {
+        await schemaPull({ appDir, host: config.host, key: config.key, slug: meta.slug, quiet: true, fail: (c, f) => { throw new Error(`${c} — ${f}`); } });
+      } catch (e) {
+        console.log(`schema: could not refresh src/monty.gen.ts (${String(e?.message ?? e).slice(0, 160)}) — building with the local copy`);
+      }
+    }
+    // 2) Fail fast locally before any upload. Style lint first (cheapest,
+    //    same contract as the typecheck: off-token styling never ships) —
+    //    then build (it also generates src/routeTree.gen.ts, without which
+    //    tsc fails on a fresh checkout), then typecheck.
+    const styleViolations = await lintStyles(appDir);
+    if (styleViolations.length > 0) {
+      fail("STYLE_OFF_TOKENS", `Off-token styling below — the platform look is tokens-only, and \`monty save\` never uploads styling off the vocabulary.\n${await formatViolations(styleViolations)}\nThe vocabulary is the monty-design skill; \`monty style\` re-checks. A deliberate exception takes \`// monty-style-ignore\` on its line.`);
+    }
     run(appDir, "build", ["npx", "vite", "build"],
       "The production build failed. Read the vite error above; it names the file to fix.");
     run(appDir, "typecheck", ["npx", "tsc", "--noEmit"],
       "TypeScript errors above. Fix them in the listed files; `monty save` never uploads code that does not compile.");
-  } else if (!registryOwned && !meta.manifest) {
-    fail("MANIFEST_MISSING",
-      "This config-only app compiled without a manifest — that should be impossible (forceManifest). Re-run `monty install` to refresh the SDK, then retry.");
   }
 
   // 3) Multipart POST to the host.
@@ -2568,41 +2542,15 @@ async function deploy() {
   // 3a) Server functions (optional): bundle server/index.ts into one worker
   //     script and ride the SAME deploy. The manifest (fns) goes in meta so
   //     the router gates /__monty/fn/* without a lookup.
-  const serverBundle = await bundleServerFns(appDir, meta.schedule);
-  const publicFns = Array.isArray(meta.publicFns) ? meta.publicFns : [];
-  const scheduleEntries = Object.entries(meta.schedule ?? {});
-  if (!serverBundle && (publicFns.length > 0 || scheduleEntries.length > 0)) {
-    fail("SERVER_DIR_MISSING",
-      "monty.config.ts declares publicFns/schedule, but this app has no server/index.ts. Create it with the named exports, or remove the declarations.");
-  }
+  const serverBundle = await bundleServerFns(appDir);
   if (serverBundle) {
-    for (const name of publicFns) {
-      if (!serverBundle.fns.includes(name)) {
-        fail("PUBLIC_FN_UNKNOWN",
-          `publicFns names "${name}" but server/index.ts exports no such function. Export it (e.g. \`export async function ${name}(req, ctx) {…}\`) or remove it from monty.config.ts.`);
-      }
-    }
-    for (const [name] of scheduleEntries) {
-      if (!serverBundle.fns.includes(name)) {
-        fail("SCHEDULE_UNKNOWN_FN",
-          `schedule targets "${name}" but server/index.ts exports no such function. Export it (e.g. \`export async function ${name}(args, ctx) {…}\`) or remove the entry from monty.config.ts.`);
-      }
-    }
-    // Wire compat: meta.fns stays the UNION (older hosts gate dispatch on
-    // it); meta.datasets is the additive split newer hosts classify with.
-    meta.fns = [...serverBundle.fns, ...serverBundle.datasets];
+    if (serverBundle.fns.length > 0) meta.fns = serverBundle.fns;
     if (serverBundle.datasets.length > 0) meta.datasets = serverBundle.datasets;
     form.set("server-worker", new Blob([serverBundle.code]), "server-worker.mjs");
     const bundled = [];
     if (serverBundle.fns.length > 0) bundled.push(`${serverBundle.fns.length} function(s) (${serverBundle.fns.join(", ")})`);
     if (serverBundle.datasets.length > 0) bundled.push(`${serverBundle.datasets.length} dataset(s) (${serverBundle.datasets.join(", ")})`);
     console.log(`fns: bundled ${bundled.join(" + ")}`);
-    if (publicFns.length > 0) {
-      console.log(`public: ${publicFns.map((f) => `/__monty/public/${f}`).join(", ")} — open to the internet; verify signatures in the function`);
-    }
-    if (scheduleEntries.length > 0) {
-      console.log(`schedule: ${scheduleEntries.map(([f, c]) => `${f} @ "${c}"`).join(", ")} (UTC; Live cron changes can take ~15 min to propagate)`);
-    }
   }
   // 3a½) Custom pages, by route-file convention (top-level src/routes/
   // files) — registered as fnsJson.pages so the shell's nav knows what this
@@ -2618,7 +2566,7 @@ async function deploy() {
   // only the minified bundle and the sole copy of the app's code is this
   // folder — delete it and the source is gone forever. The snapshot is what
   // `monty pull <slug>` restores on any machine, and the publish lands in
-  // the same version history as `monty commit`.
+  // the same version history as `monty save`.
   let sourceHash = null;
   {
     const packed = packSource(appDir);
@@ -2633,13 +2581,6 @@ async function deploy() {
       console.log(`source: ${(packed.buf.byteLength / 1024).toFixed(0)} KB snapshot rides this save (restore anywhere: monty pull ${meta.slug})`);
     }
   }
-  // V2 schema CAS: prove which stored manifest this checkout last synced,
-  // so an API/MCP edit made meanwhile surfaces as MANIFEST_DRIFT instead of
-  // being clobbered (fix: `monty schema pull`).
-  if (meta.manifest !== undefined) {
-    const state = readSchemaState(appDir);
-    if (state?.hash) meta.baseManifestHash = state.hash;
-  }
   form.set("monty", JSON.stringify(meta));
   let total = 0;
   for (const file of files) {
@@ -2650,7 +2591,7 @@ async function deploy() {
   }
   console.log(
     configOnly
-      ? `upload: config-only (manifest, no bundle) -> ${config.host}/api/deploy`
+      ? `upload: config-only (source snapshot, no bundle) -> ${config.host}/api/deploy`
       : `upload: ${files.length} files, ${(total / 1024).toFixed(0)} KB -> ${config.host}/api/deploy`,
   );
   const res = await fetch(`${config.host}/api/deploy`, {
@@ -2660,22 +2601,10 @@ async function deploy() {
   });
   const body = await res.json().catch(() => null);
   if (!res.ok || !body?.ok) {
-    if (body?.code === "MANIFEST_DRIFT" && body?.summary) {
-      console.log(`schema drift (remote changes):\n${body.summary}`);
-    }
     fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Unexpected server response — is the Monty host reachable?");
   }
   console.log(`origin: ${body.origin}`);
   console.log(`saved: ${body.url} (version ${body.version})`);
-  if (body.manifestDrift) {
-    // The code shipped; the config was HELD — the stored schema changed
-    // since this checkout last synced (another editor).
-    console.log(`schema drift (remote changes):${body.manifestDrift.summary ? `\n${body.manifestDrift.summary}` : ""}`);
-    console.log(`config push held: ${body.manifestDrift.fix ?? "Run `monty schema pull`, merge, then deploy again."}`);
-  } else if (meta.manifest !== undefined) {
-    // The manifest just published IS the new CAS base.
-    writeSchemaState(appDir, manifestHash(meta.manifest));
-  }
   // Stamp what was published — pull uses this to tell "unchanged since last
   // sync" from "locally modified".
   if (sourceHash) {
@@ -2694,7 +2623,7 @@ async function deploy() {
 // fn-worker's makeFnWorker; esbuild bundles it for workerd. node: imports are
 // rejected at compile time — Live runs on Cloudflare Workers, not Node.
 // Returns { code, fns, datasets } (per-folder export names) or null.
-async function bundleServerFns(appDir, schedule) {
+async function bundleServerFns(appDir) {
   const serverEntry = join(appDir, "server", "index.ts");
   const datasetsEntry = join(appDir, "datasets", "index.ts");
   const hasServer = existsSync(serverEntry);
@@ -2705,14 +2634,11 @@ async function bundleServerFns(appDir, schedule) {
   mkdirSync(tmpDir, { recursive: true });
   const entry = join(tmpDir, "fn-worker-entry.mjs");
   const out = join(tmpDir, "fn-worker-out.mjs");
-  // The schedule map is baked into the bundle: Cloudflare's scheduled()
-  // hands back only the matching cron expression, so the worker needs the
-  // expression→fn mapping at runtime.
   writeFileSync(entry, [
     hasServer ? `import * as appFns from "../server/index";` : `const appFns = {};`,
     hasDatasets ? `import * as appDatasets from "../datasets/index";` : `const appDatasets = {};`,
     `import { makeFnWorker } from "@montytools/sdk/fn-worker";`,
-    `export default makeFnWorker({ ...appFns, ...appDatasets }, { schedule: ${JSON.stringify(schedule ?? {})} });`,
+    `export default makeFnWorker({ ...appFns, ...appDatasets });`,
   ].join("\n"));
   // Fail the deploy if server code reaches for Node built-ins — a Worker
   // can't run them, and a silent runtime crash on Live is the worst outcome.
@@ -2777,25 +2703,6 @@ function discoverFnExports(serverEntry) {
   return [...names];
 }
 
-// Thin wrapper over the shared pipeline (lib/compile.mjs): `soft` keeps the
-// the session heartbeat's last good schema through transient config breakage.
-async function compileConfig(appDir, { soft = false } = {}) {
-  try {
-    // Config-only apps (no SPA) always compile a manifest: the platform
-    // shell is their only renderer.
-    return await compileAppConfig(appDir, { forceManifest: isConfigOnlyApp(appDir) });
-  } catch (e) {
-    if (e instanceof CompileError) {
-      if (soft) {
-        console.log("schema: monty.config.ts doesn't compile right now — keeping the last good schema");
-        return null;
-      }
-      fail(e.code, e.fix);
-    }
-    throw e;
-  }
-}
-
 function run(cwd, label, argv, fixOnFail) {
   console.log(`${label}: ${argv.join(" ")}`);
   // stdin ignored: interactive prompts (e.g. shadcn's per-file overwrite
@@ -2821,58 +2728,6 @@ function walk(dir) {
 // UTC, 5 fields, standard syntax: *  a,b  a-b  */n  a-b/n  plus month/day
 // names (JAN, MON). Deliberately forgiving: an unparsable field simply never
 // matches locally — Cloudflare is the syntax authority at deploy, so a bad
-// expression fails there with its own message.
-const CRON_MONTHS = { jan: 1, feb: 2, mar: 3, apr: 4, may: 5, jun: 6, jul: 7, aug: 8, sep: 9, oct: 10, nov: 11, dec: 12 };
-const CRON_DAYS = { sun: 0, mon: 1, tue: 2, wed: 3, thu: 4, fri: 5, sat: 6 };
-
-function cronMatches(expr, date) {
-  const fields = String(expr).trim().split(/\s+/);
-  if (fields.length !== 5) return false;
-  const values = [
-    date.getUTCMinutes(),
-    date.getUTCHours(),
-    date.getUTCDate(),
-    date.getUTCMonth() + 1,
-    date.getUTCDay(),
-  ];
-  const bounds = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 7]];
-  return fields.every((field, i) => cronFieldMatches(field, values[i], bounds[i], i));
-}
-
-function cronFieldMatches(field, value, [lo, hi], idx) {
-  const names = idx === 3 ? CRON_MONTHS : idx === 4 ? CRON_DAYS : null;
-  const num = (t) => {
-    const named = names?.[t.toLowerCase()];
-    if (named !== undefined) return named;
-    const n = Number(t);
-    return Number.isInteger(n) ? n : null;
-  };
-  for (const part of field.split(",")) {
-    const [rangeRaw, stepRaw] = part.split("/");
-    const step = stepRaw === undefined ? 1 : Number(stepRaw);
-    if (!Number.isInteger(step) || step < 1) continue;
-    let from;
-    let to;
-    if (rangeRaw === "*" || rangeRaw === "") {
-      from = lo;
-      to = hi;
-    } else if (rangeRaw.includes("-")) {
-      const [a, b] = rangeRaw.split("-");
-      from = num(a);
-      to = num(b);
-    } else {
-      from = num(rangeRaw);
-      to = stepRaw === undefined ? from : hi; // "5/10": from 5 to max, step 10
-    }
-    if (from === null || to === null || from > to) continue;
-    for (let v = from; v <= to; v += step) {
-      // day-of-week: cron accepts 7 for Sunday alongside 0
-      if (v === value || (idx === 4 && v === 7 && value === 0)) return true;
-    }
-  }
-  return false;
-}
-
 // ── monty data ─────────────────────────────────────────────────────────────
 // The agent verbs for OPERATING an app: read and write its records from any
 // terminal — no browser, no dev session. Auth is the mk_ key exchanged at
@@ -2917,10 +2772,7 @@ function resolveDataApp() {
   const root = findAppRoot(process.cwd());
   const slug = explicit ?? (root ? readSlugFromConfig(root) : null);
   if (!slug) {
-    fail("NO_APP", "Say which app: pass --app <slug>, or run inside an app folder. `monty apps` lists local apps.");
-  }
-  if (rest.includes("--studio")) {
-    fail("STUDIO_REMOVED", "The session sandbox is gone — every app has one set of records, and data verbs always target it. Drop --studio.");
+    fail("NO_APP", "Say which app: pass --app <slug>, or run inside an app folder.");
   }
   return slug;
 }
@@ -2994,7 +2846,7 @@ function flattenRow(doc) {
 
 function dataUsage() {
   console.log("usage: monty data <verb> [table] [flags]     read/write an app's records");
-  console.log("  schema  [table]                             the app's table shapes (from local monty.config.ts — `monty pull` first if needed)");
+  console.log("  schema  [table]                             the app's table shapes (read from the workspace)");
   console.log("  list    <table> [--filter '{\"k\":\"v\"}'] [--order asc|desc] [--limit N] [--cursor C]");
   console.log("  get     <table> <id>");
   console.log("  insert  <table> --data '<json|[json,…]>'");
@@ -3056,33 +2908,17 @@ async function data() {
   const [verb, table, id] = dataPositionals();
 
   if (verb === "schema") {
-    // Shape comes from the LOCAL source checkout (compiled through the real
-    // pipeline) — the same monty.config.ts that defines what the app stores.
-    const explicit = flag("app");
-    const root = explicit
-      ? (listLocalApps().find((a) => a.slug === explicit || a.id === explicit)?.path ?? null)
-      : findAppRoot(process.cwd());
-    if (!root) {
-      fail("APP_NOT_LOCAL", explicit
-        ? `No local source for "${explicit}" on this machine — run \`monty pull ${explicit}\` first, or cd into the app folder.`
-        : "Not inside an app folder. Pass --app <slug> (needs the source pulled locally) or cd into the app.");
-    }
-    let meta;
-    try {
-      meta = await compileAppConfig(root);
-    } catch (e) {
-      if (e instanceof CompileError) fail(e.code, e.fix);
-      throw e;
-    }
-    const tables = meta.schemaJson?.tables ?? {};
-    if (table !== undefined) {
-      if (!tables[table]) {
-        fail("NO_SUCH_TABLE", `App "${meta.slug}" has no table "${table}". Tables: ${Object.keys(tables).join(", ") || "(none)"}.`);
-      }
-      printJson({ app: meta.slug, table, schema: tables[table] });
-    } else {
-      printJson({ app: meta.slug, tables });
-    }
+    // Shape comes from the WORKSPACE — the stored schema the platform
+    // validates against (derived from the app's config).
+    const app = resolveDataApp();
+    const auth = await workspaceAuth();
+    const result = await callRecords(
+      "query",
+      "schema",
+      table !== undefined ? { app, table } : { app },
+      auth,
+    );
+    printJson({ app, ...result });
     return;
   }
 
@@ -3267,7 +3103,7 @@ async function data() {
 // The CLI accepts concise filters, then stores the shell's existing
 // { filters, sort, hidden } ViewConfig shape unchanged.
 
-const VIEW_VALUE_FLAGS = new Set(["app", "filter", "sort", "hide", "name"]);
+const VIEW_VALUE_FLAGS = new Set(["app", "filter", "sort", "hide", "name", "kanban"]);
 
 function viewPositionals() {
   const out = [];
@@ -3285,10 +3121,11 @@ function viewPositionals() {
 function viewsUsage() {
   console.log("usage: monty views <list|set|update|remove> <table> [name] [flags]");
   console.log("  list   <table> [--app slug]");
-  console.log("  set    <table> <name> [--filter '<json>'] [--sort field:asc|desc] [--hide field,...] [--app slug]");
-  console.log("  update <table> <name> [--name new-name] [--filter '<json>'] [--sort field:asc|desc|none] [--hide field,...] [--app slug]");
+  console.log("  set    <table> <name> [--filter '<json>'] [--sort field:asc|desc] [--hide field,...] [--kanban field|none] [--app slug]");
+  console.log("  update <table> <name> [--name new-name] [--filter '<json>'] [--sort field:asc|desc|none] [--hide field,...] [--kanban field|none] [--app slug]");
   console.log("  remove <table> <name> [--app slug]");
   console.log("filter values: null = empty; scalar = exact; array = any listed value; {\"contains\":\"text\"}; {\"min\":0,\"max\":100}");
+  console.log("kanban: the view renders as lanes over the select field's values; \"none\" makes it a table");
   console.log("example: monty views set leads \"Evaluate\" --filter '{\"pipelineId\":null}'");
   process.exit(1);
 }
@@ -3313,10 +3150,9 @@ function viewName(input) {
 async function viewContext(table) {
   const app = resolveDataApp();
   const auth = await workspaceAuth();
-  const manifest = await callConvex("query", "platform:appManifest", { slug: app }, auth);
-  if (!manifest) {
-    fail("NO_MANIFEST", `App "${app}" has no stored manifest, so it has no system table views.`);
-  }
+  // Nothing stored yet is just an empty config — the table lookup below
+  // says what's actually missing.
+  const manifest = (await callConvex("query", "platform:appManifest", { slug: app }, auth)) ?? { tables: {} };
   const tableSpec = manifest.tables?.[table];
   if (!tableSpec) {
     fail("NO_SUCH_TABLE", `App "${app}" has no table "${table}". Tables: ${Object.keys(manifest.tables ?? {}).join(", ") || "(none)"}.`);
@@ -3343,6 +3179,8 @@ function requestedViewConfig(fields) {
       sort: parseViewSort(flag("sort")),
       hidden: parseHiddenColumns(flag("hide")),
     };
+    const kanban = parseKanbanFlag(flag("kanban"));
+    if (kanban) Object.assign(config, kanban);
     return validateViewColumns(config, fields);
   } catch (error) {
     fail(error?.code ?? "BAD_VIEW_CONFIG", error?.fix ?? error?.message ?? "The saved view config is invalid.");
@@ -3355,6 +3193,7 @@ function requestedViewPatch() {
       ...(rest.includes("--filter") ? { filters: normalizeViewFilters(parseJsonFlag("filter")) } : {}),
       ...(rest.includes("--sort") ? { sort: parseViewSort(flag("sort")) } : {}),
       ...(rest.includes("--hide") ? { hidden: parseHiddenColumns(flag("hide")) } : {}),
+      ...(rest.includes("--kanban") ? { kanban: parseKanbanFlag(flag("kanban")) } : {}),
     };
   } catch (error) {
     fail(error?.code ?? "BAD_VIEW_CONFIG", error?.fix ?? error?.message ?? "The saved view config is invalid.");
@@ -3405,7 +3244,7 @@ async function views() {
     }
     const patch = requestedViewPatch();
     if (nextName === name && Object.keys(patch).length === 0) {
-      fail("NO_VIEW_CHANGES", "Provide --name, --filter, --sort, or --hide. Omitted properties stay unchanged.");
+      fail("NO_VIEW_CHANGES", "Provide --name, --filter, --sort, --hide, or --kanban. Omitted properties stay unchanged.");
     }
     const config = checkedViewConfig(mergeViewConfig(existing.config, patch), fields);
     await callConvex("mutation", "platform:saveView", { app, page: table, name: nextName, config }, auth);
@@ -3635,9 +3474,9 @@ if (command !== "dev" && command !== "logs" && command !== "support") {
 // The app's data half (tables, field algebra, metrics, settings, pages)
 // lives ONLY in the workspace. `monty schema [slug]` prints the stored
 // manifest as JSON (and stamps the CAS base); edit that JSON and
-// `monty schema set <file|->` writes it back through the one landing —
+// `monty schema set '<json>'` (or `set -` piped) writes it back|->` writes it back through the one landing —
 // validated server-side, additive-only by default, CAS against what you
-// read. `monty schema pull` (legacy) regenerates monty.config.ts.
+// read. `monty schema pull` regenerates the src/monty.gen.ts mirror.
 async function schemaCmd() {
   const verb = rest[0];
   const { host, key } = loadConfig() ?? {};
@@ -3646,42 +3485,38 @@ async function schemaCmd() {
 
   if (verb === "pull") {
     const dir = appDir ?? process.cwd();
-    let slug = rest.slice(1).find((a) => !a.startsWith("--"));
+    const slug = rest.slice(1).find((a) => !a.startsWith("--")) ?? readSlug(dir);
     if (!slug) {
-      try {
-        slug = (await compileAppConfig(dir)).slug;
-      } catch {
-        fail("INVALID_SLUG", "Pass the app slug (monty schema pull <slug>) — no compilable monty.config.ts here to read it from.");
-      }
+      fail("INVALID_SLUG", "Pass the app slug (monty schema pull <slug>) — or run it inside an app folder (.monty/app.json carries the identity).");
     }
-    await schemaPull({
-      appDir: dir, host, key, slug,
-      force: rest.includes("--force"),
-      compileAppConfig,
-      fail,
-    });
+    const migrated = await migrateConfigToGen(dir, { host, key, slug });
+    if (!migrated) await schemaPull({ appDir: dir, host, key, slug, fail });
     return;
   }
 
   if (verb === "set") {
+    // The config is passed as JSON, never a file — nothing to leave behind
+    // in the app folder. `-` reads stdin for configs too big for an arg.
     const target = rest[1];
     if (!target) {
-      fail("SCHEMA_USAGE", "Usage: monty schema set <file.json|-> [--allow-breaking] — the JSON is a full manifest (start from `monty schema`).");
+      fail("SCHEMA_USAGE", "Usage: monty schema set '<json>' [--allow-breaking] — the app's full config as JSON (start from `monty schema`; pipe with `monty schema set -`).");
     }
-    let raw;
-    try {
-      raw = target === "-" ? readFileSync(0, "utf8") : readFileSync(target, "utf8");
-    } catch {
-      fail("SCHEMA_USAGE", `Could not read ${target === "-" ? "stdin" : target}. Pass a manifest JSON file, or - for stdin.`);
+    let raw = target;
+    if (target === "-") {
+      try {
+        raw = readFileSync(0, "utf8");
+      } catch {
+        fail("SCHEMA_USAGE", "Could not read stdin. Pipe the config JSON in: `monty schema | <edit> | monty schema set -`.");
+      }
     }
     let manifest;
     try {
       manifest = JSON.parse(raw);
     } catch {
-      fail("BAD_MANIFEST_JSON", "That is not valid JSON. Start from `monty schema` output, edit, and set the whole document back.");
+      fail("BAD_CONFIG_JSON", "That is not valid JSON. Pass the whole config as one JSON argument (start from `monty schema` output), or pipe it with `monty schema set -`.");
     }
     const slug = typeof manifest?.slug === "string" && manifest.slug ? manifest.slug : (appDir ? readSlug(appDir) : null);
-    if (!slug) fail("INVALID_SLUG", "The manifest carries no slug and this is not an app folder — set `slug` in the JSON.");
+    if (!slug) fail("INVALID_SLUG", "The config carries no slug and this is not an app folder — set `slug` in the JSON.");
     // CAS: prove which stored manifest this edit was based on (stamped by
     // the last `monty schema` read in this folder). Absent = trusting push.
     const base = appDir && readSlug(appDir) === slug ? readSchemaState(appDir)?.hash : undefined;
@@ -3700,15 +3535,22 @@ async function schemaCmd() {
       if (body?.code === "MANIFEST_DRIFT" && body?.summary) {
         console.log(`schema drift (remote changes):\n${body.summary}`);
       }
-      fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Setting the manifest failed — is the Monty host reachable?");
+      fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Setting the config failed — is the Monty host reachable?");
+    }
+    // Stamp + regenerate together (the stamp claims the mirror matches) —
+    // the just-pushed document IS the new config, so the mirror updates
+    // instantly instead of waiting a heartbeat.
+    if (appDir && readSlug(appDir) === slug) {
+      const stamp = readAppJson(appDir);
+      writeGenModule(appDir, manifest, { name: stamp?.name, icon: stamp?.icon });
+      writeSchemaState(appDir, body.hash);
     }
-    if (appDir && readSlug(appDir) === slug) writeSchemaState(appDir, body.hash);
     console.log(`schema: set — "${slug}" is live now (hash ${String(body.hash).slice(0, 12)})`);
     return;
   }
 
   // Default: SHOW. `monty schema [slug]` — stdout is the pure manifest
-  // JSON (pipe it to a file, edit, `monty schema set` it back).
+  // JSON (edit it, then `monty schema set` the whole document back).
   const slug = (verb && !verb.startsWith("-") ? verb : null) ?? (appDir ? readSlug(appDir) : null);
   if (!slug) fail("INVALID_SLUG", "Usage: monty schema [slug] — or run it inside an app folder.");
   const res = await fetch(`${host}/api/schema?slug=${slug}`, {
@@ -3716,16 +3558,95 @@ async function schemaCmd() {
   });
   const body = await res.json().catch(() => null);
   if (!res.ok || !body?.ok) {
-    fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Could not read the manifest — check the connection and `monty login`.");
+    fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Could not read the config — check the connection and `monty login`.");
   }
   if (body.manifest === null) {
-    fail("NO_MANIFEST", `"${slug}" has no stored manifest yet — it's a code-only app. Declare one by setting a full manifest JSON: monty schema set <file>.`);
+    // Nothing stored yet is just an empty config — hand it back so the
+    // agent can fill it in and `monty schema set` it.
+    console.error(`# ${slug} — empty config (nothing stored yet; "monty schema set" declares it)`);
+    console.log(JSON.stringify({ slug, tables: {} }, null, 2));
+    return;
+  }
+  // The state stamp says "src/monty.gen.ts matches this hash" (it is also
+  // the CAS base) — so stamping ALWAYS travels with a regeneration, or the
+  // heartbeat would read the fresh stamp and leave a stale mirror in place.
+  if (appDir && readSlug(appDir) === slug) {
+    writeGenModule(appDir, body.manifest, { name: body.name, icon: body.icon });
+    writeSchemaState(appDir, body.hash);
   }
-  if (appDir && readSlug(appDir) === slug) writeSchemaState(appDir, body.hash);
-  console.error(`# ${slug} — manifest hash ${String(body.hash).slice(0, 12)}${appDir ? " (CAS base stamped for `monty schema set`)" : ""}`);
+  console.error(`# ${slug} — config hash ${String(body.hash).slice(0, 12)}${appDir ? " (CAS base stamped for `monty schema set`)" : ""}`);
   console.log(JSON.stringify(body.manifest, null, 2));
 }
 
+// ── monty public — the shared-functions door ──────────────────────────────
+// Which server functions answer publicly at /__monty/public/<name> on the
+// app origin. Door-owned workspace state (never a save ride): `set` replaces
+// the whole list and takes effect on Live immediately (the host patches the
+// deploy pointer) and in a running session within one heartbeat.
+async function publicCmd() {
+  const { host, key } = loadConfig() ?? {};
+  if (!key) fail("NOT_LOGGED_IN", "Run `monty login` first.");
+  const appDir = findAppRoot(process.cwd());
+  const verb = rest[0];
+  const flagValue = (name) => {
+    const i = rest.indexOf(name);
+    return i >= 0 ? rest[i + 1] : undefined;
+  };
+  const slug = flagValue("--app") ?? (appDir ? readSlug(appDir) : null);
+  if (!slug) {
+    fail("INVALID_SLUG", "Usage: monty public [set <names…>|--none] [--app <slug>] — or run it inside an app folder.");
+  }
+
+  if (verb === "set") {
+    const names = rest.includes("--none")
+      ? []
+      : rest
+          .slice(1)
+          .filter((a) => !a.startsWith("--") && a !== flagValue("--app"))
+          .flatMap((a) => a.split(","))
+          .map((a) => a.trim())
+          .filter(Boolean);
+    if (names.length === 0 && !rest.includes("--none")) {
+      fail("PUBLIC_USAGE", "Usage: monty public set <name> [<name>…] — the COMPLETE new list (it replaces, never merges). `monty public set --none` closes everything.");
+    }
+    const res = await fetch(`${host}/api/public-fns`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+      body: JSON.stringify({ slug, publicFns: names }),
+    });
+    const body = await res.json().catch(() => null);
+    if (!res.ok || !body?.ok) {
+      fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Setting the shared functions failed — is the Monty host reachable?");
+    }
+    if (body.publicFns.length === 0) {
+      console.log(`public: none — "${slug}" answers nothing at /__monty/public`);
+      return;
+    }
+    for (const name of body.publicFns) {
+      const live = body.served?.includes(name);
+      console.log(`public: /__monty/public/${name} — ${live ? "open to the internet NOW; verify signatures in the function" : "declared; opens when a save ships the function"}`);
+    }
+    return;
+  }
+
+  // Default: LIST.
+  const res = await fetch(`${host}/api/public-fns?slug=${slug}`, {
+    headers: { authorization: `Bearer ${key}` },
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.ok) {
+    fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Could not read the shared functions — check the connection and `monty login`.");
+  }
+  if (!body.publicFns?.length) {
+    console.log(`public: none — "${slug}" answers nothing at /__monty/public (share with \`monty public set <name>\`)`);
+    return;
+  }
+  const registered = new Set(body.fns ?? []);
+  for (const name of body.publicFns) {
+    console.log(`public: /__monty/public/${name}${registered.has(name) ? "" : " — not in the deployed bundle (opens when a save ships it)"}`);
+  }
+}
+
 switch (command) {
   case "login":
     await login();
@@ -3733,41 +3654,30 @@ switch (command) {
   case "create":
     await create();
     break;
+  case "connect":
+    await connect();
+    break;
   case "pull":
     await pull();
     break;
-  case "commit":
-    fail("COMMIT_REMOVED", "`monty commit` is gone — `monty save` is the one verb (every save records a history row; `monty log` lists them).");
-    break;
-  case "log":
-  case "versions":
+  case "history":
     await versionsLog();
     break;
+  case "page":
+    await pageCmd();
+    break;
   case "dev":
     await dev();
     break;
   case "logs":
     await logs();
     break;
-  case "add":
-    await add();
-    break;
   case "components":
-  case "search":
-    components();
-    break;
-  case "docs":
-    await docs();
+    await componentsCmd();
     break;
   case "current":
     current();
     break;
-  case "select":
-    select();
-    break;
-  case "apps":
-    apps();
-    break;
   case "skills":
     installSkills({ appDir: findAppRoot(process.cwd()), silent: false, force: true });
     console.log("skills: up to date");
@@ -3781,8 +3691,10 @@ switch (command) {
   case "typecheck":
     typecheckApp();
     break;
+  case "style":
+    await styleCheck();
+    break;
   case "save":
-  case "deploy":
     await deploy();
     break;
   case "data":
@@ -3791,6 +3703,9 @@ switch (command) {
   case "schema":
     await schemaCmd();
     break;
+  case "public":
+    await publicCmd();
+    break;
   case "views":
     await views();
     break;
@@ -3800,29 +3715,43 @@ switch (command) {
   case "secret":
     await secret();
     break;
+  case "help":
+  case "--help":
+  case "-h":
+    printHelp();
+    process.exit(0);
+    break;
   default:
-    console.log("usage: monty <login|create|pull|log|current|select|apps|install|dev|logs|build|typecheck|add|components|docs|save|data|schema|views|support|skills>");
-    console.log("  login       [--host <url>] [--key <mk_...>]  sign in (opens your browser to authorize)");
-    console.log("  create      <slug> [--name N] [--icon I] [--spa]  register a new app (config-only by default; --spa scaffolds the full SPA)");
-    console.log("  pull        <slug> [--version H] [--force]  restore the app's source snapshot (latest, or one from `monty log`)");
-    console.log("  log         [slug]                          the app's source version history (one row per save)");
-    console.log("  dev         [--port N] [--no-tunnel] [--takeover]  run the app's session, or attach to a running one (live data, auto-auth)");
-    console.log("  logs        [-n N] [-f]                     read/follow the dev shell log (vite output, browser errors, save results)");
-    console.log("  add         <name...> | page <name>         install UI components, or scaffold a custom page (`monty add page reports`)");
-    console.log("  components  [query]                        list the curated component catalog");
-    console.log("  docs        <name>                         view a component's source before installing");
-    console.log("  current                                     which app folder am I in?");
-    console.log("  select      <slug>                          print an app's folder — cd \"$(monty select x)\"");
-    console.log("  apps                                        list local apps (~/.monty/apps + legacy ~/Monty)");
-    console.log("  install                                     install app dependencies");
-    console.log("  build                                       production build (vite, via monty)");
-    console.log("  typecheck                                   typecheck (builds first if needed)");
-    console.log("  save        [\"what changed\"]                 push the working copy to the cloud copy, like `git push main` (build + typecheck gate it)");
-    console.log("  deploy                                      alias of save");
-    console.log("  data        <verb> [table] [flags]          read/write an app's records from the terminal (`monty data` for verbs)");
-    console.log("  schema      [slug] | set <file|->            read the app's stored manifest (JSON on stdout) / write it back (validated, CAS)");
-    console.log("  views       <list|set|update|remove> <table> manage shared saved views on a system record page");
-    console.log("  support     <status|enable|disable|submit>   opt in and send agent-authored platform reports to Monty");
-    console.log("  skills                                      install/refresh the agent build skill");
+    printHelp();
     process.exit(command ? 1 : 0);
 }
+
+function printHelp() {
+  console.log("usage: monty <command>  (`monty help` shows this)");
+  console.log("");
+  console.log("start here:");
+  console.log("  login       [--host <url>]                   sign in (opens your browser to authorize)");
+  console.log("  connect     <slug> [dir]                     pull a cloud app into any folder, ready for `monty dev`");
+  console.log("  create      <slug> [--name N] [--spa]        register a brand-new app (config-only by default)");
+  console.log("  dev         [--port N] [--takeover]          run the app's session — live data, the workspace follows it");
+  console.log("  save        [\"what changed\"]                  push the working copy to the cloud copy, like `git push main`");
+  console.log("  logs        [-n N] [-f]                      read/follow the running session's log");
+  console.log("");
+  console.log("toolbelt:");
+  console.log("  current                                      which app folder am I in?");
+  console.log("  history     [slug]                           saved-version history, one row per save (like `git log`)");
+  console.log("  pull        <slug> [--version H] [--force]   restore a source snapshot into the managed home");
+  console.log("  install / build / typecheck / style          app lifecycle + the token-vocabulary lint");
+  console.log("  data        <verb> [table] [flags]           read/write an app's records from the terminal");
+  console.log("  schema      [slug] | set <json|->              read/write the app's config, stored in the workspace (validated, CAS)");
+  console.log("  views       <list|set|update|remove> <table>  manage shared saved views on a record page");
+  console.log("  secret      <set|rm> <KEY>                   per-app server-function secrets (write-only)");
+  console.log("  public      [set <names…>|--none]            which server functions answer publicly at /__monty/public");
+  console.log("  support     <status|enable|disable|submit>    opt in to agent-authored platform reports");
+  console.log("  skills                                       install/refresh the agent build skill");
+  console.log("");
+  console.log("custom pages & components (apps with src/):");
+  console.log("  page        add <name>                       scaffold a custom (bespoke) page");
+  console.log("  components  [query] | search <q>             the curated shadcn catalog — list or search it");
+  console.log("  components  add <name...> | docs <name>      install curated components / read one's source first");
+}