@montytools/cli 0.5.5 → 0.5.6

package/bin/monty.mjs

@@ -15,10 +15,9 @@ import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { CATALOG, REGISTRIES } from "./catalog.mjs";
-import { compileAppConfig } from "../lib/compile.mjs";
-import { manifestHash } from "../lib/schemaCodegen.mjs";
-import { readSchemaState, schemaPull, writeSchemaState } from "../lib/schemaPull.mjs";
+import { readSchemaState, schemaPull, writeGenModule, writeSchemaState } from "../lib/schemaPull.mjs";
 import { mergeViewConfig, normalizeViewFilters, parseHiddenColumns, parseKanbanFlag, parseViewSort, validateViewColumns } from "../lib/views.mjs";
+import { formatViolations, lintStyles } from "../lib/styleLint.mjs";
 
 // MONTY_HOME overrides the state root (default ~/.monty): config.json,
 // apps/, and desktop.json all live under it. This is how a second, isolated
@@ -352,7 +351,7 @@ function findAppRoot(start) {
   }
 }
 
-// The identity stamp: { id, slug, name, icon, registryOwned? } — the app's
+// The identity stamp: { id, slug, name, icon } — the app's
 // durable identity on this machine, independent of the config file.
 function readAppJson(dir) {
   try {
@@ -671,11 +670,7 @@ async function connect() {
     }
     mkdirSync(target, { recursive: true });
     writeConfigOnlyScaffold(target, { appId: app.id, slug, name: app.name, icon: app.icon });
-    try {
-      await schemaPull({ appDir: target, host, key, slug, force: true, compileAppConfig, fail });
-    } catch {
-      console.log("schema: could not sync the app's config yet — `monty schema pull` retries it");
-    }
+    console.log("config: the workspace holds this app's config — read it with `monty schema`");
   }
 
   // The snapshot excludes .monty/ — the workspace row is the authority for
@@ -694,43 +689,63 @@ async function connect() {
 }
 
 // ── monty create ───────────────────────────────────────────────────────────
-// A CONFIG-ONLY app: no SPA at all — monty.config.ts is the whole app and
-// the platform shell renders it. The presence of index.html is the marker
-// (every SPA template ships one; the config-only scaffold never does).
+// A CONFIG-ONLY app: no SPA at all — the workspace config is the whole app
+// and the platform shell renders it. The presence of index.html is the
+// marker (every SPA template ships one; config-only folders never do).
 function isConfigOnlyApp(appDir) {
   return !existsSync(join(appDir, "index.html"));
 }
 
-// Literal read of the config's `publicFns: ["a", "b"]` list — the same
-// light-touch parse the SDK's vite plugin uses.
-function readPublicFnsLiteral(appDir) {
-  try {
-    const src = readFileSync(join(appDir, "monty.config.ts"), "utf8");
-    const block = /publicFns:\s*\[([^\]]*)\]/m.exec(src)?.[1];
-    if (!block) return undefined;
-    const names = [...block.matchAll(/["']([a-zA-Z][a-zA-Z0-9_]*)["']/g)].map((m) => m[1]);
-    return names.length > 0 ? names : undefined;
-  } catch {
-    return undefined;
+// One-time migration off the config-as-code shape: monty.config.ts stops
+// existing in app folders — the workspace owns the config and
+// src/monty.gen.ts is its generated, never-hand-edited mirror. Runs at the
+// front of `monty dev` / `monty save` / `monty schema pull`: generates the
+// mirror, rewrites src imports onto it, and retires the config as a .bak.
+// Demo folders are exempt (the demo rail compiles their config).
+async function migrateConfigToGen(appDir, { host, key, slug }) {
+  const configPath = join(appDir, "monty.config.ts");
+  if (!existsSync(configPath) || existsSync(join(appDir, "demo.json"))) return false;
+  const srcDir = join(appDir, "src");
+  if (existsSync(srcDir)) {
+    if (!key) {
+      console.log("migrate: monty.config.ts is retired, but generating src/monty.gen.ts needs the workspace — run `monty login`, then any monty command migrates this folder.");
+      return false;
+    }
+    const res = await fetch(`${host}/api/schema?slug=${encodeURIComponent(slug)}`, {
+      headers: { authorization: `Bearer ${key}` },
+    }).catch(() => null);
+    const body = await res?.json().catch(() => null);
+    if (!res?.ok || !body?.ok) {
+      console.log("migrate: could not fetch the workspace config — monty.config.ts left in place this run (edits to it never land; `monty schema` is the config).");
+      return false;
+    }
+    writeGenModule(appDir, body.manifest ?? { slug, tables: {} }, { name: body.name, icon: body.icon });
+    if (body.hash) writeSchemaState(appDir, body.hash);
+    rewriteGenImports(srcDir);
   }
+  renameSync(configPath, `${configPath}.bak`);
+  console.log("migrated: monty.config.ts retired (kept as monty.config.ts.bak). The workspace owns the config — read it with `monty schema`, change it with `monty schema set`; src/monty.gen.ts mirrors it automatically.");
+  return true;
 }
 
-// Literal read of the config's `schedule` block ({ fn: "cron expr" }) —
-// the same light-touch parse the SDK's vite plugin uses for publicFns.
-// Registry-owned sessions read it this way so the cron ticker works
-// without a config compile.
-function readScheduleLiteral(appDir) {
-  try {
-    const src = readFileSync(join(appDir, "monty.config.ts"), "utf8");
-    const block = /schedule:\s*{([^}]*)}/m.exec(src)?.[1];
-    if (!block) return undefined;
-    const out = {};
-    for (const m of block.matchAll(/["']?([a-zA-Z][a-zA-Z0-9_]*)["']?\s*:\s*"([^"]+)"/g)) {
-      out[m[1]] = m[2];
-    }
-    return Object.keys(out).length > 0 ? out : undefined;
-  } catch {
-    return undefined;
+// Point every `monty.config` import in src/ at the generated module. The
+// specifier is rewritten relative to each importing file (main.tsx imports
+// "./monty.gen", a route imports "../monty.gen").
+function rewriteGenImports(srcDir) {
+  const files = walk(srcDir).filter((f) => /\.(ts|tsx)$/.test(f));
+  for (const file of files) {
+    const src = readFileSync(file, "utf8");
+    if (!src.includes("monty.config")) continue;
+    let rel = relative(dirname(file), join(srcDir, "monty.gen")).replace(/\\/g, "/");
+    if (!rel.startsWith(".")) rel = `./${rel}`;
+    const out = src.replace(
+      /(["'])(?:\.\.?\/)+monty\.config(?:\.ts)?\1/g,
+      (_m, q) => `${q}${rel}${q}`,
+    );
+    if (out !== src) {
+      writeFileSync(file, out);
+      console.log(`migrate: ${relative(dirname(srcDir), file)} now imports the generated module`);
+    }
   }
 }
 
@@ -752,14 +767,15 @@ function discoverPages(appDir) {
 
 const CONFIG_ONLY_AGENTS_MD = `# This is a CONFIG-ONLY Monty app
 
-The app is rendered by the Monty platform from its config stored in the workspace —
-tables (zod), derived fields (\`rollup\`/\`lookup\`/\`formula\`), \`metrics\`,
-\`settings\`, and \`pages\`. There is no src/, no React, no build.
+The app is rendered by the Monty platform from its config stored in the
+workspace — tables (zod-shaped), derived fields (\`rollup\`/\`lookup\`/
+\`formula\`), \`metrics\`, \`settings\`, and \`pages\`. There is no src/, no
+React, no build — and no config file here: the workspace copy is the only
+one.
 
-- The schema lives in the workspace, and its door is the schema API:
-  read it with \`monty schema\`, change it with \`monty schema set '<json>'\` (or pipe: \`monty schema set -\`)
-  (validated, CAS-guarded, live within seconds). monty.config.ts edits do
-  NOT change a workspace-owned app's schema.
+- The config's door is the schema API: read it with \`monty schema\`,
+  change it with \`monty schema set '<json>'\` (or pipe:
+  \`monty schema set -\`) — validated, CAS-guarded, live within seconds.
 - Formulas are strings in the Monty expression grammar, e.g.
   \`formula(montyMoney(), "monthlySales * commissionRate")\` — fields declared
   ABOVE the formula and \`metrics.<name>\` are in scope.
@@ -770,41 +786,18 @@ tables (zod), derived fields (\`rollup\`/\`lookup\`/\`formula\`), \`metrics\`,
   with \`RecordPage\` from \`@montytools/sdk/react\` and add typed actions
   with the record controls from \`@montytools/sdk/ui\`.
 - Need a bespoke page later? \`monty page add\` declares it and upgrades this
-  app with a SPA scaffold; \`monty save\` ships the code.
+  app with a SPA scaffold (typed against the generated src/monty.gen.ts
+  mirror); \`monty save\` ships the code.
 `;
 
+// A config-only folder is identity + instructions, nothing more: the
+// workspace holds the app, so there is no config file, no package.json, no
+// tsconfig — nothing that even looks editable.
 function writeConfigOnlyScaffold(target, { appId, slug, name, icon }) {
   mkdirSync(target, { recursive: true });
-  writeFileSync(join(target, "monty.config.ts"), `import { defineApp } from "@montytools/sdk";
-
-// This file IS the app: tables, derived fields, metrics, settings, pages.
-// The Monty platform renders it — no src/, no build. Declare tables as zod
-// objects; derive with rollup()/lookup()/formula(); see AGENTS.md.
-export const app = defineApp({
-  id: "${appId}",
-  slug: "${slug}",
-  name: "${name}",
-  icon: "${icon}",
-  tables: {},
-});
-
-export type App = typeof app;
-`);
-  writeFileSync(join(target, "package.json"), JSON.stringify({
-    name: slug,
-    private: true,
-    type: "module",
-    dependencies: { "@montytools/sdk": "latest", zod: "^4.4.3" },
-  }, null, 2) + "\n");
-  writeFileSync(join(target, "tsconfig.json"), JSON.stringify({
-    compilerOptions: {
-      target: "ES2022", module: "ESNext", moduleResolution: "bundler",
-      strict: true, skipLibCheck: true, noEmit: true,
-    },
-    include: ["monty.config.ts"],
-  }, null, 2) + "\n");
   writeFileSync(join(target, ".gitignore"), "node_modules/\n.monty/\n");
   writeFileSync(join(target, "AGENTS.md"), CONFIG_ONLY_AGENTS_MD);
+  writeAppJson(target, { id: appId, slug, name, icon });
 }
 
 async function create() {
@@ -861,11 +854,8 @@ async function create() {
   // bespoke page is needed. \`--spa\` keeps the old full-SPA scaffold
   // (\`--config-only\` stays accepted as the now-default no-op).
   if (!rest.includes("--spa")) {
-    console.log(`create: ${slug} -> ${target} (config-only)`);
+    console.log(`create: ${slug} -> ${target} (config-only — the workspace holds the config)`);
     writeConfigOnlyScaffold(target, { appId, slug, name, icon });
-    // The identity stamp is the app-root marker and identity source from
-    // here on — the config file is just code.
-    writeAppJson(target, { id: appId, slug, name, icon });
     // The user's brief lands at the top of AGENTS.md, same as SPA creates.
     const brief = flag("description");
     if (brief?.trim()) {
@@ -897,7 +887,7 @@ async function create() {
     }
     installSkills({ appDir: target });
     console.log(`created: ${target}`);
-    console.log(`next: cd ${target} && monty install && monty dev`);
+    console.log(`next: cd ${target} && monty dev — then \`monty schema set\` declares the tables`);
     return;
   }
 
@@ -907,7 +897,7 @@ async function create() {
   const templateDir = [
     join(pkgRoot, "template"),
     join(pkgRoot, "..", "template"),
-  ].find((d) => existsSync(join(d, "monty.config.ts")));
+  ].find((d) => existsSync(join(d, "src", "main.tsx")));
   if (!templateDir) {
     fail("TEMPLATE_MISSING", "The Monty app template is missing from this CLI install. Reinstall the monty CLI.");
   }
@@ -934,16 +924,10 @@ async function create() {
     writeFileSync(gitignorePath, "node_modules/\ndist/\n.monty/\n.env.local\n.env\n");
   }
 
-  // Stamp identity into the copied files. The id line is INSERTED (the
-  // template ships without one — only real creates have a server id).
-  const configPath = join(target, "monty.config.ts");
-  writeFileSync(
-    configPath,
-    readFileSync(configPath, "utf8")
-      .replace(/^([ \t]*)slug: "[^"]*"/m, `$1id: "${appId}",\n$1slug: "${slug}"`)
-      .replace(/name: "[^"]*"/, `name: "${name}"`)
-      .replace(/icon: "[^"]*"/, `icon: "${icon}"`),
-  );
+  // Identity into the copied files. The registry landed the empty config at
+  // registration; the generated mirror derives from it — the template's
+  // placeholder src/monty.gen.ts is replaced wholesale.
+  writeGenModule(target, { slug, tables: {} }, { name, icon });
   const pkgPath = join(target, "package.json");
   const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
   pkg.name = slug;
@@ -1034,6 +1018,18 @@ function buildApp() {
     "The production build failed. Read the vite error above; it names the file to fix.");
 }
 
+// `monty style` — the token-vocabulary lint, standalone. The same check
+// runs advisory at `monty dev` and blocking inside `monty save`.
+async function styleCheck() {
+  const appDir = requireAppDir("style");
+  const violations = await lintStyles(appDir);
+  if (violations.length === 0) {
+    console.log("style: clean — every class is on the token vocabulary");
+    return;
+  }
+  fail("STYLE_OFF_TOKENS", `${violations.length} off-token style${violations.length === 1 ? "" : "s"}:\n${await formatViolations(violations)}\nFix with the monty-design skill's vocabulary; a deliberate exception takes \`// monty-style-ignore\` on its line.`);
+}
+
 function typecheckApp() {
   const appDir = requireAppDir("typecheck");
   // routeTree.gen.ts is generated by the build — without it tsc fails on a
@@ -1074,7 +1070,7 @@ async function freePort(start) {
 // Apps pin @montytools/sdk at scaffold time and go stale — the CLI knows the
 // minimum SDK its workflows need (e.g. tunnel-host allowlisting lives in the
 // SDK's vite plugin) and upgrades the app automatically before dev/deploy.
-const MIN_SDK = "0.2.5";
+const MIN_SDK = "0.2.6";
 const SDK_VITE_CACHE_STAMP = "sdk-vite-cache-version";
 
 function installedSdkVersion(appDir) {
@@ -1534,20 +1530,29 @@ async function dev() {
 
   installSkills({ appDir });
   ensureSdk(appDir);
+  // Style advisory (non-blocking here; `monty save` enforces): put off-token
+  // styling in the terminal the agent is watching, before the session opens.
+  try {
+    const styleViolations = await lintStyles(appDir);
+    if (styleViolations.length > 0) {
+      console.log(`style: ${styleViolations.length} off-token style${styleViolations.length === 1 ? "" : "s"} — \`monty style\` lists them; \`monty save\` refuses them`);
+    }
+  } catch {}
   // Identity comes from the .monty/app.json stamp (written by create and
   // connect) — the platform reads NOTHING from the config file, which is
-  // just code the bundle imports. `schedule` (a code-door declaration the
-  // session cron ticker needs) is read literally, the same way the vite
-  // plugin reads `publicFns`.
+  // just code the bundle imports. Clock work is an `every` rule now — the
+  // platform's minute tick dispatches to this session's runtime over the
+  // tunnel like any rule; the session runs no clock of its own.
   const stamp = readAppJson(appDir);
   if (typeof stamp?.slug !== "string" || !stamp.slug) {
     fail("NOT_CONNECTED", "This folder carries no app identity (.monty/app.json). Run `monty connect <slug>` here to join an existing app, or `monty create <slug>` for a new one.");
   }
-  const meta = { slug: stamp.slug, name: stamp.name, icon: stamp.icon, schedule: readScheduleLiteral(appDir) };
+  const meta = { slug: stamp.slug, name: stamp.name, icon: stamp.icon };
   const cfg = loadConfig();
   const host = cfg?.host ?? DEFAULT_HOST;
-  // CONFIG-ONLY apps run no vite and no tunnel: `monty dev` is watch +
-  // compile + push — the platform shell renders the app.
+  await migrateConfigToGen(appDir, { host, key: cfg?.key, slug: meta.slug });
+  // CONFIG-ONLY apps run no vite and no tunnel: `monty dev` is heartbeats
+  // only — the platform shell renders the app from the workspace config.
   const configOnly = isConfigOnlyApp(appDir);
   // Auto-pick a free port (agents run several apps side by side); an
   // explicit --port is honored strictly.
@@ -1566,13 +1571,12 @@ async function dev() {
       stdio: ["ignore", "pipe", "pipe"],
     });
   } else {
-    console.log(`dev: config-only app "${meta.slug}" — no vite; watching monty.config.ts`);
+    console.log(`dev: config-only app "${meta.slug}" — no vite; the workspace owns the config (read it with \`monty schema\`)`);
   }
 
   let tunnelChild = null;
   let hbTimer = null;
   let touchTimer = null;
-  let cronTimer = null;
   let ended = false;
   let registeredOnce = false;
   // The schema-lives-in-the-workspace notice prints once per session.
@@ -1584,7 +1588,6 @@ async function dev() {
   // Once per registry change: the manifest hash we last tried to sync the
   // local config copy to (successful or refused — never loop on dirty).
   let syncAttemptedHash = null;
-  const configPath = join(appDir, "monty.config.ts");
 
   // Advertise this session. The touch timer (not the platform heartbeat,
   // which starts minutes late or never when logged out) keeps updatedAt
@@ -1617,40 +1620,6 @@ async function dev() {
   });
   touchTimer = setInterval(() => sf.write({}), DEV_JSON_TOUCH_MS);
 
-  // The session cron runner: the Live counterpart is a real Cloudflare Cron
-  // Trigger on the app's fn-worker; here the CLI matches monty.config.ts
-  // `schedule` entries against the UTC clock once per minute and invokes the
-  // fn through the same /__monty/fn runtime (x-monty-schedule marks the
-  // lane, so ctx.viewer matches Live exactly). Fire-and-forget: a failing
-  // cron fn prints its instruction here and never blocks the loop.
-  let lastCronMinute = null;
-  function cronTick() {
-    const sched = meta?.schedule;
-    if (!sched || !loggedIn) return;
-    const now = new Date();
-    const minute = Math.floor(now.getTime() / 60_000);
-    if (minute === lastCronMinute) return;
-    lastCronMinute = minute;
-    for (const [fn, expr] of Object.entries(sched)) {
-      if (!cronMatches(expr, now)) continue;
-      console.log(`cron: "${expr}" → ${fn}() (UTC)`);
-      const t0 = Date.now();
-      fetch(`http://localhost:${port}/__monty/fn/${fn}`, {
-        method: "POST",
-        headers: { "content-type": "application/json", "x-monty-schedule": expr },
-        body: "{}",
-      }).then(async (r) => {
-        if (r.ok) {
-          console.log(`cron: ${fn} ok (${Date.now() - t0}ms)`);
-        } else {
-          const e = await r.json().catch(() => null);
-          console.log(`cron: ${fn} failed [${e?.code ?? r.status}] ${e?.fix ?? ""}`);
-        }
-      }).catch((e) => console.log(`cron: ${fn} unreachable — ${e?.message ?? e}`));
-    }
-  }
-  cronTimer = setInterval(cronTick, 20_000);
-
   async function clearDevSession(timeoutMs = 2000) {
     if (cfg?.key) {
       try {
@@ -1669,7 +1638,6 @@ async function dev() {
     ended = true;
     if (hbTimer) clearInterval(hbTimer);
     if (touchTimer) clearInterval(touchTimer);
-    if (cronTimer) clearInterval(cronTimer);
     try { tunnelChild?.kill(); } catch { /* already gone */ }
     // vite is a direct child (no npx wrapper), so this actually kills it —
     // a bare SIGTERM from the desktop must never orphan vite on the port.
@@ -1684,7 +1652,6 @@ async function dev() {
     ended = true;
     if (hbTimer) clearInterval(hbTimer);
     if (touchTimer) clearInterval(touchTimer);
-    if (cronTimer) clearInterval(cronTimer);
     try { tunnelChild?.kill(); } catch { /* already gone */ }
     try { child?.kill(); } catch { /* already gone */ }
     console.log(`dev-session: superseded — ${fix}`);
@@ -1735,53 +1702,48 @@ async function dev() {
         }
         return false;
       }
+      // publicFns rides every beat: dev.json mirrors the door-owned
+      // allowlist so the vite runtime's /__monty/public gate follows a
+      // `monty public set` / MCP change within one heartbeat.
+      const beatExtras = Array.isArray(data?.publicFns) ? { publicFns: data.publicFns } : {};
       if (!registeredOnce) {
         registeredOnce = true;
-        sf.write({ state: "online", loggedIn: true, lastHeartbeatAt: Date.now() });
+        sf.write({ state: "online", loggedIn: true, lastHeartbeatAt: Date.now(), ...beatExtras });
       } else {
-        sf.write({ loggedIn: true, lastHeartbeatAt: Date.now() });
+        sf.write({ loggedIn: true, lastHeartbeatAt: Date.now(), ...beatExtras });
       }
       if (!configIgnoredAnnounced) {
         configIgnoredAnnounced = true;
-        console.log("schema: this app's data schema lives in the workspace — monty.config.ts edits do NOT change it. Read it: `monty schema`; change it: `monty schema set '<json>'` (or pipe: `monty schema set -`).");
+        console.log("schema: this app's config lives in the workspace. Read it: `monty schema`; change it: `monty schema set '<json>'` (or pipe: `monty schema set -`). src/monty.gen.ts mirrors it automatically — never edit that file.");
       }
-      // The local config copy follows the registry: when the stored manifest
-      // moved (another editor, the schema door) and the local file is clean,
-      // regenerate it in place — the sync of the mechanical copy is
-      // automatic. Dirty or uncompilable files are left alone with the fix.
+      // src/monty.gen.ts follows the registry: when the stored manifest
+      // moved (another editor, the schema door), regenerate it in place —
+      // the file is generated, never hand-edited, so the overwrite is
+      // unconditional. Demo folders are exempt (the demo rail compiles
+      // their monty.config.ts).
       if (
         typeof data?.manifestHash === "string" &&
-        existsSync(configPath) &&
         data.manifestHash !== readSchemaState(appDir)?.hash &&
-        data.manifestHash !== syncAttemptedHash
+        data.manifestHash !== syncAttemptedHash &&
+        !existsSync(join(appDir, "demo.json"))
       ) {
         syncAttemptedHash = data.manifestHash;
         try {
-          // Already in sync (fresh checkout, no state file yet)? Stamp the
-          // base and leave the file alone — regenerate only on real drift.
-          let alreadySynced = false;
-          try {
-            const compiled = await compileAppConfig(appDir);
-            if (compiled.manifest && manifestHash(compiled.manifest) === data.manifestHash) {
-              writeSchemaState(appDir, data.manifestHash);
-              alreadySynced = true;
-            }
-          } catch { /* uncompilable — let schemaPull's dirty check narrate */ }
-          if (!alreadySynced) {
-            await schemaPull({
-              appDir,
-              host,
-              key: loadConfig()?.key ?? cfg.key,
-              slug: meta.slug,
-              force: false,
-              compileAppConfig,
-              fail: (code, fix) => {
-                throw new Error(`${code} — ${fix}`);
-              },
-            });
+          const r = await schemaPull({
+            appDir,
+            host,
+            key: loadConfig()?.key ?? cfg.key,
+            slug: meta.slug,
+            quiet: true,
+            fail: (code, fix) => {
+              throw new Error(`${code} — ${fix}`);
+            },
+          });
+          if (r.wrote) {
+            console.log(`schema: src/monty.gen.ts regenerated from the workspace (${data.manifestHash.slice(0, 12)})`);
           }
         } catch (e) {
-          console.log(`schema: the workspace manifest changed but the local copy was NOT regenerated (${String(e?.message ?? e).slice(0, 240)})`);
+          console.log(`schema: the workspace config changed but src/monty.gen.ts was NOT regenerated (${String(e?.message ?? e).slice(0, 240)}) — \`monty schema pull\` retries it`);
         }
       }
       return true;
@@ -2148,26 +2110,28 @@ function resolveComponent(name) {
 // ── monty page add <name> ──────────────────────────────────────────────────
 // Upgrades an app with a bespoke (custom) page: scaffolds the SPA on first
 // use (config-only apps gain src/ + vite from the template — their
-// monty.config.ts and AGENTS.md stay untouched), declares
+// AGENTS.md stays untouched), declares
 // `pages.<name> = { kind: "custom", path: "/<name>" }`, and writes the page
 // route. DECLARE-FIRST: on a workspace-owned app the entry lands through
 // the schema door BEFORE the code exists — a save carrying an undeclared
 // route refuses (DEPLOY_UNDECLARED_PAGE). The Shopify model: system pages
 // stay shell-rendered; only this page is the app's own code.
 
-// Declare the page through the schema door. Returns "declared" | "already"
-// (workspace-owned app) or "config" (manifest-less: the config file is
-// still that app's editor, the caller registers the entry there).
+// Declare the page through the schema door (declare-first is mandatory: a
+// save carrying an undeclared route refuses). Returns "declared" | "already".
 async function declarePageThroughDoor(appDir, pageName) {
   const slug = readSlug(appDir);
   const { host, key } = loadConfig();
-  if (!slug || !key) return "config";
+  if (!slug) fail("NOT_CONNECTED", "This folder carries no app identity (.monty/app.json). Run `monty connect <slug>` first.");
+  if (!key) fail("NOT_LOGGED_IN", "Declaring a page lands in the workspace config. Run `monty login` first.");
   const read = await fetch(`${host}/api/schema?slug=${slug}`, {
     headers: { authorization: `Bearer ${key}` },
   }).catch(() => null);
   const readBody = await read?.json().catch(() => null);
-  if (!read?.ok || !readBody?.ok || readBody.manifest === null) return "config";
-  const manifest = readBody.manifest;
+  if (!read?.ok || !readBody?.ok) {
+    fail(readBody?.code ?? "HOST_UNREACHABLE", readBody?.fix ?? `Could not read the workspace config from ${host} — check the connection and retry.`);
+  }
+  const manifest = readBody.manifest ?? { slug, tables: {} };
   const keyOf = (n) => n.toLowerCase().replace(/[^a-z0-9]/g, "");
   const declared = Object.keys(manifest.pages ?? {}).find((n) => keyOf(n) === keyOf(pageName));
   if (declared) {
@@ -2193,7 +2157,12 @@ async function declarePageThroughDoor(appDir, pageName) {
   if (!res.ok || !body?.ok) {
     fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Declaring the page through the schema door failed — check the connection and retry.");
   }
-  try { writeSchemaState(appDir, body.hash); } catch { /* state is advisory */ }
+  // Stamp + regenerate together (the stamp claims the mirror matches).
+  try {
+    const stamp = readAppJson(appDir);
+    writeGenModule(appDir, { ...manifest, pages }, { name: stamp?.name, icon: stamp?.icon });
+    writeSchemaState(appDir, body.hash);
+  } catch { /* state is advisory */ }
   return "declared";
 }
 
@@ -2201,28 +2170,22 @@ async function addPage(appDir, pageName) {
   if (!pageName || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(pageName) || pageName.length > 32) {
     fail("INVALID_PAGE", 'Usage: monty page add <name> — lowercase letters/digits with single hyphens, max 32 chars (e.g. "reports").');
   }
-  const configPath = join(appDir, "monty.config.ts");
-  if (!existsSync(configPath)) {
-    fail("NO_CONFIG", `No monty.config.ts in ${appDir} — run this inside a Monty app.`);
+  const stamp = readAppJson(appDir);
+  if (typeof stamp?.slug !== "string" || !stamp.slug) {
+    fail("NOT_CONNECTED", `No app identity in ${appDir} (.monty/app.json) — run this inside a Monty app.`);
   }
-  const config = readFileSync(configPath, "utf8");
-  const appName = config.match(/name: "([^"]*)"/)?.[1] ?? pageName;
+  const appName = stamp.name ?? pageName;
   const routeFile = join(appDir, "src", "routes", `${pageName}.tsx`);
   if (existsSync(routeFile)) {
     fail("PAGE_EXISTS", `src/routes/${pageName}.tsx already exists. Edit it, or pick a different page name.`);
   }
-  if (config.includes(`"/${pageName}"`) || new RegExp(`^\\s*${pageName}:`, "m").test(config)) {
-    console.log(`note: "${pageName}" may already be declared in monty.config.ts — check its pages block after this.`);
-  }
   // Declare BEFORE any code exists: if the door refuses, nothing to clean up.
   const declared = await declarePageThroughDoor(appDir, pageName);
-  if (declared !== "config") {
-    console.log(
-      declared === "declared"
-        ? `declared: pages.${pageName} through the schema door — live in the workspace now`
-        : `declared: pages.${pageName} already in the workspace manifest`,
-    );
-  }
+  console.log(
+    declared === "declared"
+      ? `declared: pages.${pageName} through the schema door — live in the workspace now`
+      : `declared: pages.${pageName} already in the workspace manifest`,
+  );
 
   // First custom page on a config-only app: bring in the SPA scaffold.
   if (isConfigOnlyApp(appDir)) {
@@ -2230,7 +2193,7 @@ async function addPage(appDir, pageName) {
     const templateDir = [
       join(pkgRoot, "template"),
       join(pkgRoot, "..", "template"),
-    ].find((d) => existsSync(join(d, "monty.config.ts")));
+    ].find((d) => existsSync(join(d, "src", "main.tsx")));
     if (!templateDir) {
       fail("TEMPLATE_MISSING", "The Monty app template is missing from this CLI install. Reinstall the monty CLI.");
     }
@@ -2242,7 +2205,7 @@ async function addPage(appDir, pageName) {
         const base = basename(src);
         if (["node_modules", "dist", ".monty", ".env.local", "routeTree.gen.ts"].includes(base)) return false;
         // The app keeps its own identity files.
-        if (["monty.config.ts", "AGENTS.md", "CLAUDE.md"].includes(base)) return false;
+        if (["AGENTS.md", "CLAUDE.md"].includes(base)) return false;
         return true;
       },
     });
@@ -2284,6 +2247,16 @@ async function addPage(appDir, pageName) {
     // the only route beside __root.
     const starter = join(appDir, "src", "routes", "index.tsx");
     if (existsSync(starter)) rmSync(starter);
+    // The template's placeholder src/monty.gen.ts carries no real schema —
+    // regenerate the mirror from the workspace so the new page types
+    // against the actual tables.
+    try {
+      const { host, key } = loadConfig();
+      await schemaPull({ appDir, host, key, slug: readSlug(appDir), quiet: true, fail: (c, f) => { throw new Error(`${c} — ${f}`); } });
+      console.log("schema: src/monty.gen.ts generated from the workspace config");
+    } catch (e) {
+      console.log(`schema: could not generate src/monty.gen.ts (${String(e?.message ?? e).slice(0, 160)}) — \`monty schema pull\` retries it`);
+    }
     appendFileSync(
       join(appDir, "AGENTS.md"),
       `\n---\n\n## Custom pages\n\nThis app now has a SPA half (src/) serving CUSTOM pages inside the\nplatform shell. Each page = a route in src/routes/ + a\n\`pages.<name>: { kind: "custom", path: "/<name>" }\` declaration.\nDECLARE-FIRST: \`monty page add <name>\` declares the entry (through the\nschema door on workspace-owned apps) before writing the route — a save\ncarrying an undeclared route refuses. System pages (table views) stay\nshell-rendered — only build bespoke UI here. \`monty dev\` serves both.\nAfter every meaningful change verified in dev, run\n\`monty save "<what changed>"\` — it pushes the work to the cloud copy,\nlike \`git push main\`.\n\nEvery custom page opens with \`PageHeader\` from \`@montytools/sdk/ui\` —\nthe same bar the shell renders on system pages (page actions go in it as\n\`PageHeaderButton\`s, \`primary\` for the one main action). Also there:\n\`FloatingBar\`/\`FloatingBarButton\` and the Lyra table classes\n\`SURFACE\`/\`THEAD\`/\`TH\`/\`ROW\`/\`CHIP\`.\n`,
@@ -2335,30 +2308,6 @@ function ${pageComponentName(pageName)}() {
 }
 `);
   console.log(`page: src/routes/${pageName}.tsx`);
-
-  // Manifest-less apps only: the config file is still their editor, so the
-  // entry registers there (workspace-owned apps declared through the door
-  // above — a config edit would be inert).
-  if (declared === "config") {
-    const entry = `    ${JSON.stringify(pageName).includes("-") ? JSON.stringify(pageName) : pageName}: { kind: "custom", path: "/${pageName}" },`;
-    let next = null;
-    if (/^(\s*)pages:\s*{/m.test(config)) {
-      next = config.replace(/^(\s*)pages:\s*{/m, (m) => `${m}\n${entry}`);
-    } else {
-      // No pages block: add one right before the config's closing `});`.
-      const close = config.lastIndexOf("});");
-      if (close !== -1) {
-        next = config.slice(0, close) + `  pages: {\n${entry}\n  },\n` + config.slice(close);
-      }
-    }
-    if (next) {
-      writeFileSync(configPath, next);
-      console.log(`config: pages.${pageName} registered in monty.config.ts`);
-    } else {
-      console.log(`config: could not auto-edit monty.config.ts — add this to defineApp yourself:\n  pages: { ${pageName}: { kind: "custom", path: "/${pageName}" } }`);
-    }
-  }
-
   console.log(`added: custom page "${pageName}"`);
   console.log(`next: monty install && monty dev — the shell mounts /${pageName} live; \`monty save\` pushes it to the cloud copy.`);
 }
@@ -2536,9 +2485,9 @@ async function deploy() {
     fail("NOT_LOGGED_IN", "Run `monty login` first (create a key at /cli-auth in the Monty host).");
   }
 
-  // 1) Identity from the stamp; code-door declarations (publicFns,
-  //    schedule) are read literally from the config file, the same way the
-  //    vite plugin reads them.
+  // 1) Identity from the stamp. Neither the /__monty/public allowlist nor
+  //    clock work rides a save: sharing is door-owned (`monty public set`)
+  //    and cron is an `every` rule (the rules door).
   const stamp = readAppJson(appDir);
   if (typeof stamp?.slug !== "string" || !stamp.slug) {
     fail("NOT_CONNECTED", "This folder carries no app identity (.monty/app.json). Run `monty connect <slug>` here to join an existing app, or `monty create <slug>` for a new one.");
@@ -2547,12 +2496,11 @@ async function deploy() {
     slug: stamp.slug,
     name: stamp.name ?? stamp.slug,
     icon: stamp.icon,
-    publicFns: readPublicFnsLiteral(appDir),
-    schedule: readScheduleLiteral(appDir),
   };
   // `monty save "what changed"` — the message rides the meta for the
   // platform to render as this save's Activity row.
   if (message) meta.message = message;
+  await migrateConfigToGen(appDir, { host: config.host, key: config.key, slug: meta.slug });
 
   // CONFIG-ONLY apps have no bundle — the platform shell renders them; the
   // save carries the source snapshot only.
@@ -2560,8 +2508,23 @@ async function deploy() {
   if (configOnly) {
     meta.configOnly = true;
   } else {
-    // 2) Fail fast locally before any upload. Build FIRST — it also generates
-    //    src/routeTree.gen.ts, without which tsc fails on a fresh checkout.
+    // Refresh the generated mirror before the build/typecheck: code written
+    // against a schema another surface just changed must see it.
+    if (!existsSync(join(appDir, "demo.json"))) {
+      try {
+        await schemaPull({ appDir, host: config.host, key: config.key, slug: meta.slug, quiet: true, fail: (c, f) => { throw new Error(`${c} — ${f}`); } });
+      } catch (e) {
+        console.log(`schema: could not refresh src/monty.gen.ts (${String(e?.message ?? e).slice(0, 160)}) — building with the local copy`);
+      }
+    }
+    // 2) Fail fast locally before any upload. Style lint first (cheapest,
+    //    same contract as the typecheck: off-token styling never ships) —
+    //    then build (it also generates src/routeTree.gen.ts, without which
+    //    tsc fails on a fresh checkout), then typecheck.
+    const styleViolations = await lintStyles(appDir);
+    if (styleViolations.length > 0) {
+      fail("STYLE_OFF_TOKENS", `Off-token styling below — the platform look is tokens-only, and \`monty save\` never uploads styling off the vocabulary.\n${await formatViolations(styleViolations)}\nThe vocabulary is the monty-design skill; \`monty style\` re-checks. A deliberate exception takes \`// monty-style-ignore\` on its line.`);
+    }
     run(appDir, "build", ["npx", "vite", "build"],
       "The production build failed. Read the vite error above; it names the file to fix.");
     run(appDir, "typecheck", ["npx", "tsc", "--noEmit"],
@@ -2579,26 +2542,8 @@ async function deploy() {
   // 3a) Server functions (optional): bundle server/index.ts into one worker
   //     script and ride the SAME deploy. The manifest (fns) goes in meta so
   //     the router gates /__monty/fn/* without a lookup.
-  const serverBundle = await bundleServerFns(appDir, meta.schedule);
-  const publicFns = Array.isArray(meta.publicFns) ? meta.publicFns : [];
-  const scheduleEntries = Object.entries(meta.schedule ?? {});
-  if (!serverBundle && (publicFns.length > 0 || scheduleEntries.length > 0)) {
-    fail("SERVER_DIR_MISSING",
-      "monty.config.ts declares publicFns/schedule, but this app has no server/index.ts. Create it with the named exports, or remove the declarations.");
-  }
+  const serverBundle = await bundleServerFns(appDir);
   if (serverBundle) {
-    for (const name of publicFns) {
-      if (!serverBundle.fns.includes(name)) {
-        fail("PUBLIC_FN_UNKNOWN",
-          `publicFns names "${name}" but server/index.ts exports no such function. Export it (e.g. \`export async function ${name}(req, ctx) {…}\`) or remove it from monty.config.ts.`);
-      }
-    }
-    for (const [name] of scheduleEntries) {
-      if (!serverBundle.fns.includes(name)) {
-        fail("SCHEDULE_UNKNOWN_FN",
-          `schedule targets "${name}" but server/index.ts exports no such function. Export it (e.g. \`export async function ${name}(args, ctx) {…}\`) or remove the entry from monty.config.ts.`);
-      }
-    }
     if (serverBundle.fns.length > 0) meta.fns = serverBundle.fns;
     if (serverBundle.datasets.length > 0) meta.datasets = serverBundle.datasets;
     form.set("server-worker", new Blob([serverBundle.code]), "server-worker.mjs");
@@ -2606,12 +2551,6 @@ async function deploy() {
     if (serverBundle.fns.length > 0) bundled.push(`${serverBundle.fns.length} function(s) (${serverBundle.fns.join(", ")})`);
     if (serverBundle.datasets.length > 0) bundled.push(`${serverBundle.datasets.length} dataset(s) (${serverBundle.datasets.join(", ")})`);
     console.log(`fns: bundled ${bundled.join(" + ")}`);
-    if (publicFns.length > 0) {
-      console.log(`public: ${publicFns.map((f) => `/__monty/public/${f}`).join(", ")} — open to the internet; verify signatures in the function`);
-    }
-    if (scheduleEntries.length > 0) {
-      console.log(`schedule: ${scheduleEntries.map(([f, c]) => `${f} @ "${c}"`).join(", ")} (UTC; Live cron changes can take ~15 min to propagate)`);
-    }
   }
   // 3a½) Custom pages, by route-file convention (top-level src/routes/
   // files) — registered as fnsJson.pages so the shell's nav knows what this
@@ -2684,7 +2623,7 @@ async function deploy() {
 // fn-worker's makeFnWorker; esbuild bundles it for workerd. node: imports are
 // rejected at compile time — Live runs on Cloudflare Workers, not Node.
 // Returns { code, fns, datasets } (per-folder export names) or null.
-async function bundleServerFns(appDir, schedule) {
+async function bundleServerFns(appDir) {
   const serverEntry = join(appDir, "server", "index.ts");
   const datasetsEntry = join(appDir, "datasets", "index.ts");
   const hasServer = existsSync(serverEntry);
@@ -2695,14 +2634,11 @@ async function bundleServerFns(appDir, schedule) {
   mkdirSync(tmpDir, { recursive: true });
   const entry = join(tmpDir, "fn-worker-entry.mjs");
   const out = join(tmpDir, "fn-worker-out.mjs");
-  // The schedule map is baked into the bundle: Cloudflare's scheduled()
-  // hands back only the matching cron expression, so the worker needs the
-  // expression→fn mapping at runtime.
   writeFileSync(entry, [
     hasServer ? `import * as appFns from "../server/index";` : `const appFns = {};`,
     hasDatasets ? `import * as appDatasets from "../datasets/index";` : `const appDatasets = {};`,
     `import { makeFnWorker } from "@montytools/sdk/fn-worker";`,
-    `export default makeFnWorker({ ...appFns, ...appDatasets }, { schedule: ${JSON.stringify(schedule ?? {})} });`,
+    `export default makeFnWorker({ ...appFns, ...appDatasets });`,
   ].join("\n"));
   // Fail the deploy if server code reaches for Node built-ins — a Worker
   // can't run them, and a silent runtime crash on Live is the worst outcome.
@@ -2792,58 +2728,6 @@ function walk(dir) {
 // UTC, 5 fields, standard syntax: *  a,b  a-b  */n  a-b/n  plus month/day
 // names (JAN, MON). Deliberately forgiving: an unparsable field simply never
 // matches locally — Cloudflare is the syntax authority at deploy, so a bad
-// expression fails there with its own message.
-const CRON_MONTHS = { jan: 1, feb: 2, mar: 3, apr: 4, may: 5, jun: 6, jul: 7, aug: 8, sep: 9, oct: 10, nov: 11, dec: 12 };
-const CRON_DAYS = { sun: 0, mon: 1, tue: 2, wed: 3, thu: 4, fri: 5, sat: 6 };
-
-function cronMatches(expr, date) {
-  const fields = String(expr).trim().split(/\s+/);
-  if (fields.length !== 5) return false;
-  const values = [
-    date.getUTCMinutes(),
-    date.getUTCHours(),
-    date.getUTCDate(),
-    date.getUTCMonth() + 1,
-    date.getUTCDay(),
-  ];
-  const bounds = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 7]];
-  return fields.every((field, i) => cronFieldMatches(field, values[i], bounds[i], i));
-}
-
-function cronFieldMatches(field, value, [lo, hi], idx) {
-  const names = idx === 3 ? CRON_MONTHS : idx === 4 ? CRON_DAYS : null;
-  const num = (t) => {
-    const named = names?.[t.toLowerCase()];
-    if (named !== undefined) return named;
-    const n = Number(t);
-    return Number.isInteger(n) ? n : null;
-  };
-  for (const part of field.split(",")) {
-    const [rangeRaw, stepRaw] = part.split("/");
-    const step = stepRaw === undefined ? 1 : Number(stepRaw);
-    if (!Number.isInteger(step) || step < 1) continue;
-    let from;
-    let to;
-    if (rangeRaw === "*" || rangeRaw === "") {
-      from = lo;
-      to = hi;
-    } else if (rangeRaw.includes("-")) {
-      const [a, b] = rangeRaw.split("-");
-      from = num(a);
-      to = num(b);
-    } else {
-      from = num(rangeRaw);
-      to = stepRaw === undefined ? from : hi; // "5/10": from 5 to max, step 10
-    }
-    if (from === null || to === null || from > to) continue;
-    for (let v = from; v <= to; v += step) {
-      // day-of-week: cron accepts 7 for Sunday alongside 0
-      if (v === value || (idx === 4 && v === 7 && value === 0)) return true;
-    }
-  }
-  return false;
-}
-
 // ── monty data ─────────────────────────────────────────────────────────────
 // The agent verbs for OPERATING an app: read and write its records from any
 // terminal — no browser, no dev session. Auth is the mk_ key exchanged at
@@ -2962,7 +2846,7 @@ function flattenRow(doc) {
 
 function dataUsage() {
   console.log("usage: monty data <verb> [table] [flags]     read/write an app's records");
-  console.log("  schema  [table]                             the app's table shapes (from local monty.config.ts — `monty pull` first if needed)");
+  console.log("  schema  [table]                             the app's table shapes (read from the workspace)");
   console.log("  list    <table> [--filter '{\"k\":\"v\"}'] [--order asc|desc] [--limit N] [--cursor C]");
   console.log("  get     <table> <id>");
   console.log("  insert  <table> --data '<json|[json,…]>'");
@@ -3592,7 +3476,7 @@ if (command !== "dev" && command !== "logs" && command !== "support") {
 // manifest as JSON (and stamps the CAS base); edit that JSON and
 // `monty schema set '<json>'` (or `set -` piped) writes it back|->` writes it back through the one landing —
 // validated server-side, additive-only by default, CAS against what you
-// read. `monty schema pull` (legacy) regenerates monty.config.ts.
+// read. `monty schema pull` regenerates the src/monty.gen.ts mirror.
 async function schemaCmd() {
   const verb = rest[0];
   const { host, key } = loadConfig() ?? {};
@@ -3601,20 +3485,12 @@ async function schemaCmd() {
 
   if (verb === "pull") {
     const dir = appDir ?? process.cwd();
-    let slug = rest.slice(1).find((a) => !a.startsWith("--"));
+    const slug = rest.slice(1).find((a) => !a.startsWith("--")) ?? readSlug(dir);
     if (!slug) {
-      try {
-        slug = (await compileAppConfig(dir)).slug;
-      } catch {
-        fail("INVALID_SLUG", "Pass the app slug (monty schema pull <slug>) — no compilable monty.config.ts here to read it from.");
-      }
+      fail("INVALID_SLUG", "Pass the app slug (monty schema pull <slug>) — or run it inside an app folder (.monty/app.json carries the identity).");
     }
-    await schemaPull({
-      appDir: dir, host, key, slug,
-      force: rest.includes("--force"),
-      compileAppConfig,
-      fail,
-    });
+    const migrated = await migrateConfigToGen(dir, { host, key, slug });
+    if (!migrated) await schemaPull({ appDir: dir, host, key, slug, fail });
     return;
   }
 
@@ -3661,7 +3537,14 @@ async function schemaCmd() {
       }
       fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Setting the config failed — is the Monty host reachable?");
     }
-    if (appDir && readSlug(appDir) === slug) writeSchemaState(appDir, body.hash);
+    // Stamp + regenerate together (the stamp claims the mirror matches) —
+    // the just-pushed document IS the new config, so the mirror updates
+    // instantly instead of waiting a heartbeat.
+    if (appDir && readSlug(appDir) === slug) {
+      const stamp = readAppJson(appDir);
+      writeGenModule(appDir, manifest, { name: stamp?.name, icon: stamp?.icon });
+      writeSchemaState(appDir, body.hash);
+    }
     console.log(`schema: set — "${slug}" is live now (hash ${String(body.hash).slice(0, 12)})`);
     return;
   }
@@ -3684,11 +3567,86 @@ async function schemaCmd() {
     console.log(JSON.stringify({ slug, tables: {} }, null, 2));
     return;
   }
-  if (appDir && readSlug(appDir) === slug) writeSchemaState(appDir, body.hash);
+  // The state stamp says "src/monty.gen.ts matches this hash" (it is also
+  // the CAS base) — so stamping ALWAYS travels with a regeneration, or the
+  // heartbeat would read the fresh stamp and leave a stale mirror in place.
+  if (appDir && readSlug(appDir) === slug) {
+    writeGenModule(appDir, body.manifest, { name: body.name, icon: body.icon });
+    writeSchemaState(appDir, body.hash);
+  }
   console.error(`# ${slug} — config hash ${String(body.hash).slice(0, 12)}${appDir ? " (CAS base stamped for `monty schema set`)" : ""}`);
   console.log(JSON.stringify(body.manifest, null, 2));
 }
 
+// ── monty public — the shared-functions door ──────────────────────────────
+// Which server functions answer publicly at /__monty/public/<name> on the
+// app origin. Door-owned workspace state (never a save ride): `set` replaces
+// the whole list and takes effect on Live immediately (the host patches the
+// deploy pointer) and in a running session within one heartbeat.
+async function publicCmd() {
+  const { host, key } = loadConfig() ?? {};
+  if (!key) fail("NOT_LOGGED_IN", "Run `monty login` first.");
+  const appDir = findAppRoot(process.cwd());
+  const verb = rest[0];
+  const flagValue = (name) => {
+    const i = rest.indexOf(name);
+    return i >= 0 ? rest[i + 1] : undefined;
+  };
+  const slug = flagValue("--app") ?? (appDir ? readSlug(appDir) : null);
+  if (!slug) {
+    fail("INVALID_SLUG", "Usage: monty public [set <names…>|--none] [--app <slug>] — or run it inside an app folder.");
+  }
+
+  if (verb === "set") {
+    const names = rest.includes("--none")
+      ? []
+      : rest
+          .slice(1)
+          .filter((a) => !a.startsWith("--") && a !== flagValue("--app"))
+          .flatMap((a) => a.split(","))
+          .map((a) => a.trim())
+          .filter(Boolean);
+    if (names.length === 0 && !rest.includes("--none")) {
+      fail("PUBLIC_USAGE", "Usage: monty public set <name> [<name>…] — the COMPLETE new list (it replaces, never merges). `monty public set --none` closes everything.");
+    }
+    const res = await fetch(`${host}/api/public-fns`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+      body: JSON.stringify({ slug, publicFns: names }),
+    });
+    const body = await res.json().catch(() => null);
+    if (!res.ok || !body?.ok) {
+      fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Setting the shared functions failed — is the Monty host reachable?");
+    }
+    if (body.publicFns.length === 0) {
+      console.log(`public: none — "${slug}" answers nothing at /__monty/public`);
+      return;
+    }
+    for (const name of body.publicFns) {
+      const live = body.served?.includes(name);
+      console.log(`public: /__monty/public/${name} — ${live ? "open to the internet NOW; verify signatures in the function" : "declared; opens when a save ships the function"}`);
+    }
+    return;
+  }
+
+  // Default: LIST.
+  const res = await fetch(`${host}/api/public-fns?slug=${slug}`, {
+    headers: { authorization: `Bearer ${key}` },
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.ok) {
+    fail(body?.code ?? `HTTP_${res.status}`, body?.fix ?? "Could not read the shared functions — check the connection and `monty login`.");
+  }
+  if (!body.publicFns?.length) {
+    console.log(`public: none — "${slug}" answers nothing at /__monty/public (share with \`monty public set <name>\`)`);
+    return;
+  }
+  const registered = new Set(body.fns ?? []);
+  for (const name of body.publicFns) {
+    console.log(`public: /__monty/public/${name}${registered.has(name) ? "" : " — not in the deployed bundle (opens when a save ships it)"}`);
+  }
+}
+
 switch (command) {
   case "login":
     await login();
@@ -3733,6 +3691,9 @@ switch (command) {
   case "typecheck":
     typecheckApp();
     break;
+  case "style":
+    await styleCheck();
+    break;
   case "save":
     await deploy();
     break;
@@ -3742,6 +3703,9 @@ switch (command) {
   case "schema":
     await schemaCmd();
     break;
+  case "public":
+    await publicCmd();
+    break;
   case "views":
     await views();
     break;
@@ -3777,11 +3741,12 @@ function printHelp() {
   console.log("  current                                      which app folder am I in?");
   console.log("  history     [slug]                           saved-version history, one row per save (like `git log`)");
   console.log("  pull        <slug> [--version H] [--force]   restore a source snapshot into the managed home");
-  console.log("  install / build / typecheck                  app lifecycle (pnpm/npm picked for you)");
+  console.log("  install / build / typecheck / style          app lifecycle + the token-vocabulary lint");
   console.log("  data        <verb> [table] [flags]           read/write an app's records from the terminal");
   console.log("  schema      [slug] | set <json|->              read/write the app's config, stored in the workspace (validated, CAS)");
   console.log("  views       <list|set|update|remove> <table>  manage shared saved views on a record page");
   console.log("  secret      <set|rm> <KEY>                   per-app server-function secrets (write-only)");
+  console.log("  public      [set <names…>|--none]            which server functions answer publicly at /__monty/public");
   console.log("  support     <status|enable|disable|submit>    opt in to agent-authored platform reports");
   console.log("  skills                                       install/refresh the agent build skill");
   console.log("");